2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
16 #include <linux/sched.h>
19 struct smack_known smack_known_huh
= {
24 struct smack_known smack_known_hat
= {
29 struct smack_known smack_known_star
= {
34 struct smack_known smack_known_floor
= {
39 struct smack_known smack_known_invalid
= {
44 struct smack_known smack_known_web
= {
49 LIST_HEAD(smack_known_list
);
52 * The initial value needs to be bigger than any of the
55 static u32 smack_next_secid
= 10;
58 * what events do we log
59 * can be overwritten at run-time by /smack/logging
61 int log_policy
= SMACK_AUDIT_DENIED
;
64 * smk_access_entry - look up matching access rule
65 * @subject_label: a pointer to the subject's Smack label
66 * @object_label: a pointer to the object's Smack label
67 * @rule_list: the list of rules to search
69 * This function looks up the subject/object pair in the
70 * access rule list and returns the access mode. If no
71 * entry is found returns -ENOENT.
75 * Earlier versions of this function allowed for labels that
76 * were not on the label list. This was done to allow for
77 * labels to come over the network that had never been seen
78 * before on this host. Unless the receiving socket has the
79 * star label this will always result in a failure check. The
80 * star labeled socket case is now handled in the networking
81 * hooks so there is no case where the label is not on the
82 * label list. Checking to see if the address of two labels
83 * is the same is now a reliable test.
85 * Do the object check first because that is more
88 int smk_access_entry(char *subject_label
, char *object_label
,
89 struct list_head
*rule_list
)
92 struct smack_rule
*srp
;
94 list_for_each_entry_rcu(srp
, rule_list
, list
) {
95 if (srp
->smk_object
== object_label
&&
96 srp
->smk_subject
== subject_label
) {
97 may
= srp
->smk_access
;
106 * smk_access - determine if a subject has a specific access to an object
107 * @subject_label: a pointer to the subject's Smack label
108 * @object_label: a pointer to the object's Smack label
109 * @request: the access requested, in "MAY" format
110 * @a : a pointer to the audit data
112 * This function looks up the subject/object pair in the
113 * access rule list and returns 0 if the access is permitted,
114 * non zero otherwise.
116 * Smack labels are shared on smack_list
118 int smk_access(char *subject_label
, char *object_label
, int request
,
119 struct smk_audit_info
*a
)
121 struct smack_known
*skp
;
126 * Hardcoded comparisons.
128 * A star subject can't access any object.
130 if (subject_label
== smack_known_star
.smk_known
) {
135 * An internet object can be accessed by any subject.
136 * Tasks cannot be assigned the internet label.
137 * An internet subject can access any object.
139 if (object_label
== smack_known_web
.smk_known
||
140 subject_label
== smack_known_web
.smk_known
)
143 * A star object can be accessed by any subject.
145 if (object_label
== smack_known_star
.smk_known
)
148 * An object can be accessed in any way by a subject
149 * with the same label.
151 if (subject_label
== object_label
)
154 * A hat subject can read any object.
155 * A floor object can be read by any subject.
157 if ((request
& MAY_ANYREAD
) == request
) {
158 if (object_label
== smack_known_floor
.smk_known
)
160 if (subject_label
== smack_known_hat
.smk_known
)
164 * Beyond here an explicit relationship is required.
165 * If the requested access is contained in the available
166 * access (e.g. read is included in readwrite) it's
167 * good. A negative response from smk_access_entry()
168 * indicates there is no entry for this pair.
170 skp
= smk_find_entry(subject_label
);
172 may
= smk_access_entry(subject_label
, object_label
, &skp
->smk_rules
);
175 if (may
> 0 && (request
& may
) == request
)
182 smack_log(subject_label
, object_label
, request
, rc
, a
);
188 * smk_curacc - determine if current has a specific access to an object
189 * @obj_label: a pointer to the object's Smack label
190 * @mode: the access requested, in "MAY" format
191 * @a : common audit data
193 * This function checks the current subject label/object label pair
194 * in the access rule list and returns 0 if the access is permitted,
195 * non zero otherwise. It allows that current may have the capability
196 * to override the rules.
198 int smk_curacc(char *obj_label
, u32 mode
, struct smk_audit_info
*a
)
200 struct task_smack
*tsp
= current_security();
201 char *sp
= smk_of_task(tsp
);
206 * Check the global rule list
208 rc
= smk_access(sp
, obj_label
, mode
, NULL
);
211 * If there is an entry in the task's rule list
212 * it can further restrict access.
214 may
= smk_access_entry(sp
, obj_label
, &tsp
->smk_rules
);
217 if ((mode
& may
) == mode
)
223 * Allow for priviliged to override policy.
225 if (rc
!= 0 && smack_privileged(CAP_MAC_OVERRIDE
))
231 smack_log(sp
, obj_label
, mode
, rc
, a
);
238 * smack_str_from_perm : helper to transalate an int to a
240 * @string : the string to fill
244 static inline void smack_str_from_perm(char *string
, int access
)
247 if (access
& MAY_READ
)
249 if (access
& MAY_WRITE
)
251 if (access
& MAY_EXEC
)
253 if (access
& MAY_APPEND
)
255 if (access
& MAY_TRANSMUTE
)
260 * smack_log_callback - SMACK specific information
261 * will be called by generic audit code
262 * @ab : the audit_buffer
266 static void smack_log_callback(struct audit_buffer
*ab
, void *a
)
268 struct common_audit_data
*ad
= a
;
269 struct smack_audit_data
*sad
= ad
->smack_audit_data
;
270 audit_log_format(ab
, "lsm=SMACK fn=%s action=%s",
271 ad
->smack_audit_data
->function
,
272 sad
->result
? "denied" : "granted");
273 audit_log_format(ab
, " subject=");
274 audit_log_untrustedstring(ab
, sad
->subject
);
275 audit_log_format(ab
, " object=");
276 audit_log_untrustedstring(ab
, sad
->object
);
277 audit_log_format(ab
, " requested=%s", sad
->request
);
281 * smack_log - Audit the granting or denial of permissions.
282 * @subject_label : smack label of the requester
283 * @object_label : smack label of the object being accessed
284 * @request: requested permissions
285 * @result: result from smk_access
286 * @a: auxiliary audit data
288 * Audit the granting or denial of permissions in accordance
291 void smack_log(char *subject_label
, char *object_label
, int request
,
292 int result
, struct smk_audit_info
*ad
)
294 char request_buffer
[SMK_NUM_ACCESS_TYPE
+ 1];
295 struct smack_audit_data
*sad
;
296 struct common_audit_data
*a
= &ad
->a
;
298 /* check if we have to log the current event */
299 if (result
!= 0 && (log_policy
& SMACK_AUDIT_DENIED
) == 0)
301 if (result
== 0 && (log_policy
& SMACK_AUDIT_ACCEPT
) == 0)
304 sad
= a
->smack_audit_data
;
306 if (sad
->function
== NULL
)
307 sad
->function
= "unknown";
309 /* end preparing the audit data */
310 smack_str_from_perm(request_buffer
, request
);
311 sad
->subject
= subject_label
;
312 sad
->object
= object_label
;
313 sad
->request
= request_buffer
;
314 sad
->result
= result
;
316 common_lsm_audit(a
, smack_log_callback
, NULL
);
318 #else /* #ifdef CONFIG_AUDIT */
319 void smack_log(char *subject_label
, char *object_label
, int request
,
320 int result
, struct smk_audit_info
*ad
)
325 DEFINE_MUTEX(smack_known_lock
);
328 * smk_find_entry - find a label on the list, return the list entry
329 * @string: a text string that might be a Smack label
331 * Returns a pointer to the entry in the label list that
332 * matches the passed string.
334 struct smack_known
*smk_find_entry(const char *string
)
336 struct smack_known
*skp
;
338 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
339 if (strcmp(skp
->smk_known
, string
) == 0)
347 * smk_parse_smack - parse smack label from a text string
348 * @string: a text string that might contain a Smack label
349 * @len: the maximum size, or zero if it is NULL terminated.
351 * Returns a pointer to the clean label, or NULL
353 char *smk_parse_smack(const char *string
, int len
)
359 len
= strlen(string
) + 1;
362 * Reserve a leading '-' as an indicator that
363 * this isn't a label, but an option to interfaces
364 * including /smack/cipso and /smack/cipso2
366 if (string
[0] == '-')
369 for (i
= 0; i
< len
; i
++)
370 if (string
[i
] > '~' || string
[i
] <= ' ' || string
[i
] == '/' ||
371 string
[i
] == '"' || string
[i
] == '\\' || string
[i
] == '\'')
374 if (i
== 0 || i
>= SMK_LONGLABEL
)
377 smack
= kzalloc(i
+ 1, GFP_KERNEL
);
379 strncpy(smack
, string
, i
+ 1);
386 * smk_netlbl_mls - convert a catset to netlabel mls categories
387 * @catset: the Smack categories
388 * @sap: where to put the netlabel categories
390 * Allocates and fills attr.mls
391 * Returns 0 on success, error code on failure.
393 int smk_netlbl_mls(int level
, char *catset
, struct netlbl_lsm_secattr
*sap
,
402 sap
->flags
|= NETLBL_SECATTR_MLS_CAT
;
403 sap
->attr
.mls
.lvl
= level
;
404 sap
->attr
.mls
.cat
= netlbl_secattr_catmap_alloc(GFP_ATOMIC
);
405 sap
->attr
.mls
.cat
->startbit
= 0;
407 for (cat
= 1, cp
= catset
, byte
= 0; byte
< len
; cp
++, byte
++)
408 for (m
= 0x80; m
!= 0; m
>>= 1, cat
++) {
411 rc
= netlbl_secattr_catmap_setbit(sap
->attr
.mls
.cat
,
414 netlbl_secattr_catmap_free(sap
->attr
.mls
.cat
);
423 * smk_import_entry - import a label, return the list entry
424 * @string: a text string that might be a Smack label
425 * @len: the maximum size, or zero if it is NULL terminated.
427 * Returns a pointer to the entry in the label list that
428 * matches the passed string, adding it if necessary.
430 struct smack_known
*smk_import_entry(const char *string
, int len
)
432 struct smack_known
*skp
;
437 smack
= smk_parse_smack(string
, len
);
441 mutex_lock(&smack_known_lock
);
443 skp
= smk_find_entry(smack
);
447 skp
= kzalloc(sizeof(*skp
), GFP_KERNEL
);
451 skp
->smk_known
= smack
;
452 skp
->smk_secid
= smack_next_secid
++;
453 skp
->smk_netlabel
.domain
= skp
->smk_known
;
454 skp
->smk_netlabel
.flags
=
455 NETLBL_SECATTR_DOMAIN
| NETLBL_SECATTR_MLS_LVL
;
457 * If direct labeling works use it.
458 * Otherwise use mapped labeling.
460 slen
= strlen(smack
);
461 if (slen
< SMK_CIPSOLEN
)
462 rc
= smk_netlbl_mls(smack_cipso_direct
, skp
->smk_known
,
463 &skp
->smk_netlabel
, slen
);
465 rc
= smk_netlbl_mls(smack_cipso_mapped
, (char *)&skp
->smk_secid
,
466 &skp
->smk_netlabel
, sizeof(skp
->smk_secid
));
469 INIT_LIST_HEAD(&skp
->smk_rules
);
470 mutex_init(&skp
->smk_rules_lock
);
472 * Make sure that the entry is actually
473 * filled before putting it on the list.
475 list_add_rcu(&skp
->list
, &smack_known_list
);
479 * smk_netlbl_mls failed.
486 mutex_unlock(&smack_known_lock
);
492 * smk_import - import a smack label
493 * @string: a text string that might be a Smack label
494 * @len: the maximum size, or zero if it is NULL terminated.
496 * Returns a pointer to the label in the label list that
497 * matches the passed string, adding it if necessary.
499 char *smk_import(const char *string
, int len
)
501 struct smack_known
*skp
;
503 /* labels cannot begin with a '-' */
504 if (string
[0] == '-')
506 skp
= smk_import_entry(string
, len
);
509 return skp
->smk_known
;
513 * smack_from_secid - find the Smack label associated with a secid
514 * @secid: an integer that might be associated with a Smack label
516 * Returns a pointer to the appropriate Smack label if there is one,
517 * otherwise a pointer to the invalid Smack label.
519 char *smack_from_secid(const u32 secid
)
521 struct smack_known
*skp
;
524 list_for_each_entry_rcu(skp
, &smack_known_list
, list
) {
525 if (skp
->smk_secid
== secid
) {
527 return skp
->smk_known
;
532 * If we got this far someone asked for the translation
533 * of a secid that is not on the list.
536 return smack_known_invalid
.smk_known
;
540 * smack_to_secid - find the secid associated with a Smack label
541 * @smack: the Smack label
543 * Returns the appropriate secid if there is one,
546 u32
smack_to_secid(const char *smack
)
548 struct smack_known
*skp
= smk_find_entry(smack
);
552 return skp
->smk_secid
;