1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Simplified MAC Kernel (smack) security module 4 * 5 * This file contains the smack hook function implementations. 6 * 7 * Authors: 8 * Casey Schaufler <casey@schaufler-ca.com> 9 * Jarkko Sakkinen <jarkko.sakkinen@intel.com> 10 * 11 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 12 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. 13 * Paul Moore <paul@paul-moore.com> 14 * Copyright (C) 2010 Nokia Corporation 15 * Copyright (C) 2011 Intel Corporation. 16 */ 17 18 #include <linux/xattr.h> 19 #include <linux/pagemap.h> 20 #include <linux/mount.h> 21 #include <linux/stat.h> 22 #include <linux/kd.h> 23 #include <asm/ioctls.h> 24 #include <linux/ip.h> 25 #include <linux/tcp.h> 26 #include <linux/udp.h> 27 #include <linux/icmpv6.h> 28 #include <linux/slab.h> 29 #include <linux/mutex.h> 30 #include <net/cipso_ipv4.h> 31 #include <net/ip.h> 32 #include <net/ipv6.h> 33 #include <linux/audit.h> 34 #include <linux/magic.h> 35 #include <linux/dcache.h> 36 #include <linux/personality.h> 37 #include <linux/msg.h> 38 #include <linux/shm.h> 39 #include <uapi/linux/shm.h> 40 #include <linux/binfmts.h> 41 #include <linux/parser.h> 42 #include <linux/fs_context.h> 43 #include <linux/fs_parser.h> 44 #include <linux/watch_queue.h> 45 #include <linux/io_uring/cmd.h> 46 #include <uapi/linux/lsm.h> 47 #include "smack.h" 48 49 #define TRANS_TRUE "TRUE" 50 #define TRANS_TRUE_SIZE 4 51 52 #define SMK_CONNECTING 0 53 #define SMK_RECEIVING 1 54 #define SMK_SENDING 2 55 56 /* 57 * Smack uses multiple xattrs. 58 * SMACK64 - for access control, 59 * SMACK64TRANSMUTE - label initialization, 60 * Not saved on files - SMACK64IPIN and SMACK64IPOUT, 61 * Must be set explicitly - SMACK64EXEC and SMACK64MMAP 62 */ 63 #define SMACK_INODE_INIT_XATTRS 2 64 65 #ifdef SMACK_IPV6_PORT_LABELING 66 static DEFINE_MUTEX(smack_ipv6_lock); 67 static LIST_HEAD(smk_ipv6_port_list); 68 #endif 69 struct kmem_cache *smack_rule_cache; 70 int smack_enabled __initdata; 71 72 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s} 73 static struct { 74 const char *name; 75 int len; 76 int opt; 77 } smk_mount_opts[] = { 78 {"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault}, 79 A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute) 80 }; 81 #undef A 82 83 static int match_opt_prefix(char *s, int l, char **arg) 84 { 85 int i; 86 87 for (i = 0; i < ARRAY_SIZE(smk_mount_opts); i++) { 88 size_t len = smk_mount_opts[i].len; 89 if (len > l || memcmp(s, smk_mount_opts[i].name, len)) 90 continue; 91 if (len == l || s[len] != '=') 92 continue; 93 *arg = s + len + 1; 94 return smk_mount_opts[i].opt; 95 } 96 return Opt_error; 97 } 98 99 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 100 static char *smk_bu_mess[] = { 101 "Bringup Error", /* Unused */ 102 "Bringup", /* SMACK_BRINGUP_ALLOW */ 103 "Unconfined Subject", /* SMACK_UNCONFINED_SUBJECT */ 104 "Unconfined Object", /* SMACK_UNCONFINED_OBJECT */ 105 }; 106 107 static void smk_bu_mode(int mode, char *s) 108 { 109 smack_str_from_perm(s, mode); 110 } 111 #endif 112 113 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 114 static int smk_bu_note(char *note, struct smack_known *sskp, 115 struct smack_known *oskp, int mode, int rc) 116 { 117 char acc[SMK_NUM_ACCESS_TYPE + 1]; 118 119 if (rc <= 0) 120 return rc; 121 if (rc > SMACK_UNCONFINED_OBJECT) 122 rc = 0; 123 124 smk_bu_mode(mode, acc); 125 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc], 126 sskp->smk_known, oskp->smk_known, acc, note); 127 return 0; 128 } 129 #else 130 #define smk_bu_note(note, sskp, oskp, mode, RC) (RC) 131 #endif 132 133 static int 134 smk_bu_tsk_to_obj(struct task_struct *tsk, const struct task_smack *tsp, 135 char *note, struct smack_known *oskp, int mode, int rc) 136 { 137 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 138 char acc[SMK_NUM_ACCESS_TYPE + 1]; 139 char comm[TASK_COMM_LEN]; 140 141 if (rc <= 0) 142 return rc; 143 if (rc > SMACK_UNCONFINED_OBJECT) 144 rc = 0; 145 146 smk_bu_mode(mode, acc); 147 148 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc], 149 smk_of_task(tsp)->smk_known, oskp->smk_known, 150 acc, get_task_comm(comm, tsk), note); 151 return 0; 152 #else 153 return rc; 154 #endif 155 } 156 157 static int smk_bu_current(char *note, struct smack_known *oskp, 158 int mode, int rc) 159 { 160 return smk_bu_tsk_to_obj(current, smack_cred(current_cred()), 161 note, oskp, mode, rc); 162 } 163 164 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 165 static int smk_bu_task(struct task_struct *otp, int mode, int rc) 166 { 167 struct task_smack *tsp = smack_cred(current_cred()); 168 struct smack_known *smk_task = smk_of_task_struct_obj(otp); 169 char acc[SMK_NUM_ACCESS_TYPE + 1]; 170 171 if (rc <= 0) 172 return rc; 173 if (rc > SMACK_UNCONFINED_OBJECT) 174 rc = 0; 175 176 smk_bu_mode(mode, acc); 177 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc], 178 tsp->smk_task->smk_known, smk_task->smk_known, acc, 179 current->comm, otp->comm); 180 return 0; 181 } 182 #else 183 #define smk_bu_task(otp, mode, RC) (RC) 184 #endif 185 186 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 187 static int smk_bu_inode(struct inode *inode, int mode, int rc) 188 { 189 struct task_smack *tsp = smack_cred(current_cred()); 190 struct inode_smack *isp = smack_inode(inode); 191 char acc[SMK_NUM_ACCESS_TYPE + 1]; 192 193 if (isp->smk_flags & SMK_INODE_IMPURE) 194 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 195 inode->i_sb->s_id, inode->i_ino, current->comm); 196 197 if (rc <= 0) 198 return rc; 199 if (rc > SMACK_UNCONFINED_OBJECT) 200 rc = 0; 201 if (rc == SMACK_UNCONFINED_SUBJECT && 202 (mode & (MAY_WRITE | MAY_APPEND))) 203 isp->smk_flags |= SMK_INODE_IMPURE; 204 205 smk_bu_mode(mode, acc); 206 207 pr_info("Smack %s: (%s %s %s) inode=(%s %llu) %s\n", smk_bu_mess[rc], 208 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc, 209 inode->i_sb->s_id, inode->i_ino, current->comm); 210 return 0; 211 } 212 #else 213 #define smk_bu_inode(inode, mode, RC) (RC) 214 #endif 215 216 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 217 static int smk_bu_file(struct file *file, int mode, int rc) 218 { 219 struct task_smack *tsp = smack_cred(current_cred()); 220 struct smack_known *sskp = tsp->smk_task; 221 struct inode *inode = file_inode(file); 222 struct inode_smack *isp = smack_inode(inode); 223 char acc[SMK_NUM_ACCESS_TYPE + 1]; 224 225 if (isp->smk_flags & SMK_INODE_IMPURE) 226 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 227 inode->i_sb->s_id, inode->i_ino, current->comm); 228 229 if (rc <= 0) 230 return rc; 231 if (rc > SMACK_UNCONFINED_OBJECT) 232 rc = 0; 233 234 smk_bu_mode(mode, acc); 235 pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc], 236 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 237 inode->i_sb->s_id, inode->i_ino, file, 238 current->comm); 239 return 0; 240 } 241 #else 242 #define smk_bu_file(file, mode, RC) (RC) 243 #endif 244 245 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 246 static int smk_bu_credfile(const struct cred *cred, struct file *file, 247 int mode, int rc) 248 { 249 struct task_smack *tsp = smack_cred(cred); 250 struct smack_known *sskp = tsp->smk_task; 251 struct inode *inode = file_inode(file); 252 struct inode_smack *isp = smack_inode(inode); 253 char acc[SMK_NUM_ACCESS_TYPE + 1]; 254 255 if (isp->smk_flags & SMK_INODE_IMPURE) 256 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 257 inode->i_sb->s_id, inode->i_ino, current->comm); 258 259 if (rc <= 0) 260 return rc; 261 if (rc > SMACK_UNCONFINED_OBJECT) 262 rc = 0; 263 264 smk_bu_mode(mode, acc); 265 pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc], 266 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 267 inode->i_sb->s_id, inode->i_ino, file, 268 current->comm); 269 return 0; 270 } 271 #else 272 #define smk_bu_credfile(cred, file, mode, RC) (RC) 273 #endif 274 275 /** 276 * smk_fetch - Fetch the smack label from a file. 277 * @name: type of the label (attribute) 278 * @ip: a pointer to the inode 279 * @dp: a pointer to the dentry 280 * 281 * Returns a pointer to the master list entry for the Smack label, 282 * NULL if there was no label to fetch, or an error code. 283 */ 284 static struct smack_known *smk_fetch(const char *name, struct inode *ip, 285 struct dentry *dp) 286 { 287 int rc; 288 char *buffer; 289 struct smack_known *skp = NULL; 290 291 if (!(ip->i_opflags & IOP_XATTR)) 292 return ERR_PTR(-EOPNOTSUPP); 293 294 buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS); 295 if (buffer == NULL) 296 return ERR_PTR(-ENOMEM); 297 298 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL); 299 if (rc < 0) 300 skp = ERR_PTR(rc); 301 else if (rc == 0) 302 skp = NULL; 303 else 304 skp = smk_import_entry(buffer, rc); 305 306 kfree(buffer); 307 308 return skp; 309 } 310 311 /** 312 * init_inode_smack - initialize an inode security blob 313 * @inode: inode to extract the info from 314 * @skp: a pointer to the Smack label entry to use in the blob 315 * 316 */ 317 static void init_inode_smack(struct inode *inode, struct smack_known *skp) 318 { 319 struct inode_smack *isp = smack_inode(inode); 320 321 isp->smk_inode = skp; 322 isp->smk_flags = 0; 323 } 324 325 /** 326 * init_task_smack - initialize a task security blob 327 * @tsp: blob to initialize 328 * @task: a pointer to the Smack label for the running task 329 * @forked: a pointer to the Smack label for the forked task 330 * 331 */ 332 static void init_task_smack(struct task_smack *tsp, struct smack_known *task, 333 struct smack_known *forked) 334 { 335 tsp->smk_task = task; 336 tsp->smk_forked = forked; 337 INIT_LIST_HEAD(&tsp->smk_rules); 338 INIT_LIST_HEAD(&tsp->smk_relabel); 339 mutex_init(&tsp->smk_rules_lock); 340 } 341 342 /** 343 * smk_copy_rules - copy a rule set 344 * @nhead: new rules header pointer 345 * @ohead: old rules header pointer 346 * @gfp: type of the memory for the allocation 347 * 348 * Returns 0 on success, -ENOMEM on error 349 */ 350 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead, 351 gfp_t gfp) 352 { 353 struct smack_rule *nrp; 354 struct smack_rule *orp; 355 int rc = 0; 356 357 list_for_each_entry_rcu(orp, ohead, list) { 358 nrp = kmem_cache_zalloc(smack_rule_cache, gfp); 359 if (nrp == NULL) { 360 rc = -ENOMEM; 361 break; 362 } 363 *nrp = *orp; 364 list_add_rcu(&nrp->list, nhead); 365 } 366 return rc; 367 } 368 369 /** 370 * smk_copy_relabel - copy smk_relabel labels list 371 * @nhead: new rules header pointer 372 * @ohead: old rules header pointer 373 * @gfp: type of the memory for the allocation 374 * 375 * Returns 0 on success, -ENOMEM on error 376 */ 377 static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead, 378 gfp_t gfp) 379 { 380 struct smack_known_list_elem *nklep; 381 struct smack_known_list_elem *oklep; 382 383 list_for_each_entry(oklep, ohead, list) { 384 nklep = kzalloc_obj(struct smack_known_list_elem, gfp); 385 if (nklep == NULL) { 386 smk_destroy_label_list(nhead); 387 return -ENOMEM; 388 } 389 nklep->smk_label = oklep->smk_label; 390 list_add(&nklep->list, nhead); 391 } 392 393 return 0; 394 } 395 396 /** 397 * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_* 398 * @mode: input mode in form of PTRACE_MODE_* 399 * 400 * Returns a converted MAY_* mode usable by smack rules 401 */ 402 static inline unsigned int smk_ptrace_mode(unsigned int mode) 403 { 404 if (mode & PTRACE_MODE_ATTACH) 405 return MAY_READWRITE; 406 if (mode & PTRACE_MODE_READ) 407 return MAY_READ; 408 409 return 0; 410 } 411 412 /** 413 * smk_ptrace_rule_check - helper for ptrace access 414 * @tracer: tracer process 415 * @tracee_known: label entry of the process that's about to be traced 416 * @mode: ptrace attachment mode (PTRACE_MODE_*) 417 * @func: name of the function that called us, used for audit 418 * 419 * Returns 0 on access granted, -error on error 420 */ 421 static int smk_ptrace_rule_check(struct task_struct *tracer, 422 struct smack_known *tracee_known, 423 unsigned int mode, const char *func) 424 { 425 int rc; 426 struct smk_audit_info ad, *saip = NULL; 427 struct task_smack *tsp; 428 struct smack_known *tracer_known; 429 const struct cred *tracercred; 430 431 if ((mode & PTRACE_MODE_NOAUDIT) == 0) { 432 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); 433 smk_ad_setfield_u_tsk(&ad, tracer); 434 saip = &ad; 435 } 436 437 rcu_read_lock(); 438 tracercred = __task_cred(tracer); 439 tsp = smack_cred(tracercred); 440 tracer_known = smk_of_task(tsp); 441 442 if ((mode & PTRACE_MODE_ATTACH) && 443 (smack_ptrace_rule == SMACK_PTRACE_EXACT || 444 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) { 445 if (tracer_known->smk_known == tracee_known->smk_known) 446 rc = 0; 447 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) 448 rc = -EACCES; 449 else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred)) 450 rc = 0; 451 else 452 rc = -EACCES; 453 454 if (saip) 455 smack_log(tracer_known->smk_known, 456 tracee_known->smk_known, 457 0, rc, saip); 458 459 rcu_read_unlock(); 460 return rc; 461 } 462 463 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ 464 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip); 465 466 rcu_read_unlock(); 467 return rc; 468 } 469 470 /* 471 * LSM hooks. 472 * We he, that is fun! 473 */ 474 475 /** 476 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH 477 * @ctp: child task pointer 478 * @mode: ptrace attachment mode (PTRACE_MODE_*) 479 * 480 * Returns 0 if access is OK, an error code otherwise 481 * 482 * Do the capability checks. 483 */ 484 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) 485 { 486 struct smack_known *skp; 487 488 skp = smk_of_task_struct_obj(ctp); 489 490 return smk_ptrace_rule_check(current, skp, mode, __func__); 491 } 492 493 /** 494 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME 495 * @ptp: parent task pointer 496 * 497 * Returns 0 if access is OK, an error code otherwise 498 * 499 * Do the capability checks, and require PTRACE_MODE_ATTACH. 500 */ 501 static int smack_ptrace_traceme(struct task_struct *ptp) 502 { 503 struct smack_known *skp; 504 505 skp = smk_of_task(smack_cred(current_cred())); 506 507 return smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__); 508 } 509 510 /** 511 * smack_syslog - Smack approval on syslog 512 * @typefrom_file: unused 513 * 514 * Returns 0 on success, error code otherwise. 515 */ 516 static int smack_syslog(int typefrom_file) 517 { 518 int rc = 0; 519 struct smack_known *skp = smk_of_current(); 520 521 if (smack_privileged(CAP_MAC_OVERRIDE)) 522 return 0; 523 524 if (smack_syslog_label != NULL && smack_syslog_label != skp) 525 rc = -EACCES; 526 527 return rc; 528 } 529 530 /* 531 * Superblock Hooks. 532 */ 533 534 /** 535 * smack_sb_alloc_security - allocate a superblock blob 536 * @sb: the superblock getting the blob 537 * 538 * Returns 0 on success or -ENOMEM on error. 539 */ 540 static int smack_sb_alloc_security(struct super_block *sb) 541 { 542 struct superblock_smack *sbsp = smack_superblock(sb); 543 544 sbsp->smk_root = &smack_known_floor; 545 sbsp->smk_default = &smack_known_floor; 546 sbsp->smk_floor = &smack_known_floor; 547 sbsp->smk_hat = &smack_known_hat; 548 /* 549 * SMK_SB_INITIALIZED will be zero from kzalloc. 550 */ 551 552 return 0; 553 } 554 555 struct smack_mnt_opts { 556 const char *fsdefault; 557 const char *fsfloor; 558 const char *fshat; 559 const char *fsroot; 560 const char *fstransmute; 561 }; 562 563 static void smack_free_mnt_opts(void *mnt_opts) 564 { 565 kfree(mnt_opts); 566 } 567 568 static int smack_add_opt(int token, const char *s, void **mnt_opts) 569 { 570 struct smack_mnt_opts *opts = *mnt_opts; 571 struct smack_known *skp; 572 573 if (!opts) { 574 opts = kzalloc_obj(struct smack_mnt_opts); 575 if (!opts) 576 return -ENOMEM; 577 *mnt_opts = opts; 578 } 579 if (!s) 580 return -ENOMEM; 581 582 skp = smk_import_entry(s, 0); 583 if (IS_ERR(skp)) 584 return PTR_ERR(skp); 585 586 switch (token) { 587 case Opt_fsdefault: 588 if (opts->fsdefault) 589 goto out_opt_err; 590 opts->fsdefault = skp->smk_known; 591 break; 592 case Opt_fsfloor: 593 if (opts->fsfloor) 594 goto out_opt_err; 595 opts->fsfloor = skp->smk_known; 596 break; 597 case Opt_fshat: 598 if (opts->fshat) 599 goto out_opt_err; 600 opts->fshat = skp->smk_known; 601 break; 602 case Opt_fsroot: 603 if (opts->fsroot) 604 goto out_opt_err; 605 opts->fsroot = skp->smk_known; 606 break; 607 case Opt_fstransmute: 608 if (opts->fstransmute) 609 goto out_opt_err; 610 opts->fstransmute = skp->smk_known; 611 break; 612 } 613 return 0; 614 615 out_opt_err: 616 pr_warn("Smack: duplicate mount options\n"); 617 return -EINVAL; 618 } 619 620 /** 621 * smack_fs_context_submount - Initialise security data for a filesystem context 622 * @fc: The filesystem context. 623 * @reference: reference superblock 624 * 625 * Returns 0 on success or -ENOMEM on error. 626 */ 627 static int smack_fs_context_submount(struct fs_context *fc, 628 struct super_block *reference) 629 { 630 struct superblock_smack *sbsp; 631 struct smack_mnt_opts *ctx; 632 struct inode_smack *isp; 633 634 ctx = kzalloc_obj(*ctx); 635 if (!ctx) 636 return -ENOMEM; 637 fc->security = ctx; 638 639 sbsp = smack_superblock(reference); 640 isp = smack_inode(reference->s_root->d_inode); 641 642 if (sbsp->smk_default) { 643 ctx->fsdefault = kstrdup(sbsp->smk_default->smk_known, GFP_KERNEL); 644 if (!ctx->fsdefault) 645 return -ENOMEM; 646 } 647 648 if (sbsp->smk_floor) { 649 ctx->fsfloor = kstrdup(sbsp->smk_floor->smk_known, GFP_KERNEL); 650 if (!ctx->fsfloor) 651 return -ENOMEM; 652 } 653 654 if (sbsp->smk_hat) { 655 ctx->fshat = kstrdup(sbsp->smk_hat->smk_known, GFP_KERNEL); 656 if (!ctx->fshat) 657 return -ENOMEM; 658 } 659 660 if (isp->smk_flags & SMK_INODE_TRANSMUTE) { 661 if (sbsp->smk_root) { 662 ctx->fstransmute = kstrdup(sbsp->smk_root->smk_known, GFP_KERNEL); 663 if (!ctx->fstransmute) 664 return -ENOMEM; 665 } 666 } 667 return 0; 668 } 669 670 /** 671 * smack_fs_context_dup - Duplicate the security data on fs_context duplication 672 * @fc: The new filesystem context. 673 * @src_fc: The source filesystem context being duplicated. 674 * 675 * Returns 0 on success or -ENOMEM on error. 676 */ 677 static int smack_fs_context_dup(struct fs_context *fc, 678 struct fs_context *src_fc) 679 { 680 struct smack_mnt_opts *dst, *src = src_fc->security; 681 682 if (!src) 683 return 0; 684 685 fc->security = kzalloc_obj(struct smack_mnt_opts); 686 if (!fc->security) 687 return -ENOMEM; 688 689 dst = fc->security; 690 dst->fsdefault = src->fsdefault; 691 dst->fsfloor = src->fsfloor; 692 dst->fshat = src->fshat; 693 dst->fsroot = src->fsroot; 694 dst->fstransmute = src->fstransmute; 695 696 return 0; 697 } 698 699 static const struct fs_parameter_spec smack_fs_parameters[] = { 700 fsparam_string("smackfsdef", Opt_fsdefault), 701 fsparam_string("smackfsdefault", Opt_fsdefault), 702 fsparam_string("smackfsfloor", Opt_fsfloor), 703 fsparam_string("smackfshat", Opt_fshat), 704 fsparam_string("smackfsroot", Opt_fsroot), 705 fsparam_string("smackfstransmute", Opt_fstransmute), 706 {} 707 }; 708 709 /** 710 * smack_fs_context_parse_param - Parse a single mount parameter 711 * @fc: The new filesystem context being constructed. 712 * @param: The parameter. 713 * 714 * Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on 715 * error. 716 */ 717 static int smack_fs_context_parse_param(struct fs_context *fc, 718 struct fs_parameter *param) 719 { 720 struct fs_parse_result result; 721 int opt, rc; 722 723 opt = fs_parse(fc, smack_fs_parameters, param, &result); 724 if (opt < 0) 725 return opt; 726 727 rc = smack_add_opt(opt, param->string, &fc->security); 728 if (!rc) 729 param->string = NULL; 730 return rc; 731 } 732 733 static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts) 734 { 735 char *from = options, *to = options; 736 bool first = true; 737 738 while (1) { 739 char *next = strchr(from, ','); 740 int token, len, rc; 741 char *arg = NULL; 742 743 if (next) 744 len = next - from; 745 else 746 len = strlen(from); 747 748 token = match_opt_prefix(from, len, &arg); 749 if (token != Opt_error) { 750 arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL); 751 rc = smack_add_opt(token, arg, mnt_opts); 752 kfree(arg); 753 if (unlikely(rc)) { 754 if (*mnt_opts) 755 smack_free_mnt_opts(*mnt_opts); 756 *mnt_opts = NULL; 757 return rc; 758 } 759 } else { 760 if (!first) { // copy with preceding comma 761 from--; 762 len++; 763 } 764 if (to != from) 765 memmove(to, from, len); 766 to += len; 767 first = false; 768 } 769 if (!from[len]) 770 break; 771 from += len + 1; 772 } 773 *to = '\0'; 774 return 0; 775 } 776 777 /** 778 * smack_set_mnt_opts - set Smack specific mount options 779 * @sb: the file system superblock 780 * @mnt_opts: Smack mount options 781 * @kern_flags: mount option from kernel space or user space 782 * @set_kern_flags: where to store converted mount opts 783 * 784 * Returns 0 on success, an error code on failure 785 * 786 * Allow filesystems with binary mount data to explicitly set Smack mount 787 * labels. 788 */ 789 static int smack_set_mnt_opts(struct super_block *sb, 790 void *mnt_opts, 791 unsigned long kern_flags, 792 unsigned long *set_kern_flags) 793 { 794 struct dentry *root = sb->s_root; 795 struct inode *inode = d_backing_inode(root); 796 struct superblock_smack *sp = smack_superblock(sb); 797 struct inode_smack *isp; 798 struct smack_known *skp; 799 struct smack_mnt_opts *opts = mnt_opts; 800 bool transmute = false; 801 802 if (sp->smk_flags & SMK_SB_INITIALIZED) 803 return 0; 804 805 if (!smack_privileged(CAP_MAC_ADMIN)) { 806 /* 807 * Unprivileged mounts don't get to specify Smack values. 808 */ 809 if (opts) 810 return -EPERM; 811 /* 812 * Unprivileged mounts get root and default from the caller. 813 */ 814 skp = smk_of_current(); 815 sp->smk_root = skp; 816 sp->smk_default = skp; 817 /* 818 * For a handful of fs types with no user-controlled 819 * backing store it's okay to trust security labels 820 * in the filesystem. The rest are untrusted. 821 */ 822 if (sb->s_user_ns != &init_user_ns && 823 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC && 824 sb->s_magic != RAMFS_MAGIC) { 825 transmute = true; 826 sp->smk_flags |= SMK_SB_UNTRUSTED; 827 } 828 } 829 830 sp->smk_flags |= SMK_SB_INITIALIZED; 831 832 if (opts) { 833 if (opts->fsdefault) { 834 skp = smk_import_entry(opts->fsdefault, 0); 835 if (IS_ERR(skp)) 836 return PTR_ERR(skp); 837 sp->smk_default = skp; 838 } 839 if (opts->fsfloor) { 840 skp = smk_import_entry(opts->fsfloor, 0); 841 if (IS_ERR(skp)) 842 return PTR_ERR(skp); 843 sp->smk_floor = skp; 844 } 845 if (opts->fshat) { 846 skp = smk_import_entry(opts->fshat, 0); 847 if (IS_ERR(skp)) 848 return PTR_ERR(skp); 849 sp->smk_hat = skp; 850 } 851 if (opts->fsroot) { 852 skp = smk_import_entry(opts->fsroot, 0); 853 if (IS_ERR(skp)) 854 return PTR_ERR(skp); 855 sp->smk_root = skp; 856 } 857 if (opts->fstransmute) { 858 skp = smk_import_entry(opts->fstransmute, 0); 859 if (IS_ERR(skp)) 860 return PTR_ERR(skp); 861 sp->smk_root = skp; 862 transmute = true; 863 } 864 } 865 866 /* 867 * Initialize the root inode. 868 */ 869 init_inode_smack(inode, sp->smk_root); 870 871 if (transmute) { 872 isp = smack_inode(inode); 873 isp->smk_flags |= SMK_INODE_TRANSMUTE; 874 } 875 876 return 0; 877 } 878 879 /** 880 * smack_sb_statfs - Smack check on statfs 881 * @dentry: identifies the file system in question 882 * 883 * Returns 0 if current can read the floor of the filesystem, 884 * and error code otherwise 885 */ 886 static int smack_sb_statfs(struct dentry *dentry) 887 { 888 struct superblock_smack *sbp = smack_superblock(dentry->d_sb); 889 int rc; 890 struct smk_audit_info ad; 891 892 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 893 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 894 895 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 896 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc); 897 return rc; 898 } 899 900 /* 901 * BPRM hooks 902 */ 903 904 /** 905 * smack_bprm_creds_for_exec - Update bprm->cred if needed for exec 906 * @bprm: the exec information 907 * 908 * Returns 0 if it gets a blob, -EPERM if exec forbidden and -ENOMEM otherwise 909 */ 910 static int smack_bprm_creds_for_exec(struct linux_binprm *bprm) 911 { 912 struct inode *inode = file_inode(bprm->file); 913 struct task_smack *bsp = smack_cred(bprm->cred); 914 struct inode_smack *isp; 915 struct superblock_smack *sbsp; 916 int rc; 917 918 isp = smack_inode(inode); 919 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) 920 return 0; 921 922 sbsp = smack_superblock(inode->i_sb); 923 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && 924 isp->smk_task != sbsp->smk_root) 925 return 0; 926 927 if (bprm->unsafe & LSM_UNSAFE_PTRACE) { 928 struct task_struct *tracer; 929 rc = 0; 930 931 rcu_read_lock(); 932 tracer = ptrace_parent(current); 933 if (likely(tracer != NULL)) 934 rc = smk_ptrace_rule_check(tracer, 935 isp->smk_task, 936 PTRACE_MODE_ATTACH, 937 __func__); 938 rcu_read_unlock(); 939 940 if (rc != 0) 941 return rc; 942 } 943 if (bprm->unsafe & ~LSM_UNSAFE_PTRACE) 944 return -EPERM; 945 946 bsp->smk_task = isp->smk_task; 947 bprm->per_clear |= PER_CLEAR_ON_SETID; 948 949 /* Decide if this is a secure exec. */ 950 if (bsp->smk_task != bsp->smk_forked) 951 bprm->secureexec = 1; 952 953 return 0; 954 } 955 956 /* 957 * Inode hooks 958 */ 959 960 /** 961 * smack_inode_alloc_security - allocate an inode blob 962 * @inode: the inode in need of a blob 963 * 964 * Returns 0 965 */ 966 static int smack_inode_alloc_security(struct inode *inode) 967 { 968 struct smack_known *skp = smk_of_current(); 969 970 init_inode_smack(inode, skp); 971 return 0; 972 } 973 974 /** 975 * smk_rule_transmutes - does access rule for (subject,object) contain 't'? 976 * @subject: a pointer to the subject's Smack label entry 977 * @object: a pointer to the object's Smack label entry 978 */ 979 static bool 980 smk_rule_transmutes(struct smack_known *subject, 981 const struct smack_known *object) 982 { 983 int may; 984 985 rcu_read_lock(); 986 may = smk_access_entry(subject->smk_known, object->smk_known, 987 &subject->smk_rules); 988 rcu_read_unlock(); 989 return (may > 0) && (may & MAY_TRANSMUTE); 990 } 991 992 static int 993 xattr_dupval(struct xattr *xattrs, int *xattr_count, 994 const char *name, const void *value, unsigned int vallen) 995 { 996 struct xattr * const xattr = lsm_get_xattr_slot(xattrs, xattr_count); 997 998 if (!xattr) 999 return 0; 1000 1001 xattr->value = kmemdup(value, vallen, GFP_NOFS); 1002 if (!xattr->value) 1003 return -ENOMEM; 1004 1005 xattr->value_len = vallen; 1006 xattr->name = name; 1007 return 0; 1008 } 1009 1010 /** 1011 * smack_inode_init_security - copy out the smack from an inode 1012 * @inode: the newly created inode 1013 * @dir: containing directory object 1014 * @qstr: unused 1015 * @xattrs: where to put the attributes 1016 * @xattr_count: current number of LSM-provided xattrs (updated) 1017 * 1018 * Returns 0 if it all works out, -ENOMEM if there's no memory 1019 */ 1020 static int smack_inode_init_security(struct inode *inode, struct inode *dir, 1021 const struct qstr *qstr, 1022 struct xattr *xattrs, int *xattr_count) 1023 { 1024 struct task_smack *tsp = smack_cred(current_cred()); 1025 struct inode_smack * const issp = smack_inode(inode); 1026 struct smack_known *dsp = smk_of_inode(dir); 1027 int rc = 0; 1028 int transflag = 0; 1029 bool trans_cred; 1030 bool trans_rule; 1031 1032 /* 1033 * UNIX domain sockets use lower level socket data. Let 1034 * UDS inode have fixed * label to keep smack_inode_permission() calm 1035 * when called from unix_find_bsd() 1036 */ 1037 if (S_ISSOCK(inode->i_mode)) { 1038 /* forced label, no need to save to xattrs */ 1039 issp->smk_inode = &smack_known_star; 1040 goto instant_inode; 1041 } 1042 /* 1043 * If equal, transmuting already occurred in 1044 * smack_dentry_create_files_as(). No need to check again. 1045 */ 1046 trans_cred = (tsp->smk_task == tsp->smk_transmuted); 1047 if (!trans_cred) 1048 trans_rule = smk_rule_transmutes(smk_of_task(tsp), dsp); 1049 1050 /* 1051 * In addition to having smk_task equal to smk_transmuted, 1052 * if the access rule allows transmutation and the directory 1053 * requests transmutation then by all means transmute. 1054 * Mark the inode as changed. 1055 */ 1056 if (trans_cred || (trans_rule && smk_inode_transmutable(dir))) { 1057 /* 1058 * The caller of smack_dentry_create_files_as() 1059 * should have overridden the current cred, so the 1060 * inode label was already set correctly in 1061 * smack_inode_alloc_security(). 1062 */ 1063 if (!trans_cred) 1064 issp->smk_inode = dsp; 1065 1066 if (S_ISDIR(inode->i_mode)) { 1067 transflag = SMK_INODE_TRANSMUTE; 1068 1069 if (xattr_dupval(xattrs, xattr_count, 1070 XATTR_SMACK_TRANSMUTE, 1071 TRANS_TRUE, 1072 TRANS_TRUE_SIZE 1073 )) 1074 rc = -ENOMEM; 1075 } 1076 } 1077 1078 if (rc == 0) 1079 if (xattr_dupval(xattrs, xattr_count, 1080 XATTR_SMACK_SUFFIX, 1081 issp->smk_inode->smk_known, 1082 strlen(issp->smk_inode->smk_known) 1083 )) 1084 rc = -ENOMEM; 1085 instant_inode: 1086 issp->smk_flags |= (SMK_INODE_INSTANT | transflag); 1087 return rc; 1088 } 1089 1090 /** 1091 * smack_inode_link - Smack check on link 1092 * @old_dentry: the existing object 1093 * @dir: unused 1094 * @new_dentry: the new object 1095 * 1096 * Returns 0 if access is permitted, an error code otherwise 1097 */ 1098 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, 1099 struct dentry *new_dentry) 1100 { 1101 struct smack_known *isp; 1102 struct smk_audit_info ad; 1103 int rc; 1104 1105 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1106 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1107 1108 isp = smk_of_inode(d_backing_inode(old_dentry)); 1109 rc = smk_curacc(isp, MAY_WRITE, &ad); 1110 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc); 1111 1112 if (rc == 0 && d_is_positive(new_dentry)) { 1113 isp = smk_of_inode(d_backing_inode(new_dentry)); 1114 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1115 rc = smk_curacc(isp, MAY_WRITE, &ad); 1116 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc); 1117 } 1118 1119 return rc; 1120 } 1121 1122 /** 1123 * smack_inode_unlink - Smack check on inode deletion 1124 * @dir: containing directory object 1125 * @dentry: file to unlink 1126 * 1127 * Returns 0 if current can write the containing directory 1128 * and the object, error code otherwise 1129 */ 1130 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) 1131 { 1132 struct inode *ip = d_backing_inode(dentry); 1133 struct smk_audit_info ad; 1134 int rc; 1135 1136 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1137 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1138 1139 /* 1140 * You need write access to the thing you're unlinking 1141 */ 1142 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 1143 rc = smk_bu_inode(ip, MAY_WRITE, rc); 1144 if (rc == 0) { 1145 /* 1146 * You also need write access to the containing directory 1147 */ 1148 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1149 smk_ad_setfield_u_fs_inode(&ad, dir); 1150 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1151 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1152 } 1153 return rc; 1154 } 1155 1156 /** 1157 * smack_inode_rmdir - Smack check on directory deletion 1158 * @dir: containing directory object 1159 * @dentry: directory to unlink 1160 * 1161 * Returns 0 if current can write the containing directory 1162 * and the directory, error code otherwise 1163 */ 1164 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) 1165 { 1166 struct smk_audit_info ad; 1167 int rc; 1168 1169 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1170 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1171 1172 /* 1173 * You need write access to the thing you're removing 1174 */ 1175 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1176 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1177 if (rc == 0) { 1178 /* 1179 * You also need write access to the containing directory 1180 */ 1181 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1182 smk_ad_setfield_u_fs_inode(&ad, dir); 1183 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1184 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1185 } 1186 1187 return rc; 1188 } 1189 1190 /** 1191 * smack_inode_rename - Smack check on rename 1192 * @old_inode: unused 1193 * @old_dentry: the old object 1194 * @new_inode: unused 1195 * @new_dentry: the new object 1196 * 1197 * Read and write access is required on both the old and 1198 * new directories. 1199 * 1200 * Returns 0 if access is permitted, an error code otherwise 1201 */ 1202 static int smack_inode_rename(struct inode *old_inode, 1203 struct dentry *old_dentry, 1204 struct inode *new_inode, 1205 struct dentry *new_dentry) 1206 { 1207 int rc; 1208 struct smack_known *isp; 1209 struct smk_audit_info ad; 1210 1211 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1212 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1213 1214 isp = smk_of_inode(d_backing_inode(old_dentry)); 1215 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1216 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc); 1217 1218 if (rc == 0 && d_is_positive(new_dentry)) { 1219 isp = smk_of_inode(d_backing_inode(new_dentry)); 1220 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1221 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1222 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc); 1223 } 1224 return rc; 1225 } 1226 1227 /** 1228 * smack_inode_permission - Smack version of permission() 1229 * @inode: the inode in question 1230 * @mask: the access requested 1231 * 1232 * This is the important Smack hook. 1233 * 1234 * Returns 0 if access is permitted, an error code otherwise 1235 */ 1236 static int smack_inode_permission(struct inode *inode, int mask) 1237 { 1238 struct superblock_smack *sbsp = smack_superblock(inode->i_sb); 1239 struct smk_audit_info ad; 1240 int no_block = mask & MAY_NOT_BLOCK; 1241 int rc; 1242 1243 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 1244 /* 1245 * No permission to check. Existence test. Yup, it's there. 1246 */ 1247 if (mask == 0) 1248 return 0; 1249 1250 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) { 1251 if (smk_of_inode(inode) != sbsp->smk_root) 1252 return -EACCES; 1253 } 1254 1255 /* May be droppable after audit */ 1256 if (no_block) 1257 return -ECHILD; 1258 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1259 smk_ad_setfield_u_fs_inode(&ad, inode); 1260 rc = smk_curacc(smk_of_inode(inode), mask, &ad); 1261 rc = smk_bu_inode(inode, mask, rc); 1262 return rc; 1263 } 1264 1265 /** 1266 * smack_inode_setattr - Smack check for setting attributes 1267 * @idmap: idmap of the mount 1268 * @dentry: the object 1269 * @iattr: for the force flag 1270 * 1271 * Returns 0 if access is permitted, an error code otherwise 1272 */ 1273 static int smack_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry, 1274 struct iattr *iattr) 1275 { 1276 struct smk_audit_info ad; 1277 int rc; 1278 1279 /* 1280 * Need to allow for clearing the setuid bit. 1281 */ 1282 if (iattr->ia_valid & ATTR_FORCE) 1283 return 0; 1284 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1285 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1286 1287 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1288 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1289 return rc; 1290 } 1291 1292 /** 1293 * smack_inode_getattr - Smack check for getting attributes 1294 * @path: path to extract the info from 1295 * 1296 * Returns 0 if access is permitted, an error code otherwise 1297 */ 1298 static int smack_inode_getattr(const struct path *path) 1299 { 1300 struct smk_audit_info ad; 1301 struct inode *inode = d_backing_inode(path->dentry); 1302 int rc; 1303 1304 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1305 smk_ad_setfield_u_fs_path(&ad, *path); 1306 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1307 rc = smk_bu_inode(inode, MAY_READ, rc); 1308 return rc; 1309 } 1310 1311 /** 1312 * smack_inode_xattr_skipcap - Skip the xattr capability checks? 1313 * @name: name of the xattr 1314 * 1315 * Returns 1 to indicate that Smack "owns" the access control rights to xattrs 1316 * named @name; the LSM layer should avoid enforcing any traditional 1317 * capability based access controls on this xattr. Returns 0 to indicate that 1318 * Smack does not "own" the access control rights to xattrs named @name and is 1319 * deferring to the LSM layer for further access controls, including capability 1320 * based controls. 1321 */ 1322 static int smack_inode_xattr_skipcap(const char *name) 1323 { 1324 if (strncmp(name, XATTR_SMACK_SUFFIX, strlen(XATTR_SMACK_SUFFIX)) == 0) 1325 return 0; 1326 1327 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1328 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1329 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 1330 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1331 strcmp(name, XATTR_NAME_SMACKMMAP) == 0 || 1332 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 1333 return 1; 1334 1335 return 0; 1336 } 1337 1338 /** 1339 * smack_inode_setxattr - Smack check for setting xattrs 1340 * @idmap: idmap of the mount 1341 * @dentry: the object 1342 * @name: name of the attribute 1343 * @value: value of the attribute 1344 * @size: size of the value 1345 * @flags: unused 1346 * 1347 * This protects the Smack attribute explicitly. 1348 * 1349 * Returns 0 if access is permitted, an error code otherwise 1350 */ 1351 static int smack_inode_setxattr(struct mnt_idmap *idmap, 1352 struct dentry *dentry, const char *name, 1353 const void *value, size_t size, int flags) 1354 { 1355 struct smk_audit_info ad; 1356 struct smack_known *skp; 1357 int check_priv = 0; 1358 int check_import = 0; 1359 int check_star = 0; 1360 int rc = 0; 1361 umode_t const i_mode = d_backing_inode(dentry)->i_mode; 1362 1363 /* 1364 * Check label validity here so import won't fail in post_setxattr 1365 */ 1366 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1367 /* 1368 * UDS inode has fixed label 1369 */ 1370 if (S_ISSOCK(i_mode)) { 1371 rc = -EINVAL; 1372 } else { 1373 check_priv = 1; 1374 check_import = 1; 1375 } 1376 } else if (strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1377 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) { 1378 check_priv = 1; 1379 check_import = 1; 1380 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1381 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1382 check_priv = 1; 1383 check_import = 1; 1384 check_star = 1; 1385 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1386 check_priv = 1; 1387 if (!S_ISDIR(i_mode) || 1388 size != TRANS_TRUE_SIZE || 1389 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 1390 rc = -EINVAL; 1391 } 1392 1393 if (check_priv && !smack_privileged(CAP_MAC_ADMIN)) 1394 rc = -EPERM; 1395 1396 if (rc == 0 && check_import) { 1397 skp = size ? smk_import_entry(value, size) : NULL; 1398 if (IS_ERR(skp)) 1399 rc = PTR_ERR(skp); 1400 else if (skp == NULL || (check_star && 1401 (skp == &smack_known_star || skp == &smack_known_web))) 1402 rc = -EINVAL; 1403 } 1404 1405 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1406 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1407 1408 if (rc == 0) { 1409 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1410 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1411 } 1412 1413 return rc; 1414 } 1415 1416 /** 1417 * smack_inode_post_setxattr - Apply the Smack update approved above 1418 * @dentry: object 1419 * @name: attribute name 1420 * @value: attribute value 1421 * @size: attribute size 1422 * @flags: unused 1423 * 1424 * Set the pointer in the inode blob to the entry found 1425 * in the master label list. 1426 */ 1427 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, 1428 const void *value, size_t size, int flags) 1429 { 1430 struct smack_known *skp; 1431 struct inode_smack *isp = smack_inode(d_backing_inode(dentry)); 1432 1433 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1434 isp->smk_flags |= SMK_INODE_TRANSMUTE; 1435 return; 1436 } 1437 1438 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1439 skp = smk_import_entry(value, size); 1440 if (!IS_ERR(skp)) 1441 isp->smk_inode = skp; 1442 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 1443 skp = smk_import_entry(value, size); 1444 if (!IS_ERR(skp)) 1445 isp->smk_task = skp; 1446 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1447 skp = smk_import_entry(value, size); 1448 if (!IS_ERR(skp)) 1449 isp->smk_mmap = skp; 1450 } 1451 1452 return; 1453 } 1454 1455 /** 1456 * smack_inode_getxattr - Smack check on getxattr 1457 * @dentry: the object 1458 * @name: unused 1459 * 1460 * Returns 0 if access is permitted, an error code otherwise 1461 */ 1462 static int smack_inode_getxattr(struct dentry *dentry, const char *name) 1463 { 1464 struct smk_audit_info ad; 1465 int rc; 1466 1467 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1468 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1469 1470 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad); 1471 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc); 1472 return rc; 1473 } 1474 1475 /** 1476 * smack_inode_removexattr - Smack check on removexattr 1477 * @idmap: idmap of the mount 1478 * @dentry: the object 1479 * @name: name of the attribute 1480 * 1481 * Removing the Smack attribute requires CAP_MAC_ADMIN 1482 * 1483 * Returns 0 if access is permitted, an error code otherwise 1484 */ 1485 static int smack_inode_removexattr(struct mnt_idmap *idmap, 1486 struct dentry *dentry, const char *name) 1487 { 1488 struct inode_smack *isp; 1489 struct smk_audit_info ad; 1490 int rc = 0; 1491 1492 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1493 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1494 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 1495 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1496 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 || 1497 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1498 if (!smack_privileged(CAP_MAC_ADMIN)) 1499 rc = -EPERM; 1500 } 1501 1502 if (rc != 0) 1503 return rc; 1504 1505 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1506 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1507 1508 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1509 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1510 if (rc != 0) 1511 return rc; 1512 1513 isp = smack_inode(d_backing_inode(dentry)); 1514 /* 1515 * Don't do anything special for these. 1516 * XATTR_NAME_SMACKIPIN 1517 * XATTR_NAME_SMACKIPOUT 1518 * XATTR_NAME_SMACK if S_ISSOCK (UDS inode has fixed label) 1519 */ 1520 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1521 if (!S_ISSOCK(d_backing_inode(dentry)->i_mode)) { 1522 struct super_block *sbp = dentry->d_sb; 1523 struct superblock_smack *sbsp = smack_superblock(sbp); 1524 1525 isp->smk_inode = sbsp->smk_default; 1526 } 1527 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) 1528 isp->smk_task = NULL; 1529 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) 1530 isp->smk_mmap = NULL; 1531 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 1532 isp->smk_flags &= ~SMK_INODE_TRANSMUTE; 1533 1534 return 0; 1535 } 1536 1537 /** 1538 * smack_inode_set_acl - Smack check for setting posix acls 1539 * @idmap: idmap of the mnt this request came from 1540 * @dentry: the object 1541 * @acl_name: name of the posix acl 1542 * @kacl: the posix acls 1543 * 1544 * Returns 0 if access is permitted, an error code otherwise 1545 */ 1546 static int smack_inode_set_acl(struct mnt_idmap *idmap, 1547 struct dentry *dentry, const char *acl_name, 1548 struct posix_acl *kacl) 1549 { 1550 struct smk_audit_info ad; 1551 int rc; 1552 1553 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1554 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1555 1556 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1557 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1558 return rc; 1559 } 1560 1561 /** 1562 * smack_inode_get_acl - Smack check for getting posix acls 1563 * @idmap: idmap of the mnt this request came from 1564 * @dentry: the object 1565 * @acl_name: name of the posix acl 1566 * 1567 * Returns 0 if access is permitted, an error code otherwise 1568 */ 1569 static int smack_inode_get_acl(struct mnt_idmap *idmap, 1570 struct dentry *dentry, const char *acl_name) 1571 { 1572 struct smk_audit_info ad; 1573 int rc; 1574 1575 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1576 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1577 1578 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad); 1579 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc); 1580 return rc; 1581 } 1582 1583 /** 1584 * smack_inode_remove_acl - Smack check for getting posix acls 1585 * @idmap: idmap of the mnt this request came from 1586 * @dentry: the object 1587 * @acl_name: name of the posix acl 1588 * 1589 * Returns 0 if access is permitted, an error code otherwise 1590 */ 1591 static int smack_inode_remove_acl(struct mnt_idmap *idmap, 1592 struct dentry *dentry, const char *acl_name) 1593 { 1594 struct smk_audit_info ad; 1595 int rc; 1596 1597 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1598 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1599 1600 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1601 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1602 return rc; 1603 } 1604 1605 /** 1606 * smack_inode_getsecurity - get smack xattrs 1607 * @idmap: idmap of the mount 1608 * @inode: the object 1609 * @name: attribute name 1610 * @buffer: where to put the result 1611 * @alloc: duplicate memory 1612 * 1613 * Returns the size of the attribute or an error code 1614 */ 1615 static int smack_inode_getsecurity(struct mnt_idmap *idmap, 1616 struct inode *inode, const char *name, 1617 void **buffer, bool alloc) 1618 { 1619 struct socket_smack *ssp; 1620 struct socket *sock; 1621 struct super_block *sbp; 1622 struct inode *ip = inode; 1623 struct smack_known *isp; 1624 struct inode_smack *ispp; 1625 size_t label_len; 1626 char *label = NULL; 1627 1628 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 1629 isp = smk_of_inode(inode); 1630 } else if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { 1631 ispp = smack_inode(inode); 1632 if (ispp->smk_flags & SMK_INODE_TRANSMUTE) 1633 label = TRANS_TRUE; 1634 else 1635 label = ""; 1636 } else { 1637 /* 1638 * The rest of the Smack xattrs are only on sockets. 1639 */ 1640 sbp = ip->i_sb; 1641 if (sbp->s_magic != SOCKFS_MAGIC) 1642 return -EOPNOTSUPP; 1643 1644 sock = SOCKET_I(ip); 1645 if (sock == NULL || sock->sk == NULL) 1646 return -EOPNOTSUPP; 1647 1648 ssp = smack_sock(sock->sk); 1649 1650 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1651 isp = ssp->smk_in; 1652 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 1653 isp = ssp->smk_out; 1654 else 1655 return -EOPNOTSUPP; 1656 } 1657 1658 if (!label) 1659 label = isp->smk_known; 1660 1661 label_len = strlen(label); 1662 1663 if (alloc) { 1664 *buffer = kstrdup(label, GFP_KERNEL); 1665 if (*buffer == NULL) 1666 return -ENOMEM; 1667 } 1668 1669 return label_len; 1670 } 1671 1672 1673 /** 1674 * smack_inode_listsecurity - list the Smack attributes 1675 * @inode: the object 1676 * @buffer: where they go 1677 * @remaining_size: size of buffer 1678 */ 1679 static int smack_inode_listsecurity(struct inode *inode, char **buffer, 1680 ssize_t *remaining_size) 1681 { 1682 return xattr_list_one(buffer, remaining_size, XATTR_NAME_SMACK); 1683 } 1684 1685 /** 1686 * smack_inode_getlsmprop - Extract inode's security id 1687 * @inode: inode to extract the info from 1688 * @prop: where result will be saved 1689 */ 1690 static void smack_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop) 1691 { 1692 prop->smack.skp = smk_of_inode(inode); 1693 } 1694 1695 /* 1696 * File Hooks 1697 */ 1698 1699 /* 1700 * There is no smack_file_permission hook 1701 * 1702 * Should access checks be done on each read or write? 1703 * UNICOS and SELinux say yes. 1704 * Trusted Solaris, Trusted Irix, and just about everyone else says no. 1705 * 1706 * I'll say no for now. Smack does not do the frequent 1707 * label changing that SELinux does. 1708 */ 1709 1710 /** 1711 * smack_file_alloc_security - assign a file security blob 1712 * @file: the object 1713 * 1714 * The security blob for a file is a pointer to the master 1715 * label list, so no allocation is done. 1716 * 1717 * f_security is the owner security information. It 1718 * isn't used on file access checks, it's for send_sigio. 1719 * 1720 * Returns 0 1721 */ 1722 static int smack_file_alloc_security(struct file *file) 1723 { 1724 struct smack_known **blob = smack_file(file); 1725 1726 *blob = smk_of_current(); 1727 return 0; 1728 } 1729 1730 /** 1731 * smack_file_ioctl - Smack check on ioctls 1732 * @file: the object 1733 * @cmd: what to do 1734 * @arg: unused 1735 * 1736 * Relies heavily on the correct use of the ioctl command conventions. 1737 * 1738 * Returns 0 if allowed, error code otherwise 1739 */ 1740 static int smack_file_ioctl(struct file *file, unsigned int cmd, 1741 unsigned long arg) 1742 { 1743 int rc = 0; 1744 struct smk_audit_info ad; 1745 struct inode *inode = file_inode(file); 1746 1747 if (unlikely(IS_PRIVATE(inode))) 1748 return 0; 1749 1750 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1751 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1752 1753 if (_IOC_DIR(cmd) & _IOC_WRITE) { 1754 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1755 rc = smk_bu_file(file, MAY_WRITE, rc); 1756 } 1757 1758 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) { 1759 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1760 rc = smk_bu_file(file, MAY_READ, rc); 1761 } 1762 1763 return rc; 1764 } 1765 1766 /** 1767 * smack_file_lock - Smack check on file locking 1768 * @file: the object 1769 * @cmd: unused 1770 * 1771 * Returns 0 if current has lock access, error code otherwise 1772 */ 1773 static int smack_file_lock(struct file *file, unsigned int cmd) 1774 { 1775 struct smk_audit_info ad; 1776 int rc; 1777 struct inode *inode = file_inode(file); 1778 1779 if (unlikely(IS_PRIVATE(inode))) 1780 return 0; 1781 1782 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1783 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1784 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1785 rc = smk_bu_file(file, MAY_LOCK, rc); 1786 return rc; 1787 } 1788 1789 /** 1790 * smack_file_fcntl - Smack check on fcntl 1791 * @file: the object 1792 * @cmd: what action to check 1793 * @arg: unused 1794 * 1795 * Generally these operations are harmless. 1796 * File locking operations present an obvious mechanism 1797 * for passing information, so they require write access. 1798 * 1799 * Returns 0 if current has access, error code otherwise 1800 */ 1801 static int smack_file_fcntl(struct file *file, unsigned int cmd, 1802 unsigned long arg) 1803 { 1804 struct smk_audit_info ad; 1805 int rc = 0; 1806 struct inode *inode = file_inode(file); 1807 1808 if (unlikely(IS_PRIVATE(inode))) 1809 return 0; 1810 1811 switch (cmd) { 1812 case F_GETLK: 1813 break; 1814 case F_SETLK: 1815 case F_SETLKW: 1816 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1817 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1818 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1819 rc = smk_bu_file(file, MAY_LOCK, rc); 1820 break; 1821 case F_SETOWN: 1822 case F_SETSIG: 1823 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1824 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1825 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1826 rc = smk_bu_file(file, MAY_WRITE, rc); 1827 break; 1828 default: 1829 break; 1830 } 1831 1832 return rc; 1833 } 1834 1835 /** 1836 * smack_mmap_file - Check permissions for a mmap operation. 1837 * @file: contains the file structure for file to map (may be NULL). 1838 * @reqprot: contains the protection requested by the application. 1839 * @prot: contains the protection that will be applied by the kernel. 1840 * @flags: contains the operational flags. 1841 * 1842 * The @file may be NULL, e.g. if mapping anonymous memory. 1843 * 1844 * Return 0 if permission is granted. 1845 */ 1846 static int smack_mmap_file(struct file *file, 1847 unsigned long reqprot, unsigned long prot, 1848 unsigned long flags) 1849 { 1850 struct smack_known *skp; 1851 struct smack_known *mkp; 1852 struct smack_rule *srp; 1853 struct task_smack *tsp; 1854 struct smack_known *okp; 1855 struct inode_smack *isp; 1856 struct superblock_smack *sbsp; 1857 int may; 1858 int mmay; 1859 int tmay; 1860 int rc; 1861 1862 if (file == NULL) 1863 return 0; 1864 1865 if (unlikely(IS_PRIVATE(file_inode(file)))) 1866 return 0; 1867 1868 isp = smack_inode(file_inode(file)); 1869 if (isp->smk_mmap == NULL) 1870 return 0; 1871 sbsp = smack_superblock(file_inode(file)->i_sb); 1872 if (sbsp->smk_flags & SMK_SB_UNTRUSTED && 1873 isp->smk_mmap != sbsp->smk_root) 1874 return -EACCES; 1875 mkp = isp->smk_mmap; 1876 1877 tsp = smack_cred(current_cred()); 1878 skp = smk_of_current(); 1879 rc = 0; 1880 1881 rcu_read_lock(); 1882 /* 1883 * For each Smack rule associated with the subject 1884 * label verify that the SMACK64MMAP also has access 1885 * to that rule's object label. 1886 */ 1887 list_for_each_entry_rcu(srp, &skp->smk_rules, list) { 1888 okp = srp->smk_object; 1889 /* 1890 * Matching labels always allows access. 1891 */ 1892 if (mkp->smk_known == okp->smk_known) 1893 continue; 1894 /* 1895 * If there is a matching local rule take 1896 * that into account as well. 1897 */ 1898 may = smk_access_entry(srp->smk_subject->smk_known, 1899 okp->smk_known, 1900 &tsp->smk_rules); 1901 if (may == -ENOENT) 1902 may = srp->smk_access; 1903 else 1904 may &= srp->smk_access; 1905 /* 1906 * If may is zero the SMACK64MMAP subject can't 1907 * possibly have less access. 1908 */ 1909 if (may == 0) 1910 continue; 1911 1912 /* 1913 * Fetch the global list entry. 1914 * If there isn't one a SMACK64MMAP subject 1915 * can't have as much access as current. 1916 */ 1917 mmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1918 &mkp->smk_rules); 1919 if (mmay == -ENOENT) { 1920 rc = -EACCES; 1921 break; 1922 } 1923 /* 1924 * If there is a local entry it modifies the 1925 * potential access, too. 1926 */ 1927 tmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1928 &tsp->smk_rules); 1929 if (tmay != -ENOENT) 1930 mmay &= tmay; 1931 1932 /* 1933 * If there is any access available to current that is 1934 * not available to a SMACK64MMAP subject 1935 * deny access. 1936 */ 1937 if ((may | mmay) != mmay) { 1938 rc = -EACCES; 1939 break; 1940 } 1941 } 1942 1943 rcu_read_unlock(); 1944 1945 return rc; 1946 } 1947 1948 /** 1949 * smack_file_set_fowner - set the file security blob value 1950 * @file: object in question 1951 * 1952 */ 1953 static void smack_file_set_fowner(struct file *file) 1954 { 1955 struct smack_known **blob = smack_file(file); 1956 1957 *blob = smk_of_current(); 1958 } 1959 1960 /** 1961 * smack_file_send_sigiotask - Smack on sigio 1962 * @tsk: The target task 1963 * @fown: the object the signal come from 1964 * @signum: unused 1965 * 1966 * Allow a privileged task to get signals even if it shouldn't 1967 * 1968 * Returns 0 if a subject with the object's smack could 1969 * write to the task, an error code otherwise. 1970 */ 1971 static int smack_file_send_sigiotask(struct task_struct *tsk, 1972 struct fown_struct *fown, int signum) 1973 { 1974 struct smack_known **blob; 1975 struct smack_known *skp; 1976 struct smack_known *tkp = smk_of_task_struct_obj(tsk); 1977 const struct cred *tcred; 1978 struct file *file; 1979 int rc; 1980 struct smk_audit_info ad; 1981 1982 /* 1983 * struct fown_struct is never outside the context of a struct file 1984 */ 1985 file = fown->file; 1986 1987 /* we don't log here as rc can be overridden */ 1988 blob = smack_file(file); 1989 skp = *blob; 1990 rc = smk_access(skp, tkp, MAY_DELIVER, NULL); 1991 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc); 1992 1993 rcu_read_lock(); 1994 tcred = __task_cred(tsk); 1995 if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred)) 1996 rc = 0; 1997 rcu_read_unlock(); 1998 1999 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 2000 smk_ad_setfield_u_tsk(&ad, tsk); 2001 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad); 2002 return rc; 2003 } 2004 2005 /** 2006 * smack_file_receive - Smack file receive check 2007 * @file: the object 2008 * 2009 * Returns 0 if current has access, error code otherwise 2010 */ 2011 static int smack_file_receive(struct file *file) 2012 { 2013 int rc; 2014 int may = 0; 2015 struct smk_audit_info ad; 2016 struct inode *inode = file_inode(file); 2017 struct socket *sock; 2018 struct task_smack *tsp; 2019 struct socket_smack *ssp; 2020 2021 if (unlikely(IS_PRIVATE(inode))) 2022 return 0; 2023 2024 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 2025 smk_ad_setfield_u_fs_path(&ad, file->f_path); 2026 2027 if (inode->i_sb->s_magic == SOCKFS_MAGIC) { 2028 sock = SOCKET_I(inode); 2029 ssp = smack_sock(sock->sk); 2030 tsp = smack_cred(current_cred()); 2031 /* 2032 * If the receiving process can't write to the 2033 * passed socket or if the passed socket can't 2034 * write to the receiving process don't accept 2035 * the passed socket. 2036 */ 2037 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); 2038 rc = smk_bu_file(file, may, rc); 2039 if (rc < 0) 2040 return rc; 2041 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); 2042 rc = smk_bu_file(file, may, rc); 2043 return rc; 2044 } 2045 /* 2046 * This code relies on bitmasks. 2047 */ 2048 if (file->f_mode & FMODE_READ) 2049 may = MAY_READ; 2050 if (file->f_mode & FMODE_WRITE) 2051 may |= MAY_WRITE; 2052 2053 rc = smk_curacc(smk_of_inode(inode), may, &ad); 2054 rc = smk_bu_file(file, may, rc); 2055 return rc; 2056 } 2057 2058 /** 2059 * smack_file_open - Smack dentry open processing 2060 * @file: the object 2061 * 2062 * Set the security blob in the file structure. 2063 * Allow the open only if the task has read access. There are 2064 * many read operations (e.g. fstat) that you can do with an 2065 * fd even if you have the file open write-only. 2066 * 2067 * Returns 0 if current has access, error code otherwise 2068 */ 2069 static int smack_file_open(struct file *file) 2070 { 2071 struct task_smack *tsp = smack_cred(file->f_cred); 2072 struct inode *inode = file_inode(file); 2073 struct smk_audit_info ad; 2074 int rc; 2075 2076 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 2077 smk_ad_setfield_u_fs_path(&ad, file->f_path); 2078 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad); 2079 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc); 2080 2081 return rc; 2082 } 2083 2084 /* 2085 * Task hooks 2086 */ 2087 2088 /** 2089 * smack_cred_alloc_blank - "allocate" blank task-level security credentials 2090 * @cred: the new credentials 2091 * @gfp: the atomicity of any memory allocations 2092 * 2093 * Prepare a blank set of credentials for modification. This must allocate all 2094 * the memory the LSM module might require such that cred_transfer() can 2095 * complete without error. 2096 */ 2097 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp) 2098 { 2099 init_task_smack(smack_cred(cred), NULL, NULL); 2100 return 0; 2101 } 2102 2103 2104 /** 2105 * smack_cred_free - "free" task-level security credentials 2106 * @cred: the credentials in question 2107 * 2108 */ 2109 static void smack_cred_free(struct cred *cred) 2110 { 2111 struct task_smack *tsp = smack_cred(cred); 2112 struct smack_rule *rp; 2113 struct list_head *l; 2114 struct list_head *n; 2115 2116 smk_destroy_label_list(&tsp->smk_relabel); 2117 2118 list_for_each_safe(l, n, &tsp->smk_rules) { 2119 rp = list_entry(l, struct smack_rule, list); 2120 list_del(&rp->list); 2121 kmem_cache_free(smack_rule_cache, rp); 2122 } 2123 } 2124 2125 /** 2126 * smack_cred_prepare - prepare new set of credentials for modification 2127 * @new: the new credentials 2128 * @old: the original credentials 2129 * @gfp: the atomicity of any memory allocations 2130 * 2131 * Prepare a new set of credentials for modification. 2132 */ 2133 static int smack_cred_prepare(struct cred *new, const struct cred *old, 2134 gfp_t gfp) 2135 { 2136 struct task_smack *old_tsp = smack_cred(old); 2137 struct task_smack *new_tsp = smack_cred(new); 2138 int rc; 2139 2140 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task); 2141 2142 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp); 2143 if (rc != 0) 2144 return rc; 2145 2146 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel, 2147 gfp); 2148 return rc; 2149 } 2150 2151 /** 2152 * smack_cred_transfer - Transfer the old credentials to the new credentials 2153 * @new: the new credentials 2154 * @old: the original credentials 2155 * 2156 * Fill in a set of blank credentials from another set of credentials. 2157 */ 2158 static void smack_cred_transfer(struct cred *new, const struct cred *old) 2159 { 2160 struct task_smack *old_tsp = smack_cred(old); 2161 struct task_smack *new_tsp = smack_cred(new); 2162 2163 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task); 2164 } 2165 2166 /** 2167 * smack_cred_getsecid - get the secid corresponding to a creds structure 2168 * @cred: the object creds 2169 * @secid: where to put the result 2170 * 2171 * Sets the secid to contain a u32 version of the smack label. 2172 */ 2173 static void smack_cred_getsecid(const struct cred *cred, u32 *secid) 2174 { 2175 struct smack_known *skp; 2176 2177 rcu_read_lock(); 2178 skp = smk_of_task(smack_cred(cred)); 2179 *secid = skp->smk_secid; 2180 rcu_read_unlock(); 2181 } 2182 2183 /** 2184 * smack_cred_getlsmprop - get the Smack label for a creds structure 2185 * @cred: the object creds 2186 * @prop: where to put the data 2187 * 2188 * Sets the Smack part of the ref 2189 */ 2190 static void smack_cred_getlsmprop(const struct cred *cred, 2191 struct lsm_prop *prop) 2192 { 2193 rcu_read_lock(); 2194 prop->smack.skp = smk_of_task(smack_cred(cred)); 2195 rcu_read_unlock(); 2196 } 2197 2198 /** 2199 * smack_kernel_act_as - Set the subjective context in a set of credentials 2200 * @new: points to the set of credentials to be modified. 2201 * @secid: specifies the security ID to be set 2202 * 2203 * Set the security data for a kernel service. 2204 */ 2205 static int smack_kernel_act_as(struct cred *new, u32 secid) 2206 { 2207 struct task_smack *new_tsp = smack_cred(new); 2208 2209 new_tsp->smk_task = smack_from_secid(secid); 2210 return 0; 2211 } 2212 2213 /** 2214 * smack_kernel_create_files_as - Set the file creation label in a set of creds 2215 * @new: points to the set of credentials to be modified 2216 * @inode: points to the inode to use as a reference 2217 * 2218 * Set the file creation context in a set of credentials to the same 2219 * as the objective context of the specified inode 2220 */ 2221 static int smack_kernel_create_files_as(struct cred *new, 2222 struct inode *inode) 2223 { 2224 struct inode_smack *isp = smack_inode(inode); 2225 struct task_smack *tsp = smack_cred(new); 2226 2227 tsp->smk_forked = isp->smk_inode; 2228 tsp->smk_task = tsp->smk_forked; 2229 return 0; 2230 } 2231 2232 /** 2233 * smk_curacc_on_task - helper to log task related access 2234 * @p: the task object 2235 * @access: the access requested 2236 * @caller: name of the calling function for audit 2237 * 2238 * Return 0 if access is permitted 2239 */ 2240 static int smk_curacc_on_task(struct task_struct *p, int access, 2241 const char *caller) 2242 { 2243 struct smk_audit_info ad; 2244 struct smack_known *skp = smk_of_task_struct_obj(p); 2245 int rc; 2246 2247 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); 2248 smk_ad_setfield_u_tsk(&ad, p); 2249 rc = smk_curacc(skp, access, &ad); 2250 rc = smk_bu_task(p, access, rc); 2251 return rc; 2252 } 2253 2254 /** 2255 * smack_task_setpgid - Smack check on setting pgid 2256 * @p: the task object 2257 * @pgid: unused 2258 * 2259 * Return 0 if write access is permitted 2260 */ 2261 static int smack_task_setpgid(struct task_struct *p, pid_t pgid) 2262 { 2263 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2264 } 2265 2266 /** 2267 * smack_task_getpgid - Smack access check for getpgid 2268 * @p: the object task 2269 * 2270 * Returns 0 if current can read the object task, error code otherwise 2271 */ 2272 static int smack_task_getpgid(struct task_struct *p) 2273 { 2274 return smk_curacc_on_task(p, MAY_READ, __func__); 2275 } 2276 2277 /** 2278 * smack_task_getsid - Smack access check for getsid 2279 * @p: the object task 2280 * 2281 * Returns 0 if current can read the object task, error code otherwise 2282 */ 2283 static int smack_task_getsid(struct task_struct *p) 2284 { 2285 return smk_curacc_on_task(p, MAY_READ, __func__); 2286 } 2287 2288 /** 2289 * smack_current_getlsmprop_subj - get the subjective secid of the current task 2290 * @prop: where to put the result 2291 * 2292 * Sets the secid to contain a u32 version of the task's subjective smack label. 2293 */ 2294 static void smack_current_getlsmprop_subj(struct lsm_prop *prop) 2295 { 2296 prop->smack.skp = smk_of_current(); 2297 } 2298 2299 /** 2300 * smack_task_getlsmprop_obj - get the objective data of the task 2301 * @p: the task 2302 * @prop: where to put the result 2303 * 2304 * Sets the secid to contain a u32 version of the task's objective smack label. 2305 */ 2306 static void smack_task_getlsmprop_obj(struct task_struct *p, 2307 struct lsm_prop *prop) 2308 { 2309 prop->smack.skp = smk_of_task_struct_obj(p); 2310 } 2311 2312 /** 2313 * smack_task_setnice - Smack check on setting nice 2314 * @p: the task object 2315 * @nice: unused 2316 * 2317 * Return 0 if write access is permitted 2318 */ 2319 static int smack_task_setnice(struct task_struct *p, int nice) 2320 { 2321 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2322 } 2323 2324 /** 2325 * smack_task_setioprio - Smack check on setting ioprio 2326 * @p: the task object 2327 * @ioprio: unused 2328 * 2329 * Return 0 if write access is permitted 2330 */ 2331 static int smack_task_setioprio(struct task_struct *p, int ioprio) 2332 { 2333 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2334 } 2335 2336 /** 2337 * smack_task_getioprio - Smack check on reading ioprio 2338 * @p: the task object 2339 * 2340 * Return 0 if read access is permitted 2341 */ 2342 static int smack_task_getioprio(struct task_struct *p) 2343 { 2344 return smk_curacc_on_task(p, MAY_READ, __func__); 2345 } 2346 2347 /** 2348 * smack_task_setscheduler - Smack check on setting scheduler 2349 * @p: the task object 2350 * 2351 * Return 0 if read access is permitted 2352 */ 2353 static int smack_task_setscheduler(struct task_struct *p) 2354 { 2355 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2356 } 2357 2358 /** 2359 * smack_task_getscheduler - Smack check on reading scheduler 2360 * @p: the task object 2361 * 2362 * Return 0 if read access is permitted 2363 */ 2364 static int smack_task_getscheduler(struct task_struct *p) 2365 { 2366 return smk_curacc_on_task(p, MAY_READ, __func__); 2367 } 2368 2369 /** 2370 * smack_task_movememory - Smack check on moving memory 2371 * @p: the task object 2372 * 2373 * Return 0 if write access is permitted 2374 */ 2375 static int smack_task_movememory(struct task_struct *p) 2376 { 2377 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2378 } 2379 2380 /** 2381 * smack_task_kill - Smack check on signal delivery 2382 * @p: the task object 2383 * @info: unused 2384 * @sig: unused 2385 * @cred: identifies the cred to use in lieu of current's 2386 * 2387 * Return 0 if write access is permitted 2388 * 2389 */ 2390 static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info, 2391 int sig, const struct cred *cred) 2392 { 2393 struct smk_audit_info ad; 2394 struct smack_known *skp; 2395 struct smack_known *tkp = smk_of_task_struct_obj(p); 2396 int rc; 2397 2398 if (!sig) 2399 return 0; /* null signal; existence test */ 2400 2401 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 2402 smk_ad_setfield_u_tsk(&ad, p); 2403 /* 2404 * Sending a signal requires that the sender 2405 * can write the receiver. 2406 */ 2407 if (cred == NULL) { 2408 rc = smk_curacc(tkp, MAY_DELIVER, &ad); 2409 rc = smk_bu_task(p, MAY_DELIVER, rc); 2410 return rc; 2411 } 2412 /* 2413 * If the cred isn't NULL we're dealing with some USB IO 2414 * specific behavior. This is not clean. For one thing 2415 * we can't take privilege into account. 2416 */ 2417 skp = smk_of_task(smack_cred(cred)); 2418 rc = smk_access(skp, tkp, MAY_DELIVER, &ad); 2419 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc); 2420 return rc; 2421 } 2422 2423 /** 2424 * smack_task_to_inode - copy task smack into the inode blob 2425 * @p: task to copy from 2426 * @inode: inode to copy to 2427 * 2428 * Sets the smack pointer in the inode security blob 2429 */ 2430 static void smack_task_to_inode(struct task_struct *p, struct inode *inode) 2431 { 2432 struct inode_smack *isp = smack_inode(inode); 2433 struct smack_known *skp = smk_of_task_struct_obj(p); 2434 2435 isp->smk_inode = skp; 2436 isp->smk_flags |= SMK_INODE_INSTANT; 2437 } 2438 2439 /* 2440 * Socket hooks. 2441 */ 2442 2443 /** 2444 * smack_sk_alloc_security - Allocate a socket blob 2445 * @sk: the socket 2446 * @family: unused 2447 * @gfp_flags: memory allocation flags 2448 * 2449 * Assign Smack pointers to current 2450 * 2451 * Returns 0 on success, -ENOMEM is there's no memory 2452 */ 2453 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) 2454 { 2455 struct smack_known *skp = smk_of_current(); 2456 struct socket_smack *ssp = smack_sock(sk); 2457 2458 /* 2459 * Sockets created by kernel threads receive web label. 2460 */ 2461 if (unlikely(current->flags & PF_KTHREAD)) { 2462 ssp->smk_in = &smack_known_web; 2463 ssp->smk_out = &smack_known_web; 2464 } else { 2465 ssp->smk_in = skp; 2466 ssp->smk_out = skp; 2467 } 2468 ssp->smk_packet = NULL; 2469 2470 return 0; 2471 } 2472 2473 #ifdef SMACK_IPV6_PORT_LABELING 2474 /** 2475 * smack_sk_free_security - Free a socket blob 2476 * @sk: the socket 2477 * 2478 * Clears the blob pointer 2479 */ 2480 static void smack_sk_free_security(struct sock *sk) 2481 { 2482 struct smk_port_label *spp; 2483 2484 if (sk->sk_family == PF_INET6) { 2485 rcu_read_lock(); 2486 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2487 if (spp->smk_sock != sk) 2488 continue; 2489 spp->smk_can_reuse = 1; 2490 break; 2491 } 2492 rcu_read_unlock(); 2493 } 2494 } 2495 #endif 2496 2497 /** 2498 * smack_sk_clone_security - Copy security context 2499 * @sk: the old socket 2500 * @newsk: the new socket 2501 * 2502 * Copy the security context of the old socket pointer to the cloned 2503 */ 2504 static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk) 2505 { 2506 struct socket_smack *ssp_old = smack_sock(sk); 2507 struct socket_smack *ssp_new = smack_sock(newsk); 2508 2509 *ssp_new = *ssp_old; 2510 } 2511 2512 /** 2513 * smack_ipv4host_label - check host based restrictions 2514 * @sip: the object end 2515 * 2516 * looks for host based access restrictions 2517 * 2518 * This version will only be appropriate for really small sets of single label 2519 * hosts. The caller is responsible for ensuring that the RCU read lock is 2520 * taken before calling this function. 2521 * 2522 * Returns the label of the far end or NULL if it's not special. 2523 */ 2524 static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip) 2525 { 2526 struct smk_net4addr *snp; 2527 struct in_addr *siap = &sip->sin_addr; 2528 2529 if (siap->s_addr == 0) 2530 return NULL; 2531 2532 list_for_each_entry_rcu(snp, &smk_net4addr_list, list) 2533 /* 2534 * we break after finding the first match because 2535 * the list is sorted from longest to shortest mask 2536 * so we have found the most specific match 2537 */ 2538 if (snp->smk_host.s_addr == 2539 (siap->s_addr & snp->smk_mask.s_addr)) 2540 return snp->smk_label; 2541 2542 return NULL; 2543 } 2544 2545 #if IS_ENABLED(CONFIG_IPV6) 2546 /* 2547 * smk_ipv6_localhost - Check for local ipv6 host address 2548 * @sip: the address 2549 * 2550 * Returns boolean true if this is the localhost address 2551 */ 2552 static bool smk_ipv6_localhost(struct sockaddr_in6 *sip) 2553 { 2554 __be16 *be16p = (__be16 *)&sip->sin6_addr; 2555 __be32 *be32p = (__be32 *)&sip->sin6_addr; 2556 2557 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 && 2558 ntohs(be16p[7]) == 1) 2559 return true; 2560 return false; 2561 } 2562 2563 /** 2564 * smack_ipv6host_label - check host based restrictions 2565 * @sip: the object end 2566 * 2567 * looks for host based access restrictions 2568 * 2569 * This version will only be appropriate for really small sets of single label 2570 * hosts. The caller is responsible for ensuring that the RCU read lock is 2571 * taken before calling this function. 2572 * 2573 * Returns the label of the far end or NULL if it's not special. 2574 */ 2575 static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) 2576 { 2577 struct smk_net6addr *snp; 2578 struct in6_addr *sap = &sip->sin6_addr; 2579 int i; 2580 int found = 0; 2581 2582 /* 2583 * It's local. Don't look for a host label. 2584 */ 2585 if (smk_ipv6_localhost(sip)) 2586 return NULL; 2587 2588 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) { 2589 /* 2590 * If the label is NULL the entry has 2591 * been renounced. Ignore it. 2592 */ 2593 if (snp->smk_label == NULL) 2594 continue; 2595 /* 2596 * we break after finding the first match because 2597 * the list is sorted from longest to shortest mask 2598 * so we have found the most specific match 2599 */ 2600 for (found = 1, i = 0; i < 8; i++) { 2601 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) != 2602 snp->smk_host.s6_addr16[i]) { 2603 found = 0; 2604 break; 2605 } 2606 } 2607 if (found) 2608 return snp->smk_label; 2609 } 2610 2611 return NULL; 2612 } 2613 #endif /* CONFIG_IPV6 */ 2614 2615 /** 2616 * smack_netlbl_add - Set the secattr on a socket 2617 * @sk: the socket 2618 * 2619 * Attach the outbound smack value (smk_out) to the socket. 2620 * 2621 * Returns 0 on success or an error code 2622 */ 2623 static int smack_netlbl_add(struct sock *sk) 2624 { 2625 struct socket_smack *ssp = smack_sock(sk); 2626 struct smack_known *skp = ssp->smk_out; 2627 int rc; 2628 2629 local_bh_disable(); 2630 bh_lock_sock_nested(sk); 2631 2632 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel, 2633 netlbl_sk_lock_check(sk)); 2634 switch (rc) { 2635 case 0: 2636 ssp->smk_state = SMK_NETLBL_LABELED; 2637 break; 2638 case -EDESTADDRREQ: 2639 ssp->smk_state = SMK_NETLBL_REQSKB; 2640 rc = 0; 2641 break; 2642 } 2643 2644 bh_unlock_sock(sk); 2645 local_bh_enable(); 2646 2647 return rc; 2648 } 2649 2650 /** 2651 * smack_netlbl_delete - Remove the secattr from a socket 2652 * @sk: the socket 2653 * 2654 * Remove the outbound smack value from a socket 2655 */ 2656 static void smack_netlbl_delete(struct sock *sk) 2657 { 2658 struct socket_smack *ssp = smack_sock(sk); 2659 2660 /* 2661 * Take the label off the socket if one is set. 2662 */ 2663 if (ssp->smk_state != SMK_NETLBL_LABELED) 2664 return; 2665 2666 local_bh_disable(); 2667 bh_lock_sock_nested(sk); 2668 netlbl_sock_delattr(sk); 2669 bh_unlock_sock(sk); 2670 local_bh_enable(); 2671 ssp->smk_state = SMK_NETLBL_UNLABELED; 2672 } 2673 2674 /** 2675 * smk_ipv4_check - Perform IPv4 host access checks 2676 * @sk: the socket 2677 * @sap: the destination address 2678 * 2679 * Set the correct secattr for the given socket based on the destination 2680 * address and perform any outbound access checks needed. 2681 * 2682 * Returns 0 on success or an error code. 2683 * 2684 */ 2685 static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap) 2686 { 2687 struct smack_known *skp; 2688 int rc = 0; 2689 struct smack_known *hkp; 2690 struct socket_smack *ssp = smack_sock(sk); 2691 struct smk_audit_info ad; 2692 2693 rcu_read_lock(); 2694 hkp = smack_ipv4host_label(sap); 2695 if (hkp != NULL) { 2696 #ifdef CONFIG_AUDIT 2697 struct lsm_network_audit net; 2698 2699 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2700 ad.a.u.net->family = sap->sin_family; 2701 ad.a.u.net->dport = sap->sin_port; 2702 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr; 2703 #endif 2704 skp = ssp->smk_out; 2705 rc = smk_access(skp, hkp, MAY_WRITE, &ad); 2706 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc); 2707 /* 2708 * Clear the socket netlabel if it's set. 2709 */ 2710 if (!rc) 2711 smack_netlbl_delete(sk); 2712 } 2713 rcu_read_unlock(); 2714 2715 return rc; 2716 } 2717 2718 #if IS_ENABLED(CONFIG_IPV6) 2719 /** 2720 * smk_ipv6_check - check Smack access 2721 * @subject: subject Smack label 2722 * @object: object Smack label 2723 * @address: address 2724 * @act: the action being taken 2725 * 2726 * Check an IPv6 access 2727 */ 2728 static int smk_ipv6_check(struct smack_known *subject, 2729 struct smack_known *object, 2730 struct sockaddr_in6 *address, int act) 2731 { 2732 #ifdef CONFIG_AUDIT 2733 struct lsm_network_audit net; 2734 #endif 2735 struct smk_audit_info ad; 2736 int rc; 2737 2738 #ifdef CONFIG_AUDIT 2739 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2740 ad.a.u.net->family = PF_INET6; 2741 ad.a.u.net->dport = address->sin6_port; 2742 if (act == SMK_RECEIVING) 2743 ad.a.u.net->v6info.saddr = address->sin6_addr; 2744 else 2745 ad.a.u.net->v6info.daddr = address->sin6_addr; 2746 #endif 2747 rc = smk_access(subject, object, MAY_WRITE, &ad); 2748 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc); 2749 return rc; 2750 } 2751 #endif /* CONFIG_IPV6 */ 2752 2753 #ifdef SMACK_IPV6_PORT_LABELING 2754 /** 2755 * smk_ipv6_port_label - Smack port access table management 2756 * @sock: socket 2757 * @address: address 2758 * 2759 * Create or update the port list entry 2760 */ 2761 static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) 2762 { 2763 struct sock *sk = sock->sk; 2764 struct sockaddr_in6 *addr6; 2765 struct socket_smack *ssp = smack_sock(sock->sk); 2766 struct smk_port_label *spp; 2767 unsigned short port = 0; 2768 2769 if (address == NULL) { 2770 /* 2771 * This operation is changing the Smack information 2772 * on the bound socket. Take the changes to the port 2773 * as well. 2774 */ 2775 rcu_read_lock(); 2776 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2777 if (sk != spp->smk_sock) 2778 continue; 2779 spp->smk_in = ssp->smk_in; 2780 spp->smk_out = ssp->smk_out; 2781 rcu_read_unlock(); 2782 return; 2783 } 2784 /* 2785 * A NULL address is only used for updating existing 2786 * bound entries. If there isn't one, it's OK. 2787 */ 2788 rcu_read_unlock(); 2789 return; 2790 } 2791 2792 addr6 = (struct sockaddr_in6 *)address; 2793 port = ntohs(addr6->sin6_port); 2794 /* 2795 * This is a special case that is safely ignored. 2796 */ 2797 if (port == 0) 2798 return; 2799 2800 /* 2801 * Look for an existing port list entry. 2802 * This is an indication that a port is getting reused. 2803 */ 2804 rcu_read_lock(); 2805 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2806 if (spp->smk_port != port || spp->smk_sock_type != sock->type) 2807 continue; 2808 if (spp->smk_can_reuse != 1) { 2809 rcu_read_unlock(); 2810 return; 2811 } 2812 spp->smk_port = port; 2813 spp->smk_sock = sk; 2814 spp->smk_in = ssp->smk_in; 2815 spp->smk_out = ssp->smk_out; 2816 spp->smk_can_reuse = 0; 2817 rcu_read_unlock(); 2818 return; 2819 } 2820 rcu_read_unlock(); 2821 /* 2822 * A new port entry is required. 2823 */ 2824 spp = kzalloc_obj(*spp); 2825 if (spp == NULL) 2826 return; 2827 2828 spp->smk_port = port; 2829 spp->smk_sock = sk; 2830 spp->smk_in = ssp->smk_in; 2831 spp->smk_out = ssp->smk_out; 2832 spp->smk_sock_type = sock->type; 2833 spp->smk_can_reuse = 0; 2834 2835 mutex_lock(&smack_ipv6_lock); 2836 list_add_rcu(&spp->list, &smk_ipv6_port_list); 2837 mutex_unlock(&smack_ipv6_lock); 2838 return; 2839 } 2840 2841 /** 2842 * smk_ipv6_port_check - check Smack port access 2843 * @sk: socket 2844 * @address: address 2845 * @act: the action being taken 2846 * 2847 * Create or update the port list entry 2848 */ 2849 static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, 2850 int act) 2851 { 2852 struct smk_port_label *spp; 2853 struct socket_smack *ssp = smack_sock(sk); 2854 struct smack_known *skp = NULL; 2855 unsigned short port; 2856 struct smack_known *object; 2857 2858 if (act == SMK_RECEIVING) { 2859 skp = smack_ipv6host_label(address); 2860 object = ssp->smk_in; 2861 } else { 2862 skp = ssp->smk_out; 2863 object = smack_ipv6host_label(address); 2864 } 2865 2866 /* 2867 * The other end is a single label host. 2868 */ 2869 if (skp != NULL && object != NULL) 2870 return smk_ipv6_check(skp, object, address, act); 2871 if (skp == NULL) 2872 skp = smack_net_ambient; 2873 if (object == NULL) 2874 object = smack_net_ambient; 2875 2876 /* 2877 * It's remote, so port lookup does no good. 2878 */ 2879 if (!smk_ipv6_localhost(address)) 2880 return smk_ipv6_check(skp, object, address, act); 2881 2882 /* 2883 * It's local so the send check has to have passed. 2884 */ 2885 if (act == SMK_RECEIVING) 2886 return 0; 2887 2888 port = ntohs(address->sin6_port); 2889 rcu_read_lock(); 2890 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2891 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type) 2892 continue; 2893 object = spp->smk_in; 2894 if (act == SMK_CONNECTING) 2895 ssp->smk_packet = spp->smk_out; 2896 break; 2897 } 2898 rcu_read_unlock(); 2899 2900 return smk_ipv6_check(skp, object, address, act); 2901 } 2902 #endif 2903 2904 /** 2905 * smack_inode_setsecurity - set smack xattrs 2906 * @inode: the object 2907 * @name: attribute name 2908 * @value: attribute value 2909 * @size: size of the attribute 2910 * @flags: unused 2911 * 2912 * Sets the named attribute in the appropriate blob 2913 * 2914 * Returns 0 on success, or an error code 2915 */ 2916 static int smack_inode_setsecurity(struct inode *inode, const char *name, 2917 const void *value, size_t size, int flags) 2918 { 2919 struct smack_known *skp; 2920 struct inode_smack *nsp = smack_inode(inode); 2921 struct socket_smack *ssp; 2922 struct socket *sock; 2923 int rc = 0; 2924 2925 if (value == NULL || size > SMK_LONGLABEL || size == 0) 2926 return -EINVAL; 2927 2928 if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { 2929 if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE || 2930 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 2931 return -EINVAL; 2932 2933 nsp->smk_flags |= SMK_INODE_TRANSMUTE; 2934 return 0; 2935 } 2936 2937 skp = smk_import_entry(value, size); 2938 if (IS_ERR(skp)) 2939 return PTR_ERR(skp); 2940 2941 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 2942 nsp->smk_inode = skp; 2943 nsp->smk_flags |= SMK_INODE_INSTANT; 2944 return 0; 2945 } 2946 /* 2947 * The rest of the Smack xattrs are only on sockets. 2948 */ 2949 if (inode->i_sb->s_magic != SOCKFS_MAGIC) 2950 return -EOPNOTSUPP; 2951 2952 sock = SOCKET_I(inode); 2953 if (sock == NULL || sock->sk == NULL) 2954 return -EOPNOTSUPP; 2955 2956 ssp = smack_sock(sock->sk); 2957 2958 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 2959 ssp->smk_in = skp; 2960 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) { 2961 ssp->smk_out = skp; 2962 if (sock->sk->sk_family == PF_INET) { 2963 rc = smack_netlbl_add(sock->sk); 2964 if (rc != 0) 2965 printk(KERN_WARNING 2966 "Smack: \"%s\" netlbl error %d.\n", 2967 __func__, -rc); 2968 } 2969 } else 2970 return -EOPNOTSUPP; 2971 2972 #ifdef SMACK_IPV6_PORT_LABELING 2973 if (sock->sk->sk_family == PF_INET6) 2974 smk_ipv6_port_label(sock, NULL); 2975 #endif 2976 2977 return 0; 2978 } 2979 2980 /** 2981 * smack_socket_post_create - finish socket setup 2982 * @sock: the socket 2983 * @family: protocol family 2984 * @type: unused 2985 * @protocol: unused 2986 * @kern: unused 2987 * 2988 * Sets the netlabel information on the socket 2989 * 2990 * Returns 0 on success, and error code otherwise 2991 */ 2992 static int smack_socket_post_create(struct socket *sock, int family, 2993 int type, int protocol, int kern) 2994 { 2995 struct socket_smack *ssp; 2996 2997 if (sock->sk == NULL) 2998 return 0; 2999 3000 /* 3001 * Sockets created by kernel threads receive web label. 3002 */ 3003 if (unlikely(current->flags & PF_KTHREAD)) { 3004 ssp = smack_sock(sock->sk); 3005 ssp->smk_in = &smack_known_web; 3006 ssp->smk_out = &smack_known_web; 3007 } 3008 3009 if (family != PF_INET) 3010 return 0; 3011 /* 3012 * Set the outbound netlbl. 3013 */ 3014 return smack_netlbl_add(sock->sk); 3015 } 3016 3017 /** 3018 * smack_socket_socketpair - create socket pair 3019 * @socka: one socket 3020 * @sockb: another socket 3021 * 3022 * Cross reference the peer labels for SO_PEERSEC 3023 * 3024 * Returns 0 3025 */ 3026 static int smack_socket_socketpair(struct socket *socka, 3027 struct socket *sockb) 3028 { 3029 struct socket_smack *asp = smack_sock(socka->sk); 3030 struct socket_smack *bsp = smack_sock(sockb->sk); 3031 3032 asp->smk_packet = bsp->smk_out; 3033 bsp->smk_packet = asp->smk_out; 3034 3035 return 0; 3036 } 3037 3038 #ifdef SMACK_IPV6_PORT_LABELING 3039 /** 3040 * smack_socket_bind - record port binding information. 3041 * @sock: the socket 3042 * @address: the port address 3043 * @addrlen: size of the address 3044 * 3045 * Records the label bound to a port. 3046 * 3047 * Returns 0 on success, and error code otherwise 3048 */ 3049 static int smack_socket_bind(struct socket *sock, struct sockaddr *address, 3050 int addrlen) 3051 { 3052 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) { 3053 if (addrlen < SIN6_LEN_RFC2133 || 3054 address->sa_family != AF_INET6) 3055 return -EINVAL; 3056 smk_ipv6_port_label(sock, address); 3057 } 3058 return 0; 3059 } 3060 #endif /* SMACK_IPV6_PORT_LABELING */ 3061 3062 /** 3063 * smack_socket_connect - connect access check 3064 * @sock: the socket 3065 * @sap: the other end 3066 * @addrlen: size of sap 3067 * 3068 * Verifies that a connection may be possible 3069 * 3070 * Returns 0 on success, and error code otherwise 3071 */ 3072 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 3073 int addrlen) 3074 { 3075 int rc = 0; 3076 3077 if (sock->sk == NULL) 3078 return 0; 3079 if (sock->sk->sk_family != PF_INET && 3080 (!IS_ENABLED(CONFIG_IPV6) || sock->sk->sk_family != PF_INET6)) 3081 return 0; 3082 if (addrlen < offsetofend(struct sockaddr, sa_family)) 3083 return 0; 3084 3085 #if IS_ENABLED(CONFIG_IPV6) 3086 if (sap->sa_family == AF_INET6) { 3087 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; 3088 struct smack_known *rsp = NULL; 3089 3090 if (addrlen < SIN6_LEN_RFC2133) 3091 return 0; 3092 if (__is_defined(SMACK_IPV6_SECMARK_LABELING)) 3093 rsp = smack_ipv6host_label(sip); 3094 if (rsp != NULL) { 3095 struct socket_smack *ssp = smack_sock(sock->sk); 3096 3097 rc = smk_ipv6_check(ssp->smk_out, rsp, sip, 3098 SMK_CONNECTING); 3099 } 3100 #ifdef SMACK_IPV6_PORT_LABELING 3101 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING); 3102 #endif 3103 3104 return rc; 3105 } 3106 #endif /* CONFIG_IPV6 */ 3107 3108 if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in)) 3109 return 0; 3110 rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap); 3111 return rc; 3112 } 3113 3114 /** 3115 * smack_flags_to_may - convert S_ to MAY_ values 3116 * @flags: the S_ value 3117 * 3118 * Returns the equivalent MAY_ value 3119 */ 3120 static int smack_flags_to_may(int flags) 3121 { 3122 int may = 0; 3123 3124 if (flags & S_IRUGO) 3125 may |= MAY_READ; 3126 if (flags & S_IWUGO) 3127 may |= MAY_WRITE; 3128 if (flags & S_IXUGO) 3129 may |= MAY_EXEC; 3130 3131 return may; 3132 } 3133 3134 /** 3135 * smack_msg_msg_alloc_security - Set the security blob for msg_msg 3136 * @msg: the object 3137 * 3138 * Returns 0 3139 */ 3140 static int smack_msg_msg_alloc_security(struct msg_msg *msg) 3141 { 3142 struct smack_known **blob = smack_msg_msg(msg); 3143 3144 *blob = smk_of_current(); 3145 return 0; 3146 } 3147 3148 /** 3149 * smack_of_ipc - the smack pointer for the ipc 3150 * @isp: the object 3151 * 3152 * Returns a pointer to the smack value 3153 */ 3154 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) 3155 { 3156 struct smack_known **blob = smack_ipc(isp); 3157 3158 return *blob; 3159 } 3160 3161 /** 3162 * smack_ipc_alloc_security - Set the security blob for ipc 3163 * @isp: the object 3164 * 3165 * Returns 0 3166 */ 3167 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp) 3168 { 3169 struct smack_known **blob = smack_ipc(isp); 3170 3171 *blob = smk_of_current(); 3172 return 0; 3173 } 3174 3175 /** 3176 * smk_curacc_shm : check if current has access on shm 3177 * @isp : the object 3178 * @access : access requested 3179 * 3180 * Returns 0 if current has the requested access, error code otherwise 3181 */ 3182 static int smk_curacc_shm(struct kern_ipc_perm *isp, int access) 3183 { 3184 struct smack_known *ssp = smack_of_ipc(isp); 3185 struct smk_audit_info ad; 3186 int rc; 3187 3188 #ifdef CONFIG_AUDIT 3189 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3190 ad.a.u.ipc_id = isp->id; 3191 #endif 3192 rc = smk_curacc(ssp, access, &ad); 3193 rc = smk_bu_current("shm", ssp, access, rc); 3194 return rc; 3195 } 3196 3197 /** 3198 * smack_shm_associate - Smack access check for shm 3199 * @isp: the object 3200 * @shmflg: access requested 3201 * 3202 * Returns 0 if current has the requested access, error code otherwise 3203 */ 3204 static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg) 3205 { 3206 int may; 3207 3208 may = smack_flags_to_may(shmflg); 3209 return smk_curacc_shm(isp, may); 3210 } 3211 3212 /** 3213 * smack_shm_shmctl - Smack access check for shm 3214 * @isp: the object 3215 * @cmd: what it wants to do 3216 * 3217 * Returns 0 if current has the requested access, error code otherwise 3218 */ 3219 static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd) 3220 { 3221 int may; 3222 3223 switch (cmd) { 3224 case IPC_STAT: 3225 case SHM_STAT: 3226 case SHM_STAT_ANY: 3227 may = MAY_READ; 3228 break; 3229 case IPC_SET: 3230 case SHM_LOCK: 3231 case SHM_UNLOCK: 3232 case IPC_RMID: 3233 may = MAY_READWRITE; 3234 break; 3235 case IPC_INFO: 3236 case SHM_INFO: 3237 /* 3238 * System level information. 3239 */ 3240 return 0; 3241 default: 3242 return -EINVAL; 3243 } 3244 return smk_curacc_shm(isp, may); 3245 } 3246 3247 /** 3248 * smack_shm_shmat - Smack access for shmat 3249 * @isp: the object 3250 * @shmaddr: unused 3251 * @shmflg: access requested 3252 * 3253 * Returns 0 if current has the requested access, error code otherwise 3254 */ 3255 static int smack_shm_shmat(struct kern_ipc_perm *isp, char __user *shmaddr, 3256 int shmflg) 3257 { 3258 int may; 3259 3260 may = smack_flags_to_may(shmflg); 3261 return smk_curacc_shm(isp, may); 3262 } 3263 3264 /** 3265 * smk_curacc_sem : check if current has access on sem 3266 * @isp : the object 3267 * @access : access requested 3268 * 3269 * Returns 0 if current has the requested access, error code otherwise 3270 */ 3271 static int smk_curacc_sem(struct kern_ipc_perm *isp, int access) 3272 { 3273 struct smack_known *ssp = smack_of_ipc(isp); 3274 struct smk_audit_info ad; 3275 int rc; 3276 3277 #ifdef CONFIG_AUDIT 3278 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3279 ad.a.u.ipc_id = isp->id; 3280 #endif 3281 rc = smk_curacc(ssp, access, &ad); 3282 rc = smk_bu_current("sem", ssp, access, rc); 3283 return rc; 3284 } 3285 3286 /** 3287 * smack_sem_associate - Smack access check for sem 3288 * @isp: the object 3289 * @semflg: access requested 3290 * 3291 * Returns 0 if current has the requested access, error code otherwise 3292 */ 3293 static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg) 3294 { 3295 int may; 3296 3297 may = smack_flags_to_may(semflg); 3298 return smk_curacc_sem(isp, may); 3299 } 3300 3301 /** 3302 * smack_sem_semctl - Smack access check for sem 3303 * @isp: the object 3304 * @cmd: what it wants to do 3305 * 3306 * Returns 0 if current has the requested access, error code otherwise 3307 */ 3308 static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd) 3309 { 3310 int may; 3311 3312 switch (cmd) { 3313 case GETPID: 3314 case GETNCNT: 3315 case GETZCNT: 3316 case GETVAL: 3317 case GETALL: 3318 case IPC_STAT: 3319 case SEM_STAT: 3320 case SEM_STAT_ANY: 3321 may = MAY_READ; 3322 break; 3323 case SETVAL: 3324 case SETALL: 3325 case IPC_RMID: 3326 case IPC_SET: 3327 may = MAY_READWRITE; 3328 break; 3329 case IPC_INFO: 3330 case SEM_INFO: 3331 /* 3332 * System level information 3333 */ 3334 return 0; 3335 default: 3336 return -EINVAL; 3337 } 3338 3339 return smk_curacc_sem(isp, may); 3340 } 3341 3342 /** 3343 * smack_sem_semop - Smack checks of semaphore operations 3344 * @isp: the object 3345 * @sops: unused 3346 * @nsops: unused 3347 * @alter: unused 3348 * 3349 * Treated as read and write in all cases. 3350 * 3351 * Returns 0 if access is allowed, error code otherwise 3352 */ 3353 static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops, 3354 unsigned nsops, int alter) 3355 { 3356 return smk_curacc_sem(isp, MAY_READWRITE); 3357 } 3358 3359 /** 3360 * smk_tskacc_msq : helper to check if tsk has access on msq 3361 * @tsk: the task that requests access 3362 * @isp : the sysv msg queue permissions 3363 * @access : access requested 3364 * 3365 * return 0 if tsk has access, error otherwise 3366 */ 3367 static int 3368 smk_tskacc_msq(struct task_struct *tsk, struct kern_ipc_perm *isp, int access) 3369 { 3370 const bool tsk_is_current = (tsk == current); 3371 const struct cred * const tsk_cred = 3372 (tsk_is_current ? current_cred() : get_task_cred(tsk)); 3373 struct task_smack * const tsp = smack_cred(tsk_cred); 3374 struct smack_known *msp = smack_of_ipc(isp); 3375 struct smk_audit_info ad; 3376 int rc; 3377 3378 #ifdef CONFIG_AUDIT 3379 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3380 ad.a.u.ipc_id = isp->id; 3381 if (!tsk_is_current) 3382 ad.sad.subj_tsk = tsk; 3383 #endif 3384 rc = smk_tskacc(tsp, msp, access, &ad); 3385 rc = smk_bu_tsk_to_obj(tsk, tsp, "msq", msp, access, rc); 3386 if (!tsk_is_current) 3387 put_cred(tsk_cred); 3388 return rc; 3389 } 3390 3391 /** 3392 * smk_curacc_msq : helper to check if current has access on msq 3393 * @isp : the sysv msg queue permissions 3394 * @access : access requested 3395 * 3396 * return 0 if current has access, error otherwise 3397 */ 3398 static int smk_curacc_msq(struct kern_ipc_perm *isp, int access) 3399 { 3400 return smk_tskacc_msq(current, isp, access); 3401 } 3402 3403 /** 3404 * smack_msg_queue_associate - Smack access check for msg_queue 3405 * @isp: the object 3406 * @msqflg: access requested 3407 * 3408 * Returns 0 if current has the requested access, error code otherwise 3409 */ 3410 static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg) 3411 { 3412 int may; 3413 3414 may = smack_flags_to_may(msqflg); 3415 return smk_curacc_msq(isp, may); 3416 } 3417 3418 /** 3419 * smack_msg_queue_msgctl - Smack access check for msg_queue 3420 * @isp: the object 3421 * @cmd: what it wants to do 3422 * 3423 * Returns 0 if current has the requested access, error code otherwise 3424 */ 3425 static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd) 3426 { 3427 int may; 3428 3429 switch (cmd) { 3430 case IPC_STAT: 3431 case MSG_STAT: 3432 case MSG_STAT_ANY: 3433 may = MAY_READ; 3434 break; 3435 case IPC_SET: 3436 case IPC_RMID: 3437 may = MAY_READWRITE; 3438 break; 3439 case IPC_INFO: 3440 case MSG_INFO: 3441 /* 3442 * System level information 3443 */ 3444 return 0; 3445 default: 3446 return -EINVAL; 3447 } 3448 3449 return smk_curacc_msq(isp, may); 3450 } 3451 3452 /** 3453 * smack_msg_queue_msgsnd - Smack access check for msg_queue 3454 * @isp: the object 3455 * @msg: unused 3456 * @msqflg: access requested 3457 * 3458 * Returns 0 if current has the requested access, error code otherwise 3459 */ 3460 static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg, 3461 int msqflg) 3462 { 3463 int may; 3464 3465 may = smack_flags_to_may(msqflg); 3466 return smk_curacc_msq(isp, may); 3467 } 3468 3469 /** 3470 * smack_msg_queue_msgrcv - check it target has r/w access to msg_queue 3471 * @isp: the object 3472 * @msg: unused 3473 * @target: the task that msgrcv() from the queue 3474 * @type: unused 3475 * @mode: unused 3476 * 3477 * Returns 0 if target has read and write access, error code otherwise 3478 */ 3479 static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, 3480 struct msg_msg *msg, 3481 struct task_struct *target, long type, 3482 int mode) 3483 { 3484 return smk_tskacc_msq(target, isp, MAY_READWRITE); 3485 } 3486 3487 /** 3488 * smack_ipc_permission - Smack access for ipc_permission() 3489 * @ipp: the object permissions 3490 * @flag: access requested 3491 * 3492 * Returns 0 if current has read and write access, error code otherwise 3493 */ 3494 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 3495 { 3496 struct smack_known **blob = smack_ipc(ipp); 3497 struct smack_known *iskp = *blob; 3498 int may = smack_flags_to_may(flag); 3499 struct smk_audit_info ad; 3500 int rc; 3501 3502 #ifdef CONFIG_AUDIT 3503 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3504 ad.a.u.ipc_id = ipp->id; 3505 #endif 3506 rc = smk_curacc(iskp, may, &ad); 3507 rc = smk_bu_current("svipc", iskp, may, rc); 3508 return rc; 3509 } 3510 3511 /** 3512 * smack_ipc_getlsmprop - Extract smack security data 3513 * @ipp: the object permissions 3514 * @prop: where result will be saved 3515 */ 3516 static void smack_ipc_getlsmprop(struct kern_ipc_perm *ipp, struct lsm_prop *prop) 3517 { 3518 struct smack_known **iskpp = smack_ipc(ipp); 3519 3520 prop->smack.skp = *iskpp; 3521 } 3522 3523 /** 3524 * smack_d_instantiate - Make sure the blob is correct on an inode 3525 * @opt_dentry: dentry where inode will be attached 3526 * @inode: the object 3527 * 3528 * Set the inode's security blob if it hasn't been done already. 3529 */ 3530 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) 3531 { 3532 struct super_block *sbp; 3533 struct superblock_smack *sbsp; 3534 struct inode_smack *isp; 3535 struct smack_known *skp; 3536 struct smack_known *ckp = smk_of_current(); 3537 struct smack_known *final; 3538 char trattr[TRANS_TRUE_SIZE]; 3539 int transflag = 0; 3540 int rc; 3541 struct dentry *dp; 3542 3543 if (inode == NULL) 3544 return; 3545 3546 isp = smack_inode(inode); 3547 3548 /* 3549 * If the inode is already instantiated 3550 * take the quick way out 3551 */ 3552 if (isp->smk_flags & SMK_INODE_INSTANT) 3553 return; 3554 3555 sbp = inode->i_sb; 3556 sbsp = smack_superblock(sbp); 3557 /* 3558 * We're going to use the superblock default label 3559 * if there's no label on the file. 3560 */ 3561 final = sbsp->smk_default; 3562 3563 /* 3564 * If this is the root inode the superblock 3565 * may be in the process of initialization. 3566 * If that is the case use the root value out 3567 * of the superblock. 3568 */ 3569 if (opt_dentry->d_parent == opt_dentry) { 3570 switch (sbp->s_magic) { 3571 case CGROUP_SUPER_MAGIC: 3572 case CGROUP2_SUPER_MAGIC: 3573 /* 3574 * The cgroup filesystem is never mounted, 3575 * so there's no opportunity to set the mount 3576 * options. 3577 */ 3578 sbsp->smk_root = &smack_known_star; 3579 sbsp->smk_default = &smack_known_star; 3580 isp->smk_inode = sbsp->smk_root; 3581 break; 3582 case TMPFS_MAGIC: 3583 /* 3584 * What about shmem/tmpfs anonymous files with dentry 3585 * obtained from d_alloc_pseudo()? 3586 */ 3587 isp->smk_inode = smk_of_current(); 3588 break; 3589 case PIPEFS_MAGIC: 3590 isp->smk_inode = smk_of_current(); 3591 break; 3592 case SOCKFS_MAGIC: 3593 /* 3594 * Socket access is controlled by the socket 3595 * structures associated with the task involved. 3596 */ 3597 isp->smk_inode = &smack_known_star; 3598 break; 3599 default: 3600 isp->smk_inode = sbsp->smk_root; 3601 break; 3602 } 3603 isp->smk_flags |= SMK_INODE_INSTANT; 3604 return; 3605 } 3606 3607 /* 3608 * This is pretty hackish. 3609 * Casey says that we shouldn't have to do 3610 * file system specific code, but it does help 3611 * with keeping it simple. 3612 */ 3613 switch (sbp->s_magic) { 3614 case SMACK_MAGIC: 3615 case CGROUP_SUPER_MAGIC: 3616 case CGROUP2_SUPER_MAGIC: 3617 /* 3618 * Casey says that it's a little embarrassing 3619 * that the smack file system doesn't do 3620 * extended attributes. 3621 * 3622 * Cgroupfs is special 3623 */ 3624 final = &smack_known_star; 3625 break; 3626 case DEVPTS_SUPER_MAGIC: 3627 /* 3628 * devpts seems content with the label of the task. 3629 * Programs that change smack have to treat the 3630 * pty with respect. 3631 */ 3632 final = ckp; 3633 break; 3634 case PROC_SUPER_MAGIC: 3635 /* 3636 * Casey says procfs appears not to care. 3637 * The superblock default suffices. 3638 */ 3639 break; 3640 case TMPFS_MAGIC: 3641 /* 3642 * Device labels should come from the filesystem, 3643 * but watch out, because they're volitile, 3644 * getting recreated on every reboot. 3645 */ 3646 final = &smack_known_star; 3647 /* 3648 * If a smack value has been set we want to use it, 3649 * but since tmpfs isn't giving us the opportunity 3650 * to set mount options simulate setting the 3651 * superblock default. 3652 */ 3653 fallthrough; 3654 default: 3655 /* 3656 * This isn't an understood special case. 3657 * Get the value from the xattr. 3658 */ 3659 3660 /* 3661 * UDS inode has fixed label (*) 3662 */ 3663 if (S_ISSOCK(inode->i_mode)) { 3664 final = &smack_known_star; 3665 break; 3666 } 3667 /* 3668 * No xattr support means, alas, no SMACK label. 3669 * Use the aforeapplied default. 3670 * It would be curious if the label of the task 3671 * does not match that assigned. 3672 */ 3673 if (!(inode->i_opflags & IOP_XATTR)) 3674 break; 3675 /* 3676 * Get the dentry for xattr. 3677 */ 3678 dp = dget(opt_dentry); 3679 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp); 3680 if (!IS_ERR_OR_NULL(skp)) 3681 final = skp; 3682 3683 /* 3684 * Transmuting directory 3685 */ 3686 if (S_ISDIR(inode->i_mode)) { 3687 /* 3688 * If this is a new directory and the label was 3689 * transmuted when the inode was initialized 3690 * set the transmute attribute on the directory 3691 * and mark the inode. 3692 * 3693 * If there is a transmute attribute on the 3694 * directory mark the inode. 3695 */ 3696 rc = __vfs_getxattr(dp, inode, 3697 XATTR_NAME_SMACKTRANSMUTE, trattr, 3698 TRANS_TRUE_SIZE); 3699 if (rc >= 0 && strncmp(trattr, TRANS_TRUE, 3700 TRANS_TRUE_SIZE) != 0) 3701 rc = -EINVAL; 3702 if (rc >= 0) 3703 transflag = SMK_INODE_TRANSMUTE; 3704 } 3705 /* 3706 * Don't let the exec or mmap label be "*" or "@". 3707 */ 3708 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); 3709 if (IS_ERR(skp) || skp == &smack_known_star || 3710 skp == &smack_known_web) 3711 skp = NULL; 3712 isp->smk_task = skp; 3713 3714 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); 3715 if (IS_ERR(skp) || skp == &smack_known_star || 3716 skp == &smack_known_web) 3717 skp = NULL; 3718 isp->smk_mmap = skp; 3719 3720 dput(dp); 3721 break; 3722 } 3723 3724 if (final == NULL) 3725 isp->smk_inode = ckp; 3726 else 3727 isp->smk_inode = final; 3728 3729 isp->smk_flags |= (SMK_INODE_INSTANT | transflag); 3730 3731 return; 3732 } 3733 3734 /** 3735 * smack_getselfattr - Smack current process attribute 3736 * @attr: which attribute to fetch 3737 * @ctx: buffer to receive the result 3738 * @size: available size in, actual size out 3739 * @flags: reserved, currently zero 3740 * 3741 * Fill the passed user space @ctx with the details of the requested 3742 * attribute. 3743 * 3744 * Returns the number of attributes on success, an error code otherwise. 3745 * There will only ever be one attribute. 3746 */ 3747 static int smack_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx, 3748 u32 *size, u32 flags) 3749 { 3750 int rc; 3751 struct smack_known *skp; 3752 3753 if (attr != LSM_ATTR_CURRENT) 3754 return -EOPNOTSUPP; 3755 3756 skp = smk_of_current(); 3757 rc = lsm_fill_user_ctx(ctx, size, 3758 skp->smk_known, strlen(skp->smk_known) + 1, 3759 LSM_ID_SMACK, 0); 3760 return (!rc ? 1 : rc); 3761 } 3762 3763 /** 3764 * smack_getprocattr - Smack process attribute access 3765 * @p: the object task 3766 * @name: the name of the attribute in /proc/.../attr 3767 * @value: where to put the result 3768 * 3769 * Places a copy of the task Smack into value 3770 * 3771 * Returns the length of the smack label or an error code 3772 */ 3773 static int smack_getprocattr(struct task_struct *p, const char *name, char **value) 3774 { 3775 struct smack_known *skp = smk_of_task_struct_obj(p); 3776 char *cp; 3777 int slen; 3778 3779 if (strcmp(name, "current") != 0) 3780 return -EINVAL; 3781 3782 cp = kstrdup(skp->smk_known, GFP_KERNEL); 3783 if (cp == NULL) 3784 return -ENOMEM; 3785 3786 slen = strlen(cp); 3787 *value = cp; 3788 return slen; 3789 } 3790 3791 /** 3792 * do_setattr - Smack process attribute setting 3793 * @attr: the ID of the attribute 3794 * @value: the value to set 3795 * @size: the size of the value 3796 * 3797 * Sets the Smack value of the task. Only setting self 3798 * is permitted and only with privilege 3799 * 3800 * Returns zero on success or an error code 3801 */ 3802 static int do_setattr(unsigned int attr, void *value, size_t size) 3803 { 3804 struct task_smack *tsp = smack_cred(current_cred()); 3805 struct cred *new; 3806 struct smack_known *skp; 3807 int label_len; 3808 3809 /* 3810 * let unprivileged user validate input, check permissions later 3811 */ 3812 if (value == NULL || size == 0 || size >= SMK_LONGLABEL) 3813 return -EINVAL; 3814 3815 label_len = smk_parse_label_len(value, size); 3816 if (label_len < 0 || label_len != size) 3817 return -EINVAL; 3818 3819 /* 3820 * No process is ever allowed the web ("@") label 3821 * and the star ("*") label. 3822 */ 3823 if (label_len == 1 /* '@', '*' */) { 3824 const char c = *(const char *)value; 3825 3826 if (c == *smack_known_web.smk_known || 3827 c == *smack_known_star.smk_known) 3828 return -EPERM; 3829 } 3830 3831 if (!smack_privileged(CAP_MAC_ADMIN)) { 3832 const struct smack_known_list_elem *sklep; 3833 list_for_each_entry(sklep, &tsp->smk_relabel, list) { 3834 const char *cp = sklep->smk_label->smk_known; 3835 3836 if (strlen(cp) == label_len && 3837 strncmp(cp, value, label_len) == 0) 3838 goto in_relabel; 3839 } 3840 return -EPERM; 3841 in_relabel: 3842 ; 3843 } 3844 3845 skp = smk_import_valid_label(value, label_len, GFP_KERNEL); 3846 if (IS_ERR(skp)) 3847 return PTR_ERR(skp); 3848 3849 new = prepare_creds(); 3850 if (new == NULL) 3851 return -ENOMEM; 3852 3853 tsp = smack_cred(new); 3854 tsp->smk_task = skp; 3855 /* 3856 * process can change its label only once 3857 */ 3858 smk_destroy_label_list(&tsp->smk_relabel); 3859 3860 commit_creds(new); 3861 return 0; 3862 } 3863 3864 /** 3865 * smack_setselfattr - Set a Smack process attribute 3866 * @attr: which attribute to set 3867 * @ctx: buffer containing the data 3868 * @size: size of @ctx 3869 * @flags: reserved, must be zero 3870 * 3871 * Fill the passed user space @ctx with the details of the requested 3872 * attribute. 3873 * 3874 * Returns 0 on success, an error code otherwise. 3875 */ 3876 static int smack_setselfattr(unsigned int attr, struct lsm_ctx *ctx, 3877 u32 size, u32 flags) 3878 { 3879 if (attr != LSM_ATTR_CURRENT) 3880 return -EOPNOTSUPP; 3881 3882 if (ctx->flags) 3883 return -EINVAL; 3884 /* 3885 * string must have \0 terminator, included in ctx->ctx 3886 * (see description of struct lsm_ctx) 3887 */ 3888 if (ctx->ctx_len == 0) 3889 return -EINVAL; 3890 3891 if (ctx->ctx[ctx->ctx_len - 1] != '\0') 3892 return -EINVAL; 3893 /* 3894 * other do_setattr() caller, smack_setprocattr(), 3895 * does not count \0 into size, so 3896 * decreasing length by 1 to accommodate the divergence. 3897 */ 3898 return do_setattr(attr, ctx->ctx, ctx->ctx_len - 1); 3899 } 3900 3901 /** 3902 * smack_setprocattr - Smack process attribute setting 3903 * @name: the name of the attribute in /proc/.../attr 3904 * @value: the value to set 3905 * @size: the size of the value 3906 * 3907 * Sets the Smack value of the task. Only setting self 3908 * is permitted and only with privilege 3909 * 3910 * Returns the size of the input value or an error code 3911 */ 3912 static int smack_setprocattr(const char *name, void *value, size_t size) 3913 { 3914 size_t realsize = size; 3915 unsigned int attr = lsm_name_to_attr(name); 3916 3917 switch (attr) { 3918 case LSM_ATTR_UNDEF: return -EINVAL; 3919 default: return -EOPNOTSUPP; 3920 case LSM_ATTR_CURRENT: 3921 ; 3922 } 3923 3924 /* 3925 * The value for the "current" attribute is the label 3926 * followed by one of the 4 trailers: none, \0, \n, \n\0 3927 * 3928 * I.e. following inputs are accepted as 3-characters long label "foo": 3929 * 3930 * "foo" (3 characters) 3931 * "foo\0" (4 characters) 3932 * "foo\n" (4 characters) 3933 * "foo\n\0" (5 characters) 3934 */ 3935 3936 if (realsize && (((const char *)value)[realsize - 1] == '\0')) 3937 --realsize; 3938 3939 if (realsize && (((const char *)value)[realsize - 1] == '\n')) 3940 --realsize; 3941 3942 return do_setattr(attr, value, realsize) ? : size; 3943 } 3944 3945 /** 3946 * smack_unix_stream_connect - Smack access on UDS 3947 * @sock: one sock 3948 * @other: the other sock 3949 * @newsk: unused 3950 * 3951 * Return 0 if a subject with the smack of sock could access 3952 * an object with the smack of other, otherwise an error code 3953 */ 3954 static int smack_unix_stream_connect(struct sock *sock, 3955 struct sock *other, struct sock *newsk) 3956 { 3957 struct smack_known *skp; 3958 struct smack_known *okp; 3959 struct socket_smack *ssp = smack_sock(sock); 3960 struct socket_smack *osp = smack_sock(other); 3961 struct socket_smack *nsp = smack_sock(newsk); 3962 struct smk_audit_info ad; 3963 int rc = 0; 3964 #ifdef CONFIG_AUDIT 3965 struct lsm_network_audit net; 3966 #endif 3967 3968 if (!smack_privileged(CAP_MAC_OVERRIDE)) { 3969 skp = ssp->smk_out; 3970 okp = osp->smk_in; 3971 #ifdef CONFIG_AUDIT 3972 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3973 smk_ad_setfield_u_net_sk(&ad, other); 3974 #endif 3975 rc = smk_access(skp, okp, MAY_WRITE, &ad); 3976 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc); 3977 if (rc == 0) { 3978 okp = osp->smk_out; 3979 skp = ssp->smk_in; 3980 rc = smk_access(okp, skp, MAY_WRITE, &ad); 3981 rc = smk_bu_note("UDS connect", okp, skp, 3982 MAY_WRITE, rc); 3983 } 3984 } 3985 3986 if (rc == 0) { 3987 /* 3988 * Cross reference the peer labels for SO_PEERSEC. 3989 */ 3990 nsp->smk_packet = ssp->smk_out; 3991 ssp->smk_packet = osp->smk_out; 3992 3993 /* 3994 * new/child/established socket must inherit listening socket labels 3995 */ 3996 nsp->smk_out = osp->smk_out; 3997 nsp->smk_in = osp->smk_in; 3998 } 3999 4000 return rc; 4001 } 4002 4003 /** 4004 * smack_unix_may_send - Smack access on UDS 4005 * @sock: one socket 4006 * @other: the other socket 4007 * 4008 * Return 0 if a subject with the smack of sock could access 4009 * an object with the smack of other, otherwise an error code 4010 */ 4011 static int smack_unix_may_send(struct socket *sock, struct socket *other) 4012 { 4013 struct socket_smack *ssp = smack_sock(sock->sk); 4014 struct socket_smack *osp = smack_sock(other->sk); 4015 struct smk_audit_info ad; 4016 int rc; 4017 4018 #ifdef CONFIG_AUDIT 4019 struct lsm_network_audit net; 4020 4021 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4022 smk_ad_setfield_u_net_sk(&ad, other->sk); 4023 #endif 4024 4025 if (smack_privileged(CAP_MAC_OVERRIDE)) 4026 return 0; 4027 4028 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad); 4029 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc); 4030 return rc; 4031 } 4032 4033 /** 4034 * smack_socket_sendmsg - Smack check based on destination host 4035 * @sock: the socket 4036 * @msg: the message 4037 * @size: the size of the message 4038 * 4039 * Return 0 if the current subject can write to the destination host. 4040 * For IPv4 this is only a question if the destination is a single label host. 4041 * For IPv6 this is a check against the label of the port. 4042 */ 4043 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, 4044 int size) 4045 { 4046 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name; 4047 #if IS_ENABLED(CONFIG_IPV6) 4048 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name; 4049 #endif 4050 #ifdef SMACK_IPV6_SECMARK_LABELING 4051 struct socket_smack *ssp = smack_sock(sock->sk); 4052 struct smack_known *rsp; 4053 #endif 4054 int rc = 0; 4055 4056 /* 4057 * Perfectly reasonable for this to be NULL 4058 */ 4059 if (sip == NULL) 4060 return 0; 4061 4062 switch (sock->sk->sk_family) { 4063 case AF_INET: 4064 if (msg->msg_namelen < sizeof(struct sockaddr_in) || 4065 sip->sin_family != AF_INET) 4066 return -EINVAL; 4067 rc = smk_ipv4_check(sock->sk, sip); 4068 break; 4069 #if IS_ENABLED(CONFIG_IPV6) 4070 case AF_INET6: 4071 if (msg->msg_namelen < SIN6_LEN_RFC2133 || 4072 sap->sin6_family != AF_INET6) 4073 return -EINVAL; 4074 #ifdef SMACK_IPV6_SECMARK_LABELING 4075 rsp = smack_ipv6host_label(sap); 4076 if (rsp != NULL) 4077 rc = smk_ipv6_check(ssp->smk_out, rsp, sap, 4078 SMK_CONNECTING); 4079 #endif 4080 #ifdef SMACK_IPV6_PORT_LABELING 4081 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING); 4082 #endif 4083 #endif /* IS_ENABLED(CONFIG_IPV6) */ 4084 break; 4085 } 4086 return rc; 4087 } 4088 4089 /** 4090 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack 4091 * @sap: netlabel secattr 4092 * @ssp: socket security information 4093 * 4094 * Returns a pointer to a Smack label entry found on the label list. 4095 */ 4096 static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap, 4097 struct socket_smack *ssp) 4098 { 4099 struct smack_known *skp; 4100 int found = 0; 4101 int acat; 4102 int kcat; 4103 4104 /* 4105 * Netlabel found it in the cache. 4106 */ 4107 if ((sap->flags & NETLBL_SECATTR_CACHE) != 0) 4108 return (struct smack_known *)sap->cache->data; 4109 4110 if ((sap->flags & NETLBL_SECATTR_SECID) != 0) 4111 /* 4112 * Looks like a fallback, which gives us a secid. 4113 */ 4114 return smack_from_secid(sap->attr.secid); 4115 4116 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) { 4117 /* 4118 * Looks like a CIPSO packet. 4119 * If there are flags but no level netlabel isn't 4120 * behaving the way we expect it to. 4121 * 4122 * Look it up in the label table 4123 * Without guidance regarding the smack value 4124 * for the packet fall back on the network 4125 * ambient value. 4126 */ 4127 rcu_read_lock(); 4128 list_for_each_entry_rcu(skp, &smack_known_list, list) { 4129 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl) 4130 continue; 4131 /* 4132 * Compare the catsets. Use the netlbl APIs. 4133 */ 4134 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) { 4135 if ((skp->smk_netlabel.flags & 4136 NETLBL_SECATTR_MLS_CAT) == 0) 4137 found = 1; 4138 break; 4139 } 4140 for (acat = -1, kcat = -1; acat == kcat; ) { 4141 acat = netlbl_catmap_walk(sap->attr.mls.cat, 4142 acat + 1); 4143 kcat = netlbl_catmap_walk( 4144 skp->smk_netlabel.attr.mls.cat, 4145 kcat + 1); 4146 if (acat < 0 || kcat < 0) 4147 break; 4148 } 4149 if (acat == kcat) { 4150 found = 1; 4151 break; 4152 } 4153 } 4154 rcu_read_unlock(); 4155 4156 if (found) 4157 return skp; 4158 4159 if (ssp != NULL && ssp->smk_in == &smack_known_star) 4160 return &smack_known_web; 4161 return &smack_known_star; 4162 } 4163 /* 4164 * Without guidance regarding the smack value 4165 * for the packet fall back on the network 4166 * ambient value. 4167 */ 4168 return smack_net_ambient; 4169 } 4170 4171 #if IS_ENABLED(CONFIG_IPV6) 4172 static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) 4173 { 4174 u8 nexthdr; 4175 int offset; 4176 int proto = -EINVAL; 4177 struct ipv6hdr _ipv6h; 4178 struct ipv6hdr *ip6; 4179 __be16 frag_off; 4180 struct tcphdr _tcph, *th; 4181 struct udphdr _udph, *uh; 4182 4183 sip->sin6_port = 0; 4184 4185 offset = skb_network_offset(skb); 4186 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 4187 if (ip6 == NULL) 4188 return -EINVAL; 4189 sip->sin6_addr = ip6->saddr; 4190 4191 nexthdr = ip6->nexthdr; 4192 offset += sizeof(_ipv6h); 4193 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 4194 if (offset < 0) 4195 return -EINVAL; 4196 4197 proto = nexthdr; 4198 switch (proto) { 4199 case IPPROTO_TCP: 4200 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4201 if (th != NULL) 4202 sip->sin6_port = th->source; 4203 break; 4204 case IPPROTO_UDP: 4205 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4206 if (uh != NULL) 4207 sip->sin6_port = uh->source; 4208 break; 4209 } 4210 return proto; 4211 } 4212 #endif /* CONFIG_IPV6 */ 4213 4214 /** 4215 * smack_from_skb - Smack data from the secmark in an skb 4216 * @skb: packet 4217 * 4218 * Returns smack_known of the secmark or NULL if that won't work. 4219 */ 4220 #ifdef CONFIG_NETWORK_SECMARK 4221 static struct smack_known *smack_from_skb(struct sk_buff *skb) 4222 { 4223 if (skb == NULL || skb->secmark == 0) 4224 return NULL; 4225 4226 return smack_from_secid(skb->secmark); 4227 } 4228 #else 4229 static inline struct smack_known *smack_from_skb(struct sk_buff *skb) 4230 { 4231 return NULL; 4232 } 4233 #endif 4234 4235 /** 4236 * smack_from_netlbl - Smack data from the IP options in an skb 4237 * @sk: socket data came in on 4238 * @family: address family 4239 * @skb: packet 4240 * 4241 * Find the Smack label in the IP options. If it hasn't been 4242 * added to the netlabel cache, add it here. 4243 * 4244 * Returns smack_known of the IP options or NULL if that won't work. 4245 */ 4246 static struct smack_known *smack_from_netlbl(const struct sock *sk, u16 family, 4247 struct sk_buff *skb) 4248 { 4249 struct netlbl_lsm_secattr secattr; 4250 struct socket_smack *ssp = NULL; 4251 struct smack_known *skp = NULL; 4252 4253 netlbl_secattr_init(&secattr); 4254 4255 if (sk) 4256 ssp = smack_sock(sk); 4257 4258 if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) { 4259 skp = smack_from_secattr(&secattr, ssp); 4260 if (secattr.flags & NETLBL_SECATTR_CACHEABLE) 4261 netlbl_cache_add(skb, family, &skp->smk_netlabel); 4262 } 4263 4264 netlbl_secattr_destroy(&secattr); 4265 4266 return skp; 4267 } 4268 4269 /** 4270 * smack_socket_sock_rcv_skb - Smack packet delivery access check 4271 * @sk: socket 4272 * @skb: packet 4273 * 4274 * Returns 0 if the packet should be delivered, an error code otherwise 4275 */ 4276 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 4277 { 4278 struct socket_smack *ssp = smack_sock(sk); 4279 struct smack_known *skp = NULL; 4280 int rc = 0; 4281 struct smk_audit_info ad; 4282 u16 family = sk->sk_family; 4283 #ifdef CONFIG_AUDIT 4284 struct lsm_network_audit net; 4285 #endif 4286 #if IS_ENABLED(CONFIG_IPV6) 4287 struct sockaddr_in6 sadd; 4288 int proto; 4289 4290 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4291 family = PF_INET; 4292 #endif /* CONFIG_IPV6 */ 4293 4294 switch (family) { 4295 case PF_INET: 4296 /* 4297 * If there is a secmark use it rather than the CIPSO label. 4298 * If there is no secmark fall back to CIPSO. 4299 * The secmark is assumed to reflect policy better. 4300 */ 4301 skp = smack_from_skb(skb); 4302 if (skp == NULL) { 4303 skp = smack_from_netlbl(sk, family, skb); 4304 if (skp == NULL) 4305 skp = smack_net_ambient; 4306 } 4307 4308 #ifdef CONFIG_AUDIT 4309 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4310 ad.a.u.net->family = family; 4311 ad.a.u.net->netif = skb->skb_iif; 4312 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 4313 #endif 4314 /* 4315 * Receiving a packet requires that the other end 4316 * be able to write here. Read access is not required. 4317 * This is the simplest possible security model 4318 * for networking. 4319 */ 4320 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4321 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, 4322 MAY_WRITE, rc); 4323 if (rc != 0) 4324 netlbl_skbuff_err(skb, family, rc, 0); 4325 break; 4326 #if IS_ENABLED(CONFIG_IPV6) 4327 case PF_INET6: 4328 proto = smk_skb_to_addr_ipv6(skb, &sadd); 4329 if (proto != IPPROTO_UDP && proto != IPPROTO_TCP) 4330 break; 4331 #ifdef SMACK_IPV6_SECMARK_LABELING 4332 skp = smack_from_skb(skb); 4333 if (skp == NULL) { 4334 if (smk_ipv6_localhost(&sadd)) 4335 break; 4336 skp = smack_ipv6host_label(&sadd); 4337 if (skp == NULL) 4338 skp = smack_net_ambient; 4339 } 4340 #ifdef CONFIG_AUDIT 4341 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4342 ad.a.u.net->family = family; 4343 ad.a.u.net->netif = skb->skb_iif; 4344 ipv6_skb_to_auditdata(skb, &ad.a, NULL); 4345 #endif /* CONFIG_AUDIT */ 4346 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4347 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in, 4348 MAY_WRITE, rc); 4349 #endif /* SMACK_IPV6_SECMARK_LABELING */ 4350 #ifdef SMACK_IPV6_PORT_LABELING 4351 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING); 4352 #endif /* SMACK_IPV6_PORT_LABELING */ 4353 if (rc != 0) 4354 icmpv6_send(skb, ICMPV6_DEST_UNREACH, 4355 ICMPV6_ADM_PROHIBITED, 0); 4356 break; 4357 #endif /* CONFIG_IPV6 */ 4358 } 4359 4360 return rc; 4361 } 4362 4363 /** 4364 * smack_socket_getpeersec_stream - pull in packet label 4365 * @sock: the socket 4366 * @optval: user's destination 4367 * @optlen: size thereof 4368 * @len: max thereof 4369 * 4370 * returns zero on success, an error code otherwise 4371 */ 4372 static int smack_socket_getpeersec_stream(struct socket *sock, 4373 sockptr_t optval, sockptr_t optlen, 4374 unsigned int len) 4375 { 4376 struct socket_smack *ssp; 4377 char *rcp = ""; 4378 u32 slen = 1; 4379 int rc = 0; 4380 4381 ssp = smack_sock(sock->sk); 4382 if (ssp->smk_packet != NULL) { 4383 rcp = ssp->smk_packet->smk_known; 4384 slen = strlen(rcp) + 1; 4385 } 4386 if (slen > len) { 4387 rc = -ERANGE; 4388 goto out_len; 4389 } 4390 4391 if (copy_to_sockptr(optval, rcp, slen)) 4392 rc = -EFAULT; 4393 out_len: 4394 if (copy_to_sockptr(optlen, &slen, sizeof(slen))) 4395 rc = -EFAULT; 4396 return rc; 4397 } 4398 4399 4400 /** 4401 * smack_socket_getpeersec_dgram - pull in packet label 4402 * @sock: the peer socket 4403 * @skb: packet data 4404 * @secid: pointer to where to put the secid of the packet 4405 * 4406 * Sets the netlabel socket state on sk from parent 4407 */ 4408 static int smack_socket_getpeersec_dgram(struct socket *sock, 4409 struct sk_buff *skb, u32 *secid) 4410 4411 { 4412 struct socket_smack *ssp = NULL; 4413 struct smack_known *skp; 4414 struct sock *sk = NULL; 4415 int family = PF_UNSPEC; 4416 u32 s = 0; /* 0 is the invalid secid */ 4417 4418 if (skb != NULL) { 4419 if (skb->protocol == htons(ETH_P_IP)) 4420 family = PF_INET; 4421 #if IS_ENABLED(CONFIG_IPV6) 4422 else if (skb->protocol == htons(ETH_P_IPV6)) 4423 family = PF_INET6; 4424 #endif /* CONFIG_IPV6 */ 4425 } 4426 if (family == PF_UNSPEC && sock != NULL) 4427 family = sock->sk->sk_family; 4428 4429 switch (family) { 4430 case PF_UNIX: 4431 ssp = smack_sock(sock->sk); 4432 s = ssp->smk_out->smk_secid; 4433 break; 4434 case PF_INET: 4435 skp = smack_from_skb(skb); 4436 if (skp) { 4437 s = skp->smk_secid; 4438 break; 4439 } 4440 /* 4441 * Translate what netlabel gave us. 4442 */ 4443 if (sock != NULL) 4444 sk = sock->sk; 4445 skp = smack_from_netlbl(sk, family, skb); 4446 if (skp != NULL) 4447 s = skp->smk_secid; 4448 break; 4449 case PF_INET6: 4450 #ifdef SMACK_IPV6_SECMARK_LABELING 4451 skp = smack_from_skb(skb); 4452 if (skp) 4453 s = skp->smk_secid; 4454 #endif 4455 break; 4456 } 4457 *secid = s; 4458 if (s == 0) 4459 return -EINVAL; 4460 return 0; 4461 } 4462 4463 /** 4464 * smack_inet_conn_request - Smack access check on connect 4465 * @sk: socket involved 4466 * @skb: packet 4467 * @req: unused 4468 * 4469 * Returns 0 if a task with the packet label could write to 4470 * the socket, otherwise an error code 4471 */ 4472 static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, 4473 struct request_sock *req) 4474 { 4475 u16 family = sk->sk_family; 4476 struct smack_known *skp; 4477 struct socket_smack *ssp = smack_sock(sk); 4478 struct sockaddr_in addr; 4479 struct iphdr *hdr; 4480 struct smack_known *hskp; 4481 int rc; 4482 struct smk_audit_info ad; 4483 #ifdef CONFIG_AUDIT 4484 struct lsm_network_audit net; 4485 #endif 4486 4487 #if IS_ENABLED(CONFIG_IPV6) 4488 if (family == PF_INET6) { 4489 /* 4490 * Handle mapped IPv4 packets arriving 4491 * via IPv6 sockets. Don't set up netlabel 4492 * processing on IPv6. 4493 */ 4494 if (skb->protocol == htons(ETH_P_IP)) 4495 family = PF_INET; 4496 else 4497 return 0; 4498 } 4499 #endif /* CONFIG_IPV6 */ 4500 4501 /* 4502 * If there is a secmark use it rather than the CIPSO label. 4503 * If there is no secmark fall back to CIPSO. 4504 * The secmark is assumed to reflect policy better. 4505 */ 4506 skp = smack_from_skb(skb); 4507 if (skp == NULL) { 4508 skp = smack_from_netlbl(sk, family, skb); 4509 if (skp == NULL) 4510 skp = &smack_known_huh; 4511 } 4512 4513 #ifdef CONFIG_AUDIT 4514 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4515 ad.a.u.net->family = family; 4516 ad.a.u.net->netif = skb->skb_iif; 4517 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 4518 #endif 4519 /* 4520 * Receiving a packet requires that the other end be able to write 4521 * here. Read access is not required. 4522 */ 4523 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4524 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc); 4525 if (rc != 0) 4526 return rc; 4527 4528 /* 4529 * Save the peer's label in the request_sock so we can later setup 4530 * smk_packet in the child socket so that SO_PEERCRED can report it. 4531 */ 4532 req->peer_secid = skp->smk_secid; 4533 4534 /* 4535 * We need to decide if we want to label the incoming connection here 4536 * if we do we only need to label the request_sock and the stack will 4537 * propagate the wire-label to the sock when it is created. 4538 */ 4539 hdr = ip_hdr(skb); 4540 addr.sin_addr.s_addr = hdr->saddr; 4541 rcu_read_lock(); 4542 hskp = smack_ipv4host_label(&addr); 4543 rcu_read_unlock(); 4544 4545 if (hskp == NULL) 4546 rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel); 4547 else 4548 netlbl_req_delattr(req); 4549 4550 return rc; 4551 } 4552 4553 /** 4554 * smack_inet_csk_clone - Copy the connection information to the new socket 4555 * @sk: the new socket 4556 * @req: the connection's request_sock 4557 * 4558 * Transfer the connection's peer label to the newly created socket. 4559 */ 4560 static void smack_inet_csk_clone(struct sock *sk, 4561 const struct request_sock *req) 4562 { 4563 struct socket_smack *ssp = smack_sock(sk); 4564 struct smack_known *skp; 4565 4566 if (req->peer_secid != 0) { 4567 skp = smack_from_secid(req->peer_secid); 4568 ssp->smk_packet = skp; 4569 } else 4570 ssp->smk_packet = NULL; 4571 } 4572 4573 /* 4574 * Key management security hooks 4575 * 4576 * Casey has not tested key support very heavily. 4577 * The permission check is most likely too restrictive. 4578 * If you care about keys please have a look. 4579 */ 4580 #ifdef CONFIG_KEYS 4581 4582 /** 4583 * smack_key_alloc - Set the key security blob 4584 * @key: object 4585 * @cred: the credentials to use 4586 * @flags: unused 4587 * 4588 * No allocation required 4589 * 4590 * Returns 0 4591 */ 4592 static int smack_key_alloc(struct key *key, const struct cred *cred, 4593 unsigned long flags) 4594 { 4595 struct smack_known **blob = smack_key(key); 4596 struct smack_known *skp = smk_of_task(smack_cred(cred)); 4597 4598 *blob = skp; 4599 return 0; 4600 } 4601 4602 /** 4603 * smack_key_permission - Smack access on a key 4604 * @key_ref: gets to the object 4605 * @cred: the credentials to use 4606 * @need_perm: requested key permission 4607 * 4608 * Return 0 if the task has read and write to the object, 4609 * an error code otherwise 4610 */ 4611 static int smack_key_permission(key_ref_t key_ref, 4612 const struct cred *cred, 4613 enum key_need_perm need_perm) 4614 { 4615 struct smack_known **blob; 4616 struct smack_known *skp; 4617 struct key *keyp; 4618 struct smk_audit_info ad; 4619 struct smack_known *tkp = smk_of_task(smack_cred(cred)); 4620 int request = 0; 4621 int rc; 4622 4623 /* 4624 * Validate requested permissions 4625 */ 4626 switch (need_perm) { 4627 case KEY_NEED_READ: 4628 case KEY_NEED_SEARCH: 4629 case KEY_NEED_VIEW: 4630 request |= MAY_READ; 4631 break; 4632 case KEY_NEED_WRITE: 4633 case KEY_NEED_LINK: 4634 case KEY_NEED_SETATTR: 4635 request |= MAY_WRITE; 4636 break; 4637 case KEY_NEED_UNSPECIFIED: 4638 case KEY_NEED_UNLINK: 4639 case KEY_SYSADMIN_OVERRIDE: 4640 case KEY_AUTHTOKEN_OVERRIDE: 4641 case KEY_DEFER_PERM_CHECK: 4642 return 0; 4643 default: 4644 return -EINVAL; 4645 } 4646 4647 keyp = key_ref_to_ptr(key_ref); 4648 if (keyp == NULL) 4649 return -EINVAL; 4650 /* 4651 * If the key hasn't been initialized give it access so that 4652 * it may do so. 4653 */ 4654 blob = smack_key(keyp); 4655 skp = *blob; 4656 if (skp == NULL) 4657 return 0; 4658 /* 4659 * This should not occur 4660 */ 4661 if (tkp == NULL) 4662 return -EACCES; 4663 4664 if (smack_privileged(CAP_MAC_OVERRIDE)) 4665 return 0; 4666 4667 #ifdef CONFIG_AUDIT 4668 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 4669 ad.a.u.key_struct.key = keyp->serial; 4670 ad.a.u.key_struct.key_desc = keyp->description; 4671 #endif 4672 rc = smk_access(tkp, skp, request, &ad); 4673 rc = smk_bu_note("key access", tkp, skp, request, rc); 4674 return rc; 4675 } 4676 4677 /* 4678 * smack_key_getsecurity - Smack label tagging the key 4679 * @key points to the key to be queried 4680 * @_buffer points to a pointer that should be set to point to the 4681 * resulting string (if no label or an error occurs). 4682 * Return the length of the string (including terminating NUL) or -ve if 4683 * an error. 4684 * May also return 0 (and a NULL buffer pointer) if there is no label. 4685 */ 4686 static int smack_key_getsecurity(struct key *key, char **_buffer) 4687 { 4688 struct smack_known **blob = smack_key(key); 4689 struct smack_known *skp = *blob; 4690 size_t length; 4691 char *copy; 4692 4693 if (skp == NULL) { 4694 *_buffer = NULL; 4695 return 0; 4696 } 4697 4698 copy = kstrdup(skp->smk_known, GFP_KERNEL); 4699 if (copy == NULL) 4700 return -ENOMEM; 4701 length = strlen(copy) + 1; 4702 4703 *_buffer = copy; 4704 return length; 4705 } 4706 4707 4708 #ifdef CONFIG_KEY_NOTIFICATIONS 4709 /** 4710 * smack_watch_key - Smack access to watch a key for notifications. 4711 * @key: The key to be watched 4712 * 4713 * Return 0 if the @watch->cred has permission to read from the key object and 4714 * an error otherwise. 4715 */ 4716 static int smack_watch_key(struct key *key) 4717 { 4718 struct smk_audit_info ad; 4719 struct smack_known *tkp = smk_of_current(); 4720 struct smack_known **blob = smack_key(key); 4721 int rc; 4722 4723 /* 4724 * This should not occur 4725 */ 4726 if (tkp == NULL) 4727 return -EACCES; 4728 4729 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred())) 4730 return 0; 4731 4732 #ifdef CONFIG_AUDIT 4733 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 4734 ad.a.u.key_struct.key = key->serial; 4735 ad.a.u.key_struct.key_desc = key->description; 4736 #endif 4737 rc = smk_access(tkp, *blob, MAY_READ, &ad); 4738 rc = smk_bu_note("key watch", tkp, *blob, MAY_READ, rc); 4739 return rc; 4740 } 4741 #endif /* CONFIG_KEY_NOTIFICATIONS */ 4742 #endif /* CONFIG_KEYS */ 4743 4744 #ifdef CONFIG_WATCH_QUEUE 4745 /** 4746 * smack_post_notification - Smack access to post a notification to a queue 4747 * @w_cred: The credentials of the watcher. 4748 * @cred: The credentials of the event source (may be NULL). 4749 * @n: The notification message to be posted. 4750 */ 4751 static int smack_post_notification(const struct cred *w_cred, 4752 const struct cred *cred, 4753 struct watch_notification *n) 4754 { 4755 struct smk_audit_info ad; 4756 struct smack_known *subj, *obj; 4757 int rc; 4758 4759 /* Always let maintenance notifications through. */ 4760 if (n->type == WATCH_TYPE_META) 4761 return 0; 4762 4763 if (!cred) 4764 return 0; 4765 subj = smk_of_task(smack_cred(cred)); 4766 obj = smk_of_task(smack_cred(w_cred)); 4767 4768 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NOTIFICATION); 4769 rc = smk_access(subj, obj, MAY_WRITE, &ad); 4770 rc = smk_bu_note("notification", subj, obj, MAY_WRITE, rc); 4771 return rc; 4772 } 4773 #endif /* CONFIG_WATCH_QUEUE */ 4774 4775 /* 4776 * Smack Audit hooks 4777 * 4778 * Audit requires a unique representation of each Smack specific 4779 * rule. This unique representation is used to distinguish the 4780 * object to be audited from remaining kernel objects and also 4781 * works as a glue between the audit hooks. 4782 * 4783 * Since repository entries are added but never deleted, we'll use 4784 * the smack_known label address related to the given audit rule as 4785 * the needed unique representation. This also better fits the smack 4786 * model where nearly everything is a label. 4787 */ 4788 #ifdef CONFIG_AUDIT 4789 4790 /** 4791 * smack_audit_rule_init - Initialize a smack audit rule 4792 * @field: audit rule fields given from user-space (audit.h) 4793 * @op: required testing operator (=, !=, >, <, ...) 4794 * @rulestr: smack label to be audited 4795 * @vrule: pointer to save our own audit rule representation 4796 * @gfp: type of the memory for the allocation 4797 * 4798 * Prepare to audit cases where (@field @op @rulestr) is true. 4799 * The label to be audited is created if necessary. 4800 */ 4801 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, 4802 gfp_t gfp) 4803 { 4804 struct smack_known *skp; 4805 char **rule = (char **)vrule; 4806 *rule = NULL; 4807 4808 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4809 return -EINVAL; 4810 4811 if (op != Audit_equal && op != Audit_not_equal) 4812 return -EINVAL; 4813 4814 skp = smk_import_entry(rulestr, 0); 4815 if (IS_ERR(skp)) 4816 return PTR_ERR(skp); 4817 4818 *rule = skp->smk_known; 4819 4820 return 0; 4821 } 4822 4823 /** 4824 * smack_audit_rule_known - Distinguish Smack audit rules 4825 * @krule: rule of interest, in Audit kernel representation format 4826 * 4827 * This is used to filter Smack rules from remaining Audit ones. 4828 * If it's proved that this rule belongs to us, the 4829 * audit_rule_match hook will be called to do the final judgement. 4830 */ 4831 static int smack_audit_rule_known(struct audit_krule *krule) 4832 { 4833 struct audit_field *f; 4834 int i; 4835 4836 for (i = 0; i < krule->field_count; i++) { 4837 f = &krule->fields[i]; 4838 4839 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER) 4840 return 1; 4841 } 4842 4843 return 0; 4844 } 4845 4846 /** 4847 * smack_audit_rule_match - Audit given object ? 4848 * @prop: security id for identifying the object to test 4849 * @field: audit rule flags given from user-space 4850 * @op: required testing operator 4851 * @vrule: smack internal rule presentation 4852 * 4853 * The core Audit hook. It's used to take the decision of 4854 * whether to audit or not to audit a given object. 4855 */ 4856 static int smack_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, 4857 void *vrule) 4858 { 4859 struct smack_known *skp = prop->smack.skp; 4860 char *rule = vrule; 4861 4862 if (unlikely(!rule)) { 4863 WARN_ONCE(1, "Smack: missing rule\n"); 4864 return -ENOENT; 4865 } 4866 4867 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4868 return 0; 4869 4870 /* 4871 * No need to do string comparisons. If a match occurs, 4872 * both pointers will point to the same smack_known 4873 * label. 4874 */ 4875 if (op == Audit_equal) 4876 return (rule == skp->smk_known); 4877 if (op == Audit_not_equal) 4878 return (rule != skp->smk_known); 4879 4880 return 0; 4881 } 4882 4883 /* 4884 * There is no need for a smack_audit_rule_free hook. 4885 * No memory was allocated. 4886 */ 4887 4888 #endif /* CONFIG_AUDIT */ 4889 4890 /** 4891 * smack_ismaclabel - check if xattr @name references a smack MAC label 4892 * @name: Full xattr name to check. 4893 */ 4894 static int smack_ismaclabel(const char *name) 4895 { 4896 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); 4897 } 4898 4899 /** 4900 * smack_to_secctx - fill a lsm_context 4901 * @skp: Smack label 4902 * @cp: destination 4903 * 4904 * Fill the passed @cp and return the length of the string 4905 */ 4906 static int smack_to_secctx(struct smack_known *skp, struct lsm_context *cp) 4907 { 4908 int len = strlen(skp->smk_known); 4909 4910 if (cp) { 4911 cp->context = skp->smk_known; 4912 cp->len = len; 4913 cp->id = LSM_ID_SMACK; 4914 } 4915 return len; 4916 } 4917 4918 /** 4919 * smack_secid_to_secctx - return the smack label for a secid 4920 * @secid: incoming integer 4921 * @cp: destination 4922 * 4923 * Exists for networking code. 4924 */ 4925 static int smack_secid_to_secctx(u32 secid, struct lsm_context *cp) 4926 { 4927 return smack_to_secctx(smack_from_secid(secid), cp); 4928 } 4929 4930 /** 4931 * smack_lsmprop_to_secctx - return the smack label 4932 * @prop: includes incoming Smack data 4933 * @cp: destination 4934 * 4935 * Exists for audit code. 4936 */ 4937 static int smack_lsmprop_to_secctx(struct lsm_prop *prop, 4938 struct lsm_context *cp) 4939 { 4940 return smack_to_secctx(prop->smack.skp, cp); 4941 } 4942 4943 /** 4944 * smack_secctx_to_secid - return the secid for a smack label 4945 * @secdata: smack label 4946 * @seclen: how long result is 4947 * @secid: outgoing integer 4948 * 4949 * Exists for audit and networking code. 4950 */ 4951 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 4952 { 4953 struct smack_known *skp = smk_find_entry(secdata); 4954 4955 if (skp) 4956 *secid = skp->smk_secid; 4957 else 4958 *secid = 0; 4959 return 0; 4960 } 4961 4962 /* 4963 * There used to be a smack_release_secctx hook 4964 * that did nothing back when hooks were in a vector. 4965 * Now that there's a list such a hook adds cost. 4966 */ 4967 4968 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 4969 { 4970 /* 4971 * UDS inode has fixed label. Ignore nfs label. 4972 */ 4973 if (S_ISSOCK(inode->i_mode)) 4974 return 0; 4975 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, 4976 ctxlen, 0); 4977 } 4978 4979 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 4980 { 4981 return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, 4982 ctx, ctxlen, 0, NULL); 4983 } 4984 4985 static int smack_inode_getsecctx(struct inode *inode, struct lsm_context *cp) 4986 { 4987 struct smack_known *skp = smk_of_inode(inode); 4988 4989 cp->context = skp->smk_known; 4990 cp->len = strlen(skp->smk_known); 4991 cp->id = LSM_ID_SMACK; 4992 return 0; 4993 } 4994 4995 static int smack_inode_copy_up(struct dentry *dentry, struct cred **new) 4996 { 4997 4998 struct task_smack *tsp; 4999 struct smack_known *skp; 5000 struct inode_smack *isp; 5001 struct cred *new_creds = *new; 5002 5003 if (new_creds == NULL) { 5004 new_creds = prepare_creds(); 5005 if (new_creds == NULL) 5006 return -ENOMEM; 5007 } 5008 5009 tsp = smack_cred(new_creds); 5010 5011 /* 5012 * Get label from overlay inode and set it in create_sid 5013 */ 5014 isp = smack_inode(d_inode(dentry)); 5015 skp = isp->smk_inode; 5016 tsp->smk_task = skp; 5017 *new = new_creds; 5018 return 0; 5019 } 5020 5021 static int smack_inode_copy_up_xattr(struct dentry *src, const char *name) 5022 { 5023 /* 5024 * Return -ECANCELED if this is the smack access Smack attribute. 5025 */ 5026 if (!strcmp(name, XATTR_NAME_SMACK)) 5027 return -ECANCELED; 5028 5029 return -EOPNOTSUPP; 5030 } 5031 5032 static int smack_dentry_create_files_as(struct dentry *dentry, int mode, 5033 const struct qstr *name, 5034 const struct cred *old, 5035 struct cred *new) 5036 { 5037 struct task_smack *otsp = smack_cred(old); 5038 struct task_smack *ntsp = smack_cred(new); 5039 struct inode_smack *isp; 5040 5041 /* 5042 * Use the process credential unless all of 5043 * the transmuting criteria are met 5044 */ 5045 ntsp->smk_task = otsp->smk_task; 5046 5047 /* 5048 * the attribute of the containing directory 5049 */ 5050 isp = smack_inode(d_inode(dentry->d_parent)); 5051 5052 if (isp->smk_flags & SMK_INODE_TRANSMUTE) { 5053 /* 5054 * If the directory is transmuting and the rule 5055 * providing access is transmuting use the containing 5056 * directory label instead of the process label. 5057 */ 5058 if (smk_rule_transmutes(otsp->smk_task, isp->smk_inode)) { 5059 ntsp->smk_task = isp->smk_inode; 5060 ntsp->smk_transmuted = ntsp->smk_task; 5061 } 5062 } 5063 return 0; 5064 } 5065 5066 #ifdef CONFIG_IO_URING 5067 /** 5068 * smack_uring_override_creds - Is io_uring cred override allowed? 5069 * @new: the target creds 5070 * 5071 * Check to see if the current task is allowed to override it's credentials 5072 * to service an io_uring operation. 5073 */ 5074 static int smack_uring_override_creds(const struct cred *new) 5075 { 5076 struct task_smack *tsp = smack_cred(current_cred()); 5077 struct task_smack *nsp = smack_cred(new); 5078 5079 /* 5080 * Allow the degenerate case where the new Smack value is 5081 * the same as the current Smack value. 5082 */ 5083 if (tsp->smk_task == nsp->smk_task) 5084 return 0; 5085 5086 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred())) 5087 return 0; 5088 5089 return -EPERM; 5090 } 5091 5092 /** 5093 * smack_uring_sqpoll - check if a io_uring polling thread can be created 5094 * 5095 * Check to see if the current task is allowed to create a new io_uring 5096 * kernel polling thread. 5097 */ 5098 static int smack_uring_sqpoll(void) 5099 { 5100 if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred())) 5101 return 0; 5102 5103 return -EPERM; 5104 } 5105 5106 /** 5107 * smack_uring_cmd - check on file operations for io_uring 5108 * @ioucmd: the command in question 5109 * 5110 * Make a best guess about whether a io_uring "command" should 5111 * be allowed. Use the same logic used for determining if the 5112 * file could be opened for read in the absence of better criteria. 5113 */ 5114 static int smack_uring_cmd(struct io_uring_cmd *ioucmd) 5115 { 5116 struct file *file = ioucmd->file; 5117 struct smk_audit_info ad; 5118 struct task_smack *tsp; 5119 struct inode *inode; 5120 int rc; 5121 5122 if (!file) 5123 return -EINVAL; 5124 5125 tsp = smack_cred(file->f_cred); 5126 inode = file_inode(file); 5127 5128 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 5129 smk_ad_setfield_u_fs_path(&ad, file->f_path); 5130 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad); 5131 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc); 5132 5133 return rc; 5134 } 5135 5136 #endif /* CONFIG_IO_URING */ 5137 5138 struct lsm_blob_sizes smack_blob_sizes __ro_after_init = { 5139 .lbs_cred = sizeof(struct task_smack), 5140 .lbs_file = sizeof(struct smack_known *), 5141 .lbs_inode = sizeof(struct inode_smack), 5142 .lbs_ipc = sizeof(struct smack_known *), 5143 .lbs_key = sizeof(struct smack_known *), 5144 .lbs_msg_msg = sizeof(struct smack_known *), 5145 .lbs_sock = sizeof(struct socket_smack), 5146 .lbs_superblock = sizeof(struct superblock_smack), 5147 .lbs_xattr_count = SMACK_INODE_INIT_XATTRS, 5148 }; 5149 5150 static const struct lsm_id smack_lsmid = { 5151 .name = "smack", 5152 .id = LSM_ID_SMACK, 5153 }; 5154 5155 static struct security_hook_list smack_hooks[] __ro_after_init = { 5156 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), 5157 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), 5158 LSM_HOOK_INIT(syslog, smack_syslog), 5159 5160 LSM_HOOK_INIT(fs_context_submount, smack_fs_context_submount), 5161 LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup), 5162 LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param), 5163 5164 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security), 5165 LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts), 5166 LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts), 5167 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs), 5168 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts), 5169 5170 LSM_HOOK_INIT(bprm_creds_for_exec, smack_bprm_creds_for_exec), 5171 5172 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security), 5173 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security), 5174 LSM_HOOK_INIT(inode_link, smack_inode_link), 5175 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink), 5176 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir), 5177 LSM_HOOK_INIT(inode_rename, smack_inode_rename), 5178 LSM_HOOK_INIT(inode_permission, smack_inode_permission), 5179 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr), 5180 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr), 5181 LSM_HOOK_INIT(inode_xattr_skipcap, smack_inode_xattr_skipcap), 5182 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr), 5183 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr), 5184 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr), 5185 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr), 5186 LSM_HOOK_INIT(inode_set_acl, smack_inode_set_acl), 5187 LSM_HOOK_INIT(inode_get_acl, smack_inode_get_acl), 5188 LSM_HOOK_INIT(inode_remove_acl, smack_inode_remove_acl), 5189 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity), 5190 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity), 5191 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity), 5192 LSM_HOOK_INIT(inode_getlsmprop, smack_inode_getlsmprop), 5193 5194 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security), 5195 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl), 5196 LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl), 5197 LSM_HOOK_INIT(file_lock, smack_file_lock), 5198 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl), 5199 LSM_HOOK_INIT(mmap_file, smack_mmap_file), 5200 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr), 5201 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner), 5202 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask), 5203 LSM_HOOK_INIT(file_receive, smack_file_receive), 5204 5205 LSM_HOOK_INIT(file_open, smack_file_open), 5206 5207 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank), 5208 LSM_HOOK_INIT(cred_free, smack_cred_free), 5209 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare), 5210 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer), 5211 LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid), 5212 LSM_HOOK_INIT(cred_getlsmprop, smack_cred_getlsmprop), 5213 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as), 5214 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as), 5215 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid), 5216 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid), 5217 LSM_HOOK_INIT(task_getsid, smack_task_getsid), 5218 LSM_HOOK_INIT(current_getlsmprop_subj, smack_current_getlsmprop_subj), 5219 LSM_HOOK_INIT(task_getlsmprop_obj, smack_task_getlsmprop_obj), 5220 LSM_HOOK_INIT(task_setnice, smack_task_setnice), 5221 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio), 5222 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio), 5223 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler), 5224 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler), 5225 LSM_HOOK_INIT(task_movememory, smack_task_movememory), 5226 LSM_HOOK_INIT(task_kill, smack_task_kill), 5227 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode), 5228 5229 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission), 5230 LSM_HOOK_INIT(ipc_getlsmprop, smack_ipc_getlsmprop), 5231 5232 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security), 5233 5234 LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security), 5235 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate), 5236 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl), 5237 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd), 5238 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv), 5239 5240 LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security), 5241 LSM_HOOK_INIT(shm_associate, smack_shm_associate), 5242 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl), 5243 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat), 5244 5245 LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security), 5246 LSM_HOOK_INIT(sem_associate, smack_sem_associate), 5247 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl), 5248 LSM_HOOK_INIT(sem_semop, smack_sem_semop), 5249 5250 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate), 5251 5252 LSM_HOOK_INIT(getselfattr, smack_getselfattr), 5253 LSM_HOOK_INIT(setselfattr, smack_setselfattr), 5254 LSM_HOOK_INIT(getprocattr, smack_getprocattr), 5255 LSM_HOOK_INIT(setprocattr, smack_setprocattr), 5256 5257 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect), 5258 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send), 5259 5260 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create), 5261 LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair), 5262 #ifdef SMACK_IPV6_PORT_LABELING 5263 LSM_HOOK_INIT(socket_bind, smack_socket_bind), 5264 #endif 5265 LSM_HOOK_INIT(socket_connect, smack_socket_connect), 5266 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg), 5267 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb), 5268 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream), 5269 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram), 5270 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), 5271 #ifdef SMACK_IPV6_PORT_LABELING 5272 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), 5273 #endif 5274 LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security), 5275 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), 5276 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone), 5277 5278 /* key management security hooks */ 5279 #ifdef CONFIG_KEYS 5280 LSM_HOOK_INIT(key_alloc, smack_key_alloc), 5281 LSM_HOOK_INIT(key_permission, smack_key_permission), 5282 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity), 5283 #ifdef CONFIG_KEY_NOTIFICATIONS 5284 LSM_HOOK_INIT(watch_key, smack_watch_key), 5285 #endif 5286 #endif /* CONFIG_KEYS */ 5287 5288 #ifdef CONFIG_WATCH_QUEUE 5289 LSM_HOOK_INIT(post_notification, smack_post_notification), 5290 #endif 5291 5292 /* Audit hooks */ 5293 #ifdef CONFIG_AUDIT 5294 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init), 5295 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known), 5296 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match), 5297 #endif /* CONFIG_AUDIT */ 5298 5299 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel), 5300 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), 5301 LSM_HOOK_INIT(lsmprop_to_secctx, smack_lsmprop_to_secctx), 5302 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), 5303 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), 5304 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), 5305 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), 5306 LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up), 5307 LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr), 5308 LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as), 5309 #ifdef CONFIG_IO_URING 5310 LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds), 5311 LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll), 5312 LSM_HOOK_INIT(uring_cmd, smack_uring_cmd), 5313 #endif 5314 }; 5315 5316 5317 static __init void init_smack_known_list(void) 5318 { 5319 /* 5320 * Initialize rule list locks 5321 */ 5322 mutex_init(&smack_known_huh.smk_rules_lock); 5323 mutex_init(&smack_known_hat.smk_rules_lock); 5324 mutex_init(&smack_known_floor.smk_rules_lock); 5325 mutex_init(&smack_known_star.smk_rules_lock); 5326 mutex_init(&smack_known_web.smk_rules_lock); 5327 /* 5328 * Initialize rule lists 5329 */ 5330 INIT_LIST_HEAD(&smack_known_huh.smk_rules); 5331 INIT_LIST_HEAD(&smack_known_hat.smk_rules); 5332 INIT_LIST_HEAD(&smack_known_star.smk_rules); 5333 INIT_LIST_HEAD(&smack_known_floor.smk_rules); 5334 INIT_LIST_HEAD(&smack_known_web.smk_rules); 5335 /* 5336 * Create the known labels list 5337 */ 5338 smk_insert_entry(&smack_known_huh); 5339 smk_insert_entry(&smack_known_hat); 5340 smk_insert_entry(&smack_known_star); 5341 smk_insert_entry(&smack_known_floor); 5342 smk_insert_entry(&smack_known_web); 5343 } 5344 5345 /** 5346 * smack_init - initialize the smack system 5347 * 5348 * Returns 0 on success, -ENOMEM is there's no memory 5349 */ 5350 static __init int smack_init(void) 5351 { 5352 struct cred *cred = (struct cred *) current->cred; 5353 struct task_smack *tsp; 5354 5355 smack_rule_cache = KMEM_CACHE(smack_rule, 0); 5356 if (!smack_rule_cache) 5357 return -ENOMEM; 5358 5359 /* 5360 * Set the security state for the initial task. 5361 */ 5362 tsp = smack_cred(cred); 5363 init_task_smack(tsp, &smack_known_floor, &smack_known_floor); 5364 5365 /* 5366 * Register with LSM 5367 */ 5368 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), &smack_lsmid); 5369 smack_enabled = 1; 5370 5371 pr_info("Smack: Initializing.\n"); 5372 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 5373 pr_info("Smack: Netfilter enabled.\n"); 5374 #endif 5375 #ifdef SMACK_IPV6_PORT_LABELING 5376 pr_info("Smack: IPv6 port labeling enabled.\n"); 5377 #endif 5378 #ifdef SMACK_IPV6_SECMARK_LABELING 5379 pr_info("Smack: IPv6 Netfilter enabled.\n"); 5380 #endif 5381 5382 /* initialize the smack_known_list */ 5383 init_smack_known_list(); 5384 5385 /* Inform the audit system that secctx is used */ 5386 audit_cfg_lsm(&smack_lsmid, 5387 AUDIT_CFG_LSM_SECCTX_SUBJECT | 5388 AUDIT_CFG_LSM_SECCTX_OBJECT); 5389 5390 return 0; 5391 } 5392 5393 int __init smack_initcall(void) 5394 { 5395 int rc_fs = init_smk_fs(); 5396 int rc_nf = smack_nf_ip_init(); 5397 5398 return rc_fs ? rc_fs : rc_nf; 5399 } 5400 5401 /* 5402 * Smack requires early initialization in order to label 5403 * all processes and objects when they are created. 5404 */ 5405 DEFINE_LSM(smack) = { 5406 .id = &smack_lsmid, 5407 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, 5408 .blobs = &smack_blob_sizes, 5409 .init = smack_init, 5410 .initcall_device = smack_initcall, 5411 }; 5412