1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18#include <linux/xattr.h>
19#include <linux/pagemap.h>
20#include <linux/mount.h>
21#include <linux/stat.h>
22#include <linux/kd.h>
23#include <asm/ioctls.h>
24#include <linux/ip.h>
25#include <linux/tcp.h>
26#include <linux/udp.h>
27#include <linux/dccp.h>
28#include <linux/icmpv6.h>
29#include <linux/slab.h>
30#include <linux/mutex.h>
31#include <linux/pipe_fs_i.h>
32#include <net/cipso_ipv4.h>
33#include <net/ip.h>
34#include <net/ipv6.h>
35#include <linux/audit.h>
36#include <linux/magic.h>
37#include <linux/dcache.h>
38#include <linux/personality.h>
39#include <linux/msg.h>
40#include <linux/shm.h>
41#include <linux/binfmts.h>
42#include <linux/parser.h>
43#include <linux/fs_context.h>
44#include <linux/fs_parser.h>
45#include "smack.h"
46
47#define TRANS_TRUE "TRUE"
48#define TRANS_TRUE_SIZE 4
49
50#define SMK_CONNECTING 0
51#define SMK_RECEIVING 1
52#define SMK_SENDING 2
53
54#ifdef SMACK_IPV6_PORT_LABELING
55DEFINE_MUTEX(smack_ipv6_lock);
56static LIST_HEAD(smk_ipv6_port_list);
57#endif
58static struct kmem_cache *smack_inode_cache;
59struct kmem_cache *smack_rule_cache;
60int smack_enabled;
61
62#define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s}
63static struct {
64 const char *name;
65 int len;
66 int opt;
67} smk_mount_opts[] = {
68 {"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault},
69 A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute)
70};
71#undef A
72
73static int match_opt_prefix(char *s, int l, char **arg)
74{
75 int i;
76
77 for (i = 0; i < ARRAY_SIZE(smk_mount_opts); i++) {
78 size_t len = smk_mount_opts[i].len;
79 if (len > l || memcmp(s, smk_mount_opts[i].name, len))
80 continue;
81 if (len == l || s[len] != '=')
82 continue;
83 *arg = s + len + 1;
84 return smk_mount_opts[i].opt;
85 }
86 return Opt_error;
87}
88
89#ifdef CONFIG_SECURITY_SMACK_BRINGUP
90static char *smk_bu_mess[] = {
91 "Bringup Error",
92 "Bringup",
93 "Unconfined Subject",
94 "Unconfined Object",
95};
96
97static void smk_bu_mode(int mode, char *s)
98{
99 int i = 0;
100
101 if (mode & MAY_READ)
102 s[i++] = 'r';
103 if (mode & MAY_WRITE)
104 s[i++] = 'w';
105 if (mode & MAY_EXEC)
106 s[i++] = 'x';
107 if (mode & MAY_APPEND)
108 s[i++] = 'a';
109 if (mode & MAY_TRANSMUTE)
110 s[i++] = 't';
111 if (mode & MAY_LOCK)
112 s[i++] = 'l';
113 if (i == 0)
114 s[i++] = '-';
115 s[i] = '\0';
116}
117#endif
118
119#ifdef CONFIG_SECURITY_SMACK_BRINGUP
120static int smk_bu_note(char *note, struct smack_known *sskp,
121 struct smack_known *oskp, int mode, int rc)
122{
123 char acc[SMK_NUM_ACCESS_TYPE + 1];
124
125 if (rc <= 0)
126 return rc;
127 if (rc > SMACK_UNCONFINED_OBJECT)
128 rc = 0;
129
130 smk_bu_mode(mode, acc);
131 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc],
132 sskp->smk_known, oskp->smk_known, acc, note);
133 return 0;
134}
135#else
136#define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
137#endif
138
139#ifdef CONFIG_SECURITY_SMACK_BRINGUP
140static int smk_bu_current(char *note, struct smack_known *oskp,
141 int mode, int rc)
142{
143 struct task_smack *tsp = smack_cred(current_cred());
144 char acc[SMK_NUM_ACCESS_TYPE + 1];
145
146 if (rc <= 0)
147 return rc;
148 if (rc > SMACK_UNCONFINED_OBJECT)
149 rc = 0;
150
151 smk_bu_mode(mode, acc);
152 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc],
153 tsp->smk_task->smk_known, oskp->smk_known,
154 acc, current->comm, note);
155 return 0;
156}
157#else
158#define smk_bu_current(note, oskp, mode, RC) (RC)
159#endif
160
161#ifdef CONFIG_SECURITY_SMACK_BRINGUP
162static int smk_bu_task(struct task_struct *otp, int mode, int rc)
163{
164 struct task_smack *tsp = smack_cred(current_cred());
165 struct smack_known *smk_task = smk_of_task_struct(otp);
166 char acc[SMK_NUM_ACCESS_TYPE + 1];
167
168 if (rc <= 0)
169 return rc;
170 if (rc > SMACK_UNCONFINED_OBJECT)
171 rc = 0;
172
173 smk_bu_mode(mode, acc);
174 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc],
175 tsp->smk_task->smk_known, smk_task->smk_known, acc,
176 current->comm, otp->comm);
177 return 0;
178}
179#else
180#define smk_bu_task(otp, mode, RC) (RC)
181#endif
182
183#ifdef CONFIG_SECURITY_SMACK_BRINGUP
184static int smk_bu_inode(struct inode *inode, int mode, int rc)
185{
186 struct task_smack *tsp = smack_cred(current_cred());
187 struct inode_smack *isp = smack_inode(inode);
188 char acc[SMK_NUM_ACCESS_TYPE + 1];
189
190 if (isp->smk_flags & SMK_INODE_IMPURE)
191 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
192 inode->i_sb->s_id, inode->i_ino, current->comm);
193
194 if (rc <= 0)
195 return rc;
196 if (rc > SMACK_UNCONFINED_OBJECT)
197 rc = 0;
198 if (rc == SMACK_UNCONFINED_SUBJECT &&
199 (mode & (MAY_WRITE | MAY_APPEND)))
200 isp->smk_flags |= SMK_INODE_IMPURE;
201
202 smk_bu_mode(mode, acc);
203
204 pr_info("Smack %s: (%s %s %s) inode=(%s %ld) %s\n", smk_bu_mess[rc],
205 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc,
206 inode->i_sb->s_id, inode->i_ino, current->comm);
207 return 0;
208}
209#else
210#define smk_bu_inode(inode, mode, RC) (RC)
211#endif
212
213#ifdef CONFIG_SECURITY_SMACK_BRINGUP
214static int smk_bu_file(struct file *file, int mode, int rc)
215{
216 struct task_smack *tsp = smack_cred(current_cred());
217 struct smack_known *sskp = tsp->smk_task;
218 struct inode *inode = file_inode(file);
219 struct inode_smack *isp = smack_inode(inode);
220 char acc[SMK_NUM_ACCESS_TYPE + 1];
221
222 if (isp->smk_flags & SMK_INODE_IMPURE)
223 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
224 inode->i_sb->s_id, inode->i_ino, current->comm);
225
226 if (rc <= 0)
227 return rc;
228 if (rc > SMACK_UNCONFINED_OBJECT)
229 rc = 0;
230
231 smk_bu_mode(mode, acc);
232 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
233 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
234 inode->i_sb->s_id, inode->i_ino, file,
235 current->comm);
236 return 0;
237}
238#else
239#define smk_bu_file(file, mode, RC) (RC)
240#endif
241
242#ifdef CONFIG_SECURITY_SMACK_BRINGUP
243static int smk_bu_credfile(const struct cred *cred, struct file *file,
244 int mode, int rc)
245{
246 struct task_smack *tsp = smack_cred(cred);
247 struct smack_known *sskp = tsp->smk_task;
248 struct inode *inode = file_inode(file);
249 struct inode_smack *isp = smack_inode(inode);
250 char acc[SMK_NUM_ACCESS_TYPE + 1];
251
252 if (isp->smk_flags & SMK_INODE_IMPURE)
253 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
254 inode->i_sb->s_id, inode->i_ino, current->comm);
255
256 if (rc <= 0)
257 return rc;
258 if (rc > SMACK_UNCONFINED_OBJECT)
259 rc = 0;
260
261 smk_bu_mode(mode, acc);
262 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
263 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
264 inode->i_sb->s_id, inode->i_ino, file,
265 current->comm);
266 return 0;
267}
268#else
269#define smk_bu_credfile(cred, file, mode, RC) (RC)
270#endif
271
272
273
274
275
276
277
278
279
280
281static struct smack_known *smk_fetch(const char *name, struct inode *ip,
282 struct dentry *dp)
283{
284 int rc;
285 char *buffer;
286 struct smack_known *skp = NULL;
287
288 if (!(ip->i_opflags & IOP_XATTR))
289 return ERR_PTR(-EOPNOTSUPP);
290
291 buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL);
292 if (buffer == NULL)
293 return ERR_PTR(-ENOMEM);
294
295 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL);
296 if (rc < 0)
297 skp = ERR_PTR(rc);
298 else if (rc == 0)
299 skp = NULL;
300 else
301 skp = smk_import_entry(buffer, rc);
302
303 kfree(buffer);
304
305 return skp;
306}
307
308
309
310
311
312
313
314static void init_inode_smack(struct inode *inode, struct smack_known *skp)
315{
316 struct inode_smack *isp = smack_inode(inode);
317
318 isp->smk_inode = skp;
319 isp->smk_flags = 0;
320 mutex_init(&isp->smk_lock);
321}
322
323
324
325
326
327
328
329
330static void init_task_smack(struct task_smack *tsp, struct smack_known *task,
331 struct smack_known *forked)
332{
333 tsp->smk_task = task;
334 tsp->smk_forked = forked;
335 INIT_LIST_HEAD(&tsp->smk_rules);
336 INIT_LIST_HEAD(&tsp->smk_relabel);
337 mutex_init(&tsp->smk_rules_lock);
338}
339
340
341
342
343
344
345
346
347
348static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
349 gfp_t gfp)
350{
351 struct smack_rule *nrp;
352 struct smack_rule *orp;
353 int rc = 0;
354
355 list_for_each_entry_rcu(orp, ohead, list) {
356 nrp = kmem_cache_zalloc(smack_rule_cache, gfp);
357 if (nrp == NULL) {
358 rc = -ENOMEM;
359 break;
360 }
361 *nrp = *orp;
362 list_add_rcu(&nrp->list, nhead);
363 }
364 return rc;
365}
366
367
368
369
370
371
372
373
374
375static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead,
376 gfp_t gfp)
377{
378 struct smack_known_list_elem *nklep;
379 struct smack_known_list_elem *oklep;
380
381 list_for_each_entry(oklep, ohead, list) {
382 nklep = kzalloc(sizeof(struct smack_known_list_elem), gfp);
383 if (nklep == NULL) {
384 smk_destroy_label_list(nhead);
385 return -ENOMEM;
386 }
387 nklep->smk_label = oklep->smk_label;
388 list_add(&nklep->list, nhead);
389 }
390
391 return 0;
392}
393
394
395
396
397
398
399
400static inline unsigned int smk_ptrace_mode(unsigned int mode)
401{
402 if (mode & PTRACE_MODE_ATTACH)
403 return MAY_READWRITE;
404 if (mode & PTRACE_MODE_READ)
405 return MAY_READ;
406
407 return 0;
408}
409
410
411
412
413
414
415
416
417
418
419static int smk_ptrace_rule_check(struct task_struct *tracer,
420 struct smack_known *tracee_known,
421 unsigned int mode, const char *func)
422{
423 int rc;
424 struct smk_audit_info ad, *saip = NULL;
425 struct task_smack *tsp;
426 struct smack_known *tracer_known;
427 const struct cred *tracercred;
428
429 if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
430 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
431 smk_ad_setfield_u_tsk(&ad, tracer);
432 saip = &ad;
433 }
434
435 rcu_read_lock();
436 tracercred = __task_cred(tracer);
437 tsp = smack_cred(tracercred);
438 tracer_known = smk_of_task(tsp);
439
440 if ((mode & PTRACE_MODE_ATTACH) &&
441 (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
442 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
443 if (tracer_known->smk_known == tracee_known->smk_known)
444 rc = 0;
445 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
446 rc = -EACCES;
447 else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
448 rc = 0;
449 else
450 rc = -EACCES;
451
452 if (saip)
453 smack_log(tracer_known->smk_known,
454 tracee_known->smk_known,
455 0, rc, saip);
456
457 rcu_read_unlock();
458 return rc;
459 }
460
461
462 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
463
464 rcu_read_unlock();
465 return rc;
466}
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
483{
484 struct smack_known *skp;
485
486 skp = smk_of_task_struct(ctp);
487
488 return smk_ptrace_rule_check(current, skp, mode, __func__);
489}
490
491
492
493
494
495
496
497
498
499static int smack_ptrace_traceme(struct task_struct *ptp)
500{
501 int rc;
502 struct smack_known *skp;
503
504 skp = smk_of_task(smack_cred(current_cred()));
505
506 rc = smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
507 return rc;
508}
509
510
511
512
513
514
515
516static int smack_syslog(int typefrom_file)
517{
518 int rc = 0;
519 struct smack_known *skp = smk_of_current();
520
521 if (smack_privileged(CAP_MAC_OVERRIDE))
522 return 0;
523
524 if (smack_syslog_label != NULL && smack_syslog_label != skp)
525 rc = -EACCES;
526
527 return rc;
528}
529
530
531
532
533
534
535
536
537
538
539
540static int smack_sb_alloc_security(struct super_block *sb)
541{
542 struct superblock_smack *sbsp;
543
544 sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL);
545
546 if (sbsp == NULL)
547 return -ENOMEM;
548
549 sbsp->smk_root = &smack_known_floor;
550 sbsp->smk_default = &smack_known_floor;
551 sbsp->smk_floor = &smack_known_floor;
552 sbsp->smk_hat = &smack_known_hat;
553
554
555
556 sb->s_security = sbsp;
557
558 return 0;
559}
560
561
562
563
564
565
566static void smack_sb_free_security(struct super_block *sb)
567{
568 kfree(sb->s_security);
569 sb->s_security = NULL;
570}
571
572struct smack_mnt_opts {
573 const char *fsdefault, *fsfloor, *fshat, *fsroot, *fstransmute;
574};
575
576static void smack_free_mnt_opts(void *mnt_opts)
577{
578 struct smack_mnt_opts *opts = mnt_opts;
579 kfree(opts->fsdefault);
580 kfree(opts->fsfloor);
581 kfree(opts->fshat);
582 kfree(opts->fsroot);
583 kfree(opts->fstransmute);
584 kfree(opts);
585}
586
587static int smack_add_opt(int token, const char *s, void **mnt_opts)
588{
589 struct smack_mnt_opts *opts = *mnt_opts;
590
591 if (!opts) {
592 opts = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
593 if (!opts)
594 return -ENOMEM;
595 *mnt_opts = opts;
596 }
597 if (!s)
598 return -ENOMEM;
599
600 switch (token) {
601 case Opt_fsdefault:
602 if (opts->fsdefault)
603 goto out_opt_err;
604 opts->fsdefault = s;
605 break;
606 case Opt_fsfloor:
607 if (opts->fsfloor)
608 goto out_opt_err;
609 opts->fsfloor = s;
610 break;
611 case Opt_fshat:
612 if (opts->fshat)
613 goto out_opt_err;
614 opts->fshat = s;
615 break;
616 case Opt_fsroot:
617 if (opts->fsroot)
618 goto out_opt_err;
619 opts->fsroot = s;
620 break;
621 case Opt_fstransmute:
622 if (opts->fstransmute)
623 goto out_opt_err;
624 opts->fstransmute = s;
625 break;
626 }
627 return 0;
628
629out_opt_err:
630 pr_warn("Smack: duplicate mount options\n");
631 return -EINVAL;
632}
633
634
635
636
637
638
639
640
641static int smack_fs_context_dup(struct fs_context *fc,
642 struct fs_context *src_fc)
643{
644 struct smack_mnt_opts *dst, *src = src_fc->security;
645
646 if (!src)
647 return 0;
648
649 fc->security = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
650 if (!fc->security)
651 return -ENOMEM;
652 dst = fc->security;
653
654 if (src->fsdefault) {
655 dst->fsdefault = kstrdup(src->fsdefault, GFP_KERNEL);
656 if (!dst->fsdefault)
657 return -ENOMEM;
658 }
659 if (src->fsfloor) {
660 dst->fsfloor = kstrdup(src->fsfloor, GFP_KERNEL);
661 if (!dst->fsfloor)
662 return -ENOMEM;
663 }
664 if (src->fshat) {
665 dst->fshat = kstrdup(src->fshat, GFP_KERNEL);
666 if (!dst->fshat)
667 return -ENOMEM;
668 }
669 if (src->fsroot) {
670 dst->fsroot = kstrdup(src->fsroot, GFP_KERNEL);
671 if (!dst->fsroot)
672 return -ENOMEM;
673 }
674 if (src->fstransmute) {
675 dst->fstransmute = kstrdup(src->fstransmute, GFP_KERNEL);
676 if (!dst->fstransmute)
677 return -ENOMEM;
678 }
679 return 0;
680}
681
682static const struct fs_parameter_spec smack_param_specs[] = {
683 fsparam_string("smackfsdef", Opt_fsdefault),
684 fsparam_string("smackfsdefault", Opt_fsdefault),
685 fsparam_string("smackfsfloor", Opt_fsfloor),
686 fsparam_string("smackfshat", Opt_fshat),
687 fsparam_string("smackfsroot", Opt_fsroot),
688 fsparam_string("smackfstransmute", Opt_fstransmute),
689 {}
690};
691
692static const struct fs_parameter_description smack_fs_parameters = {
693 .name = "smack",
694 .specs = smack_param_specs,
695};
696
697
698
699
700
701
702
703
704
705static int smack_fs_context_parse_param(struct fs_context *fc,
706 struct fs_parameter *param)
707{
708 struct fs_parse_result result;
709 int opt, rc;
710
711 opt = fs_parse(fc, &smack_fs_parameters, param, &result);
712 if (opt < 0)
713 return opt;
714
715 rc = smack_add_opt(opt, param->string, &fc->security);
716 if (!rc)
717 param->string = NULL;
718 return rc;
719}
720
721static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts)
722{
723 char *from = options, *to = options;
724 bool first = true;
725
726 while (1) {
727 char *next = strchr(from, ',');
728 int token, len, rc;
729 char *arg = NULL;
730
731 if (next)
732 len = next - from;
733 else
734 len = strlen(from);
735
736 token = match_opt_prefix(from, len, &arg);
737 if (token != Opt_error) {
738 arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL);
739 rc = smack_add_opt(token, arg, mnt_opts);
740 if (unlikely(rc)) {
741 kfree(arg);
742 if (*mnt_opts)
743 smack_free_mnt_opts(*mnt_opts);
744 *mnt_opts = NULL;
745 return rc;
746 }
747 } else {
748 if (!first) {
749 from--;
750 len++;
751 }
752 if (to != from)
753 memmove(to, from, len);
754 to += len;
755 first = false;
756 }
757 if (!from[len])
758 break;
759 from += len + 1;
760 }
761 *to = '\0';
762 return 0;
763}
764
765
766
767
768
769
770
771
772
773
774
775
776
777static int smack_set_mnt_opts(struct super_block *sb,
778 void *mnt_opts,
779 unsigned long kern_flags,
780 unsigned long *set_kern_flags)
781{
782 struct dentry *root = sb->s_root;
783 struct inode *inode = d_backing_inode(root);
784 struct superblock_smack *sp = sb->s_security;
785 struct inode_smack *isp;
786 struct smack_known *skp;
787 struct smack_mnt_opts *opts = mnt_opts;
788 bool transmute = false;
789
790 if (sp->smk_flags & SMK_SB_INITIALIZED)
791 return 0;
792
793 if (inode->i_security == NULL) {
794 int rc = lsm_inode_alloc(inode);
795
796 if (rc)
797 return rc;
798 }
799
800 if (!smack_privileged(CAP_MAC_ADMIN)) {
801
802
803
804 if (opts)
805 return -EPERM;
806
807
808
809 skp = smk_of_current();
810 sp->smk_root = skp;
811 sp->smk_default = skp;
812
813
814
815
816
817 if (sb->s_user_ns != &init_user_ns &&
818 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC &&
819 sb->s_magic != RAMFS_MAGIC) {
820 transmute = true;
821 sp->smk_flags |= SMK_SB_UNTRUSTED;
822 }
823 }
824
825 sp->smk_flags |= SMK_SB_INITIALIZED;
826
827 if (opts) {
828 if (opts->fsdefault) {
829 skp = smk_import_entry(opts->fsdefault, 0);
830 if (IS_ERR(skp))
831 return PTR_ERR(skp);
832 sp->smk_default = skp;
833 }
834 if (opts->fsfloor) {
835 skp = smk_import_entry(opts->fsfloor, 0);
836 if (IS_ERR(skp))
837 return PTR_ERR(skp);
838 sp->smk_floor = skp;
839 }
840 if (opts->fshat) {
841 skp = smk_import_entry(opts->fshat, 0);
842 if (IS_ERR(skp))
843 return PTR_ERR(skp);
844 sp->smk_hat = skp;
845 }
846 if (opts->fsroot) {
847 skp = smk_import_entry(opts->fsroot, 0);
848 if (IS_ERR(skp))
849 return PTR_ERR(skp);
850 sp->smk_root = skp;
851 }
852 if (opts->fstransmute) {
853 skp = smk_import_entry(opts->fstransmute, 0);
854 if (IS_ERR(skp))
855 return PTR_ERR(skp);
856 sp->smk_root = skp;
857 transmute = true;
858 }
859 }
860
861
862
863
864 init_inode_smack(inode, sp->smk_root);
865
866 if (transmute) {
867 isp = smack_inode(inode);
868 isp->smk_flags |= SMK_INODE_TRANSMUTE;
869 }
870
871 return 0;
872}
873
874
875
876
877
878
879
880
881static int smack_sb_statfs(struct dentry *dentry)
882{
883 struct superblock_smack *sbp = dentry->d_sb->s_security;
884 int rc;
885 struct smk_audit_info ad;
886
887 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
888 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
889
890 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
891 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
892 return rc;
893}
894
895
896
897
898
899
900
901
902
903
904
905static int smack_bprm_set_creds(struct linux_binprm *bprm)
906{
907 struct inode *inode = file_inode(bprm->file);
908 struct task_smack *bsp = smack_cred(bprm->cred);
909 struct inode_smack *isp;
910 struct superblock_smack *sbsp;
911 int rc;
912
913 if (bprm->called_set_creds)
914 return 0;
915
916 isp = smack_inode(inode);
917 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
918 return 0;
919
920 sbsp = inode->i_sb->s_security;
921 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
922 isp->smk_task != sbsp->smk_root)
923 return 0;
924
925 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
926 struct task_struct *tracer;
927 rc = 0;
928
929 rcu_read_lock();
930 tracer = ptrace_parent(current);
931 if (likely(tracer != NULL))
932 rc = smk_ptrace_rule_check(tracer,
933 isp->smk_task,
934 PTRACE_MODE_ATTACH,
935 __func__);
936 rcu_read_unlock();
937
938 if (rc != 0)
939 return rc;
940 } else if (bprm->unsafe)
941 return -EPERM;
942
943 bsp->smk_task = isp->smk_task;
944 bprm->per_clear |= PER_CLEAR_ON_SETID;
945
946
947 if (bsp->smk_task != bsp->smk_forked)
948 bprm->secureexec = 1;
949
950 return 0;
951}
952
953
954
955
956
957
958
959
960
961
962
963static int smack_inode_alloc_security(struct inode *inode)
964{
965 struct smack_known *skp = smk_of_current();
966
967 init_inode_smack(inode, skp);
968 return 0;
969}
970
971
972
973
974
975
976
977
978
979
980
981
982static int smack_inode_init_security(struct inode *inode, struct inode *dir,
983 const struct qstr *qstr, const char **name,
984 void **value, size_t *len)
985{
986 struct inode_smack *issp = smack_inode(inode);
987 struct smack_known *skp = smk_of_current();
988 struct smack_known *isp = smk_of_inode(inode);
989 struct smack_known *dsp = smk_of_inode(dir);
990 int may;
991
992 if (name)
993 *name = XATTR_SMACK_SUFFIX;
994
995 if (value && len) {
996 rcu_read_lock();
997 may = smk_access_entry(skp->smk_known, dsp->smk_known,
998 &skp->smk_rules);
999 rcu_read_unlock();
1000
1001
1002
1003
1004
1005
1006
1007 if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
1008 smk_inode_transmutable(dir)) {
1009 isp = dsp;
1010 issp->smk_flags |= SMK_INODE_CHANGED;
1011 }
1012
1013 *value = kstrdup(isp->smk_known, GFP_NOFS);
1014 if (*value == NULL)
1015 return -ENOMEM;
1016
1017 *len = strlen(isp->smk_known);
1018 }
1019
1020 return 0;
1021}
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
1032 struct dentry *new_dentry)
1033{
1034 struct smack_known *isp;
1035 struct smk_audit_info ad;
1036 int rc;
1037
1038 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1039 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1040
1041 isp = smk_of_inode(d_backing_inode(old_dentry));
1042 rc = smk_curacc(isp, MAY_WRITE, &ad);
1043 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc);
1044
1045 if (rc == 0 && d_is_positive(new_dentry)) {
1046 isp = smk_of_inode(d_backing_inode(new_dentry));
1047 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1048 rc = smk_curacc(isp, MAY_WRITE, &ad);
1049 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc);
1050 }
1051
1052 return rc;
1053}
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
1064{
1065 struct inode *ip = d_backing_inode(dentry);
1066 struct smk_audit_info ad;
1067 int rc;
1068
1069 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1070 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1071
1072
1073
1074
1075 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
1076 rc = smk_bu_inode(ip, MAY_WRITE, rc);
1077 if (rc == 0) {
1078
1079
1080
1081 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1082 smk_ad_setfield_u_fs_inode(&ad, dir);
1083 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1084 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1085 }
1086 return rc;
1087}
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
1098{
1099 struct smk_audit_info ad;
1100 int rc;
1101
1102 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1103 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1104
1105
1106
1107
1108 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1109 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1110 if (rc == 0) {
1111
1112
1113
1114 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1115 smk_ad_setfield_u_fs_inode(&ad, dir);
1116 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1117 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1118 }
1119
1120 return rc;
1121}
1122
1123
1124
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134
1135static int smack_inode_rename(struct inode *old_inode,
1136 struct dentry *old_dentry,
1137 struct inode *new_inode,
1138 struct dentry *new_dentry)
1139{
1140 int rc;
1141 struct smack_known *isp;
1142 struct smk_audit_info ad;
1143
1144 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1145 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1146
1147 isp = smk_of_inode(d_backing_inode(old_dentry));
1148 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1149 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc);
1150
1151 if (rc == 0 && d_is_positive(new_dentry)) {
1152 isp = smk_of_inode(d_backing_inode(new_dentry));
1153 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1154 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1155 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc);
1156 }
1157 return rc;
1158}
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169static int smack_inode_permission(struct inode *inode, int mask)
1170{
1171 struct superblock_smack *sbsp = inode->i_sb->s_security;
1172 struct smk_audit_info ad;
1173 int no_block = mask & MAY_NOT_BLOCK;
1174 int rc;
1175
1176 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
1177
1178
1179
1180 if (mask == 0)
1181 return 0;
1182
1183 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) {
1184 if (smk_of_inode(inode) != sbsp->smk_root)
1185 return -EACCES;
1186 }
1187
1188
1189 if (no_block)
1190 return -ECHILD;
1191 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1192 smk_ad_setfield_u_fs_inode(&ad, inode);
1193 rc = smk_curacc(smk_of_inode(inode), mask, &ad);
1194 rc = smk_bu_inode(inode, mask, rc);
1195 return rc;
1196}
1197
1198
1199
1200
1201
1202
1203
1204
1205static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
1206{
1207 struct smk_audit_info ad;
1208 int rc;
1209
1210
1211
1212
1213 if (iattr->ia_valid & ATTR_FORCE)
1214 return 0;
1215 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1216 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1217
1218 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1219 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1220 return rc;
1221}
1222
1223
1224
1225
1226
1227
1228
1229
1230static int smack_inode_getattr(const struct path *path)
1231{
1232 struct smk_audit_info ad;
1233 struct inode *inode = d_backing_inode(path->dentry);
1234 int rc;
1235
1236 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1237 smk_ad_setfield_u_fs_path(&ad, *path);
1238 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1239 rc = smk_bu_inode(inode, MAY_READ, rc);
1240 return rc;
1241}
1242
1243
1244
1245
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255static int smack_inode_setxattr(struct dentry *dentry, const char *name,
1256 const void *value, size_t size, int flags)
1257{
1258 struct smk_audit_info ad;
1259 struct smack_known *skp;
1260 int check_priv = 0;
1261 int check_import = 0;
1262 int check_star = 0;
1263 int rc = 0;
1264
1265
1266
1267
1268 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1269 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1270 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
1271 check_priv = 1;
1272 check_import = 1;
1273 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1274 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1275 check_priv = 1;
1276 check_import = 1;
1277 check_star = 1;
1278 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1279 check_priv = 1;
1280 if (size != TRANS_TRUE_SIZE ||
1281 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
1282 rc = -EINVAL;
1283 } else
1284 rc = cap_inode_setxattr(dentry, name, value, size, flags);
1285
1286 if (check_priv && !smack_privileged(CAP_MAC_ADMIN))
1287 rc = -EPERM;
1288
1289 if (rc == 0 && check_import) {
1290 skp = size ? smk_import_entry(value, size) : NULL;
1291 if (IS_ERR(skp))
1292 rc = PTR_ERR(skp);
1293 else if (skp == NULL || (check_star &&
1294 (skp == &smack_known_star || skp == &smack_known_web)))
1295 rc = -EINVAL;
1296 }
1297
1298 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1299 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1300
1301 if (rc == 0) {
1302 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1303 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1304 }
1305
1306 return rc;
1307}
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
1321 const void *value, size_t size, int flags)
1322{
1323 struct smack_known *skp;
1324 struct inode_smack *isp = smack_inode(d_backing_inode(dentry));
1325
1326 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1327 isp->smk_flags |= SMK_INODE_TRANSMUTE;
1328 return;
1329 }
1330
1331 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1332 skp = smk_import_entry(value, size);
1333 if (!IS_ERR(skp))
1334 isp->smk_inode = skp;
1335 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
1336 skp = smk_import_entry(value, size);
1337 if (!IS_ERR(skp))
1338 isp->smk_task = skp;
1339 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1340 skp = smk_import_entry(value, size);
1341 if (!IS_ERR(skp))
1342 isp->smk_mmap = skp;
1343 }
1344
1345 return;
1346}
1347
1348
1349
1350
1351
1352
1353
1354
1355static int smack_inode_getxattr(struct dentry *dentry, const char *name)
1356{
1357 struct smk_audit_info ad;
1358 int rc;
1359
1360 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1361 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1362
1363 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
1364 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
1365 return rc;
1366}
1367
1368
1369
1370
1371
1372
1373
1374
1375
1376
1377static int smack_inode_removexattr(struct dentry *dentry, const char *name)
1378{
1379 struct inode_smack *isp;
1380 struct smk_audit_info ad;
1381 int rc = 0;
1382
1383 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1384 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1385 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
1386 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1387 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
1388 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1389 if (!smack_privileged(CAP_MAC_ADMIN))
1390 rc = -EPERM;
1391 } else
1392 rc = cap_inode_removexattr(dentry, name);
1393
1394 if (rc != 0)
1395 return rc;
1396
1397 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1398 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1399
1400 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1401 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1402 if (rc != 0)
1403 return rc;
1404
1405 isp = smack_inode(d_backing_inode(dentry));
1406
1407
1408
1409
1410
1411 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1412 struct super_block *sbp = dentry->d_sb;
1413 struct superblock_smack *sbsp = sbp->s_security;
1414
1415 isp->smk_inode = sbsp->smk_default;
1416 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
1417 isp->smk_task = NULL;
1418 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0)
1419 isp->smk_mmap = NULL;
1420 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
1421 isp->smk_flags &= ~SMK_INODE_TRANSMUTE;
1422
1423 return 0;
1424}
1425
1426
1427
1428
1429
1430
1431
1432
1433
1434
1435static int smack_inode_getsecurity(struct inode *inode,
1436 const char *name, void **buffer,
1437 bool alloc)
1438{
1439 struct socket_smack *ssp;
1440 struct socket *sock;
1441 struct super_block *sbp;
1442 struct inode *ip = (struct inode *)inode;
1443 struct smack_known *isp;
1444
1445 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
1446 isp = smk_of_inode(inode);
1447 else {
1448
1449
1450
1451 sbp = ip->i_sb;
1452 if (sbp->s_magic != SOCKFS_MAGIC)
1453 return -EOPNOTSUPP;
1454
1455 sock = SOCKET_I(ip);
1456 if (sock == NULL || sock->sk == NULL)
1457 return -EOPNOTSUPP;
1458
1459 ssp = sock->sk->sk_security;
1460
1461 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1462 isp = ssp->smk_in;
1463 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1464 isp = ssp->smk_out;
1465 else
1466 return -EOPNOTSUPP;
1467 }
1468
1469 if (alloc) {
1470 *buffer = kstrdup(isp->smk_known, GFP_KERNEL);
1471 if (*buffer == NULL)
1472 return -ENOMEM;
1473 }
1474
1475 return strlen(isp->smk_known);
1476}
1477
1478
1479
1480
1481
1482
1483
1484
1485static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1486 size_t buffer_size)
1487{
1488 int len = sizeof(XATTR_NAME_SMACK);
1489
1490 if (buffer != NULL && len <= buffer_size)
1491 memcpy(buffer, XATTR_NAME_SMACK, len);
1492
1493 return len;
1494}
1495
1496
1497
1498
1499
1500
1501static void smack_inode_getsecid(struct inode *inode, u32 *secid)
1502{
1503 struct smack_known *skp = smk_of_inode(inode);
1504
1505 *secid = skp->smk_secid;
1506}
1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535static int smack_file_alloc_security(struct file *file)
1536{
1537 struct smack_known **blob = smack_file(file);
1538
1539 *blob = smk_of_current();
1540 return 0;
1541}
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553static int smack_file_ioctl(struct file *file, unsigned int cmd,
1554 unsigned long arg)
1555{
1556 int rc = 0;
1557 struct smk_audit_info ad;
1558 struct inode *inode = file_inode(file);
1559
1560 if (unlikely(IS_PRIVATE(inode)))
1561 return 0;
1562
1563 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1564 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1565
1566 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1567 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1568 rc = smk_bu_file(file, MAY_WRITE, rc);
1569 }
1570
1571 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1572 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1573 rc = smk_bu_file(file, MAY_READ, rc);
1574 }
1575
1576 return rc;
1577}
1578
1579
1580
1581
1582
1583
1584
1585
1586static int smack_file_lock(struct file *file, unsigned int cmd)
1587{
1588 struct smk_audit_info ad;
1589 int rc;
1590 struct inode *inode = file_inode(file);
1591
1592 if (unlikely(IS_PRIVATE(inode)))
1593 return 0;
1594
1595 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1596 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1597 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1598 rc = smk_bu_file(file, MAY_LOCK, rc);
1599 return rc;
1600}
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614static int smack_file_fcntl(struct file *file, unsigned int cmd,
1615 unsigned long arg)
1616{
1617 struct smk_audit_info ad;
1618 int rc = 0;
1619 struct inode *inode = file_inode(file);
1620
1621 if (unlikely(IS_PRIVATE(inode)))
1622 return 0;
1623
1624 switch (cmd) {
1625 case F_GETLK:
1626 break;
1627 case F_SETLK:
1628 case F_SETLKW:
1629 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1630 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1631 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1632 rc = smk_bu_file(file, MAY_LOCK, rc);
1633 break;
1634 case F_SETOWN:
1635 case F_SETSIG:
1636 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1637 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1638 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1639 rc = smk_bu_file(file, MAY_WRITE, rc);
1640 break;
1641 default:
1642 break;
1643 }
1644
1645 return rc;
1646}
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658static int smack_mmap_file(struct file *file,
1659 unsigned long reqprot, unsigned long prot,
1660 unsigned long flags)
1661{
1662 struct smack_known *skp;
1663 struct smack_known *mkp;
1664 struct smack_rule *srp;
1665 struct task_smack *tsp;
1666 struct smack_known *okp;
1667 struct inode_smack *isp;
1668 struct superblock_smack *sbsp;
1669 int may;
1670 int mmay;
1671 int tmay;
1672 int rc;
1673
1674 if (file == NULL)
1675 return 0;
1676
1677 if (unlikely(IS_PRIVATE(file_inode(file))))
1678 return 0;
1679
1680 isp = smack_inode(file_inode(file));
1681 if (isp->smk_mmap == NULL)
1682 return 0;
1683 sbsp = file_inode(file)->i_sb->s_security;
1684 if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
1685 isp->smk_mmap != sbsp->smk_root)
1686 return -EACCES;
1687 mkp = isp->smk_mmap;
1688
1689 tsp = smack_cred(current_cred());
1690 skp = smk_of_current();
1691 rc = 0;
1692
1693 rcu_read_lock();
1694
1695
1696
1697
1698
1699 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1700 okp = srp->smk_object;
1701
1702
1703
1704 if (mkp->smk_known == okp->smk_known)
1705 continue;
1706
1707
1708
1709
1710 may = smk_access_entry(srp->smk_subject->smk_known,
1711 okp->smk_known,
1712 &tsp->smk_rules);
1713 if (may == -ENOENT)
1714 may = srp->smk_access;
1715 else
1716 may &= srp->smk_access;
1717
1718
1719
1720
1721 if (may == 0)
1722 continue;
1723
1724
1725
1726
1727
1728
1729 mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1730 &mkp->smk_rules);
1731 if (mmay == -ENOENT) {
1732 rc = -EACCES;
1733 break;
1734 }
1735
1736
1737
1738
1739 tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1740 &tsp->smk_rules);
1741 if (tmay != -ENOENT)
1742 mmay &= tmay;
1743
1744
1745
1746
1747
1748
1749 if ((may | mmay) != mmay) {
1750 rc = -EACCES;
1751 break;
1752 }
1753 }
1754
1755 rcu_read_unlock();
1756
1757 return rc;
1758}
1759
1760
1761
1762
1763
1764
1765static void smack_file_set_fowner(struct file *file)
1766{
1767 struct smack_known **blob = smack_file(file);
1768
1769 *blob = smk_of_current();
1770}
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783static int smack_file_send_sigiotask(struct task_struct *tsk,
1784 struct fown_struct *fown, int signum)
1785{
1786 struct smack_known **blob;
1787 struct smack_known *skp;
1788 struct smack_known *tkp = smk_of_task(smack_cred(tsk->cred));
1789 const struct cred *tcred;
1790 struct file *file;
1791 int rc;
1792 struct smk_audit_info ad;
1793
1794
1795
1796
1797 file = container_of(fown, struct file, f_owner);
1798
1799
1800 blob = smack_file(file);
1801 skp = *blob;
1802 rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
1803 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
1804
1805 rcu_read_lock();
1806 tcred = __task_cred(tsk);
1807 if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
1808 rc = 0;
1809 rcu_read_unlock();
1810
1811 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1812 smk_ad_setfield_u_tsk(&ad, tsk);
1813 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad);
1814 return rc;
1815}
1816
1817
1818
1819
1820
1821
1822
1823static int smack_file_receive(struct file *file)
1824{
1825 int rc;
1826 int may = 0;
1827 struct smk_audit_info ad;
1828 struct inode *inode = file_inode(file);
1829 struct socket *sock;
1830 struct task_smack *tsp;
1831 struct socket_smack *ssp;
1832
1833 if (unlikely(IS_PRIVATE(inode)))
1834 return 0;
1835
1836 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1837 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1838
1839 if (inode->i_sb->s_magic == SOCKFS_MAGIC) {
1840 sock = SOCKET_I(inode);
1841 ssp = sock->sk->sk_security;
1842 tsp = smack_cred(current_cred());
1843
1844
1845
1846
1847
1848
1849 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad);
1850 rc = smk_bu_file(file, may, rc);
1851 if (rc < 0)
1852 return rc;
1853 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad);
1854 rc = smk_bu_file(file, may, rc);
1855 return rc;
1856 }
1857
1858
1859
1860 if (file->f_mode & FMODE_READ)
1861 may = MAY_READ;
1862 if (file->f_mode & FMODE_WRITE)
1863 may |= MAY_WRITE;
1864
1865 rc = smk_curacc(smk_of_inode(inode), may, &ad);
1866 rc = smk_bu_file(file, may, rc);
1867 return rc;
1868}
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879
1880
1881
1882static int smack_file_open(struct file *file)
1883{
1884 struct task_smack *tsp = smack_cred(file->f_cred);
1885 struct inode *inode = file_inode(file);
1886 struct smk_audit_info ad;
1887 int rc;
1888
1889 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1890 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1891 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
1892 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
1893
1894 return rc;
1895}
1896
1897
1898
1899
1900
1901
1902
1903
1904
1905
1906
1907
1908
1909
1910static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1911{
1912 init_task_smack(smack_cred(cred), NULL, NULL);
1913 return 0;
1914}
1915
1916
1917
1918
1919
1920
1921
1922static void smack_cred_free(struct cred *cred)
1923{
1924 struct task_smack *tsp = smack_cred(cred);
1925 struct smack_rule *rp;
1926 struct list_head *l;
1927 struct list_head *n;
1928
1929 smk_destroy_label_list(&tsp->smk_relabel);
1930
1931 list_for_each_safe(l, n, &tsp->smk_rules) {
1932 rp = list_entry(l, struct smack_rule, list);
1933 list_del(&rp->list);
1934 kmem_cache_free(smack_rule_cache, rp);
1935 }
1936}
1937
1938
1939
1940
1941
1942
1943
1944
1945
1946static int smack_cred_prepare(struct cred *new, const struct cred *old,
1947 gfp_t gfp)
1948{
1949 struct task_smack *old_tsp = smack_cred(old);
1950 struct task_smack *new_tsp = smack_cred(new);
1951 int rc;
1952
1953 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task);
1954
1955 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
1956 if (rc != 0)
1957 return rc;
1958
1959 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel,
1960 gfp);
1961 return rc;
1962}
1963
1964
1965
1966
1967
1968
1969
1970
1971static void smack_cred_transfer(struct cred *new, const struct cred *old)
1972{
1973 struct task_smack *old_tsp = smack_cred(old);
1974 struct task_smack *new_tsp = smack_cred(new);
1975
1976 new_tsp->smk_task = old_tsp->smk_task;
1977 new_tsp->smk_forked = old_tsp->smk_task;
1978 mutex_init(&new_tsp->smk_rules_lock);
1979 INIT_LIST_HEAD(&new_tsp->smk_rules);
1980
1981
1982}
1983
1984
1985
1986
1987
1988
1989
1990
1991static void smack_cred_getsecid(const struct cred *cred, u32 *secid)
1992{
1993 struct smack_known *skp;
1994
1995 rcu_read_lock();
1996 skp = smk_of_task(smack_cred(cred));
1997 *secid = skp->smk_secid;
1998 rcu_read_unlock();
1999}
2000
2001
2002
2003
2004
2005
2006
2007
2008static int smack_kernel_act_as(struct cred *new, u32 secid)
2009{
2010 struct task_smack *new_tsp = smack_cred(new);
2011
2012 new_tsp->smk_task = smack_from_secid(secid);
2013 return 0;
2014}
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024static int smack_kernel_create_files_as(struct cred *new,
2025 struct inode *inode)
2026{
2027 struct inode_smack *isp = smack_inode(inode);
2028 struct task_smack *tsp = smack_cred(new);
2029
2030 tsp->smk_forked = isp->smk_inode;
2031 tsp->smk_task = tsp->smk_forked;
2032 return 0;
2033}
2034
2035
2036
2037
2038
2039
2040
2041
2042
2043static int smk_curacc_on_task(struct task_struct *p, int access,
2044 const char *caller)
2045{
2046 struct smk_audit_info ad;
2047 struct smack_known *skp = smk_of_task_struct(p);
2048 int rc;
2049
2050 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
2051 smk_ad_setfield_u_tsk(&ad, p);
2052 rc = smk_curacc(skp, access, &ad);
2053 rc = smk_bu_task(p, access, rc);
2054 return rc;
2055}
2056
2057
2058
2059
2060
2061
2062
2063
2064static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
2065{
2066 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2067}
2068
2069
2070
2071
2072
2073
2074
2075static int smack_task_getpgid(struct task_struct *p)
2076{
2077 return smk_curacc_on_task(p, MAY_READ, __func__);
2078}
2079
2080
2081
2082
2083
2084
2085
2086static int smack_task_getsid(struct task_struct *p)
2087{
2088 return smk_curacc_on_task(p, MAY_READ, __func__);
2089}
2090
2091
2092
2093
2094
2095
2096
2097
2098static void smack_task_getsecid(struct task_struct *p, u32 *secid)
2099{
2100 struct smack_known *skp = smk_of_task_struct(p);
2101
2102 *secid = skp->smk_secid;
2103}
2104
2105
2106
2107
2108
2109
2110
2111
2112static int smack_task_setnice(struct task_struct *p, int nice)
2113{
2114 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2115}
2116
2117
2118
2119
2120
2121
2122
2123
2124static int smack_task_setioprio(struct task_struct *p, int ioprio)
2125{
2126 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2127}
2128
2129
2130
2131
2132
2133
2134
2135static int smack_task_getioprio(struct task_struct *p)
2136{
2137 return smk_curacc_on_task(p, MAY_READ, __func__);
2138}
2139
2140
2141
2142
2143
2144
2145
2146
2147
2148static int smack_task_setscheduler(struct task_struct *p)
2149{
2150 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2151}
2152
2153
2154
2155
2156
2157
2158
2159static int smack_task_getscheduler(struct task_struct *p)
2160{
2161 return smk_curacc_on_task(p, MAY_READ, __func__);
2162}
2163
2164
2165
2166
2167
2168
2169
2170static int smack_task_movememory(struct task_struct *p)
2171{
2172 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2173}
2174
2175
2176
2177
2178
2179
2180
2181
2182
2183
2184
2185static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info,
2186 int sig, const struct cred *cred)
2187{
2188 struct smk_audit_info ad;
2189 struct smack_known *skp;
2190 struct smack_known *tkp = smk_of_task_struct(p);
2191 int rc;
2192
2193 if (!sig)
2194 return 0;
2195
2196 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
2197 smk_ad_setfield_u_tsk(&ad, p);
2198
2199
2200
2201
2202 if (cred == NULL) {
2203 rc = smk_curacc(tkp, MAY_DELIVER, &ad);
2204 rc = smk_bu_task(p, MAY_DELIVER, rc);
2205 return rc;
2206 }
2207
2208
2209
2210
2211
2212 skp = smk_of_task(smack_cred(cred));
2213 rc = smk_access(skp, tkp, MAY_DELIVER, &ad);
2214 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc);
2215 return rc;
2216}
2217
2218
2219
2220
2221
2222
2223
2224
2225static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
2226{
2227 struct inode_smack *isp = smack_inode(inode);
2228 struct smack_known *skp = smk_of_task_struct(p);
2229
2230 isp->smk_inode = skp;
2231 isp->smk_flags |= SMK_INODE_INSTANT;
2232}
2233
2234
2235
2236
2237
2238
2239
2240
2241
2242
2243
2244
2245
2246
2247
2248static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
2249{
2250 struct smack_known *skp = smk_of_current();
2251 struct socket_smack *ssp;
2252
2253 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
2254 if (ssp == NULL)
2255 return -ENOMEM;
2256
2257
2258
2259
2260 if (unlikely(current->flags & PF_KTHREAD)) {
2261 ssp->smk_in = &smack_known_web;
2262 ssp->smk_out = &smack_known_web;
2263 } else {
2264 ssp->smk_in = skp;
2265 ssp->smk_out = skp;
2266 }
2267 ssp->smk_packet = NULL;
2268
2269 sk->sk_security = ssp;
2270
2271 return 0;
2272}
2273
2274
2275
2276
2277
2278
2279
2280static void smack_sk_free_security(struct sock *sk)
2281{
2282#ifdef SMACK_IPV6_PORT_LABELING
2283 struct smk_port_label *spp;
2284
2285 if (sk->sk_family == PF_INET6) {
2286 rcu_read_lock();
2287 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2288 if (spp->smk_sock != sk)
2289 continue;
2290 spp->smk_can_reuse = 1;
2291 break;
2292 }
2293 rcu_read_unlock();
2294 }
2295#endif
2296 kfree(sk->sk_security);
2297}
2298
2299
2300
2301
2302
2303
2304
2305
2306
2307
2308
2309
2310
2311static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)
2312{
2313 struct smk_net4addr *snp;
2314 struct in_addr *siap = &sip->sin_addr;
2315
2316 if (siap->s_addr == 0)
2317 return NULL;
2318
2319 list_for_each_entry_rcu(snp, &smk_net4addr_list, list)
2320
2321
2322
2323
2324
2325 if (snp->smk_host.s_addr ==
2326 (siap->s_addr & snp->smk_mask.s_addr))
2327 return snp->smk_label;
2328
2329 return NULL;
2330}
2331
2332#if IS_ENABLED(CONFIG_IPV6)
2333
2334
2335
2336
2337
2338
2339static bool smk_ipv6_localhost(struct sockaddr_in6 *sip)
2340{
2341 __be16 *be16p = (__be16 *)&sip->sin6_addr;
2342 __be32 *be32p = (__be32 *)&sip->sin6_addr;
2343
2344 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 &&
2345 ntohs(be16p[7]) == 1)
2346 return true;
2347 return false;
2348}
2349
2350
2351
2352
2353
2354
2355
2356
2357
2358
2359
2360
2361
2362static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip)
2363{
2364 struct smk_net6addr *snp;
2365 struct in6_addr *sap = &sip->sin6_addr;
2366 int i;
2367 int found = 0;
2368
2369
2370
2371
2372 if (smk_ipv6_localhost(sip))
2373 return NULL;
2374
2375 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) {
2376
2377
2378
2379
2380 if (snp->smk_label == NULL)
2381 continue;
2382
2383
2384
2385
2386
2387 for (found = 1, i = 0; i < 8; i++) {
2388 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) !=
2389 snp->smk_host.s6_addr16[i]) {
2390 found = 0;
2391 break;
2392 }
2393 }
2394 if (found)
2395 return snp->smk_label;
2396 }
2397
2398 return NULL;
2399}
2400#endif
2401
2402
2403
2404
2405
2406
2407
2408
2409
2410
2411
2412static int smack_netlabel(struct sock *sk, int labeled)
2413{
2414 struct smack_known *skp;
2415 struct socket_smack *ssp = sk->sk_security;
2416 int rc = 0;
2417
2418
2419
2420
2421
2422
2423
2424
2425
2426 local_bh_disable();
2427 bh_lock_sock_nested(sk);
2428
2429 if (ssp->smk_out == smack_net_ambient ||
2430 labeled == SMACK_UNLABELED_SOCKET)
2431 netlbl_sock_delattr(sk);
2432 else {
2433 skp = ssp->smk_out;
2434 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel);
2435 }
2436
2437 bh_unlock_sock(sk);
2438 local_bh_enable();
2439
2440 return rc;
2441}
2442
2443
2444
2445
2446
2447
2448
2449
2450
2451
2452
2453
2454static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
2455{
2456 struct smack_known *skp;
2457 int rc;
2458 int sk_lbl;
2459 struct smack_known *hkp;
2460 struct socket_smack *ssp = sk->sk_security;
2461 struct smk_audit_info ad;
2462
2463 rcu_read_lock();
2464 hkp = smack_ipv4host_label(sap);
2465 if (hkp != NULL) {
2466#ifdef CONFIG_AUDIT
2467 struct lsm_network_audit net;
2468
2469 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2470 ad.a.u.net->family = sap->sin_family;
2471 ad.a.u.net->dport = sap->sin_port;
2472 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
2473#endif
2474 sk_lbl = SMACK_UNLABELED_SOCKET;
2475 skp = ssp->smk_out;
2476 rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2477 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2478 } else {
2479 sk_lbl = SMACK_CIPSO_SOCKET;
2480 rc = 0;
2481 }
2482 rcu_read_unlock();
2483 if (rc != 0)
2484 return rc;
2485
2486 return smack_netlabel(sk, sk_lbl);
2487}
2488
2489#if IS_ENABLED(CONFIG_IPV6)
2490
2491
2492
2493
2494
2495
2496
2497
2498
2499static int smk_ipv6_check(struct smack_known *subject,
2500 struct smack_known *object,
2501 struct sockaddr_in6 *address, int act)
2502{
2503#ifdef CONFIG_AUDIT
2504 struct lsm_network_audit net;
2505#endif
2506 struct smk_audit_info ad;
2507 int rc;
2508
2509#ifdef CONFIG_AUDIT
2510 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2511 ad.a.u.net->family = PF_INET6;
2512 ad.a.u.net->dport = ntohs(address->sin6_port);
2513 if (act == SMK_RECEIVING)
2514 ad.a.u.net->v6info.saddr = address->sin6_addr;
2515 else
2516 ad.a.u.net->v6info.daddr = address->sin6_addr;
2517#endif
2518 rc = smk_access(subject, object, MAY_WRITE, &ad);
2519 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc);
2520 return rc;
2521}
2522#endif
2523
2524#ifdef SMACK_IPV6_PORT_LABELING
2525
2526
2527
2528
2529
2530
2531
2532static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address)
2533{
2534 struct sock *sk = sock->sk;
2535 struct sockaddr_in6 *addr6;
2536 struct socket_smack *ssp = sock->sk->sk_security;
2537 struct smk_port_label *spp;
2538 unsigned short port = 0;
2539
2540 if (address == NULL) {
2541
2542
2543
2544
2545
2546 rcu_read_lock();
2547 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2548 if (sk != spp->smk_sock)
2549 continue;
2550 spp->smk_in = ssp->smk_in;
2551 spp->smk_out = ssp->smk_out;
2552 rcu_read_unlock();
2553 return;
2554 }
2555
2556
2557
2558
2559 rcu_read_unlock();
2560 return;
2561 }
2562
2563 addr6 = (struct sockaddr_in6 *)address;
2564 port = ntohs(addr6->sin6_port);
2565
2566
2567
2568 if (port == 0)
2569 return;
2570
2571
2572
2573
2574
2575 rcu_read_lock();
2576 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2577 if (spp->smk_port != port || spp->smk_sock_type != sock->type)
2578 continue;
2579 if (spp->smk_can_reuse != 1) {
2580 rcu_read_unlock();
2581 return;
2582 }
2583 spp->smk_port = port;
2584 spp->smk_sock = sk;
2585 spp->smk_in = ssp->smk_in;
2586 spp->smk_out = ssp->smk_out;
2587 spp->smk_can_reuse = 0;
2588 rcu_read_unlock();
2589 return;
2590 }
2591 rcu_read_unlock();
2592
2593
2594
2595 spp = kzalloc(sizeof(*spp), GFP_KERNEL);
2596 if (spp == NULL)
2597 return;
2598
2599 spp->smk_port = port;
2600 spp->smk_sock = sk;
2601 spp->smk_in = ssp->smk_in;
2602 spp->smk_out = ssp->smk_out;
2603 spp->smk_sock_type = sock->type;
2604 spp->smk_can_reuse = 0;
2605
2606 mutex_lock(&smack_ipv6_lock);
2607 list_add_rcu(&spp->list, &smk_ipv6_port_list);
2608 mutex_unlock(&smack_ipv6_lock);
2609 return;
2610}
2611
2612
2613
2614
2615
2616
2617
2618
2619static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2620 int act)
2621{
2622 struct smk_port_label *spp;
2623 struct socket_smack *ssp = sk->sk_security;
2624 struct smack_known *skp = NULL;
2625 unsigned short port;
2626 struct smack_known *object;
2627
2628 if (act == SMK_RECEIVING) {
2629 skp = smack_ipv6host_label(address);
2630 object = ssp->smk_in;
2631 } else {
2632 skp = ssp->smk_out;
2633 object = smack_ipv6host_label(address);
2634 }
2635
2636
2637
2638
2639 if (skp != NULL && object != NULL)
2640 return smk_ipv6_check(skp, object, address, act);
2641 if (skp == NULL)
2642 skp = smack_net_ambient;
2643 if (object == NULL)
2644 object = smack_net_ambient;
2645
2646
2647
2648
2649 if (!smk_ipv6_localhost(address))
2650 return smk_ipv6_check(skp, object, address, act);
2651
2652
2653
2654
2655 if (act == SMK_RECEIVING)
2656 return 0;
2657
2658 port = ntohs(address->sin6_port);
2659 rcu_read_lock();
2660 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2661 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type)
2662 continue;
2663 object = spp->smk_in;
2664 if (act == SMK_CONNECTING)
2665 ssp->smk_packet = spp->smk_out;
2666 break;
2667 }
2668 rcu_read_unlock();
2669
2670 return smk_ipv6_check(skp, object, address, act);
2671}
2672#endif
2673
2674
2675
2676
2677
2678
2679
2680
2681
2682
2683
2684
2685
2686static int smack_inode_setsecurity(struct inode *inode, const char *name,
2687 const void *value, size_t size, int flags)
2688{
2689 struct smack_known *skp;
2690 struct inode_smack *nsp = smack_inode(inode);
2691 struct socket_smack *ssp;
2692 struct socket *sock;
2693 int rc = 0;
2694
2695 if (value == NULL || size > SMK_LONGLABEL || size == 0)
2696 return -EINVAL;
2697
2698 skp = smk_import_entry(value, size);
2699 if (IS_ERR(skp))
2700 return PTR_ERR(skp);
2701
2702 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2703 nsp->smk_inode = skp;
2704 nsp->smk_flags |= SMK_INODE_INSTANT;
2705 return 0;
2706 }
2707
2708
2709
2710 if (inode->i_sb->s_magic != SOCKFS_MAGIC)
2711 return -EOPNOTSUPP;
2712
2713 sock = SOCKET_I(inode);
2714 if (sock == NULL || sock->sk == NULL)
2715 return -EOPNOTSUPP;
2716
2717 ssp = sock->sk->sk_security;
2718
2719 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
2720 ssp->smk_in = skp;
2721 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
2722 ssp->smk_out = skp;
2723 if (sock->sk->sk_family == PF_INET) {
2724 rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
2725 if (rc != 0)
2726 printk(KERN_WARNING
2727 "Smack: \"%s\" netlbl error %d.\n",
2728 __func__, -rc);
2729 }
2730 } else
2731 return -EOPNOTSUPP;
2732
2733#ifdef SMACK_IPV6_PORT_LABELING
2734 if (sock->sk->sk_family == PF_INET6)
2735 smk_ipv6_port_label(sock, NULL);
2736#endif
2737
2738 return 0;
2739}
2740
2741
2742
2743
2744
2745
2746
2747
2748
2749
2750
2751
2752
2753static int smack_socket_post_create(struct socket *sock, int family,
2754 int type, int protocol, int kern)
2755{
2756 struct socket_smack *ssp;
2757
2758 if (sock->sk == NULL)
2759 return 0;
2760
2761
2762
2763
2764 if (unlikely(current->flags & PF_KTHREAD)) {
2765 ssp = sock->sk->sk_security;
2766 ssp->smk_in = &smack_known_web;
2767 ssp->smk_out = &smack_known_web;
2768 }
2769
2770 if (family != PF_INET)
2771 return 0;
2772
2773
2774
2775 return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
2776}
2777
2778
2779
2780
2781
2782
2783
2784
2785
2786
2787static int smack_socket_socketpair(struct socket *socka,
2788 struct socket *sockb)
2789{
2790 struct socket_smack *asp = socka->sk->sk_security;
2791 struct socket_smack *bsp = sockb->sk->sk_security;
2792
2793 asp->smk_packet = bsp->smk_out;
2794 bsp->smk_packet = asp->smk_out;
2795
2796 return 0;
2797}
2798
2799#ifdef SMACK_IPV6_PORT_LABELING
2800
2801
2802
2803
2804
2805
2806
2807
2808
2809
2810static int smack_socket_bind(struct socket *sock, struct sockaddr *address,
2811 int addrlen)
2812{
2813 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) {
2814 if (addrlen < SIN6_LEN_RFC2133 ||
2815 address->sa_family != AF_INET6)
2816 return -EINVAL;
2817 smk_ipv6_port_label(sock, address);
2818 }
2819 return 0;
2820}
2821#endif
2822
2823
2824
2825
2826
2827
2828
2829
2830
2831
2832
2833static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
2834 int addrlen)
2835{
2836 int rc = 0;
2837#if IS_ENABLED(CONFIG_IPV6)
2838 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
2839#endif
2840#ifdef SMACK_IPV6_SECMARK_LABELING
2841 struct smack_known *rsp;
2842 struct socket_smack *ssp;
2843#endif
2844
2845 if (sock->sk == NULL)
2846 return 0;
2847
2848#ifdef SMACK_IPV6_SECMARK_LABELING
2849 ssp = sock->sk->sk_security;
2850#endif
2851
2852 switch (sock->sk->sk_family) {
2853 case PF_INET:
2854 if (addrlen < sizeof(struct sockaddr_in) ||
2855 sap->sa_family != AF_INET)
2856 return -EINVAL;
2857 rc = smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap);
2858 break;
2859 case PF_INET6:
2860 if (addrlen < SIN6_LEN_RFC2133 || sap->sa_family != AF_INET6)
2861 return -EINVAL;
2862#ifdef SMACK_IPV6_SECMARK_LABELING
2863 rsp = smack_ipv6host_label(sip);
2864 if (rsp != NULL)
2865 rc = smk_ipv6_check(ssp->smk_out, rsp, sip,
2866 SMK_CONNECTING);
2867#endif
2868#ifdef SMACK_IPV6_PORT_LABELING
2869 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);
2870#endif
2871 break;
2872 }
2873 return rc;
2874}
2875
2876
2877
2878
2879
2880
2881
2882static int smack_flags_to_may(int flags)
2883{
2884 int may = 0;
2885
2886 if (flags & S_IRUGO)
2887 may |= MAY_READ;
2888 if (flags & S_IWUGO)
2889 may |= MAY_WRITE;
2890 if (flags & S_IXUGO)
2891 may |= MAY_EXEC;
2892
2893 return may;
2894}
2895
2896
2897
2898
2899
2900
2901
2902static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2903{
2904 struct smack_known **blob = smack_msg_msg(msg);
2905
2906 *blob = smk_of_current();
2907 return 0;
2908}
2909
2910
2911
2912
2913
2914
2915
2916static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)
2917{
2918 struct smack_known **blob = smack_ipc(isp);
2919
2920 return *blob;
2921}
2922
2923
2924
2925
2926
2927
2928
2929static int smack_ipc_alloc_security(struct kern_ipc_perm *isp)
2930{
2931 struct smack_known **blob = smack_ipc(isp);
2932
2933 *blob = smk_of_current();
2934 return 0;
2935}
2936
2937
2938
2939
2940
2941
2942
2943
2944static int smk_curacc_shm(struct kern_ipc_perm *isp, int access)
2945{
2946 struct smack_known *ssp = smack_of_ipc(isp);
2947 struct smk_audit_info ad;
2948 int rc;
2949
2950#ifdef CONFIG_AUDIT
2951 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2952 ad.a.u.ipc_id = isp->id;
2953#endif
2954 rc = smk_curacc(ssp, access, &ad);
2955 rc = smk_bu_current("shm", ssp, access, rc);
2956 return rc;
2957}
2958
2959
2960
2961
2962
2963
2964
2965
2966static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg)
2967{
2968 int may;
2969
2970 may = smack_flags_to_may(shmflg);
2971 return smk_curacc_shm(isp, may);
2972}
2973
2974
2975
2976
2977
2978
2979
2980
2981static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd)
2982{
2983 int may;
2984
2985 switch (cmd) {
2986 case IPC_STAT:
2987 case SHM_STAT:
2988 case SHM_STAT_ANY:
2989 may = MAY_READ;
2990 break;
2991 case IPC_SET:
2992 case SHM_LOCK:
2993 case SHM_UNLOCK:
2994 case IPC_RMID:
2995 may = MAY_READWRITE;
2996 break;
2997 case IPC_INFO:
2998 case SHM_INFO:
2999
3000
3001
3002 return 0;
3003 default:
3004 return -EINVAL;
3005 }
3006 return smk_curacc_shm(isp, may);
3007}
3008
3009
3010
3011
3012
3013
3014
3015
3016
3017static int smack_shm_shmat(struct kern_ipc_perm *ipc, char __user *shmaddr,
3018 int shmflg)
3019{
3020 int may;
3021
3022 may = smack_flags_to_may(shmflg);
3023 return smk_curacc_shm(ipc, may);
3024}
3025
3026
3027
3028
3029
3030
3031
3032
3033static int smk_curacc_sem(struct kern_ipc_perm *isp, int access)
3034{
3035 struct smack_known *ssp = smack_of_ipc(isp);
3036 struct smk_audit_info ad;
3037 int rc;
3038
3039#ifdef CONFIG_AUDIT
3040 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3041 ad.a.u.ipc_id = isp->id;
3042#endif
3043 rc = smk_curacc(ssp, access, &ad);
3044 rc = smk_bu_current("sem", ssp, access, rc);
3045 return rc;
3046}
3047
3048
3049
3050
3051
3052
3053
3054
3055static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg)
3056{
3057 int may;
3058
3059 may = smack_flags_to_may(semflg);
3060 return smk_curacc_sem(isp, may);
3061}
3062
3063
3064
3065
3066
3067
3068
3069
3070static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd)
3071{
3072 int may;
3073
3074 switch (cmd) {
3075 case GETPID:
3076 case GETNCNT:
3077 case GETZCNT:
3078 case GETVAL:
3079 case GETALL:
3080 case IPC_STAT:
3081 case SEM_STAT:
3082 case SEM_STAT_ANY:
3083 may = MAY_READ;
3084 break;
3085 case SETVAL:
3086 case SETALL:
3087 case IPC_RMID:
3088 case IPC_SET:
3089 may = MAY_READWRITE;
3090 break;
3091 case IPC_INFO:
3092 case SEM_INFO:
3093
3094
3095
3096 return 0;
3097 default:
3098 return -EINVAL;
3099 }
3100
3101 return smk_curacc_sem(isp, may);
3102}
3103
3104
3105
3106
3107
3108
3109
3110
3111
3112
3113
3114
3115static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops,
3116 unsigned nsops, int alter)
3117{
3118 return smk_curacc_sem(isp, MAY_READWRITE);
3119}
3120
3121
3122
3123
3124
3125
3126
3127
3128static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
3129{
3130 struct smack_known *msp = smack_of_ipc(isp);
3131 struct smk_audit_info ad;
3132 int rc;
3133
3134#ifdef CONFIG_AUDIT
3135 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3136 ad.a.u.ipc_id = isp->id;
3137#endif
3138 rc = smk_curacc(msp, access, &ad);
3139 rc = smk_bu_current("msq", msp, access, rc);
3140 return rc;
3141}
3142
3143
3144
3145
3146
3147
3148
3149
3150static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg)
3151{
3152 int may;
3153
3154 may = smack_flags_to_may(msqflg);
3155 return smk_curacc_msq(isp, may);
3156}
3157
3158
3159
3160
3161
3162
3163
3164
3165static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd)
3166{
3167 int may;
3168
3169 switch (cmd) {
3170 case IPC_STAT:
3171 case MSG_STAT:
3172 case MSG_STAT_ANY:
3173 may = MAY_READ;
3174 break;
3175 case IPC_SET:
3176 case IPC_RMID:
3177 may = MAY_READWRITE;
3178 break;
3179 case IPC_INFO:
3180 case MSG_INFO:
3181
3182
3183
3184 return 0;
3185 default:
3186 return -EINVAL;
3187 }
3188
3189 return smk_curacc_msq(isp, may);
3190}
3191
3192
3193
3194
3195
3196
3197
3198
3199
3200static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg,
3201 int msqflg)
3202{
3203 int may;
3204
3205 may = smack_flags_to_may(msqflg);
3206 return smk_curacc_msq(isp, may);
3207}
3208
3209
3210
3211
3212
3213
3214
3215
3216
3217
3218
3219static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg,
3220 struct task_struct *target, long type, int mode)
3221{
3222 return smk_curacc_msq(isp, MAY_READWRITE);
3223}
3224
3225
3226
3227
3228
3229
3230
3231
3232static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
3233{
3234 struct smack_known **blob = smack_ipc(ipp);
3235 struct smack_known *iskp = *blob;
3236 int may = smack_flags_to_may(flag);
3237 struct smk_audit_info ad;
3238 int rc;
3239
3240#ifdef CONFIG_AUDIT
3241 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3242 ad.a.u.ipc_id = ipp->id;
3243#endif
3244 rc = smk_curacc(iskp, may, &ad);
3245 rc = smk_bu_current("svipc", iskp, may, rc);
3246 return rc;
3247}
3248
3249
3250
3251
3252
3253
3254static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
3255{
3256 struct smack_known **blob = smack_ipc(ipp);
3257 struct smack_known *iskp = *blob;
3258
3259 *secid = iskp->smk_secid;
3260}
3261
3262
3263
3264
3265
3266
3267
3268
3269static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
3270{
3271 struct super_block *sbp;
3272 struct superblock_smack *sbsp;
3273 struct inode_smack *isp;
3274 struct smack_known *skp;
3275 struct smack_known *ckp = smk_of_current();
3276 struct smack_known *final;
3277 char trattr[TRANS_TRUE_SIZE];
3278 int transflag = 0;
3279 int rc;
3280 struct dentry *dp;
3281
3282 if (inode == NULL)
3283 return;
3284
3285 isp = smack_inode(inode);
3286
3287 mutex_lock(&isp->smk_lock);
3288
3289
3290
3291
3292 if (isp->smk_flags & SMK_INODE_INSTANT)
3293 goto unlockandout;
3294
3295 sbp = inode->i_sb;
3296 sbsp = sbp->s_security;
3297
3298
3299
3300
3301 final = sbsp->smk_default;
3302
3303
3304
3305
3306
3307
3308
3309 if (opt_dentry->d_parent == opt_dentry) {
3310 switch (sbp->s_magic) {
3311 case CGROUP_SUPER_MAGIC:
3312 case CGROUP2_SUPER_MAGIC:
3313
3314
3315
3316
3317
3318 sbsp->smk_root = &smack_known_star;
3319 sbsp->smk_default = &smack_known_star;
3320 isp->smk_inode = sbsp->smk_root;
3321 break;
3322 case TMPFS_MAGIC:
3323
3324
3325
3326
3327 isp->smk_inode = smk_of_current();
3328 break;
3329 case PIPEFS_MAGIC:
3330 isp->smk_inode = smk_of_current();
3331 break;
3332 case SOCKFS_MAGIC:
3333
3334
3335
3336
3337 isp->smk_inode = &smack_known_star;
3338 break;
3339 default:
3340 isp->smk_inode = sbsp->smk_root;
3341 break;
3342 }
3343 isp->smk_flags |= SMK_INODE_INSTANT;
3344 goto unlockandout;
3345 }
3346
3347
3348
3349
3350
3351
3352
3353 switch (sbp->s_magic) {
3354 case SMACK_MAGIC:
3355 case CGROUP_SUPER_MAGIC:
3356 case CGROUP2_SUPER_MAGIC:
3357
3358
3359
3360
3361
3362
3363
3364 final = &smack_known_star;
3365 break;
3366 case DEVPTS_SUPER_MAGIC:
3367
3368
3369
3370
3371
3372 final = ckp;
3373 break;
3374 case PROC_SUPER_MAGIC:
3375
3376
3377
3378
3379 break;
3380 case TMPFS_MAGIC:
3381
3382
3383
3384
3385
3386 final = &smack_known_star;
3387
3388
3389
3390
3391
3392
3393
3394 default:
3395
3396
3397
3398
3399
3400
3401
3402
3403 if (S_ISSOCK(inode->i_mode)) {
3404 final = &smack_known_star;
3405 break;
3406 }
3407
3408
3409
3410
3411
3412
3413 if (!(inode->i_opflags & IOP_XATTR))
3414 break;
3415
3416
3417
3418 dp = dget(opt_dentry);
3419 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
3420 if (!IS_ERR_OR_NULL(skp))
3421 final = skp;
3422
3423
3424
3425
3426 if (S_ISDIR(inode->i_mode)) {
3427
3428
3429
3430
3431
3432
3433
3434
3435
3436 if (isp->smk_flags & SMK_INODE_CHANGED) {
3437 isp->smk_flags &= ~SMK_INODE_CHANGED;
3438 rc = __vfs_setxattr(dp, inode,
3439 XATTR_NAME_SMACKTRANSMUTE,
3440 TRANS_TRUE, TRANS_TRUE_SIZE,
3441 0);
3442 } else {
3443 rc = __vfs_getxattr(dp, inode,
3444 XATTR_NAME_SMACKTRANSMUTE, trattr,
3445 TRANS_TRUE_SIZE);
3446 if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
3447 TRANS_TRUE_SIZE) != 0)
3448 rc = -EINVAL;
3449 }
3450 if (rc >= 0)
3451 transflag = SMK_INODE_TRANSMUTE;
3452 }
3453
3454
3455
3456 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
3457 if (IS_ERR(skp) || skp == &smack_known_star ||
3458 skp == &smack_known_web)
3459 skp = NULL;
3460 isp->smk_task = skp;
3461
3462 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
3463 if (IS_ERR(skp) || skp == &smack_known_star ||
3464 skp == &smack_known_web)
3465 skp = NULL;
3466 isp->smk_mmap = skp;
3467
3468 dput(dp);
3469 break;
3470 }
3471
3472 if (final == NULL)
3473 isp->smk_inode = ckp;
3474 else
3475 isp->smk_inode = final;
3476
3477 isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
3478
3479unlockandout:
3480 mutex_unlock(&isp->smk_lock);
3481 return;
3482}
3483
3484
3485
3486
3487
3488
3489
3490
3491
3492
3493
3494static int smack_getprocattr(struct task_struct *p, char *name, char **value)
3495{
3496 struct smack_known *skp = smk_of_task_struct(p);
3497 char *cp;
3498 int slen;
3499
3500 if (strcmp(name, "current") != 0)
3501 return -EINVAL;
3502
3503 cp = kstrdup(skp->smk_known, GFP_KERNEL);
3504 if (cp == NULL)
3505 return -ENOMEM;
3506
3507 slen = strlen(cp);
3508 *value = cp;
3509 return slen;
3510}
3511
3512
3513
3514
3515
3516
3517
3518
3519
3520
3521
3522
3523static int smack_setprocattr(const char *name, void *value, size_t size)
3524{
3525 struct task_smack *tsp = smack_cred(current_cred());
3526 struct cred *new;
3527 struct smack_known *skp;
3528 struct smack_known_list_elem *sklep;
3529 int rc;
3530
3531 if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
3532 return -EPERM;
3533
3534 if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
3535 return -EINVAL;
3536
3537 if (strcmp(name, "current") != 0)
3538 return -EINVAL;
3539
3540 skp = smk_import_entry(value, size);
3541 if (IS_ERR(skp))
3542 return PTR_ERR(skp);
3543
3544
3545
3546
3547
3548 if (skp == &smack_known_web || skp == &smack_known_star)
3549 return -EINVAL;
3550
3551 if (!smack_privileged(CAP_MAC_ADMIN)) {
3552 rc = -EPERM;
3553 list_for_each_entry(sklep, &tsp->smk_relabel, list)
3554 if (sklep->smk_label == skp) {
3555 rc = 0;
3556 break;
3557 }
3558 if (rc)
3559 return rc;
3560 }
3561
3562 new = prepare_creds();
3563 if (new == NULL)
3564 return -ENOMEM;
3565
3566 tsp = smack_cred(new);
3567 tsp->smk_task = skp;
3568
3569
3570
3571 smk_destroy_label_list(&tsp->smk_relabel);
3572
3573 commit_creds(new);
3574 return size;
3575}
3576
3577
3578
3579
3580
3581
3582
3583
3584
3585
3586static int smack_unix_stream_connect(struct sock *sock,
3587 struct sock *other, struct sock *newsk)
3588{
3589 struct smack_known *skp;
3590 struct smack_known *okp;
3591 struct socket_smack *ssp = sock->sk_security;
3592 struct socket_smack *osp = other->sk_security;
3593 struct socket_smack *nsp = newsk->sk_security;
3594 struct smk_audit_info ad;
3595 int rc = 0;
3596#ifdef CONFIG_AUDIT
3597 struct lsm_network_audit net;
3598#endif
3599
3600 if (!smack_privileged(CAP_MAC_OVERRIDE)) {
3601 skp = ssp->smk_out;
3602 okp = osp->smk_in;
3603#ifdef CONFIG_AUDIT
3604 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3605 smk_ad_setfield_u_net_sk(&ad, other);
3606#endif
3607 rc = smk_access(skp, okp, MAY_WRITE, &ad);
3608 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3609 if (rc == 0) {
3610 okp = osp->smk_out;
3611 skp = ssp->smk_in;
3612 rc = smk_access(okp, skp, MAY_WRITE, &ad);
3613 rc = smk_bu_note("UDS connect", okp, skp,
3614 MAY_WRITE, rc);
3615 }
3616 }
3617
3618
3619
3620
3621 if (rc == 0) {
3622 nsp->smk_packet = ssp->smk_out;
3623 ssp->smk_packet = osp->smk_out;
3624 }
3625
3626 return rc;
3627}
3628
3629
3630
3631
3632
3633
3634
3635
3636
3637static int smack_unix_may_send(struct socket *sock, struct socket *other)
3638{
3639 struct socket_smack *ssp = sock->sk->sk_security;
3640 struct socket_smack *osp = other->sk->sk_security;
3641 struct smk_audit_info ad;
3642 int rc;
3643
3644#ifdef CONFIG_AUDIT
3645 struct lsm_network_audit net;
3646
3647 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3648 smk_ad_setfield_u_net_sk(&ad, other->sk);
3649#endif
3650
3651 if (smack_privileged(CAP_MAC_OVERRIDE))
3652 return 0;
3653
3654 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3655 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3656 return rc;
3657}
3658
3659
3660
3661
3662
3663
3664
3665
3666
3667
3668
3669static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3670 int size)
3671{
3672 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
3673#if IS_ENABLED(CONFIG_IPV6)
3674 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
3675#endif
3676#ifdef SMACK_IPV6_SECMARK_LABELING
3677 struct socket_smack *ssp = sock->sk->sk_security;
3678 struct smack_known *rsp;
3679#endif
3680 int rc = 0;
3681
3682
3683
3684
3685 if (sip == NULL)
3686 return 0;
3687
3688 switch (sock->sk->sk_family) {
3689 case AF_INET:
3690 if (msg->msg_namelen < sizeof(struct sockaddr_in) ||
3691 sip->sin_family != AF_INET)
3692 return -EINVAL;
3693 rc = smack_netlabel_send(sock->sk, sip);
3694 break;
3695#if IS_ENABLED(CONFIG_IPV6)
3696 case AF_INET6:
3697 if (msg->msg_namelen < SIN6_LEN_RFC2133 ||
3698 sap->sin6_family != AF_INET6)
3699 return -EINVAL;
3700#ifdef SMACK_IPV6_SECMARK_LABELING
3701 rsp = smack_ipv6host_label(sap);
3702 if (rsp != NULL)
3703 rc = smk_ipv6_check(ssp->smk_out, rsp, sap,
3704 SMK_CONNECTING);
3705#endif
3706#ifdef SMACK_IPV6_PORT_LABELING
3707 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING);
3708#endif
3709#endif
3710 break;
3711 }
3712 return rc;
3713}
3714
3715
3716
3717
3718
3719
3720
3721
3722static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
3723 struct socket_smack *ssp)
3724{
3725 struct smack_known *skp;
3726 int found = 0;
3727 int acat;
3728 int kcat;
3729
3730 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
3731
3732
3733
3734
3735
3736
3737
3738
3739
3740
3741 rcu_read_lock();
3742 list_for_each_entry_rcu(skp, &smack_known_list, list) {
3743 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl)
3744 continue;
3745
3746
3747
3748 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
3749 if ((skp->smk_netlabel.flags &
3750 NETLBL_SECATTR_MLS_CAT) == 0)
3751 found = 1;
3752 break;
3753 }
3754 for (acat = -1, kcat = -1; acat == kcat; ) {
3755 acat = netlbl_catmap_walk(sap->attr.mls.cat,
3756 acat + 1);
3757 kcat = netlbl_catmap_walk(
3758 skp->smk_netlabel.attr.mls.cat,
3759 kcat + 1);
3760 if (acat < 0 || kcat < 0)
3761 break;
3762 }
3763 if (acat == kcat) {
3764 found = 1;
3765 break;
3766 }
3767 }
3768 rcu_read_unlock();
3769
3770 if (found)
3771 return skp;
3772
3773 if (ssp != NULL && ssp->smk_in == &smack_known_star)
3774 return &smack_known_web;
3775 return &smack_known_star;
3776 }
3777 if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
3778
3779
3780
3781 return smack_from_secid(sap->attr.secid);
3782
3783
3784
3785
3786
3787 return smack_net_ambient;
3788}
3789
3790#if IS_ENABLED(CONFIG_IPV6)
3791static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
3792{
3793 u8 nexthdr;
3794 int offset;
3795 int proto = -EINVAL;
3796 struct ipv6hdr _ipv6h;
3797 struct ipv6hdr *ip6;
3798 __be16 frag_off;
3799 struct tcphdr _tcph, *th;
3800 struct udphdr _udph, *uh;
3801 struct dccp_hdr _dccph, *dh;
3802
3803 sip->sin6_port = 0;
3804
3805 offset = skb_network_offset(skb);
3806 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3807 if (ip6 == NULL)
3808 return -EINVAL;
3809 sip->sin6_addr = ip6->saddr;
3810
3811 nexthdr = ip6->nexthdr;
3812 offset += sizeof(_ipv6h);
3813 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3814 if (offset < 0)
3815 return -EINVAL;
3816
3817 proto = nexthdr;
3818 switch (proto) {
3819 case IPPROTO_TCP:
3820 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3821 if (th != NULL)
3822 sip->sin6_port = th->source;
3823 break;
3824 case IPPROTO_UDP:
3825 case IPPROTO_UDPLITE:
3826 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3827 if (uh != NULL)
3828 sip->sin6_port = uh->source;
3829 break;
3830 case IPPROTO_DCCP:
3831 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3832 if (dh != NULL)
3833 sip->sin6_port = dh->dccph_sport;
3834 break;
3835 }
3836 return proto;
3837}
3838#endif
3839
3840
3841
3842
3843
3844
3845
3846
3847static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3848{
3849 struct netlbl_lsm_secattr secattr;
3850 struct socket_smack *ssp = sk->sk_security;
3851 struct smack_known *skp = NULL;
3852 int rc = 0;
3853 struct smk_audit_info ad;
3854 u16 family = sk->sk_family;
3855#ifdef CONFIG_AUDIT
3856 struct lsm_network_audit net;
3857#endif
3858#if IS_ENABLED(CONFIG_IPV6)
3859 struct sockaddr_in6 sadd;
3860 int proto;
3861
3862 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3863 family = PF_INET;
3864#endif
3865
3866 switch (family) {
3867 case PF_INET:
3868#ifdef CONFIG_SECURITY_SMACK_NETFILTER
3869
3870
3871
3872
3873
3874 if (skb && skb->secmark != 0) {
3875 skp = smack_from_secid(skb->secmark);
3876 goto access_check;
3877 }
3878#endif
3879
3880
3881
3882 netlbl_secattr_init(&secattr);
3883
3884 rc = netlbl_skbuff_getattr(skb, family, &secattr);
3885 if (rc == 0)
3886 skp = smack_from_secattr(&secattr, ssp);
3887 else
3888 skp = smack_net_ambient;
3889
3890 netlbl_secattr_destroy(&secattr);
3891
3892#ifdef CONFIG_SECURITY_SMACK_NETFILTER
3893access_check:
3894#endif
3895#ifdef CONFIG_AUDIT
3896 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3897 ad.a.u.net->family = family;
3898 ad.a.u.net->netif = skb->skb_iif;
3899 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
3900#endif
3901
3902
3903
3904
3905
3906
3907 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3908 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
3909 MAY_WRITE, rc);
3910 if (rc != 0)
3911 netlbl_skbuff_err(skb, family, rc, 0);
3912 break;
3913#if IS_ENABLED(CONFIG_IPV6)
3914 case PF_INET6:
3915 proto = smk_skb_to_addr_ipv6(skb, &sadd);
3916 if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
3917 proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
3918 break;
3919#ifdef SMACK_IPV6_SECMARK_LABELING
3920 if (skb && skb->secmark != 0)
3921 skp = smack_from_secid(skb->secmark);
3922 else if (smk_ipv6_localhost(&sadd))
3923 break;
3924 else
3925 skp = smack_ipv6host_label(&sadd);
3926 if (skp == NULL)
3927 skp = smack_net_ambient;
3928#ifdef CONFIG_AUDIT
3929 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3930 ad.a.u.net->family = family;
3931 ad.a.u.net->netif = skb->skb_iif;
3932 ipv6_skb_to_auditdata(skb, &ad.a, NULL);
3933#endif
3934 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3935 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in,
3936 MAY_WRITE, rc);
3937#endif
3938#ifdef SMACK_IPV6_PORT_LABELING
3939 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING);
3940#endif
3941 if (rc != 0)
3942 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
3943 ICMPV6_ADM_PROHIBITED, 0);
3944 break;
3945#endif
3946 }
3947
3948 return rc;
3949}
3950
3951
3952
3953
3954
3955
3956
3957
3958
3959
3960static int smack_socket_getpeersec_stream(struct socket *sock,
3961 char __user *optval,
3962 int __user *optlen, unsigned len)
3963{
3964 struct socket_smack *ssp;
3965 char *rcp = "";
3966 int slen = 1;
3967 int rc = 0;
3968
3969 ssp = sock->sk->sk_security;
3970 if (ssp->smk_packet != NULL) {
3971 rcp = ssp->smk_packet->smk_known;
3972 slen = strlen(rcp) + 1;
3973 }
3974
3975 if (slen > len)
3976 rc = -ERANGE;
3977 else if (copy_to_user(optval, rcp, slen) != 0)
3978 rc = -EFAULT;
3979
3980 if (put_user(slen, optlen) != 0)
3981 rc = -EFAULT;
3982
3983 return rc;
3984}
3985
3986
3987
3988
3989
3990
3991
3992
3993
3994
3995static int smack_socket_getpeersec_dgram(struct socket *sock,
3996 struct sk_buff *skb, u32 *secid)
3997
3998{
3999 struct netlbl_lsm_secattr secattr;
4000 struct socket_smack *ssp = NULL;
4001 struct smack_known *skp;
4002 int family = PF_UNSPEC;
4003 u32 s = 0;
4004 int rc;
4005
4006 if (skb != NULL) {
4007 if (skb->protocol == htons(ETH_P_IP))
4008 family = PF_INET;
4009#if IS_ENABLED(CONFIG_IPV6)
4010 else if (skb->protocol == htons(ETH_P_IPV6))
4011 family = PF_INET6;
4012#endif
4013 }
4014 if (family == PF_UNSPEC && sock != NULL)
4015 family = sock->sk->sk_family;
4016
4017 switch (family) {
4018 case PF_UNIX:
4019 ssp = sock->sk->sk_security;
4020 s = ssp->smk_out->smk_secid;
4021 break;
4022 case PF_INET:
4023#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4024 s = skb->secmark;
4025 if (s != 0)
4026 break;
4027#endif
4028
4029
4030
4031 if (sock != NULL && sock->sk != NULL)
4032 ssp = sock->sk->sk_security;
4033 netlbl_secattr_init(&secattr);
4034 rc = netlbl_skbuff_getattr(skb, family, &secattr);
4035 if (rc == 0) {
4036 skp = smack_from_secattr(&secattr, ssp);
4037 s = skp->smk_secid;
4038 }
4039 netlbl_secattr_destroy(&secattr);
4040 break;
4041 case PF_INET6:
4042#ifdef SMACK_IPV6_SECMARK_LABELING
4043 s = skb->secmark;
4044#endif
4045 break;
4046 }
4047 *secid = s;
4048 if (s == 0)
4049 return -EINVAL;
4050 return 0;
4051}
4052
4053
4054
4055
4056
4057
4058
4059
4060
4061static void smack_sock_graft(struct sock *sk, struct socket *parent)
4062{
4063 struct socket_smack *ssp;
4064 struct smack_known *skp = smk_of_current();
4065
4066 if (sk == NULL ||
4067 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
4068 return;
4069
4070 ssp = sk->sk_security;
4071 ssp->smk_in = skp;
4072 ssp->smk_out = skp;
4073
4074}
4075
4076
4077
4078
4079
4080
4081
4082
4083
4084
4085static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4086 struct request_sock *req)
4087{
4088 u16 family = sk->sk_family;
4089 struct smack_known *skp;
4090 struct socket_smack *ssp = sk->sk_security;
4091 struct netlbl_lsm_secattr secattr;
4092 struct sockaddr_in addr;
4093 struct iphdr *hdr;
4094 struct smack_known *hskp;
4095 int rc;
4096 struct smk_audit_info ad;
4097#ifdef CONFIG_AUDIT
4098 struct lsm_network_audit net;
4099#endif
4100
4101#if IS_ENABLED(CONFIG_IPV6)
4102 if (family == PF_INET6) {
4103
4104
4105
4106
4107
4108 if (skb->protocol == htons(ETH_P_IP))
4109 family = PF_INET;
4110 else
4111 return 0;
4112 }
4113#endif
4114
4115#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4116
4117
4118
4119
4120
4121 if (skb && skb->secmark != 0) {
4122 skp = smack_from_secid(skb->secmark);
4123 goto access_check;
4124 }
4125#endif
4126
4127 netlbl_secattr_init(&secattr);
4128 rc = netlbl_skbuff_getattr(skb, family, &secattr);
4129 if (rc == 0)
4130 skp = smack_from_secattr(&secattr, ssp);
4131 else
4132 skp = &smack_known_huh;
4133 netlbl_secattr_destroy(&secattr);
4134
4135#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4136access_check:
4137#endif
4138
4139#ifdef CONFIG_AUDIT
4140 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4141 ad.a.u.net->family = family;
4142 ad.a.u.net->netif = skb->skb_iif;
4143 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4144#endif
4145
4146
4147
4148
4149 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4150 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
4151 if (rc != 0)
4152 return rc;
4153
4154
4155
4156
4157
4158 req->peer_secid = skp->smk_secid;
4159
4160
4161
4162
4163
4164
4165 hdr = ip_hdr(skb);
4166 addr.sin_addr.s_addr = hdr->saddr;
4167 rcu_read_lock();
4168 hskp = smack_ipv4host_label(&addr);
4169 rcu_read_unlock();
4170
4171 if (hskp == NULL)
4172 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
4173 else
4174 netlbl_req_delattr(req);
4175
4176 return rc;
4177}
4178
4179
4180
4181
4182
4183
4184
4185
4186static void smack_inet_csk_clone(struct sock *sk,
4187 const struct request_sock *req)
4188{
4189 struct socket_smack *ssp = sk->sk_security;
4190 struct smack_known *skp;
4191
4192 if (req->peer_secid != 0) {
4193 skp = smack_from_secid(req->peer_secid);
4194 ssp->smk_packet = skp;
4195 } else
4196 ssp->smk_packet = NULL;
4197}
4198
4199
4200
4201
4202
4203
4204
4205
4206#ifdef CONFIG_KEYS
4207
4208
4209
4210
4211
4212
4213
4214
4215
4216
4217
4218static int smack_key_alloc(struct key *key, const struct cred *cred,
4219 unsigned long flags)
4220{
4221 struct smack_known *skp = smk_of_task(smack_cred(cred));
4222
4223 key->security = skp;
4224 return 0;
4225}
4226
4227
4228
4229
4230
4231
4232
4233static void smack_key_free(struct key *key)
4234{
4235 key->security = NULL;
4236}
4237
4238
4239
4240
4241
4242
4243
4244
4245
4246
4247static int smack_key_permission(key_ref_t key_ref,
4248 const struct cred *cred, unsigned perm)
4249{
4250 struct key *keyp;
4251 struct smk_audit_info ad;
4252 struct smack_known *tkp = smk_of_task(smack_cred(cred));
4253 int request = 0;
4254 int rc;
4255
4256
4257
4258
4259 if (perm & ~KEY_NEED_ALL)
4260 return -EINVAL;
4261
4262 keyp = key_ref_to_ptr(key_ref);
4263 if (keyp == NULL)
4264 return -EINVAL;
4265
4266
4267
4268
4269 if (keyp->security == NULL)
4270 return 0;
4271
4272
4273
4274 if (tkp == NULL)
4275 return -EACCES;
4276
4277 if (smack_privileged_cred(CAP_MAC_OVERRIDE, cred))
4278 return 0;
4279
4280#ifdef CONFIG_AUDIT
4281 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4282 ad.a.u.key_struct.key = keyp->serial;
4283 ad.a.u.key_struct.key_desc = keyp->description;
4284#endif
4285 if (perm & (KEY_NEED_READ | KEY_NEED_SEARCH | KEY_NEED_VIEW))
4286 request |= MAY_READ;
4287 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
4288 request |= MAY_WRITE;
4289 rc = smk_access(tkp, keyp->security, request, &ad);
4290 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
4291 return rc;
4292}
4293
4294
4295
4296
4297
4298
4299
4300
4301
4302
4303static int smack_key_getsecurity(struct key *key, char **_buffer)
4304{
4305 struct smack_known *skp = key->security;
4306 size_t length;
4307 char *copy;
4308
4309 if (key->security == NULL) {
4310 *_buffer = NULL;
4311 return 0;
4312 }
4313
4314 copy = kstrdup(skp->smk_known, GFP_KERNEL);
4315 if (copy == NULL)
4316 return -ENOMEM;
4317 length = strlen(copy) + 1;
4318
4319 *_buffer = copy;
4320 return length;
4321}
4322
4323#endif
4324
4325
4326
4327
4328
4329
4330
4331
4332
4333
4334
4335
4336
4337
4338#ifdef CONFIG_AUDIT
4339
4340
4341
4342
4343
4344
4345
4346
4347
4348
4349
4350static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
4351{
4352 struct smack_known *skp;
4353 char **rule = (char **)vrule;
4354 *rule = NULL;
4355
4356 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4357 return -EINVAL;
4358
4359 if (op != Audit_equal && op != Audit_not_equal)
4360 return -EINVAL;
4361
4362 skp = smk_import_entry(rulestr, 0);
4363 if (IS_ERR(skp))
4364 return PTR_ERR(skp);
4365
4366 *rule = skp->smk_known;
4367
4368 return 0;
4369}
4370
4371
4372
4373
4374
4375
4376
4377
4378
4379static int smack_audit_rule_known(struct audit_krule *krule)
4380{
4381 struct audit_field *f;
4382 int i;
4383
4384 for (i = 0; i < krule->field_count; i++) {
4385 f = &krule->fields[i];
4386
4387 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER)
4388 return 1;
4389 }
4390
4391 return 0;
4392}
4393
4394
4395
4396
4397
4398
4399
4400
4401
4402
4403
4404static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule)
4405{
4406 struct smack_known *skp;
4407 char *rule = vrule;
4408
4409 if (unlikely(!rule)) {
4410 WARN_ONCE(1, "Smack: missing rule\n");
4411 return -ENOENT;
4412 }
4413
4414 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4415 return 0;
4416
4417 skp = smack_from_secid(secid);
4418
4419
4420
4421
4422
4423
4424 if (op == Audit_equal)
4425 return (rule == skp->smk_known);
4426 if (op == Audit_not_equal)
4427 return (rule != skp->smk_known);
4428
4429 return 0;
4430}
4431
4432
4433
4434
4435
4436
4437#endif
4438
4439
4440
4441
4442
4443static int smack_ismaclabel(const char *name)
4444{
4445 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
4446}
4447
4448
4449
4450
4451
4452
4453
4454
4455
4456
4457static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4458{
4459 struct smack_known *skp = smack_from_secid(secid);
4460
4461 if (secdata)
4462 *secdata = skp->smk_known;
4463 *seclen = strlen(skp->smk_known);
4464 return 0;
4465}
4466
4467
4468
4469
4470
4471
4472
4473
4474
4475static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
4476{
4477 struct smack_known *skp = smk_find_entry(secdata);
4478
4479 if (skp)
4480 *secid = skp->smk_secid;
4481 else
4482 *secid = 0;
4483 return 0;
4484}
4485
4486
4487
4488
4489
4490
4491
4492static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
4493{
4494 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0);
4495}
4496
4497static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
4498{
4499 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0);
4500}
4501
4502static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4503{
4504 struct smack_known *skp = smk_of_inode(inode);
4505
4506 *ctx = skp->smk_known;
4507 *ctxlen = strlen(skp->smk_known);
4508 return 0;
4509}
4510
4511static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
4512{
4513
4514 struct task_smack *tsp;
4515 struct smack_known *skp;
4516 struct inode_smack *isp;
4517 struct cred *new_creds = *new;
4518
4519 if (new_creds == NULL) {
4520 new_creds = prepare_creds();
4521 if (new_creds == NULL)
4522 return -ENOMEM;
4523 }
4524
4525 tsp = smack_cred(new_creds);
4526
4527
4528
4529
4530 isp = smack_inode(d_inode(dentry->d_parent));
4531 skp = isp->smk_inode;
4532 tsp->smk_task = skp;
4533 *new = new_creds;
4534 return 0;
4535}
4536
4537static int smack_inode_copy_up_xattr(const char *name)
4538{
4539
4540
4541
4542 if (strcmp(name, XATTR_NAME_SMACK) == 0)
4543 return 1;
4544
4545 return -EOPNOTSUPP;
4546}
4547
4548static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
4549 struct qstr *name,
4550 const struct cred *old,
4551 struct cred *new)
4552{
4553 struct task_smack *otsp = smack_cred(old);
4554 struct task_smack *ntsp = smack_cred(new);
4555 struct inode_smack *isp;
4556 int may;
4557
4558
4559
4560
4561
4562 ntsp->smk_task = otsp->smk_task;
4563
4564
4565
4566
4567 isp = smack_inode(d_inode(dentry->d_parent));
4568
4569 if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
4570 rcu_read_lock();
4571 may = smk_access_entry(otsp->smk_task->smk_known,
4572 isp->smk_inode->smk_known,
4573 &otsp->smk_task->smk_rules);
4574 rcu_read_unlock();
4575
4576
4577
4578
4579
4580
4581 if (may > 0 && (may & MAY_TRANSMUTE))
4582 ntsp->smk_task = isp->smk_inode;
4583 }
4584 return 0;
4585}
4586
4587struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
4588 .lbs_cred = sizeof(struct task_smack),
4589 .lbs_file = sizeof(struct smack_known *),
4590 .lbs_inode = sizeof(struct inode_smack),
4591 .lbs_ipc = sizeof(struct smack_known *),
4592 .lbs_msg_msg = sizeof(struct smack_known *),
4593};
4594
4595static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
4596 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
4597 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
4598 LSM_HOOK_INIT(syslog, smack_syslog),
4599
4600 LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup),
4601 LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
4602
4603 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
4604 LSM_HOOK_INIT(sb_free_security, smack_sb_free_security),
4605 LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),
4606 LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts),
4607 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),
4608 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts),
4609
4610 LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds),
4611
4612 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security),
4613 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security),
4614 LSM_HOOK_INIT(inode_link, smack_inode_link),
4615 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),
4616 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir),
4617 LSM_HOOK_INIT(inode_rename, smack_inode_rename),
4618 LSM_HOOK_INIT(inode_permission, smack_inode_permission),
4619 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr),
4620 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr),
4621 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr),
4622 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr),
4623 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr),
4624 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr),
4625 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),
4626 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),
4627 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),
4628 LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),
4629
4630 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
4631 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
4632 LSM_HOOK_INIT(file_lock, smack_file_lock),
4633 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
4634 LSM_HOOK_INIT(mmap_file, smack_mmap_file),
4635 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
4636 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner),
4637 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask),
4638 LSM_HOOK_INIT(file_receive, smack_file_receive),
4639
4640 LSM_HOOK_INIT(file_open, smack_file_open),
4641
4642 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank),
4643 LSM_HOOK_INIT(cred_free, smack_cred_free),
4644 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
4645 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
4646 LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid),
4647 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
4648 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
4649 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),
4650 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),
4651 LSM_HOOK_INIT(task_getsid, smack_task_getsid),
4652 LSM_HOOK_INIT(task_getsecid, smack_task_getsecid),
4653 LSM_HOOK_INIT(task_setnice, smack_task_setnice),
4654 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),
4655 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),
4656 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),
4657 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),
4658 LSM_HOOK_INIT(task_movememory, smack_task_movememory),
4659 LSM_HOOK_INIT(task_kill, smack_task_kill),
4660 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),
4661
4662 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),
4663 LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),
4664
4665 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),
4666
4667 LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security),
4668 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate),
4669 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl),
4670 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd),
4671 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv),
4672
4673 LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security),
4674 LSM_HOOK_INIT(shm_associate, smack_shm_associate),
4675 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl),
4676 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat),
4677
4678 LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security),
4679 LSM_HOOK_INIT(sem_associate, smack_sem_associate),
4680 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl),
4681 LSM_HOOK_INIT(sem_semop, smack_sem_semop),
4682
4683 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate),
4684
4685 LSM_HOOK_INIT(getprocattr, smack_getprocattr),
4686 LSM_HOOK_INIT(setprocattr, smack_setprocattr),
4687
4688 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect),
4689 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),
4690
4691 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),
4692 LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair),
4693#ifdef SMACK_IPV6_PORT_LABELING
4694 LSM_HOOK_INIT(socket_bind, smack_socket_bind),
4695#endif
4696 LSM_HOOK_INIT(socket_connect, smack_socket_connect),
4697 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg),
4698 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb),
4699 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),
4700 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
4701 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
4702 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
4703 LSM_HOOK_INIT(sock_graft, smack_sock_graft),
4704 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
4705 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
4706
4707
4708#ifdef CONFIG_KEYS
4709 LSM_HOOK_INIT(key_alloc, smack_key_alloc),
4710 LSM_HOOK_INIT(key_free, smack_key_free),
4711 LSM_HOOK_INIT(key_permission, smack_key_permission),
4712 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),
4713#endif
4714
4715
4716#ifdef CONFIG_AUDIT
4717 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init),
4718 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known),
4719 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match),
4720#endif
4721
4722 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),
4723 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),
4724 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),
4725 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),
4726 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),
4727 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),
4728 LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up),
4729 LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr),
4730 LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as),
4731};
4732
4733
4734static __init void init_smack_known_list(void)
4735{
4736
4737
4738
4739 mutex_init(&smack_known_huh.smk_rules_lock);
4740 mutex_init(&smack_known_hat.smk_rules_lock);
4741 mutex_init(&smack_known_floor.smk_rules_lock);
4742 mutex_init(&smack_known_star.smk_rules_lock);
4743 mutex_init(&smack_known_web.smk_rules_lock);
4744
4745
4746
4747 INIT_LIST_HEAD(&smack_known_huh.smk_rules);
4748 INIT_LIST_HEAD(&smack_known_hat.smk_rules);
4749 INIT_LIST_HEAD(&smack_known_star.smk_rules);
4750 INIT_LIST_HEAD(&smack_known_floor.smk_rules);
4751 INIT_LIST_HEAD(&smack_known_web.smk_rules);
4752
4753
4754
4755 smk_insert_entry(&smack_known_huh);
4756 smk_insert_entry(&smack_known_hat);
4757 smk_insert_entry(&smack_known_star);
4758 smk_insert_entry(&smack_known_floor);
4759 smk_insert_entry(&smack_known_web);
4760}
4761
4762
4763
4764
4765
4766
4767static __init int smack_init(void)
4768{
4769 struct cred *cred = (struct cred *) current->cred;
4770 struct task_smack *tsp;
4771
4772 smack_inode_cache = KMEM_CACHE(inode_smack, 0);
4773 if (!smack_inode_cache)
4774 return -ENOMEM;
4775
4776 smack_rule_cache = KMEM_CACHE(smack_rule, 0);
4777 if (!smack_rule_cache) {
4778 kmem_cache_destroy(smack_inode_cache);
4779 return -ENOMEM;
4780 }
4781
4782
4783
4784
4785 tsp = smack_cred(cred);
4786 init_task_smack(tsp, &smack_known_floor, &smack_known_floor);
4787
4788
4789
4790
4791 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
4792 smack_enabled = 1;
4793
4794 pr_info("Smack: Initializing.\n");
4795#ifdef CONFIG_SECURITY_SMACK_NETFILTER
4796 pr_info("Smack: Netfilter enabled.\n");
4797#endif
4798#ifdef SMACK_IPV6_PORT_LABELING
4799 pr_info("Smack: IPv6 port labeling enabled.\n");
4800#endif
4801#ifdef SMACK_IPV6_SECMARK_LABELING
4802 pr_info("Smack: IPv6 Netfilter enabled.\n");
4803#endif
4804
4805
4806 init_smack_known_list();
4807
4808 return 0;
4809}
4810
4811
4812
4813
4814
4815DEFINE_LSM(smack) = {
4816 .name = "smack",
4817 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
4818 .blobs = &smack_blob_sizes,
4819 .init = smack_init,
4820};
4821