1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Simplified MAC Kernel (smack) security module 4 * 5 * This file contains the smack hook function implementations. 6 * 7 * Authors: 8 * Casey Schaufler <casey@schaufler-ca.com> 9 * Jarkko Sakkinen <jarkko.sakkinen@intel.com> 10 * 11 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 12 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. 13 * Paul Moore <paul@paul-moore.com> 14 * Copyright (C) 2010 Nokia Corporation 15 * Copyright (C) 2011 Intel Corporation. 16 */ 17 18 #include <linux/xattr.h> 19 #include <linux/pagemap.h> 20 #include <linux/mount.h> 21 #include <linux/stat.h> 22 #include <linux/kd.h> 23 #include <asm/ioctls.h> 24 #include <linux/ip.h> 25 #include <linux/tcp.h> 26 #include <linux/udp.h> 27 #include <linux/icmpv6.h> 28 #include <linux/slab.h> 29 #include <linux/mutex.h> 30 #include <net/cipso_ipv4.h> 31 #include <net/ip.h> 32 #include <net/ipv6.h> 33 #include <linux/audit.h> 34 #include <linux/magic.h> 35 #include <linux/dcache.h> 36 #include <linux/personality.h> 37 #include <linux/msg.h> 38 #include <linux/shm.h> 39 #include <uapi/linux/shm.h> 40 #include <linux/binfmts.h> 41 #include <linux/parser.h> 42 #include <linux/fs_context.h> 43 #include <linux/fs_parser.h> 44 #include <linux/watch_queue.h> 45 #include <linux/io_uring/cmd.h> 46 #include <uapi/linux/lsm.h> 47 #include "smack.h" 48 49 #define TRANS_TRUE "TRUE" 50 #define TRANS_TRUE_SIZE 4 51 52 #define SMK_CONNECTING 0 53 #define SMK_RECEIVING 1 54 #define SMK_SENDING 2 55 56 /* 57 * Smack uses multiple xattrs. 58 * SMACK64 - for access control, 59 * SMACK64TRANSMUTE - label initialization, 60 * Not saved on files - SMACK64IPIN and SMACK64IPOUT, 61 * Must be set explicitly - SMACK64EXEC and SMACK64MMAP 62 */ 63 #define SMACK_INODE_INIT_XATTRS 2 64 65 #ifdef SMACK_IPV6_PORT_LABELING 66 static DEFINE_MUTEX(smack_ipv6_lock); 67 static LIST_HEAD(smk_ipv6_port_list); 68 #endif 69 struct kmem_cache *smack_rule_cache; 70 int smack_enabled __initdata; 71 72 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s} 73 static struct { 74 const char *name; 75 int len; 76 int opt; 77 } smk_mount_opts[] = { 78 {"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault}, 79 A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute) 80 }; 81 #undef A 82 83 static int match_opt_prefix(char *s, int l, char **arg) 84 { 85 int i; 86 87 for (i = 0; i < ARRAY_SIZE(smk_mount_opts); i++) { 88 size_t len = smk_mount_opts[i].len; 89 if (len > l || memcmp(s, smk_mount_opts[i].name, len)) 90 continue; 91 if (len == l || s[len] != '=') 92 continue; 93 *arg = s + len + 1; 94 return smk_mount_opts[i].opt; 95 } 96 return Opt_error; 97 } 98 99 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 100 static char *smk_bu_mess[] = { 101 "Bringup Error", /* Unused */ 102 "Bringup", /* SMACK_BRINGUP_ALLOW */ 103 "Unconfined Subject", /* SMACK_UNCONFINED_SUBJECT */ 104 "Unconfined Object", /* SMACK_UNCONFINED_OBJECT */ 105 }; 106 107 static void smk_bu_mode(int mode, char *s) 108 { 109 smack_str_from_perm(s, mode); 110 } 111 #endif 112 113 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 114 static int smk_bu_note(char *note, struct smack_known *sskp, 115 struct smack_known *oskp, int mode, int rc) 116 { 117 char acc[SMK_NUM_ACCESS_TYPE + 1]; 118 119 if (rc <= 0) 120 return rc; 121 if (rc > SMACK_UNCONFINED_OBJECT) 122 rc = 0; 123 124 smk_bu_mode(mode, acc); 125 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc], 126 sskp->smk_known, oskp->smk_known, acc, note); 127 return 0; 128 } 129 #else 130 #define smk_bu_note(note, sskp, oskp, mode, RC) (RC) 131 #endif 132 133 static int 134 smk_bu_tsk_to_obj(struct task_struct *tsk, const struct task_smack *tsp, 135 char *note, struct smack_known *oskp, int mode, int rc) 136 { 137 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 138 char acc[SMK_NUM_ACCESS_TYPE + 1]; 139 char comm[TASK_COMM_LEN]; 140 141 if (rc <= 0) 142 return rc; 143 if (rc > SMACK_UNCONFINED_OBJECT) 144 rc = 0; 145 146 smk_bu_mode(mode, acc); 147 148 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc], 149 smk_of_task(tsp)->smk_known, oskp->smk_known, 150 acc, get_task_comm(comm, tsk), note); 151 return 0; 152 #else 153 return rc; 154 #endif 155 } 156 157 static int smk_bu_current(char *note, struct smack_known *oskp, 158 int mode, int rc) 159 { 160 return smk_bu_tsk_to_obj(current, smack_cred(current_cred()), 161 note, oskp, mode, rc); 162 } 163 164 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 165 static int smk_bu_task(struct task_struct *otp, int mode, int rc) 166 { 167 struct task_smack *tsp = smack_cred(current_cred()); 168 struct smack_known *smk_task = smk_of_task_struct_obj(otp); 169 char acc[SMK_NUM_ACCESS_TYPE + 1]; 170 171 if (rc <= 0) 172 return rc; 173 if (rc > SMACK_UNCONFINED_OBJECT) 174 rc = 0; 175 176 smk_bu_mode(mode, acc); 177 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc], 178 tsp->smk_task->smk_known, smk_task->smk_known, acc, 179 current->comm, otp->comm); 180 return 0; 181 } 182 #else 183 #define smk_bu_task(otp, mode, RC) (RC) 184 #endif 185 186 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 187 static int smk_bu_inode(struct inode *inode, int mode, int rc) 188 { 189 struct task_smack *tsp = smack_cred(current_cred()); 190 struct inode_smack *isp = smack_inode(inode); 191 char acc[SMK_NUM_ACCESS_TYPE + 1]; 192 193 if (isp->smk_flags & SMK_INODE_IMPURE) 194 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 195 inode->i_sb->s_id, inode->i_ino, current->comm); 196 197 if (rc <= 0) 198 return rc; 199 if (rc > SMACK_UNCONFINED_OBJECT) 200 rc = 0; 201 if (rc == SMACK_UNCONFINED_SUBJECT && 202 (mode & (MAY_WRITE | MAY_APPEND))) 203 isp->smk_flags |= SMK_INODE_IMPURE; 204 205 smk_bu_mode(mode, acc); 206 207 pr_info("Smack %s: (%s %s %s) inode=(%s %llu) %s\n", smk_bu_mess[rc], 208 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc, 209 inode->i_sb->s_id, inode->i_ino, current->comm); 210 return 0; 211 } 212 #else 213 #define smk_bu_inode(inode, mode, RC) (RC) 214 #endif 215 216 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 217 static int smk_bu_file(struct file *file, int mode, int rc) 218 { 219 struct task_smack *tsp = smack_cred(current_cred()); 220 struct smack_known *sskp = tsp->smk_task; 221 struct inode *inode = file_inode(file); 222 struct inode_smack *isp = smack_inode(inode); 223 char acc[SMK_NUM_ACCESS_TYPE + 1]; 224 225 if (isp->smk_flags & SMK_INODE_IMPURE) 226 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 227 inode->i_sb->s_id, inode->i_ino, current->comm); 228 229 if (rc <= 0) 230 return rc; 231 if (rc > SMACK_UNCONFINED_OBJECT) 232 rc = 0; 233 234 smk_bu_mode(mode, acc); 235 pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc], 236 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 237 inode->i_sb->s_id, inode->i_ino, file, 238 current->comm); 239 return 0; 240 } 241 #else 242 #define smk_bu_file(file, mode, RC) (RC) 243 #endif 244 245 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 246 static int smk_bu_credfile(const struct cred *cred, struct file *file, 247 int mode, int rc) 248 { 249 struct task_smack *tsp = smack_cred(cred); 250 struct smack_known *sskp = tsp->smk_task; 251 struct inode *inode = file_inode(file); 252 struct inode_smack *isp = smack_inode(inode); 253 char acc[SMK_NUM_ACCESS_TYPE + 1]; 254 255 if (isp->smk_flags & SMK_INODE_IMPURE) 256 pr_info("Smack Unconfined Corruption: inode=(%s %llu) %s\n", 257 inode->i_sb->s_id, inode->i_ino, current->comm); 258 259 if (rc <= 0) 260 return rc; 261 if (rc > SMACK_UNCONFINED_OBJECT) 262 rc = 0; 263 264 smk_bu_mode(mode, acc); 265 pr_info("Smack %s: (%s %s %s) file=(%s %llu %pD) %s\n", smk_bu_mess[rc], 266 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 267 inode->i_sb->s_id, inode->i_ino, file, 268 current->comm); 269 return 0; 270 } 271 #else 272 #define smk_bu_credfile(cred, file, mode, RC) (RC) 273 #endif 274 275 /** 276 * smk_fetch - Fetch the smack label from a file. 277 * @name: type of the label (attribute) 278 * @ip: a pointer to the inode 279 * @dp: a pointer to the dentry 280 * 281 * Returns a pointer to the master list entry for the Smack label, 282 * NULL if there was no label to fetch, or an error code. 283 */ 284 static struct smack_known *smk_fetch(const char *name, struct inode *ip, 285 struct dentry *dp) 286 { 287 int rc; 288 char *buffer; 289 struct smack_known *skp = NULL; 290 291 if (!(ip->i_opflags & IOP_XATTR)) 292 return ERR_PTR(-EOPNOTSUPP); 293 294 buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS); 295 if (buffer == NULL) 296 return ERR_PTR(-ENOMEM); 297 298 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL); 299 if (rc < 0) 300 skp = ERR_PTR(rc); 301 else if (rc == 0) 302 skp = NULL; 303 else 304 skp = smk_import_entry(buffer, rc); 305 306 kfree(buffer); 307 308 return skp; 309 } 310 311 /** 312 * init_inode_smack - initialize an inode security blob 313 * @inode: inode to extract the info from 314 * @skp: a pointer to the Smack label entry to use in the blob 315 * 316 */ 317 static void init_inode_smack(struct inode *inode, struct smack_known *skp) 318 { 319 struct inode_smack *isp = smack_inode(inode); 320 321 isp->smk_inode = skp; 322 isp->smk_flags = 0; 323 } 324 325 /** 326 * init_task_smack - initialize a task security blob 327 * @tsp: blob to initialize 328 * @task: a pointer to the Smack label for the running task 329 * @forked: a pointer to the Smack label for the forked task 330 * 331 */ 332 static void init_task_smack(struct task_smack *tsp, struct smack_known *task, 333 struct smack_known *forked) 334 { 335 tsp->smk_task = task; 336 tsp->smk_forked = forked; 337 INIT_LIST_HEAD(&tsp->smk_rules); 338 INIT_LIST_HEAD(&tsp->smk_relabel); 339 mutex_init(&tsp->smk_rules_lock); 340 } 341 342 /** 343 * smk_copy_rules - copy a rule set 344 * @nhead: new rules header pointer 345 * @ohead: old rules header pointer 346 * @gfp: type of the memory for the allocation 347 * 348 * Returns 0 on success, -ENOMEM on error 349 */ 350 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead, 351 gfp_t gfp) 352 { 353 struct smack_rule *nrp; 354 struct smack_rule *orp; 355 int rc = 0; 356 357 list_for_each_entry_rcu(orp, ohead, list) { 358 nrp = kmem_cache_zalloc(smack_rule_cache, gfp); 359 if (nrp == NULL) { 360 rc = -ENOMEM; 361 break; 362 } 363 *nrp = *orp; 364 list_add_rcu(&nrp->list, nhead); 365 } 366 return rc; 367 } 368 369 /** 370 * smk_copy_relabel - copy smk_relabel labels list 371 * @nhead: new rules header pointer 372 * @ohead: old rules header pointer 373 * @gfp: type of the memory for the allocation 374 * 375 * Returns 0 on success, -ENOMEM on error 376 */ 377 static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead, 378 gfp_t gfp) 379 { 380 struct smack_known_list_elem *nklep; 381 struct smack_known_list_elem *oklep; 382 383 list_for_each_entry(oklep, ohead, list) { 384 nklep = kzalloc_obj(struct smack_known_list_elem, gfp); 385 if (nklep == NULL) { 386 smk_destroy_label_list(nhead); 387 return -ENOMEM; 388 } 389 nklep->smk_label = oklep->smk_label; 390 list_add(&nklep->list, nhead); 391 } 392 393 return 0; 394 } 395 396 /** 397 * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_* 398 * @mode: input mode in form of PTRACE_MODE_* 399 * 400 * Returns a converted MAY_* mode usable by smack rules 401 */ 402 static inline unsigned int smk_ptrace_mode(unsigned int mode) 403 { 404 if (mode & PTRACE_MODE_ATTACH) 405 return MAY_READWRITE; 406 if (mode & PTRACE_MODE_READ) 407 return MAY_READ; 408 409 return 0; 410 } 411 412 /** 413 * smk_ptrace_rule_check - helper for ptrace access 414 * @tracer: tracer process 415 * @tracee_known: label entry of the process that's about to be traced 416 * @mode: ptrace attachment mode (PTRACE_MODE_*) 417 * @func: name of the function that called us, used for audit 418 * 419 * Returns 0 on access granted, -error on error 420 */ 421 static int smk_ptrace_rule_check(struct task_struct *tracer, 422 struct smack_known *tracee_known, 423 unsigned int mode, const char *func) 424 { 425 int rc; 426 struct smk_audit_info ad, *saip = NULL; 427 struct task_smack *tsp; 428 struct smack_known *tracer_known; 429 const struct cred *tracercred; 430 431 if ((mode & PTRACE_MODE_NOAUDIT) == 0) { 432 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); 433 smk_ad_setfield_u_tsk(&ad, tracer); 434 saip = &ad; 435 } 436 437 rcu_read_lock(); 438 tracercred = __task_cred(tracer); 439 tsp = smack_cred(tracercred); 440 tracer_known = smk_of_task(tsp); 441 442 if ((mode & PTRACE_MODE_ATTACH) && 443 (smack_ptrace_rule == SMACK_PTRACE_EXACT || 444 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) { 445 if (tracer_known->smk_known == tracee_known->smk_known) 446 rc = 0; 447 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) 448 rc = -EACCES; 449 else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred)) 450 rc = 0; 451 else 452 rc = -EACCES; 453 454 if (saip) 455 smack_log(tracer_known->smk_known, 456 tracee_known->smk_known, 457 0, rc, saip); 458 459 rcu_read_unlock(); 460 return rc; 461 } 462 463 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ 464 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip); 465 466 rcu_read_unlock(); 467 return rc; 468 } 469 470 /* 471 * LSM hooks. 472 * We he, that is fun! 473 */ 474 475 /** 476 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH 477 * @ctp: child task pointer 478 * @mode: ptrace attachment mode (PTRACE_MODE_*) 479 * 480 * Returns 0 if access is OK, an error code otherwise 481 * 482 * Do the capability checks. 483 */ 484 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) 485 { 486 struct smack_known *skp; 487 488 skp = smk_of_task_struct_obj(ctp); 489 490 return smk_ptrace_rule_check(current, skp, mode, __func__); 491 } 492 493 /** 494 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME 495 * @ptp: parent task pointer 496 * 497 * Returns 0 if access is OK, an error code otherwise 498 * 499 * Do the capability checks, and require PTRACE_MODE_ATTACH. 500 */ 501 static int smack_ptrace_traceme(struct task_struct *ptp) 502 { 503 struct smack_known *skp; 504 505 skp = smk_of_task(smack_cred(current_cred())); 506 507 return smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__); 508 } 509 510 /** 511 * smack_syslog - Smack approval on syslog 512 * @typefrom_file: unused 513 * 514 * Returns 0 on success, error code otherwise. 515 */ 516 static int smack_syslog(int typefrom_file) 517 { 518 int rc = 0; 519 struct smack_known *skp = smk_of_current(); 520 521 if (smack_privileged(CAP_MAC_OVERRIDE)) 522 return 0; 523 524 if (smack_syslog_label != NULL && smack_syslog_label != skp) 525 rc = -EACCES; 526 527 return rc; 528 } 529 530 /* 531 * Superblock Hooks. 532 */ 533 534 /** 535 * smack_sb_alloc_security - allocate a superblock blob 536 * @sb: the superblock getting the blob 537 * 538 * Returns 0 on success or -ENOMEM on error. 539 */ 540 static int smack_sb_alloc_security(struct super_block *sb) 541 { 542 struct superblock_smack *sbsp = smack_superblock(sb); 543 544 sbsp->smk_root = &smack_known_floor; 545 sbsp->smk_default = &smack_known_floor; 546 sbsp->smk_floor = &smack_known_floor; 547 sbsp->smk_hat = &smack_known_hat; 548 /* 549 * SMK_SB_INITIALIZED will be zero from kzalloc. 550 */ 551 552 return 0; 553 } 554 555 struct smack_mnt_opts { 556 const char *fsdefault; 557 const char *fsfloor; 558 const char *fshat; 559 const char *fsroot; 560 const char *fstransmute; 561 }; 562 563 static void smack_free_mnt_opts(void *mnt_opts) 564 { 565 kfree(mnt_opts); 566 } 567 568 static int smack_add_opt(int token, const char *s, void **mnt_opts) 569 { 570 struct smack_mnt_opts *opts = *mnt_opts; 571 struct smack_known *skp; 572 573 if (!opts) { 574 opts = kzalloc_obj(struct smack_mnt_opts); 575 if (!opts) 576 return -ENOMEM; 577 *mnt_opts = opts; 578 } 579 if (!s) 580 return -ENOMEM; 581 582 skp = smk_import_entry(s, 0); 583 if (IS_ERR(skp)) 584 return PTR_ERR(skp); 585 586 switch (token) { 587 case Opt_fsdefault: 588 if (opts->fsdefault) 589 goto out_opt_err; 590 opts->fsdefault = skp->smk_known; 591 break; 592 case Opt_fsfloor: 593 if (opts->fsfloor) 594 goto out_opt_err; 595 opts->fsfloor = skp->smk_known; 596 break; 597 case Opt_fshat: 598 if (opts->fshat) 599 goto out_opt_err; 600 opts->fshat = skp->smk_known; 601 break; 602 case Opt_fsroot: 603 if (opts->fsroot) 604 goto out_opt_err; 605 opts->fsroot = skp->smk_known; 606 break; 607 case Opt_fstransmute: 608 if (opts->fstransmute) 609 goto out_opt_err; 610 opts->fstransmute = skp->smk_known; 611 break; 612 } 613 return 0; 614 615 out_opt_err: 616 pr_warn("Smack: duplicate mount options\n"); 617 return -EINVAL; 618 } 619 620 /** 621 * smack_fs_context_submount - Initialise security data for a filesystem context 622 * @fc: The filesystem context. 623 * @reference: reference superblock 624 * 625 * Returns 0 on success or -ENOMEM on error. 626 */ 627 static int smack_fs_context_submount(struct fs_context *fc, 628 struct super_block *reference) 629 { 630 struct superblock_smack *sbsp; 631 struct smack_mnt_opts *ctx; 632 struct inode_smack *isp; 633 634 ctx = kzalloc_obj(*ctx); 635 if (!ctx) 636 return -ENOMEM; 637 fc->security = ctx; 638 639 sbsp = smack_superblock(reference); 640 isp = smack_inode(reference->s_root->d_inode); 641 642 if (sbsp->smk_default) { 643 ctx->fsdefault = kstrdup(sbsp->smk_default->smk_known, GFP_KERNEL); 644 if (!ctx->fsdefault) 645 return -ENOMEM; 646 } 647 648 if (sbsp->smk_floor) { 649 ctx->fsfloor = kstrdup(sbsp->smk_floor->smk_known, GFP_KERNEL); 650 if (!ctx->fsfloor) 651 return -ENOMEM; 652 } 653 654 if (sbsp->smk_hat) { 655 ctx->fshat = kstrdup(sbsp->smk_hat->smk_known, GFP_KERNEL); 656 if (!ctx->fshat) 657 return -ENOMEM; 658 } 659 660 if (isp->smk_flags & SMK_INODE_TRANSMUTE) { 661 if (sbsp->smk_root) { 662 ctx->fstransmute = kstrdup(sbsp->smk_root->smk_known, GFP_KERNEL); 663 if (!ctx->fstransmute) 664 return -ENOMEM; 665 } 666 } 667 return 0; 668 } 669 670 /** 671 * smack_fs_context_dup - Duplicate the security data on fs_context duplication 672 * @fc: The new filesystem context. 673 * @src_fc: The source filesystem context being duplicated. 674 * 675 * Returns 0 on success or -ENOMEM on error. 676 */ 677 static int smack_fs_context_dup(struct fs_context *fc, 678 struct fs_context *src_fc) 679 { 680 struct smack_mnt_opts *dst, *src = src_fc->security; 681 682 if (!src) 683 return 0; 684 685 fc->security = kzalloc_obj(struct smack_mnt_opts); 686 if (!fc->security) 687 return -ENOMEM; 688 689 dst = fc->security; 690 dst->fsdefault = src->fsdefault; 691 dst->fsfloor = src->fsfloor; 692 dst->fshat = src->fshat; 693 dst->fsroot = src->fsroot; 694 dst->fstransmute = src->fstransmute; 695 696 return 0; 697 } 698 699 static const struct fs_parameter_spec smack_fs_parameters[] = { 700 fsparam_string("smackfsdef", Opt_fsdefault), 701 fsparam_string("smackfsdefault", Opt_fsdefault), 702 fsparam_string("smackfsfloor", Opt_fsfloor), 703 fsparam_string("smackfshat", Opt_fshat), 704 fsparam_string("smackfsroot", Opt_fsroot), 705 fsparam_string("smackfstransmute", Opt_fstransmute), 706 {} 707 }; 708 709 /** 710 * smack_fs_context_parse_param - Parse a single mount parameter 711 * @fc: The new filesystem context being constructed. 712 * @param: The parameter. 713 * 714 * Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on 715 * error. 716 */ 717 static int smack_fs_context_parse_param(struct fs_context *fc, 718 struct fs_parameter *param) 719 { 720 struct fs_parse_result result; 721 int opt, rc; 722 723 opt = fs_parse(fc, smack_fs_parameters, param, &result); 724 if (opt < 0) 725 return opt; 726 727 rc = smack_add_opt(opt, param->string, &fc->security); 728 if (!rc) 729 param->string = NULL; 730 return rc; 731 } 732 733 static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts) 734 { 735 char *from = options, *to = options; 736 bool first = true; 737 738 while (1) { 739 char *next = strchr(from, ','); 740 int token, len, rc; 741 char *arg = NULL; 742 743 if (next) 744 len = next - from; 745 else 746 len = strlen(from); 747 748 token = match_opt_prefix(from, len, &arg); 749 if (token != Opt_error) { 750 arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL); 751 rc = smack_add_opt(token, arg, mnt_opts); 752 kfree(arg); 753 if (unlikely(rc)) { 754 if (*mnt_opts) 755 smack_free_mnt_opts(*mnt_opts); 756 *mnt_opts = NULL; 757 return rc; 758 } 759 } else { 760 if (!first) { // copy with preceding comma 761 from--; 762 len++; 763 } 764 if (to != from) 765 memmove(to, from, len); 766 to += len; 767 first = false; 768 } 769 if (!from[len]) 770 break; 771 from += len + 1; 772 } 773 *to = '\0'; 774 return 0; 775 } 776 777 /** 778 * smack_set_mnt_opts - set Smack specific mount options 779 * @sb: the file system superblock 780 * @mnt_opts: Smack mount options 781 * @kern_flags: mount option from kernel space or user space 782 * @set_kern_flags: where to store converted mount opts 783 * 784 * Returns 0 on success, an error code on failure 785 * 786 * Allow filesystems with binary mount data to explicitly set Smack mount 787 * labels. 788 */ 789 static int smack_set_mnt_opts(struct super_block *sb, 790 void *mnt_opts, 791 unsigned long kern_flags, 792 unsigned long *set_kern_flags) 793 { 794 struct dentry *root = sb->s_root; 795 struct inode *inode = d_backing_inode(root); 796 struct superblock_smack *sp = smack_superblock(sb); 797 struct inode_smack *isp; 798 struct smack_known *skp; 799 struct smack_mnt_opts *opts = mnt_opts; 800 bool transmute = false; 801 802 if (sp->smk_flags & SMK_SB_INITIALIZED) 803 return 0; 804 805 if (!smack_privileged(CAP_MAC_ADMIN)) { 806 /* 807 * Unprivileged mounts don't get to specify Smack values. 808 */ 809 if (opts) 810 return -EPERM; 811 /* 812 * Unprivileged mounts get root and default from the caller. 813 */ 814 skp = smk_of_current(); 815 sp->smk_root = skp; 816 sp->smk_default = skp; 817 /* 818 * For a handful of fs types with no user-controlled 819 * backing store it's okay to trust security labels 820 * in the filesystem. The rest are untrusted. 821 */ 822 if (sb->s_user_ns != &init_user_ns && 823 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC && 824 sb->s_magic != RAMFS_MAGIC) { 825 transmute = true; 826 sp->smk_flags |= SMK_SB_UNTRUSTED; 827 } 828 } 829 830 sp->smk_flags |= SMK_SB_INITIALIZED; 831 832 if (opts) { 833 if (opts->fsdefault) { 834 skp = smk_import_entry(opts->fsdefault, 0); 835 if (IS_ERR(skp)) 836 return PTR_ERR(skp); 837 sp->smk_default = skp; 838 } 839 if (opts->fsfloor) { 840 skp = smk_import_entry(opts->fsfloor, 0); 841 if (IS_ERR(skp)) 842 return PTR_ERR(skp); 843 sp->smk_floor = skp; 844 } 845 if (opts->fshat) { 846 skp = smk_import_entry(opts->fshat, 0); 847 if (IS_ERR(skp)) 848 return PTR_ERR(skp); 849 sp->smk_hat = skp; 850 } 851 if (opts->fsroot) { 852 skp = smk_import_entry(opts->fsroot, 0); 853 if (IS_ERR(skp)) 854 return PTR_ERR(skp); 855 sp->smk_root = skp; 856 } 857 if (opts->fstransmute) { 858 skp = smk_import_entry(opts->fstransmute, 0); 859 if (IS_ERR(skp)) 860 return PTR_ERR(skp); 861 sp->smk_root = skp; 862 transmute = true; 863 } 864 } 865 866 /* 867 * Initialize the root inode. 868 */ 869 init_inode_smack(inode, sp->smk_root); 870 871 if (transmute) { 872 isp = smack_inode(inode); 873 isp->smk_flags |= SMK_INODE_TRANSMUTE; 874 } 875 876 return 0; 877 } 878 879 /** 880 * smack_sb_statfs - Smack check on statfs 881 * @dentry: identifies the file system in question 882 * 883 * Returns 0 if current can read the floor of the filesystem, 884 * and error code otherwise 885 */ 886 static int smack_sb_statfs(struct dentry *dentry) 887 { 888 struct superblock_smack *sbp = smack_superblock(dentry->d_sb); 889 int rc; 890 struct smk_audit_info ad; 891 892 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 893 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 894 895 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 896 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc); 897 return rc; 898 } 899 900 /* 901 * BPRM hooks 902 */ 903 904 /** 905 * smack_bprm_creds_for_exec - Update bprm->cred if needed for exec 906 * @bprm: the exec information 907 * 908 * Returns 0 if it gets a blob, -EPERM if exec forbidden and -ENOMEM otherwise 909 */ 910 static int smack_bprm_creds_for_exec(struct linux_binprm *bprm) 911 { 912 struct inode *inode = file_inode(bprm->file); 913 struct task_smack *bsp = smack_cred(bprm->cred); 914 struct inode_smack *isp; 915 struct superblock_smack *sbsp; 916 int rc; 917 918 isp = smack_inode(inode); 919 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) 920 return 0; 921 922 sbsp = smack_superblock(inode->i_sb); 923 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && 924 isp->smk_task != sbsp->smk_root) 925 return 0; 926 927 if (bprm->unsafe & LSM_UNSAFE_PTRACE) { 928 struct task_struct *tracer; 929 rc = 0; 930 931 rcu_read_lock(); 932 tracer = ptrace_parent(current); 933 if (likely(tracer != NULL)) 934 rc = smk_ptrace_rule_check(tracer, 935 isp->smk_task, 936 PTRACE_MODE_ATTACH, 937 __func__); 938 rcu_read_unlock(); 939 940 if (rc != 0) 941 return rc; 942 } 943 if (bprm->unsafe & ~LSM_UNSAFE_PTRACE) 944 return -EPERM; 945 946 bsp->smk_task = isp->smk_task; 947 bprm->per_clear |= PER_CLEAR_ON_SETID; 948 949 /* Decide if this is a secure exec. */ 950 if (bsp->smk_task != bsp->smk_forked) 951 bprm->secureexec = 1; 952 953 return 0; 954 } 955 956 /* 957 * Inode hooks 958 */ 959 960 /** 961 * smack_inode_alloc_security - allocate an inode blob 962 * @inode: the inode in need of a blob 963 * 964 * Returns 0 965 */ 966 static int smack_inode_alloc_security(struct inode *inode) 967 { 968 struct smack_known *skp = smk_of_current(); 969 970 init_inode_smack(inode, skp); 971 return 0; 972 } 973 974 /** 975 * smk_rule_transmutes - does access rule for (subject,object) contain 't'? 976 * @subject: a pointer to the subject's Smack label entry 977 * @object: a pointer to the object's Smack label entry 978 */ 979 static bool 980 smk_rule_transmutes(struct smack_known *subject, 981 const struct smack_known *object) 982 { 983 int may; 984 985 rcu_read_lock(); 986 may = smk_access_entry(subject->smk_known, object->smk_known, 987 &subject->smk_rules); 988 rcu_read_unlock(); 989 return (may > 0) && (may & MAY_TRANSMUTE); 990 } 991 992 static int 993 xattr_dupval(struct xattr *xattrs, int *xattr_count, 994 const char *name, const void *value, unsigned int vallen) 995 { 996 struct xattr * const xattr = lsm_get_xattr_slot(xattrs, xattr_count); 997 998 if (!xattr) 999 return 0; 1000 1001 xattr->value = kmemdup(value, vallen, GFP_NOFS); 1002 if (!xattr->value) 1003 return -ENOMEM; 1004 1005 xattr->value_len = vallen; 1006 xattr->name = name; 1007 return 0; 1008 } 1009 1010 /** 1011 * smack_inode_init_security - copy out the smack from an inode 1012 * @inode: the newly created inode 1013 * @dir: containing directory object 1014 * @qstr: unused 1015 * @xattrs: where to put the attributes 1016 * @xattr_count: current number of LSM-provided xattrs (updated) 1017 * 1018 * Returns 0 if it all works out, -ENOMEM if there's no memory 1019 */ 1020 static int smack_inode_init_security(struct inode *inode, struct inode *dir, 1021 const struct qstr *qstr, 1022 struct xattr *xattrs, int *xattr_count) 1023 { 1024 struct task_smack *tsp = smack_cred(current_cred()); 1025 struct inode_smack * const issp = smack_inode(inode); 1026 struct smack_known *dsp = smk_of_inode(dir); 1027 int rc = 0; 1028 int transflag = 0; 1029 bool trans_cred; 1030 bool trans_rule; 1031 1032 /* 1033 * UNIX domain sockets use lower level socket data. Let 1034 * UDS inode have fixed * label to keep smack_inode_permission() calm 1035 * when called from unix_find_bsd() 1036 */ 1037 if (S_ISSOCK(inode->i_mode)) { 1038 /* forced label, no need to save to xattrs */ 1039 issp->smk_inode = &smack_known_star; 1040 goto instant_inode; 1041 } 1042 /* 1043 * If equal, transmuting already occurred in 1044 * smack_dentry_create_files_as(). No need to check again. 1045 */ 1046 trans_cred = (tsp->smk_task == tsp->smk_transmuted); 1047 if (!trans_cred) 1048 trans_rule = smk_rule_transmutes(smk_of_task(tsp), dsp); 1049 1050 /* 1051 * In addition to having smk_task equal to smk_transmuted, 1052 * if the access rule allows transmutation and the directory 1053 * requests transmutation then by all means transmute. 1054 * Mark the inode as changed. 1055 */ 1056 if (trans_cred || (trans_rule && smk_inode_transmutable(dir))) { 1057 /* 1058 * The caller of smack_dentry_create_files_as() 1059 * should have overridden the current cred, so the 1060 * inode label was already set correctly in 1061 * smack_inode_alloc_security(). 1062 */ 1063 if (!trans_cred) 1064 issp->smk_inode = dsp; 1065 1066 if (S_ISDIR(inode->i_mode)) { 1067 transflag = SMK_INODE_TRANSMUTE; 1068 1069 if (xattr_dupval(xattrs, xattr_count, 1070 XATTR_SMACK_TRANSMUTE, 1071 TRANS_TRUE, 1072 TRANS_TRUE_SIZE 1073 )) 1074 rc = -ENOMEM; 1075 } 1076 } 1077 1078 if (rc == 0) 1079 if (xattr_dupval(xattrs, xattr_count, 1080 XATTR_SMACK_SUFFIX, 1081 issp->smk_inode->smk_known, 1082 strlen(issp->smk_inode->smk_known) 1083 )) 1084 rc = -ENOMEM; 1085 instant_inode: 1086 issp->smk_flags |= (SMK_INODE_INSTANT | transflag); 1087 return rc; 1088 } 1089 1090 /** 1091 * smack_inode_link - Smack check on link 1092 * @idmap: idmap of the mount 1093 * @old_dentry: the existing object 1094 * @dir: unused 1095 * @new_dentry: the new object 1096 * 1097 * Returns 0 if access is permitted, an error code otherwise 1098 */ 1099 static int smack_inode_link(const struct mnt_idmap *idmap, struct dentry *old_dentry, 1100 struct inode *dir, struct dentry *new_dentry) 1101 { 1102 struct smack_known *isp; 1103 struct smk_audit_info ad; 1104 int rc; 1105 1106 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1107 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1108 1109 isp = smk_of_inode(d_backing_inode(old_dentry)); 1110 rc = smk_curacc(isp, MAY_WRITE, &ad); 1111 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc); 1112 1113 if (rc == 0 && d_is_positive(new_dentry)) { 1114 isp = smk_of_inode(d_backing_inode(new_dentry)); 1115 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1116 rc = smk_curacc(isp, MAY_WRITE, &ad); 1117 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc); 1118 } 1119 1120 return rc; 1121 } 1122 1123 /** 1124 * smack_inode_unlink - Smack check on inode deletion 1125 * @dir: containing directory object 1126 * @dentry: file to unlink 1127 * 1128 * Returns 0 if current can write the containing directory 1129 * and the object, error code otherwise 1130 */ 1131 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) 1132 { 1133 struct inode *ip = d_backing_inode(dentry); 1134 struct smk_audit_info ad; 1135 int rc; 1136 1137 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1138 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1139 1140 /* 1141 * You need write access to the thing you're unlinking 1142 */ 1143 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 1144 rc = smk_bu_inode(ip, MAY_WRITE, rc); 1145 if (rc == 0) { 1146 /* 1147 * You also need write access to the containing directory 1148 */ 1149 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1150 smk_ad_setfield_u_fs_inode(&ad, dir); 1151 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1152 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1153 } 1154 return rc; 1155 } 1156 1157 /** 1158 * smack_inode_rmdir - Smack check on directory deletion 1159 * @dir: containing directory object 1160 * @dentry: directory to unlink 1161 * 1162 * Returns 0 if current can write the containing directory 1163 * and the directory, error code otherwise 1164 */ 1165 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) 1166 { 1167 struct smk_audit_info ad; 1168 int rc; 1169 1170 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1171 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1172 1173 /* 1174 * You need write access to the thing you're removing 1175 */ 1176 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1177 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1178 if (rc == 0) { 1179 /* 1180 * You also need write access to the containing directory 1181 */ 1182 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1183 smk_ad_setfield_u_fs_inode(&ad, dir); 1184 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1185 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1186 } 1187 1188 return rc; 1189 } 1190 1191 /** 1192 * smack_inode_rename - Smack check on rename 1193 * @old_inode: unused 1194 * @old_dentry: the old object 1195 * @new_inode: unused 1196 * @new_dentry: the new object 1197 * 1198 * Read and write access is required on both the old and 1199 * new directories. 1200 * 1201 * Returns 0 if access is permitted, an error code otherwise 1202 */ 1203 static int smack_inode_rename(struct inode *old_inode, 1204 struct dentry *old_dentry, 1205 struct inode *new_inode, 1206 struct dentry *new_dentry) 1207 { 1208 int rc; 1209 struct smack_known *isp; 1210 struct smk_audit_info ad; 1211 1212 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1213 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1214 1215 isp = smk_of_inode(d_backing_inode(old_dentry)); 1216 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1217 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc); 1218 1219 if (rc == 0 && d_is_positive(new_dentry)) { 1220 isp = smk_of_inode(d_backing_inode(new_dentry)); 1221 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1222 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1223 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc); 1224 } 1225 return rc; 1226 } 1227 1228 /** 1229 * smack_inode_permission - Smack version of permission() 1230 * @idmap: idmap of the mount 1231 * @inode: the inode in question 1232 * @mask: the access requested 1233 * 1234 * This is the important Smack hook. 1235 * 1236 * Returns 0 if access is permitted, an error code otherwise 1237 */ 1238 static int smack_inode_permission(const struct mnt_idmap *idmap, struct inode *inode, 1239 int mask) 1240 { 1241 struct superblock_smack *sbsp = smack_superblock(inode->i_sb); 1242 struct smk_audit_info ad; 1243 int no_block = mask & MAY_NOT_BLOCK; 1244 int rc; 1245 1246 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 1247 /* 1248 * No permission to check. Existence test. Yup, it's there. 1249 */ 1250 if (mask == 0) 1251 return 0; 1252 1253 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) { 1254 if (smk_of_inode(inode) != sbsp->smk_root) 1255 return -EACCES; 1256 } 1257 1258 /* May be droppable after audit */ 1259 if (no_block) 1260 return -ECHILD; 1261 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1262 smk_ad_setfield_u_fs_inode(&ad, inode); 1263 rc = smk_curacc(smk_of_inode(inode), mask, &ad); 1264 rc = smk_bu_inode(inode, mask, rc); 1265 return rc; 1266 } 1267 1268 /** 1269 * smack_inode_setattr - Smack check for setting attributes 1270 * @idmap: idmap of the mount 1271 * @dentry: the object 1272 * @iattr: for the force flag 1273 * 1274 * Returns 0 if access is permitted, an error code otherwise 1275 */ 1276 static int smack_inode_setattr(const struct mnt_idmap *idmap, struct dentry *dentry, 1277 struct iattr *iattr) 1278 { 1279 struct smk_audit_info ad; 1280 int rc; 1281 1282 /* 1283 * Need to allow for clearing the setuid bit. 1284 */ 1285 if (iattr->ia_valid & ATTR_FORCE) 1286 return 0; 1287 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1288 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1289 1290 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1291 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1292 return rc; 1293 } 1294 1295 /** 1296 * smack_inode_getattr - Smack check for getting attributes 1297 * @path: path to extract the info from 1298 * 1299 * Returns 0 if access is permitted, an error code otherwise 1300 */ 1301 static int smack_inode_getattr(const struct path *path) 1302 { 1303 struct smk_audit_info ad; 1304 struct inode *inode = d_backing_inode(path->dentry); 1305 int rc; 1306 1307 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1308 smk_ad_setfield_u_fs_path(&ad, *path); 1309 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1310 rc = smk_bu_inode(inode, MAY_READ, rc); 1311 return rc; 1312 } 1313 1314 /** 1315 * smack_inode_xattr_skipcap - Skip the xattr capability checks? 1316 * @name: name of the xattr 1317 * 1318 * Returns 1 to indicate that Smack "owns" the access control rights to xattrs 1319 * named @name; the LSM layer should avoid enforcing any traditional 1320 * capability based access controls on this xattr. Returns 0 to indicate that 1321 * Smack does not "own" the access control rights to xattrs named @name and is 1322 * deferring to the LSM layer for further access controls, including capability 1323 * based controls. 1324 */ 1325 static int smack_inode_xattr_skipcap(const char *name) 1326 { 1327 if (strncmp(name, XATTR_SMACK_SUFFIX, strlen(XATTR_SMACK_SUFFIX)) == 0) 1328 return 0; 1329 1330 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1331 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1332 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 1333 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1334 strcmp(name, XATTR_NAME_SMACKMMAP) == 0 || 1335 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 1336 return 1; 1337 1338 return 0; 1339 } 1340 1341 /** 1342 * smack_inode_setxattr - Smack check for setting xattrs 1343 * @idmap: idmap of the mount 1344 * @dentry: the object 1345 * @name: name of the attribute 1346 * @value: value of the attribute 1347 * @size: size of the value 1348 * @flags: unused 1349 * 1350 * This protects the Smack attribute explicitly. 1351 * 1352 * Returns 0 if access is permitted, an error code otherwise 1353 */ 1354 static int smack_inode_setxattr(const struct mnt_idmap *idmap, 1355 struct dentry *dentry, const char *name, 1356 const void *value, size_t size, int flags) 1357 { 1358 struct smk_audit_info ad; 1359 struct smack_known *skp; 1360 int check_priv = 0; 1361 int check_import = 0; 1362 int check_star = 0; 1363 int rc = 0; 1364 umode_t const i_mode = d_backing_inode(dentry)->i_mode; 1365 1366 /* 1367 * Check label validity here so import won't fail in post_setxattr 1368 */ 1369 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1370 /* 1371 * UDS inode has fixed label 1372 */ 1373 if (S_ISSOCK(i_mode)) { 1374 rc = -EINVAL; 1375 } else { 1376 check_priv = 1; 1377 check_import = 1; 1378 } 1379 } else if (strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1380 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) { 1381 check_priv = 1; 1382 check_import = 1; 1383 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1384 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1385 check_priv = 1; 1386 check_import = 1; 1387 check_star = 1; 1388 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1389 check_priv = 1; 1390 if (!S_ISDIR(i_mode) || 1391 size != TRANS_TRUE_SIZE || 1392 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 1393 rc = -EINVAL; 1394 } 1395 1396 if (check_priv && !smack_privileged(CAP_MAC_ADMIN)) 1397 rc = -EPERM; 1398 1399 if (rc == 0 && check_import) { 1400 skp = size ? smk_import_entry(value, size) : NULL; 1401 if (IS_ERR(skp)) 1402 rc = PTR_ERR(skp); 1403 else if (skp == NULL || (check_star && 1404 (skp == &smack_known_star || skp == &smack_known_web))) 1405 rc = -EINVAL; 1406 } 1407 1408 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1409 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1410 1411 if (rc == 0) { 1412 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1413 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1414 } 1415 1416 return rc; 1417 } 1418 1419 /** 1420 * smack_inode_post_setxattr - Apply the Smack update approved above 1421 * @dentry: object 1422 * @name: attribute name 1423 * @value: attribute value 1424 * @size: attribute size 1425 * @flags: unused 1426 * 1427 * Set the pointer in the inode blob to the entry found 1428 * in the master label list. 1429 */ 1430 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, 1431 const void *value, size_t size, int flags) 1432 { 1433 struct smack_known *skp; 1434 struct inode_smack *isp = smack_inode(d_backing_inode(dentry)); 1435 1436 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1437 isp->smk_flags |= SMK_INODE_TRANSMUTE; 1438 return; 1439 } 1440 1441 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1442 skp = smk_import_entry(value, size); 1443 if (!IS_ERR(skp)) 1444 isp->smk_inode = skp; 1445 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 1446 skp = smk_import_entry(value, size); 1447 if (!IS_ERR(skp)) 1448 isp->smk_task = skp; 1449 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1450 skp = smk_import_entry(value, size); 1451 if (!IS_ERR(skp)) 1452 isp->smk_mmap = skp; 1453 } 1454 1455 return; 1456 } 1457 1458 /** 1459 * smack_inode_getxattr - Smack check on getxattr 1460 * @dentry: the object 1461 * @name: unused 1462 * 1463 * Returns 0 if access is permitted, an error code otherwise 1464 */ 1465 static int smack_inode_getxattr(struct dentry *dentry, const char *name) 1466 { 1467 struct smk_audit_info ad; 1468 int rc; 1469 1470 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1471 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1472 1473 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad); 1474 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc); 1475 return rc; 1476 } 1477 1478 /** 1479 * smack_inode_removexattr - Smack check on removexattr 1480 * @idmap: idmap of the mount 1481 * @dentry: the object 1482 * @name: name of the attribute 1483 * 1484 * Removing the Smack attribute requires CAP_MAC_ADMIN 1485 * 1486 * Returns 0 if access is permitted, an error code otherwise 1487 */ 1488 static int smack_inode_removexattr(const struct mnt_idmap *idmap, 1489 struct dentry *dentry, const char *name) 1490 { 1491 struct inode_smack *isp; 1492 struct smk_audit_info ad; 1493 int rc = 0; 1494 1495 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1496 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1497 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 1498 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1499 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 || 1500 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1501 if (!smack_privileged(CAP_MAC_ADMIN)) 1502 rc = -EPERM; 1503 } 1504 1505 if (rc != 0) 1506 return rc; 1507 1508 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1509 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1510 1511 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1512 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1513 if (rc != 0) 1514 return rc; 1515 1516 isp = smack_inode(d_backing_inode(dentry)); 1517 /* 1518 * Don't do anything special for these. 1519 * XATTR_NAME_SMACKIPIN 1520 * XATTR_NAME_SMACKIPOUT 1521 * XATTR_NAME_SMACK if S_ISSOCK (UDS inode has fixed label) 1522 */ 1523 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1524 if (!S_ISSOCK(d_backing_inode(dentry)->i_mode)) { 1525 struct super_block *sbp = dentry->d_sb; 1526 struct superblock_smack *sbsp = smack_superblock(sbp); 1527 1528 isp->smk_inode = sbsp->smk_default; 1529 } 1530 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) 1531 isp->smk_task = NULL; 1532 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) 1533 isp->smk_mmap = NULL; 1534 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 1535 isp->smk_flags &= ~SMK_INODE_TRANSMUTE; 1536 1537 return 0; 1538 } 1539 1540 /** 1541 * smack_inode_set_acl - Smack check for setting posix acls 1542 * @idmap: idmap of the mnt this request came from 1543 * @dentry: the object 1544 * @acl_name: name of the posix acl 1545 * @kacl: the posix acls 1546 * 1547 * Returns 0 if access is permitted, an error code otherwise 1548 */ 1549 static int smack_inode_set_acl(const struct mnt_idmap *idmap, 1550 struct dentry *dentry, const char *acl_name, 1551 struct posix_acl *kacl) 1552 { 1553 struct smk_audit_info ad; 1554 int rc; 1555 1556 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1557 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1558 1559 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1560 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1561 return rc; 1562 } 1563 1564 /** 1565 * smack_inode_get_acl - Smack check for getting posix acls 1566 * @idmap: idmap of the mnt this request came from 1567 * @dentry: the object 1568 * @acl_name: name of the posix acl 1569 * 1570 * Returns 0 if access is permitted, an error code otherwise 1571 */ 1572 static int smack_inode_get_acl(const struct mnt_idmap *idmap, 1573 struct dentry *dentry, const char *acl_name) 1574 { 1575 struct smk_audit_info ad; 1576 int rc; 1577 1578 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1579 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1580 1581 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad); 1582 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc); 1583 return rc; 1584 } 1585 1586 /** 1587 * smack_inode_remove_acl - Smack check for getting posix acls 1588 * @idmap: idmap of the mnt this request came from 1589 * @dentry: the object 1590 * @acl_name: name of the posix acl 1591 * 1592 * Returns 0 if access is permitted, an error code otherwise 1593 */ 1594 static int smack_inode_remove_acl(const struct mnt_idmap *idmap, 1595 struct dentry *dentry, const char *acl_name) 1596 { 1597 struct smk_audit_info ad; 1598 int rc; 1599 1600 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1601 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1602 1603 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1604 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1605 return rc; 1606 } 1607 1608 /** 1609 * smack_inode_getsecurity - get smack xattrs 1610 * @idmap: idmap of the mount 1611 * @inode: the object 1612 * @name: attribute name 1613 * @buffer: where to put the result 1614 * @alloc: duplicate memory 1615 * 1616 * Returns the size of the attribute or an error code 1617 */ 1618 static int smack_inode_getsecurity(const struct mnt_idmap *idmap, 1619 struct inode *inode, const char *name, 1620 void **buffer, bool alloc) 1621 { 1622 struct socket_smack *ssp; 1623 struct socket *sock; 1624 struct super_block *sbp; 1625 struct inode *ip = inode; 1626 struct smack_known *isp; 1627 struct inode_smack *ispp; 1628 size_t label_len; 1629 char *label = NULL; 1630 1631 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 1632 isp = smk_of_inode(inode); 1633 } else if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { 1634 ispp = smack_inode(inode); 1635 if (ispp->smk_flags & SMK_INODE_TRANSMUTE) 1636 label = TRANS_TRUE; 1637 else 1638 label = ""; 1639 } else { 1640 /* 1641 * The rest of the Smack xattrs are only on sockets. 1642 */ 1643 sbp = ip->i_sb; 1644 if (sbp->s_magic != SOCKFS_MAGIC) 1645 return -EOPNOTSUPP; 1646 1647 sock = SOCKET_I(ip); 1648 if (sock == NULL || sock->sk == NULL) 1649 return -EOPNOTSUPP; 1650 1651 ssp = smack_sock(sock->sk); 1652 1653 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1654 isp = ssp->smk_in; 1655 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 1656 isp = ssp->smk_out; 1657 else 1658 return -EOPNOTSUPP; 1659 } 1660 1661 if (!label) 1662 label = isp->smk_known; 1663 1664 label_len = strlen(label); 1665 1666 if (alloc) { 1667 *buffer = kstrdup(label, GFP_KERNEL); 1668 if (*buffer == NULL) 1669 return -ENOMEM; 1670 } 1671 1672 return label_len; 1673 } 1674 1675 1676 /** 1677 * smack_inode_listsecurity - list the Smack attributes 1678 * @inode: the object 1679 * @buffer: where they go 1680 * @remaining_size: size of buffer 1681 */ 1682 static int smack_inode_listsecurity(struct inode *inode, char **buffer, 1683 ssize_t *remaining_size) 1684 { 1685 return xattr_list_one(buffer, remaining_size, XATTR_NAME_SMACK); 1686 } 1687 1688 /** 1689 * smack_inode_getlsmprop - Extract inode's security id 1690 * @inode: inode to extract the info from 1691 * @prop: where result will be saved 1692 */ 1693 static void smack_inode_getlsmprop(struct inode *inode, struct lsm_prop *prop) 1694 { 1695 prop->smack.skp = smk_of_inode(inode); 1696 } 1697 1698 /* 1699 * File Hooks 1700 */ 1701 1702 /* 1703 * There is no smack_file_permission hook 1704 * 1705 * Should access checks be done on each read or write? 1706 * UNICOS and SELinux say yes. 1707 * Trusted Solaris, Trusted Irix, and just about everyone else says no. 1708 * 1709 * I'll say no for now. Smack does not do the frequent 1710 * label changing that SELinux does. 1711 */ 1712 1713 /** 1714 * smack_file_alloc_security - assign a file security blob 1715 * @file: the object 1716 * 1717 * The security blob for a file is a pointer to the master 1718 * label list, so no allocation is done. 1719 * 1720 * f_security is the owner security information. It 1721 * isn't used on file access checks, it's for send_sigio. 1722 * 1723 * Returns 0 1724 */ 1725 static int smack_file_alloc_security(struct file *file) 1726 { 1727 struct smack_known **blob = smack_file(file); 1728 1729 *blob = smk_of_current(); 1730 return 0; 1731 } 1732 1733 /** 1734 * smack_file_ioctl - Smack check on ioctls 1735 * @file: the object 1736 * @cmd: what to do 1737 * @arg: unused 1738 * 1739 * Relies heavily on the correct use of the ioctl command conventions. 1740 * 1741 * Returns 0 if allowed, error code otherwise 1742 */ 1743 static int smack_file_ioctl(struct file *file, unsigned int cmd, 1744 unsigned long arg) 1745 { 1746 int rc = 0; 1747 struct smk_audit_info ad; 1748 struct inode *inode = file_inode(file); 1749 1750 if (unlikely(IS_PRIVATE(inode))) 1751 return 0; 1752 1753 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1754 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1755 1756 if (_IOC_DIR(cmd) & _IOC_WRITE) { 1757 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1758 rc = smk_bu_file(file, MAY_WRITE, rc); 1759 } 1760 1761 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) { 1762 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1763 rc = smk_bu_file(file, MAY_READ, rc); 1764 } 1765 1766 return rc; 1767 } 1768 1769 /** 1770 * smack_file_lock - Smack check on file locking 1771 * @file: the object 1772 * @cmd: unused 1773 * 1774 * Returns 0 if current has lock access, error code otherwise 1775 */ 1776 static int smack_file_lock(struct file *file, unsigned int cmd) 1777 { 1778 struct smk_audit_info ad; 1779 int rc; 1780 struct inode *inode = file_inode(file); 1781 1782 if (unlikely(IS_PRIVATE(inode))) 1783 return 0; 1784 1785 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1786 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1787 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1788 rc = smk_bu_file(file, MAY_LOCK, rc); 1789 return rc; 1790 } 1791 1792 /** 1793 * smack_file_fcntl - Smack check on fcntl 1794 * @file: the object 1795 * @cmd: what action to check 1796 * @arg: unused 1797 * 1798 * Generally these operations are harmless. 1799 * File locking operations present an obvious mechanism 1800 * for passing information, so they require write access. 1801 * 1802 * Returns 0 if current has access, error code otherwise 1803 */ 1804 static int smack_file_fcntl(struct file *file, unsigned int cmd, 1805 unsigned long arg) 1806 { 1807 struct smk_audit_info ad; 1808 int rc = 0; 1809 struct inode *inode = file_inode(file); 1810 1811 if (unlikely(IS_PRIVATE(inode))) 1812 return 0; 1813 1814 switch (cmd) { 1815 case F_GETLK: 1816 break; 1817 case F_SETLK: 1818 case F_SETLKW: 1819 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1820 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1821 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1822 rc = smk_bu_file(file, MAY_LOCK, rc); 1823 break; 1824 case F_SETOWN: 1825 case F_SETSIG: 1826 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1827 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1828 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1829 rc = smk_bu_file(file, MAY_WRITE, rc); 1830 break; 1831 default: 1832 break; 1833 } 1834 1835 return rc; 1836 } 1837 1838 /** 1839 * smack_mmap_file - Check permissions for a mmap operation. 1840 * @file: contains the file structure for file to map (may be NULL). 1841 * @reqprot: contains the protection requested by the application. 1842 * @prot: contains the protection that will be applied by the kernel. 1843 * @flags: contains the operational flags. 1844 * 1845 * The @file may be NULL, e.g. if mapping anonymous memory. 1846 * 1847 * Return 0 if permission is granted. 1848 */ 1849 static int smack_mmap_file(struct file *file, 1850 unsigned long reqprot, unsigned long prot, 1851 unsigned long flags) 1852 { 1853 struct smack_known *skp; 1854 struct smack_known *mkp; 1855 struct smack_rule *srp; 1856 struct task_smack *tsp; 1857 struct smack_known *okp; 1858 struct inode_smack *isp; 1859 struct superblock_smack *sbsp; 1860 int may; 1861 int mmay; 1862 int tmay; 1863 int rc; 1864 1865 if (file == NULL) 1866 return 0; 1867 1868 if (unlikely(IS_PRIVATE(file_inode(file)))) 1869 return 0; 1870 1871 isp = smack_inode(file_inode(file)); 1872 if (isp->smk_mmap == NULL) 1873 return 0; 1874 sbsp = smack_superblock(file_inode(file)->i_sb); 1875 if (sbsp->smk_flags & SMK_SB_UNTRUSTED && 1876 isp->smk_mmap != sbsp->smk_root) 1877 return -EACCES; 1878 mkp = isp->smk_mmap; 1879 1880 tsp = smack_cred(current_cred()); 1881 skp = smk_of_current(); 1882 rc = 0; 1883 1884 rcu_read_lock(); 1885 /* 1886 * For each Smack rule associated with the subject 1887 * label verify that the SMACK64MMAP also has access 1888 * to that rule's object label. 1889 */ 1890 list_for_each_entry_rcu(srp, &skp->smk_rules, list) { 1891 okp = srp->smk_object; 1892 /* 1893 * Matching labels always allows access. 1894 */ 1895 if (mkp->smk_known == okp->smk_known) 1896 continue; 1897 /* 1898 * If there is a matching local rule take 1899 * that into account as well. 1900 */ 1901 may = smk_access_entry(srp->smk_subject->smk_known, 1902 okp->smk_known, 1903 &tsp->smk_rules); 1904 if (may == -ENOENT) 1905 may = srp->smk_access; 1906 else 1907 may &= srp->smk_access; 1908 /* 1909 * If may is zero the SMACK64MMAP subject can't 1910 * possibly have less access. 1911 */ 1912 if (may == 0) 1913 continue; 1914 1915 /* 1916 * Fetch the global list entry. 1917 * If there isn't one a SMACK64MMAP subject 1918 * can't have as much access as current. 1919 */ 1920 mmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1921 &mkp->smk_rules); 1922 if (mmay == -ENOENT) { 1923 rc = -EACCES; 1924 break; 1925 } 1926 /* 1927 * If there is a local entry it modifies the 1928 * potential access, too. 1929 */ 1930 tmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1931 &tsp->smk_rules); 1932 if (tmay != -ENOENT) 1933 mmay &= tmay; 1934 1935 /* 1936 * If there is any access available to current that is 1937 * not available to a SMACK64MMAP subject 1938 * deny access. 1939 */ 1940 if ((may | mmay) != mmay) { 1941 rc = -EACCES; 1942 break; 1943 } 1944 } 1945 1946 rcu_read_unlock(); 1947 1948 return rc; 1949 } 1950 1951 /** 1952 * smack_file_set_fowner - set the file security blob value 1953 * @file: object in question 1954 * 1955 */ 1956 static void smack_file_set_fowner(struct file *file) 1957 { 1958 struct smack_known **blob = smack_file(file); 1959 1960 *blob = smk_of_current(); 1961 } 1962 1963 /** 1964 * smack_file_send_sigiotask - Smack on sigio 1965 * @tsk: The target task 1966 * @fown: the object the signal come from 1967 * @signum: unused 1968 * 1969 * Allow a privileged task to get signals even if it shouldn't 1970 * 1971 * Returns 0 if a subject with the object's smack could 1972 * write to the task, an error code otherwise. 1973 */ 1974 static int smack_file_send_sigiotask(struct task_struct *tsk, 1975 struct fown_struct *fown, int signum) 1976 { 1977 struct smack_known **blob; 1978 struct smack_known *skp; 1979 struct smack_known *tkp = smk_of_task_struct_obj(tsk); 1980 const struct cred *tcred; 1981 struct file *file; 1982 int rc; 1983 struct smk_audit_info ad; 1984 1985 /* 1986 * struct fown_struct is never outside the context of a struct file 1987 */ 1988 file = fown->file; 1989 1990 /* we don't log here as rc can be overridden */ 1991 blob = smack_file(file); 1992 skp = *blob; 1993 rc = smk_access(skp, tkp, MAY_DELIVER, NULL); 1994 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc); 1995 1996 rcu_read_lock(); 1997 tcred = __task_cred(tsk); 1998 if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred)) 1999 rc = 0; 2000 rcu_read_unlock(); 2001 2002 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 2003 smk_ad_setfield_u_tsk(&ad, tsk); 2004 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad); 2005 return rc; 2006 } 2007 2008 /** 2009 * smack_file_receive - Smack file receive check 2010 * @file: the object 2011 * 2012 * Returns 0 if current has access, error code otherwise 2013 */ 2014 static int smack_file_receive(struct file *file) 2015 { 2016 int rc; 2017 int may = 0; 2018 struct smk_audit_info ad; 2019 struct inode *inode = file_inode(file); 2020 struct socket *sock; 2021 struct task_smack *tsp; 2022 struct socket_smack *ssp; 2023 2024 if (unlikely(IS_PRIVATE(inode))) 2025 return 0; 2026 2027 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 2028 smk_ad_setfield_u_fs_path(&ad, file->f_path); 2029 2030 if (inode->i_sb->s_magic == SOCKFS_MAGIC) { 2031 sock = SOCKET_I(inode); 2032 ssp = smack_sock(sock->sk); 2033 tsp = smack_cred(current_cred()); 2034 /* 2035 * If the receiving process can't write to the 2036 * passed socket or if the passed socket can't 2037 * write to the receiving process don't accept 2038 * the passed socket. 2039 */ 2040 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); 2041 rc = smk_bu_file(file, may, rc); 2042 if (rc < 0) 2043 return rc; 2044 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); 2045 rc = smk_bu_file(file, may, rc); 2046 return rc; 2047 } 2048 /* 2049 * This code relies on bitmasks. 2050 */ 2051 if (file->f_mode & FMODE_READ) 2052 may = MAY_READ; 2053 if (file->f_mode & FMODE_WRITE) 2054 may |= MAY_WRITE; 2055 2056 rc = smk_curacc(smk_of_inode(inode), may, &ad); 2057 rc = smk_bu_file(file, may, rc); 2058 return rc; 2059 } 2060 2061 /** 2062 * smack_file_open - Smack dentry open processing 2063 * @file: the object 2064 * 2065 * Set the security blob in the file structure. 2066 * Allow the open only if the task has read access. There are 2067 * many read operations (e.g. fstat) that you can do with an 2068 * fd even if you have the file open write-only. 2069 * 2070 * Returns 0 if current has access, error code otherwise 2071 */ 2072 static int smack_file_open(struct file *file) 2073 { 2074 struct task_smack *tsp = smack_cred(file->f_cred); 2075 struct inode *inode = file_inode(file); 2076 struct smk_audit_info ad; 2077 int rc; 2078 2079 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 2080 smk_ad_setfield_u_fs_path(&ad, file->f_path); 2081 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad); 2082 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc); 2083 2084 return rc; 2085 } 2086 2087 /* 2088 * Task hooks 2089 */ 2090 2091 /** 2092 * smack_cred_alloc_blank - "allocate" blank task-level security credentials 2093 * @cred: the new credentials 2094 * @gfp: the atomicity of any memory allocations 2095 * 2096 * Prepare a blank set of credentials for modification. This must allocate all 2097 * the memory the LSM module might require such that cred_transfer() can 2098 * complete without error. 2099 */ 2100 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp) 2101 { 2102 init_task_smack(smack_cred(cred), NULL, NULL); 2103 return 0; 2104 } 2105 2106 2107 /** 2108 * smack_cred_free - "free" task-level security credentials 2109 * @cred: the credentials in question 2110 * 2111 */ 2112 static void smack_cred_free(struct cred *cred) 2113 { 2114 struct task_smack *tsp = smack_cred(cred); 2115 struct smack_rule *rp; 2116 struct list_head *l; 2117 struct list_head *n; 2118 2119 smk_destroy_label_list(&tsp->smk_relabel); 2120 2121 list_for_each_safe(l, n, &tsp->smk_rules) { 2122 rp = list_entry(l, struct smack_rule, list); 2123 list_del(&rp->list); 2124 kmem_cache_free(smack_rule_cache, rp); 2125 } 2126 } 2127 2128 /** 2129 * smack_cred_prepare - prepare new set of credentials for modification 2130 * @new: the new credentials 2131 * @old: the original credentials 2132 * @gfp: the atomicity of any memory allocations 2133 * 2134 * Prepare a new set of credentials for modification. 2135 */ 2136 static int smack_cred_prepare(struct cred *new, const struct cred *old, 2137 gfp_t gfp) 2138 { 2139 struct task_smack *old_tsp = smack_cred(old); 2140 struct task_smack *new_tsp = smack_cred(new); 2141 int rc; 2142 2143 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task); 2144 2145 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp); 2146 if (rc != 0) 2147 return rc; 2148 2149 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel, 2150 gfp); 2151 return rc; 2152 } 2153 2154 /** 2155 * smack_cred_transfer - Transfer the old credentials to the new credentials 2156 * @new: the new credentials 2157 * @old: the original credentials 2158 * 2159 * Fill in a set of blank credentials from another set of credentials. 2160 */ 2161 static void smack_cred_transfer(struct cred *new, const struct cred *old) 2162 { 2163 struct task_smack *old_tsp = smack_cred(old); 2164 struct task_smack *new_tsp = smack_cred(new); 2165 2166 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task); 2167 } 2168 2169 /** 2170 * smack_cred_getsecid - get the secid corresponding to a creds structure 2171 * @cred: the object creds 2172 * @secid: where to put the result 2173 * 2174 * Sets the secid to contain a u32 version of the smack label. 2175 */ 2176 static void smack_cred_getsecid(const struct cred *cred, u32 *secid) 2177 { 2178 struct smack_known *skp; 2179 2180 rcu_read_lock(); 2181 skp = smk_of_task(smack_cred(cred)); 2182 *secid = skp->smk_secid; 2183 rcu_read_unlock(); 2184 } 2185 2186 /** 2187 * smack_cred_getlsmprop - get the Smack label for a creds structure 2188 * @cred: the object creds 2189 * @prop: where to put the data 2190 * 2191 * Sets the Smack part of the ref 2192 */ 2193 static void smack_cred_getlsmprop(const struct cred *cred, 2194 struct lsm_prop *prop) 2195 { 2196 rcu_read_lock(); 2197 prop->smack.skp = smk_of_task(smack_cred(cred)); 2198 rcu_read_unlock(); 2199 } 2200 2201 /** 2202 * smack_kernel_act_as - Set the subjective context in a set of credentials 2203 * @new: points to the set of credentials to be modified. 2204 * @secid: specifies the security ID to be set 2205 * 2206 * Set the security data for a kernel service. 2207 */ 2208 static int smack_kernel_act_as(struct cred *new, u32 secid) 2209 { 2210 struct task_smack *new_tsp = smack_cred(new); 2211 2212 new_tsp->smk_task = smack_from_secid(secid); 2213 return 0; 2214 } 2215 2216 /** 2217 * smack_kernel_create_files_as - Set the file creation label in a set of creds 2218 * @new: points to the set of credentials to be modified 2219 * @inode: points to the inode to use as a reference 2220 * 2221 * Set the file creation context in a set of credentials to the same 2222 * as the objective context of the specified inode 2223 */ 2224 static int smack_kernel_create_files_as(struct cred *new, 2225 struct inode *inode) 2226 { 2227 struct inode_smack *isp = smack_inode(inode); 2228 struct task_smack *tsp = smack_cred(new); 2229 2230 tsp->smk_forked = isp->smk_inode; 2231 tsp->smk_task = tsp->smk_forked; 2232 return 0; 2233 } 2234 2235 /** 2236 * smk_curacc_on_task - helper to log task related access 2237 * @p: the task object 2238 * @access: the access requested 2239 * @caller: name of the calling function for audit 2240 * 2241 * Return 0 if access is permitted 2242 */ 2243 static int smk_curacc_on_task(struct task_struct *p, int access, 2244 const char *caller) 2245 { 2246 struct smk_audit_info ad; 2247 struct smack_known *skp = smk_of_task_struct_obj(p); 2248 int rc; 2249 2250 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); 2251 smk_ad_setfield_u_tsk(&ad, p); 2252 rc = smk_curacc(skp, access, &ad); 2253 rc = smk_bu_task(p, access, rc); 2254 return rc; 2255 } 2256 2257 /** 2258 * smack_task_setpgid - Smack check on setting pgid 2259 * @p: the task object 2260 * @pgid: unused 2261 * 2262 * Return 0 if write access is permitted 2263 */ 2264 static int smack_task_setpgid(struct task_struct *p, pid_t pgid) 2265 { 2266 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2267 } 2268 2269 /** 2270 * smack_task_getpgid - Smack access check for getpgid 2271 * @p: the object task 2272 * 2273 * Returns 0 if current can read the object task, error code otherwise 2274 */ 2275 static int smack_task_getpgid(struct task_struct *p) 2276 { 2277 return smk_curacc_on_task(p, MAY_READ, __func__); 2278 } 2279 2280 /** 2281 * smack_task_getsid - Smack access check for getsid 2282 * @p: the object task 2283 * 2284 * Returns 0 if current can read the object task, error code otherwise 2285 */ 2286 static int smack_task_getsid(struct task_struct *p) 2287 { 2288 return smk_curacc_on_task(p, MAY_READ, __func__); 2289 } 2290 2291 /** 2292 * smack_current_getlsmprop_subj - get the subjective secid of the current task 2293 * @prop: where to put the result 2294 * 2295 * Sets the secid to contain a u32 version of the task's subjective smack label. 2296 */ 2297 static void smack_current_getlsmprop_subj(struct lsm_prop *prop) 2298 { 2299 prop->smack.skp = smk_of_current(); 2300 } 2301 2302 /** 2303 * smack_task_getlsmprop_obj - get the objective data of the task 2304 * @p: the task 2305 * @prop: where to put the result 2306 * 2307 * Sets the secid to contain a u32 version of the task's objective smack label. 2308 */ 2309 static void smack_task_getlsmprop_obj(struct task_struct *p, 2310 struct lsm_prop *prop) 2311 { 2312 prop->smack.skp = smk_of_task_struct_obj(p); 2313 } 2314 2315 /** 2316 * smack_task_setnice - Smack check on setting nice 2317 * @p: the task object 2318 * @nice: unused 2319 * 2320 * Return 0 if write access is permitted 2321 */ 2322 static int smack_task_setnice(struct task_struct *p, int nice) 2323 { 2324 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2325 } 2326 2327 /** 2328 * smack_task_setioprio - Smack check on setting ioprio 2329 * @p: the task object 2330 * @ioprio: unused 2331 * 2332 * Return 0 if write access is permitted 2333 */ 2334 static int smack_task_setioprio(struct task_struct *p, int ioprio) 2335 { 2336 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2337 } 2338 2339 /** 2340 * smack_task_getioprio - Smack check on reading ioprio 2341 * @p: the task object 2342 * 2343 * Return 0 if read access is permitted 2344 */ 2345 static int smack_task_getioprio(struct task_struct *p) 2346 { 2347 return smk_curacc_on_task(p, MAY_READ, __func__); 2348 } 2349 2350 /** 2351 * smack_task_setscheduler - Smack check on setting scheduler 2352 * @p: the task object 2353 * 2354 * Return 0 if read access is permitted 2355 */ 2356 static int smack_task_setscheduler(struct task_struct *p) 2357 { 2358 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2359 } 2360 2361 /** 2362 * smack_task_getscheduler - Smack check on reading scheduler 2363 * @p: the task object 2364 * 2365 * Return 0 if read access is permitted 2366 */ 2367 static int smack_task_getscheduler(struct task_struct *p) 2368 { 2369 return smk_curacc_on_task(p, MAY_READ, __func__); 2370 } 2371 2372 /** 2373 * smack_task_movememory - Smack check on moving memory 2374 * @p: the task object 2375 * 2376 * Return 0 if write access is permitted 2377 */ 2378 static int smack_task_movememory(struct task_struct *p) 2379 { 2380 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2381 } 2382 2383 /** 2384 * smack_task_kill - Smack check on signal delivery 2385 * @p: the task object 2386 * @info: unused 2387 * @sig: unused 2388 * @cred: identifies the cred to use in lieu of current's 2389 * 2390 * Return 0 if write access is permitted 2391 * 2392 */ 2393 static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info, 2394 int sig, const struct cred *cred) 2395 { 2396 struct smk_audit_info ad; 2397 struct smack_known *skp; 2398 struct smack_known *tkp = smk_of_task_struct_obj(p); 2399 int rc; 2400 2401 if (!sig) 2402 return 0; /* null signal; existence test */ 2403 2404 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 2405 smk_ad_setfield_u_tsk(&ad, p); 2406 /* 2407 * Sending a signal requires that the sender 2408 * can write the receiver. 2409 */ 2410 if (cred == NULL) { 2411 rc = smk_curacc(tkp, MAY_DELIVER, &ad); 2412 rc = smk_bu_task(p, MAY_DELIVER, rc); 2413 return rc; 2414 } 2415 /* 2416 * If the cred isn't NULL we're dealing with some USB IO 2417 * specific behavior. This is not clean. For one thing 2418 * we can't take privilege into account. 2419 */ 2420 skp = smk_of_task(smack_cred(cred)); 2421 rc = smk_access(skp, tkp, MAY_DELIVER, &ad); 2422 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc); 2423 return rc; 2424 } 2425 2426 /** 2427 * smack_task_to_inode - copy task smack into the inode blob 2428 * @p: task to copy from 2429 * @inode: inode to copy to 2430 * 2431 * Sets the smack pointer in the inode security blob 2432 */ 2433 static void smack_task_to_inode(struct task_struct *p, struct inode *inode) 2434 { 2435 struct inode_smack *isp = smack_inode(inode); 2436 struct smack_known *skp = smk_of_task_struct_obj(p); 2437 2438 isp->smk_inode = skp; 2439 isp->smk_flags |= SMK_INODE_INSTANT; 2440 } 2441 2442 /* 2443 * Socket hooks. 2444 */ 2445 2446 /** 2447 * smack_sk_alloc_security - Allocate a socket blob 2448 * @sk: the socket 2449 * @family: unused 2450 * @gfp_flags: memory allocation flags 2451 * 2452 * Assign Smack pointers to current 2453 * 2454 * Returns 0 on success, -ENOMEM is there's no memory 2455 */ 2456 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) 2457 { 2458 struct smack_known *skp = smk_of_current(); 2459 struct socket_smack *ssp = smack_sock(sk); 2460 2461 /* 2462 * Sockets created by kernel threads receive web label. 2463 */ 2464 if (unlikely(current->flags & PF_KTHREAD)) { 2465 ssp->smk_in = &smack_known_web; 2466 ssp->smk_out = &smack_known_web; 2467 } else { 2468 ssp->smk_in = skp; 2469 ssp->smk_out = skp; 2470 } 2471 ssp->smk_packet = NULL; 2472 2473 return 0; 2474 } 2475 2476 #ifdef SMACK_IPV6_PORT_LABELING 2477 /** 2478 * smack_sk_free_security - Free a socket blob 2479 * @sk: the socket 2480 * 2481 * Clears the blob pointer 2482 */ 2483 static void smack_sk_free_security(struct sock *sk) 2484 { 2485 struct smk_port_label *spp; 2486 2487 if (sk->sk_family == PF_INET6) { 2488 rcu_read_lock(); 2489 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2490 if (spp->smk_sock != sk) 2491 continue; 2492 spp->smk_can_reuse = 1; 2493 break; 2494 } 2495 rcu_read_unlock(); 2496 } 2497 } 2498 #endif 2499 2500 /** 2501 * smack_sk_clone_security - Copy security context 2502 * @sk: the old socket 2503 * @newsk: the new socket 2504 * 2505 * Copy the security context of the old socket pointer to the cloned 2506 */ 2507 static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk) 2508 { 2509 struct socket_smack *ssp_old = smack_sock(sk); 2510 struct socket_smack *ssp_new = smack_sock(newsk); 2511 2512 *ssp_new = *ssp_old; 2513 } 2514 2515 /** 2516 * smack_ipv4host_label - check host based restrictions 2517 * @sip: the object end 2518 * 2519 * looks for host based access restrictions 2520 * 2521 * This version will only be appropriate for really small sets of single label 2522 * hosts. The caller is responsible for ensuring that the RCU read lock is 2523 * taken before calling this function. 2524 * 2525 * Returns the label of the far end or NULL if it's not special. 2526 */ 2527 static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip) 2528 { 2529 struct smk_net4addr *snp; 2530 struct in_addr *siap = &sip->sin_addr; 2531 2532 if (siap->s_addr == 0) 2533 return NULL; 2534 2535 list_for_each_entry_rcu(snp, &smk_net4addr_list, list) 2536 /* 2537 * we break after finding the first match because 2538 * the list is sorted from longest to shortest mask 2539 * so we have found the most specific match 2540 */ 2541 if (snp->smk_host.s_addr == 2542 (siap->s_addr & snp->smk_mask.s_addr)) 2543 return snp->smk_label; 2544 2545 return NULL; 2546 } 2547 2548 #if IS_ENABLED(CONFIG_IPV6) 2549 /* 2550 * smk_ipv6_localhost - Check for local ipv6 host address 2551 * @sip: the address 2552 * 2553 * Returns boolean true if this is the localhost address 2554 */ 2555 static bool smk_ipv6_localhost(struct sockaddr_in6 *sip) 2556 { 2557 __be16 *be16p = (__be16 *)&sip->sin6_addr; 2558 __be32 *be32p = (__be32 *)&sip->sin6_addr; 2559 2560 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 && 2561 ntohs(be16p[7]) == 1) 2562 return true; 2563 return false; 2564 } 2565 2566 /** 2567 * smack_ipv6host_label - check host based restrictions 2568 * @sip: the object end 2569 * 2570 * looks for host based access restrictions 2571 * 2572 * This version will only be appropriate for really small sets of single label 2573 * hosts. The caller is responsible for ensuring that the RCU read lock is 2574 * taken before calling this function. 2575 * 2576 * Returns the label of the far end or NULL if it's not special. 2577 */ 2578 static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) 2579 { 2580 struct smk_net6addr *snp; 2581 struct in6_addr *sap = &sip->sin6_addr; 2582 int i; 2583 int found = 0; 2584 2585 /* 2586 * It's local. Don't look for a host label. 2587 */ 2588 if (smk_ipv6_localhost(sip)) 2589 return NULL; 2590 2591 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) { 2592 /* 2593 * If the label is NULL the entry has 2594 * been renounced. Ignore it. 2595 */ 2596 if (snp->smk_label == NULL) 2597 continue; 2598 /* 2599 * we break after finding the first match because 2600 * the list is sorted from longest to shortest mask 2601 * so we have found the most specific match 2602 */ 2603 for (found = 1, i = 0; i < 8; i++) { 2604 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) != 2605 snp->smk_host.s6_addr16[i]) { 2606 found = 0; 2607 break; 2608 } 2609 } 2610 if (found) 2611 return snp->smk_label; 2612 } 2613 2614 return NULL; 2615 } 2616 #endif /* CONFIG_IPV6 */ 2617 2618 /** 2619 * smack_netlbl_add - Set the secattr on a socket 2620 * @sk: the socket 2621 * 2622 * Attach the outbound smack value (smk_out) to the socket. 2623 * 2624 * Returns 0 on success or an error code 2625 */ 2626 static int smack_netlbl_add(struct sock *sk) 2627 { 2628 struct socket_smack *ssp = smack_sock(sk); 2629 struct smack_known *skp = ssp->smk_out; 2630 int rc; 2631 2632 local_bh_disable(); 2633 bh_lock_sock_nested(sk); 2634 2635 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel, 2636 netlbl_sk_lock_check(sk)); 2637 switch (rc) { 2638 case 0: 2639 ssp->smk_state = SMK_NETLBL_LABELED; 2640 break; 2641 case -EDESTADDRREQ: 2642 ssp->smk_state = SMK_NETLBL_REQSKB; 2643 rc = 0; 2644 break; 2645 } 2646 2647 bh_unlock_sock(sk); 2648 local_bh_enable(); 2649 2650 return rc; 2651 } 2652 2653 /** 2654 * smack_netlbl_delete - Remove the secattr from a socket 2655 * @sk: the socket 2656 * 2657 * Remove the outbound smack value from a socket 2658 */ 2659 static void smack_netlbl_delete(struct sock *sk) 2660 { 2661 struct socket_smack *ssp = smack_sock(sk); 2662 2663 /* 2664 * Take the label off the socket if one is set. 2665 */ 2666 if (ssp->smk_state != SMK_NETLBL_LABELED) 2667 return; 2668 2669 local_bh_disable(); 2670 bh_lock_sock_nested(sk); 2671 netlbl_sock_delattr(sk); 2672 bh_unlock_sock(sk); 2673 local_bh_enable(); 2674 ssp->smk_state = SMK_NETLBL_UNLABELED; 2675 } 2676 2677 /** 2678 * smk_ipv4_check - Perform IPv4 host access checks 2679 * @sk: the socket 2680 * @sap: the destination address 2681 * 2682 * Set the correct secattr for the given socket based on the destination 2683 * address and perform any outbound access checks needed. 2684 * 2685 * Returns 0 on success or an error code. 2686 * 2687 */ 2688 static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap) 2689 { 2690 struct smack_known *skp; 2691 int rc = 0; 2692 struct smack_known *hkp; 2693 struct socket_smack *ssp = smack_sock(sk); 2694 struct smk_audit_info ad; 2695 2696 rcu_read_lock(); 2697 hkp = smack_ipv4host_label(sap); 2698 if (hkp != NULL) { 2699 #ifdef CONFIG_AUDIT 2700 struct lsm_network_audit net; 2701 2702 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2703 ad.a.u.net->family = sap->sin_family; 2704 ad.a.u.net->dport = sap->sin_port; 2705 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr; 2706 #endif 2707 skp = ssp->smk_out; 2708 rc = smk_access(skp, hkp, MAY_WRITE, &ad); 2709 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc); 2710 /* 2711 * Clear the socket netlabel if it's set. 2712 */ 2713 if (!rc) 2714 smack_netlbl_delete(sk); 2715 } 2716 rcu_read_unlock(); 2717 2718 return rc; 2719 } 2720 2721 #if IS_ENABLED(CONFIG_IPV6) 2722 /** 2723 * smk_ipv6_check - check Smack access 2724 * @subject: subject Smack label 2725 * @object: object Smack label 2726 * @address: address 2727 * @act: the action being taken 2728 * 2729 * Check an IPv6 access 2730 */ 2731 static int smk_ipv6_check(struct smack_known *subject, 2732 struct smack_known *object, 2733 struct sockaddr_in6 *address, int act) 2734 { 2735 #ifdef CONFIG_AUDIT 2736 struct lsm_network_audit net; 2737 #endif 2738 struct smk_audit_info ad; 2739 int rc; 2740 2741 #ifdef CONFIG_AUDIT 2742 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2743 ad.a.u.net->family = PF_INET6; 2744 ad.a.u.net->dport = address->sin6_port; 2745 if (act == SMK_RECEIVING) 2746 ad.a.u.net->v6info.saddr = address->sin6_addr; 2747 else 2748 ad.a.u.net->v6info.daddr = address->sin6_addr; 2749 #endif 2750 rc = smk_access(subject, object, MAY_WRITE, &ad); 2751 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc); 2752 return rc; 2753 } 2754 #endif /* CONFIG_IPV6 */ 2755 2756 #ifdef SMACK_IPV6_PORT_LABELING 2757 /** 2758 * smk_ipv6_port_label - Smack port access table management 2759 * @sock: socket 2760 * @address: address 2761 * 2762 * Create or update the port list entry 2763 */ 2764 static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) 2765 { 2766 struct sock *sk = sock->sk; 2767 struct sockaddr_in6 *addr6; 2768 struct socket_smack *ssp = smack_sock(sock->sk); 2769 struct smk_port_label *spp; 2770 unsigned short port = 0; 2771 2772 if (address == NULL) { 2773 /* 2774 * This operation is changing the Smack information 2775 * on the bound socket. Take the changes to the port 2776 * as well. 2777 */ 2778 rcu_read_lock(); 2779 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2780 if (sk != spp->smk_sock) 2781 continue; 2782 spp->smk_in = ssp->smk_in; 2783 spp->smk_out = ssp->smk_out; 2784 rcu_read_unlock(); 2785 return; 2786 } 2787 /* 2788 * A NULL address is only used for updating existing 2789 * bound entries. If there isn't one, it's OK. 2790 */ 2791 rcu_read_unlock(); 2792 return; 2793 } 2794 2795 addr6 = (struct sockaddr_in6 *)address; 2796 port = ntohs(addr6->sin6_port); 2797 /* 2798 * This is a special case that is safely ignored. 2799 */ 2800 if (port == 0) 2801 return; 2802 2803 /* 2804 * Look for an existing port list entry. 2805 * This is an indication that a port is getting reused. 2806 */ 2807 rcu_read_lock(); 2808 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2809 if (spp->smk_port != port || spp->smk_sock_type != sock->type) 2810 continue; 2811 if (spp->smk_can_reuse != 1) { 2812 rcu_read_unlock(); 2813 return; 2814 } 2815 spp->smk_port = port; 2816 spp->smk_sock = sk; 2817 spp->smk_in = ssp->smk_in; 2818 spp->smk_out = ssp->smk_out; 2819 spp->smk_can_reuse = 0; 2820 rcu_read_unlock(); 2821 return; 2822 } 2823 rcu_read_unlock(); 2824 /* 2825 * A new port entry is required. 2826 */ 2827 spp = kzalloc_obj(*spp); 2828 if (spp == NULL) 2829 return; 2830 2831 spp->smk_port = port; 2832 spp->smk_sock = sk; 2833 spp->smk_in = ssp->smk_in; 2834 spp->smk_out = ssp->smk_out; 2835 spp->smk_sock_type = sock->type; 2836 spp->smk_can_reuse = 0; 2837 2838 mutex_lock(&smack_ipv6_lock); 2839 list_add_rcu(&spp->list, &smk_ipv6_port_list); 2840 mutex_unlock(&smack_ipv6_lock); 2841 return; 2842 } 2843 2844 /** 2845 * smk_ipv6_port_check - check Smack port access 2846 * @sk: socket 2847 * @address: address 2848 * @act: the action being taken 2849 * 2850 * Create or update the port list entry 2851 */ 2852 static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, 2853 int act) 2854 { 2855 struct smk_port_label *spp; 2856 struct socket_smack *ssp = smack_sock(sk); 2857 struct smack_known *skp = NULL; 2858 unsigned short port; 2859 struct smack_known *object; 2860 2861 if (act == SMK_RECEIVING) { 2862 skp = smack_ipv6host_label(address); 2863 object = ssp->smk_in; 2864 } else { 2865 skp = ssp->smk_out; 2866 object = smack_ipv6host_label(address); 2867 } 2868 2869 /* 2870 * The other end is a single label host. 2871 */ 2872 if (skp != NULL && object != NULL) 2873 return smk_ipv6_check(skp, object, address, act); 2874 if (skp == NULL) 2875 skp = smack_net_ambient; 2876 if (object == NULL) 2877 object = smack_net_ambient; 2878 2879 /* 2880 * It's remote, so port lookup does no good. 2881 */ 2882 if (!smk_ipv6_localhost(address)) 2883 return smk_ipv6_check(skp, object, address, act); 2884 2885 /* 2886 * It's local so the send check has to have passed. 2887 */ 2888 if (act == SMK_RECEIVING) 2889 return 0; 2890 2891 port = ntohs(address->sin6_port); 2892 rcu_read_lock(); 2893 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2894 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type) 2895 continue; 2896 object = spp->smk_in; 2897 if (act == SMK_CONNECTING) 2898 ssp->smk_packet = spp->smk_out; 2899 break; 2900 } 2901 rcu_read_unlock(); 2902 2903 return smk_ipv6_check(skp, object, address, act); 2904 } 2905 #endif 2906 2907 /** 2908 * smack_inode_setsecurity - set smack xattrs 2909 * @inode: the object 2910 * @name: attribute name 2911 * @value: attribute value 2912 * @size: size of the attribute 2913 * @flags: unused 2914 * 2915 * Sets the named attribute in the appropriate blob 2916 * 2917 * Returns 0 on success, or an error code 2918 */ 2919 static int smack_inode_setsecurity(struct inode *inode, const char *name, 2920 const void *value, size_t size, int flags) 2921 { 2922 struct smack_known *skp; 2923 struct inode_smack *nsp = smack_inode(inode); 2924 struct socket_smack *ssp; 2925 struct socket *sock; 2926 int rc = 0; 2927 2928 if (value == NULL || size > SMK_LONGLABEL || size == 0) 2929 return -EINVAL; 2930 2931 if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) { 2932 if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE || 2933 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 2934 return -EINVAL; 2935 2936 nsp->smk_flags |= SMK_INODE_TRANSMUTE; 2937 return 0; 2938 } 2939 2940 skp = smk_import_entry(value, size); 2941 if (IS_ERR(skp)) 2942 return PTR_ERR(skp); 2943 2944 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 2945 nsp->smk_inode = skp; 2946 nsp->smk_flags |= SMK_INODE_INSTANT; 2947 return 0; 2948 } 2949 /* 2950 * The rest of the Smack xattrs are only on sockets. 2951 */ 2952 if (inode->i_sb->s_magic != SOCKFS_MAGIC) 2953 return -EOPNOTSUPP; 2954 2955 sock = SOCKET_I(inode); 2956 if (sock == NULL || sock->sk == NULL) 2957 return -EOPNOTSUPP; 2958 2959 ssp = smack_sock(sock->sk); 2960 2961 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 2962 ssp->smk_in = skp; 2963 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) { 2964 ssp->smk_out = skp; 2965 if (sock->sk->sk_family == PF_INET) { 2966 rc = smack_netlbl_add(sock->sk); 2967 if (rc != 0) 2968 printk(KERN_WARNING 2969 "Smack: \"%s\" netlbl error %d.\n", 2970 __func__, -rc); 2971 } 2972 } else 2973 return -EOPNOTSUPP; 2974 2975 #ifdef SMACK_IPV6_PORT_LABELING 2976 if (sock->sk->sk_family == PF_INET6) 2977 smk_ipv6_port_label(sock, NULL); 2978 #endif 2979 2980 return 0; 2981 } 2982 2983 /** 2984 * smack_socket_post_create - finish socket setup 2985 * @sock: the socket 2986 * @family: protocol family 2987 * @type: unused 2988 * @protocol: unused 2989 * @kern: unused 2990 * 2991 * Sets the netlabel information on the socket 2992 * 2993 * Returns 0 on success, and error code otherwise 2994 */ 2995 static int smack_socket_post_create(struct socket *sock, int family, 2996 int type, int protocol, int kern) 2997 { 2998 struct socket_smack *ssp; 2999 3000 if (sock->sk == NULL) 3001 return 0; 3002 3003 /* 3004 * Sockets created by kernel threads receive web label. 3005 */ 3006 if (unlikely(current->flags & PF_KTHREAD)) { 3007 ssp = smack_sock(sock->sk); 3008 ssp->smk_in = &smack_known_web; 3009 ssp->smk_out = &smack_known_web; 3010 } 3011 3012 if (family != PF_INET) 3013 return 0; 3014 /* 3015 * Set the outbound netlbl. 3016 */ 3017 return smack_netlbl_add(sock->sk); 3018 } 3019 3020 /** 3021 * smack_socket_socketpair - create socket pair 3022 * @socka: one socket 3023 * @sockb: another socket 3024 * 3025 * Cross reference the peer labels for SO_PEERSEC 3026 * 3027 * Returns 0 3028 */ 3029 static int smack_socket_socketpair(struct socket *socka, 3030 struct socket *sockb) 3031 { 3032 struct socket_smack *asp = smack_sock(socka->sk); 3033 struct socket_smack *bsp = smack_sock(sockb->sk); 3034 3035 asp->smk_packet = bsp->smk_out; 3036 bsp->smk_packet = asp->smk_out; 3037 3038 return 0; 3039 } 3040 3041 #ifdef SMACK_IPV6_PORT_LABELING 3042 /** 3043 * smack_socket_bind - record port binding information. 3044 * @sock: the socket 3045 * @address: the port address 3046 * @addrlen: size of the address 3047 * 3048 * Records the label bound to a port. 3049 * 3050 * Returns 0 on success, and error code otherwise 3051 */ 3052 static int smack_socket_bind(struct socket *sock, struct sockaddr *address, 3053 int addrlen) 3054 { 3055 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) { 3056 if (addrlen < SIN6_LEN_RFC2133 || 3057 address->sa_family != AF_INET6) 3058 return -EINVAL; 3059 smk_ipv6_port_label(sock, address); 3060 } 3061 return 0; 3062 } 3063 #endif /* SMACK_IPV6_PORT_LABELING */ 3064 3065 /** 3066 * smack_socket_connect - connect access check 3067 * @sock: the socket 3068 * @sap: the other end 3069 * @addrlen: size of sap 3070 * 3071 * Verifies that a connection may be possible 3072 * 3073 * Returns 0 on success, and error code otherwise 3074 */ 3075 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 3076 int addrlen) 3077 { 3078 int rc = 0; 3079 3080 if (sock->sk == NULL) 3081 return 0; 3082 if (sock->sk->sk_family != PF_INET && 3083 (!IS_ENABLED(CONFIG_IPV6) || sock->sk->sk_family != PF_INET6)) 3084 return 0; 3085 if (addrlen < offsetofend(struct sockaddr, sa_family)) 3086 return 0; 3087 3088 #if IS_ENABLED(CONFIG_IPV6) 3089 if (sap->sa_family == AF_INET6) { 3090 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; 3091 struct smack_known *rsp = NULL; 3092 3093 if (addrlen < SIN6_LEN_RFC2133) 3094 return 0; 3095 if (__is_defined(SMACK_IPV6_SECMARK_LABELING)) 3096 rsp = smack_ipv6host_label(sip); 3097 if (rsp != NULL) { 3098 struct socket_smack *ssp = smack_sock(sock->sk); 3099 3100 rc = smk_ipv6_check(ssp->smk_out, rsp, sip, 3101 SMK_CONNECTING); 3102 } 3103 #ifdef SMACK_IPV6_PORT_LABELING 3104 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING); 3105 #endif 3106 3107 return rc; 3108 } 3109 #endif /* CONFIG_IPV6 */ 3110 3111 if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in)) 3112 return 0; 3113 rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap); 3114 return rc; 3115 } 3116 3117 /** 3118 * smack_flags_to_may - convert S_ to MAY_ values 3119 * @flags: the S_ value 3120 * 3121 * Returns the equivalent MAY_ value 3122 */ 3123 static int smack_flags_to_may(int flags) 3124 { 3125 int may = 0; 3126 3127 if (flags & S_IRUGO) 3128 may |= MAY_READ; 3129 if (flags & S_IWUGO) 3130 may |= MAY_WRITE; 3131 if (flags & S_IXUGO) 3132 may |= MAY_EXEC; 3133 3134 return may; 3135 } 3136 3137 /** 3138 * smack_msg_msg_alloc_security - Set the security blob for msg_msg 3139 * @msg: the object 3140 * 3141 * Returns 0 3142 */ 3143 static int smack_msg_msg_alloc_security(struct msg_msg *msg) 3144 { 3145 struct smack_known **blob = smack_msg_msg(msg); 3146 3147 *blob = smk_of_current(); 3148 return 0; 3149 } 3150 3151 /** 3152 * smack_of_ipc - the smack pointer for the ipc 3153 * @isp: the object 3154 * 3155 * Returns a pointer to the smack value 3156 */ 3157 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) 3158 { 3159 struct smack_known **blob = smack_ipc(isp); 3160 3161 return *blob; 3162 } 3163 3164 /** 3165 * smack_ipc_alloc_security - Set the security blob for ipc 3166 * @isp: the object 3167 * 3168 * Returns 0 3169 */ 3170 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp) 3171 { 3172 struct smack_known **blob = smack_ipc(isp); 3173 3174 *blob = smk_of_current(); 3175 return 0; 3176 } 3177 3178 /** 3179 * smk_curacc_shm : check if current has access on shm 3180 * @isp : the object 3181 * @access : access requested 3182 * 3183 * Returns 0 if current has the requested access, error code otherwise 3184 */ 3185 static int smk_curacc_shm(struct kern_ipc_perm *isp, int access) 3186 { 3187 struct smack_known *ssp = smack_of_ipc(isp); 3188 struct smk_audit_info ad; 3189 int rc; 3190 3191 #ifdef CONFIG_AUDIT 3192 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3193 ad.a.u.ipc_id = isp->id; 3194 #endif 3195 rc = smk_curacc(ssp, access, &ad); 3196 rc = smk_bu_current("shm", ssp, access, rc); 3197 return rc; 3198 } 3199 3200 /** 3201 * smack_shm_associate - Smack access check for shm 3202 * @isp: the object 3203 * @shmflg: access requested 3204 * 3205 * Returns 0 if current has the requested access, error code otherwise 3206 */ 3207 static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg) 3208 { 3209 int may; 3210 3211 may = smack_flags_to_may(shmflg); 3212 return smk_curacc_shm(isp, may); 3213 } 3214 3215 /** 3216 * smack_shm_shmctl - Smack access check for shm 3217 * @isp: the object 3218 * @cmd: what it wants to do 3219 * 3220 * Returns 0 if current has the requested access, error code otherwise 3221 */ 3222 static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd) 3223 { 3224 int may; 3225 3226 switch (cmd) { 3227 case IPC_STAT: 3228 case SHM_STAT: 3229 case SHM_STAT_ANY: 3230 may = MAY_READ; 3231 break; 3232 case IPC_SET: 3233 case SHM_LOCK: 3234 case SHM_UNLOCK: 3235 case IPC_RMID: 3236 may = MAY_READWRITE; 3237 break; 3238 case IPC_INFO: 3239 case SHM_INFO: 3240 /* 3241 * System level information. 3242 */ 3243 return 0; 3244 default: 3245 return -EINVAL; 3246 } 3247 return smk_curacc_shm(isp, may); 3248 } 3249 3250 /** 3251 * smack_shm_shmat - Smack access for shmat 3252 * @isp: the object 3253 * @shmaddr: unused 3254 * @shmflg: access requested 3255 * 3256 * Returns 0 if current has the requested access, error code otherwise 3257 */ 3258 static int smack_shm_shmat(struct kern_ipc_perm *isp, char __user *shmaddr, 3259 int shmflg) 3260 { 3261 int may; 3262 3263 may = smack_flags_to_may(shmflg); 3264 return smk_curacc_shm(isp, may); 3265 } 3266 3267 /** 3268 * smk_curacc_sem : check if current has access on sem 3269 * @isp : the object 3270 * @access : access requested 3271 * 3272 * Returns 0 if current has the requested access, error code otherwise 3273 */ 3274 static int smk_curacc_sem(struct kern_ipc_perm *isp, int access) 3275 { 3276 struct smack_known *ssp = smack_of_ipc(isp); 3277 struct smk_audit_info ad; 3278 int rc; 3279 3280 #ifdef CONFIG_AUDIT 3281 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3282 ad.a.u.ipc_id = isp->id; 3283 #endif 3284 rc = smk_curacc(ssp, access, &ad); 3285 rc = smk_bu_current("sem", ssp, access, rc); 3286 return rc; 3287 } 3288 3289 /** 3290 * smack_sem_associate - Smack access check for sem 3291 * @isp: the object 3292 * @semflg: access requested 3293 * 3294 * Returns 0 if current has the requested access, error code otherwise 3295 */ 3296 static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg) 3297 { 3298 int may; 3299 3300 may = smack_flags_to_may(semflg); 3301 return smk_curacc_sem(isp, may); 3302 } 3303 3304 /** 3305 * smack_sem_semctl - Smack access check for sem 3306 * @isp: the object 3307 * @cmd: what it wants to do 3308 * 3309 * Returns 0 if current has the requested access, error code otherwise 3310 */ 3311 static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd) 3312 { 3313 int may; 3314 3315 switch (cmd) { 3316 case GETPID: 3317 case GETNCNT: 3318 case GETZCNT: 3319 case GETVAL: 3320 case GETALL: 3321 case IPC_STAT: 3322 case SEM_STAT: 3323 case SEM_STAT_ANY: 3324 may = MAY_READ; 3325 break; 3326 case SETVAL: 3327 case SETALL: 3328 case IPC_RMID: 3329 case IPC_SET: 3330 may = MAY_READWRITE; 3331 break; 3332 case IPC_INFO: 3333 case SEM_INFO: 3334 /* 3335 * System level information 3336 */ 3337 return 0; 3338 default: 3339 return -EINVAL; 3340 } 3341 3342 return smk_curacc_sem(isp, may); 3343 } 3344 3345 /** 3346 * smack_sem_semop - Smack checks of semaphore operations 3347 * @isp: the object 3348 * @sops: unused 3349 * @nsops: unused 3350 * @alter: unused 3351 * 3352 * Treated as read and write in all cases. 3353 * 3354 * Returns 0 if access is allowed, error code otherwise 3355 */ 3356 static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops, 3357 unsigned nsops, int alter) 3358 { 3359 return smk_curacc_sem(isp, MAY_READWRITE); 3360 } 3361 3362 /** 3363 * smk_tskacc_msq : helper to check if tsk has access on msq 3364 * @tsk: the task that requests access 3365 * @isp : the sysv msg queue permissions 3366 * @access : access requested 3367 * 3368 * return 0 if tsk has access, error otherwise 3369 */ 3370 static int 3371 smk_tskacc_msq(struct task_struct *tsk, struct kern_ipc_perm *isp, int access) 3372 { 3373 const bool tsk_is_current = (tsk == current); 3374 const struct cred * const tsk_cred = 3375 (tsk_is_current ? current_cred() : get_task_cred(tsk)); 3376 struct task_smack * const tsp = smack_cred(tsk_cred); 3377 struct smack_known *msp = smack_of_ipc(isp); 3378 struct smk_audit_info ad; 3379 int rc; 3380 3381 #ifdef CONFIG_AUDIT 3382 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3383 ad.a.u.ipc_id = isp->id; 3384 if (!tsk_is_current) 3385 ad.sad.subj_tsk = tsk; 3386 #endif 3387 rc = smk_tskacc(tsp, msp, access, &ad); 3388 rc = smk_bu_tsk_to_obj(tsk, tsp, "msq", msp, access, rc); 3389 if (!tsk_is_current) 3390 put_cred(tsk_cred); 3391 return rc; 3392 } 3393 3394 /** 3395 * smk_curacc_msq : helper to check if current has access on msq 3396 * @isp : the sysv msg queue permissions 3397 * @access : access requested 3398 * 3399 * return 0 if current has access, error otherwise 3400 */ 3401 static int smk_curacc_msq(struct kern_ipc_perm *isp, int access) 3402 { 3403 return smk_tskacc_msq(current, isp, access); 3404 } 3405 3406 /** 3407 * smack_msg_queue_associate - Smack access check for msg_queue 3408 * @isp: the object 3409 * @msqflg: access requested 3410 * 3411 * Returns 0 if current has the requested access, error code otherwise 3412 */ 3413 static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg) 3414 { 3415 int may; 3416 3417 may = smack_flags_to_may(msqflg); 3418 return smk_curacc_msq(isp, may); 3419 } 3420 3421 /** 3422 * smack_msg_queue_msgctl - Smack access check for msg_queue 3423 * @isp: the object 3424 * @cmd: what it wants to do 3425 * 3426 * Returns 0 if current has the requested access, error code otherwise 3427 */ 3428 static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd) 3429 { 3430 int may; 3431 3432 switch (cmd) { 3433 case IPC_STAT: 3434 case MSG_STAT: 3435 case MSG_STAT_ANY: 3436 may = MAY_READ; 3437 break; 3438 case IPC_SET: 3439 case IPC_RMID: 3440 may = MAY_READWRITE; 3441 break; 3442 case IPC_INFO: 3443 case MSG_INFO: 3444 /* 3445 * System level information 3446 */ 3447 return 0; 3448 default: 3449 return -EINVAL; 3450 } 3451 3452 return smk_curacc_msq(isp, may); 3453 } 3454 3455 /** 3456 * smack_msg_queue_msgsnd - Smack access check for msg_queue 3457 * @isp: the object 3458 * @msg: unused 3459 * @msqflg: access requested 3460 * 3461 * Returns 0 if current has the requested access, error code otherwise 3462 */ 3463 static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg, 3464 int msqflg) 3465 { 3466 int may; 3467 3468 may = smack_flags_to_may(msqflg); 3469 return smk_curacc_msq(isp, may); 3470 } 3471 3472 /** 3473 * smack_msg_queue_msgrcv - check it target has r/w access to msg_queue 3474 * @isp: the object 3475 * @msg: unused 3476 * @target: the task that msgrcv() from the queue 3477 * @type: unused 3478 * @mode: unused 3479 * 3480 * Returns 0 if target has read and write access, error code otherwise 3481 */ 3482 static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, 3483 struct msg_msg *msg, 3484 struct task_struct *target, long type, 3485 int mode) 3486 { 3487 return smk_tskacc_msq(target, isp, MAY_READWRITE); 3488 } 3489 3490 /** 3491 * smack_ipc_permission - Smack access for ipc_permission() 3492 * @ipp: the object permissions 3493 * @flag: access requested 3494 * 3495 * Returns 0 if current has read and write access, error code otherwise 3496 */ 3497 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 3498 { 3499 struct smack_known **blob = smack_ipc(ipp); 3500 struct smack_known *iskp = *blob; 3501 int may = smack_flags_to_may(flag); 3502 struct smk_audit_info ad; 3503 int rc; 3504 3505 #ifdef CONFIG_AUDIT 3506 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3507 ad.a.u.ipc_id = ipp->id; 3508 #endif 3509 rc = smk_curacc(iskp, may, &ad); 3510 rc = smk_bu_current("svipc", iskp, may, rc); 3511 return rc; 3512 } 3513 3514 /** 3515 * smack_ipc_getlsmprop - Extract smack security data 3516 * @ipp: the object permissions 3517 * @prop: where result will be saved 3518 */ 3519 static void smack_ipc_getlsmprop(struct kern_ipc_perm *ipp, struct lsm_prop *prop) 3520 { 3521 struct smack_known **iskpp = smack_ipc(ipp); 3522 3523 prop->smack.skp = *iskpp; 3524 } 3525 3526 /** 3527 * smack_d_instantiate - Make sure the blob is correct on an inode 3528 * @opt_dentry: dentry where inode will be attached 3529 * @inode: the object 3530 * 3531 * Set the inode's security blob if it hasn't been done already. 3532 */ 3533 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) 3534 { 3535 struct super_block *sbp; 3536 struct superblock_smack *sbsp; 3537 struct inode_smack *isp; 3538 struct smack_known *skp; 3539 struct smack_known *ckp = smk_of_current(); 3540 struct smack_known *final; 3541 char trattr[TRANS_TRUE_SIZE]; 3542 int transflag = 0; 3543 int rc; 3544 struct dentry *dp; 3545 3546 if (inode == NULL) 3547 return; 3548 3549 isp = smack_inode(inode); 3550 3551 /* 3552 * If the inode is already instantiated 3553 * take the quick way out 3554 */ 3555 if (isp->smk_flags & SMK_INODE_INSTANT) 3556 return; 3557 3558 sbp = inode->i_sb; 3559 sbsp = smack_superblock(sbp); 3560 /* 3561 * We're going to use the superblock default label 3562 * if there's no label on the file. 3563 */ 3564 final = sbsp->smk_default; 3565 3566 /* 3567 * If this is the root inode the superblock 3568 * may be in the process of initialization. 3569 * If that is the case use the root value out 3570 * of the superblock. 3571 */ 3572 if (opt_dentry->d_parent == opt_dentry) { 3573 switch (sbp->s_magic) { 3574 case CGROUP_SUPER_MAGIC: 3575 case CGROUP2_SUPER_MAGIC: 3576 /* 3577 * The cgroup filesystem is never mounted, 3578 * so there's no opportunity to set the mount 3579 * options. 3580 */ 3581 sbsp->smk_root = &smack_known_star; 3582 sbsp->smk_default = &smack_known_star; 3583 isp->smk_inode = sbsp->smk_root; 3584 break; 3585 case TMPFS_MAGIC: 3586 /* 3587 * What about shmem/tmpfs anonymous files with dentry 3588 * obtained from d_alloc_pseudo()? 3589 */ 3590 isp->smk_inode = smk_of_current(); 3591 break; 3592 case PIPEFS_MAGIC: 3593 isp->smk_inode = smk_of_current(); 3594 break; 3595 case SOCKFS_MAGIC: 3596 /* 3597 * Socket access is controlled by the socket 3598 * structures associated with the task involved. 3599 */ 3600 isp->smk_inode = &smack_known_star; 3601 break; 3602 default: 3603 isp->smk_inode = sbsp->smk_root; 3604 break; 3605 } 3606 isp->smk_flags |= SMK_INODE_INSTANT; 3607 return; 3608 } 3609 3610 /* 3611 * This is pretty hackish. 3612 * Casey says that we shouldn't have to do 3613 * file system specific code, but it does help 3614 * with keeping it simple. 3615 */ 3616 switch (sbp->s_magic) { 3617 case SMACK_MAGIC: 3618 case CGROUP_SUPER_MAGIC: 3619 case CGROUP2_SUPER_MAGIC: 3620 /* 3621 * Casey says that it's a little embarrassing 3622 * that the smack file system doesn't do 3623 * extended attributes. 3624 * 3625 * Cgroupfs is special 3626 */ 3627 final = &smack_known_star; 3628 break; 3629 case DEVPTS_SUPER_MAGIC: 3630 /* 3631 * devpts seems content with the label of the task. 3632 * Programs that change smack have to treat the 3633 * pty with respect. 3634 */ 3635 final = ckp; 3636 break; 3637 case PROC_SUPER_MAGIC: 3638 /* 3639 * Casey says procfs appears not to care. 3640 * The superblock default suffices. 3641 */ 3642 break; 3643 case TMPFS_MAGIC: 3644 /* 3645 * Device labels should come from the filesystem, 3646 * but watch out, because they're volitile, 3647 * getting recreated on every reboot. 3648 */ 3649 final = &smack_known_star; 3650 /* 3651 * If a smack value has been set we want to use it, 3652 * but since tmpfs isn't giving us the opportunity 3653 * to set mount options simulate setting the 3654 * superblock default. 3655 */ 3656 fallthrough; 3657 default: 3658 /* 3659 * This isn't an understood special case. 3660 * Get the value from the xattr. 3661 */ 3662 3663 /* 3664 * UDS inode has fixed label (*) 3665 */ 3666 if (S_ISSOCK(inode->i_mode)) { 3667 final = &smack_known_star; 3668 break; 3669 } 3670 /* 3671 * No xattr support means, alas, no SMACK label. 3672 * Use the aforeapplied default. 3673 * It would be curious if the label of the task 3674 * does not match that assigned. 3675 */ 3676 if (!(inode->i_opflags & IOP_XATTR)) 3677 break; 3678 /* 3679 * Get the dentry for xattr. 3680 */ 3681 dp = dget(opt_dentry); 3682 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp); 3683 if (!IS_ERR_OR_NULL(skp)) 3684 final = skp; 3685 3686 /* 3687 * Transmuting directory 3688 */ 3689 if (S_ISDIR(inode->i_mode)) { 3690 /* 3691 * If this is a new directory and the label was 3692 * transmuted when the inode was initialized 3693 * set the transmute attribute on the directory 3694 * and mark the inode. 3695 * 3696 * If there is a transmute attribute on the 3697 * directory mark the inode. 3698 */ 3699 rc = __vfs_getxattr(dp, inode, 3700 XATTR_NAME_SMACKTRANSMUTE, trattr, 3701 TRANS_TRUE_SIZE); 3702 if (rc >= 0 && strncmp(trattr, TRANS_TRUE, 3703 TRANS_TRUE_SIZE) != 0) 3704 rc = -EINVAL; 3705 if (rc >= 0) 3706 transflag = SMK_INODE_TRANSMUTE; 3707 } 3708 /* 3709 * Don't let the exec or mmap label be "*" or "@". 3710 */ 3711 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); 3712 if (IS_ERR(skp) || skp == &smack_known_star || 3713 skp == &smack_known_web) 3714 skp = NULL; 3715 isp->smk_task = skp; 3716 3717 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); 3718 if (IS_ERR(skp) || skp == &smack_known_star || 3719 skp == &smack_known_web) 3720 skp = NULL; 3721 isp->smk_mmap = skp; 3722 3723 dput(dp); 3724 break; 3725 } 3726 3727 if (final == NULL) 3728 isp->smk_inode = ckp; 3729 else 3730 isp->smk_inode = final; 3731 3732 isp->smk_flags |= (SMK_INODE_INSTANT | transflag); 3733 3734 return; 3735 } 3736 3737 /** 3738 * smack_getselfattr - Smack current process attribute 3739 * @attr: which attribute to fetch 3740 * @ctx: buffer to receive the result 3741 * @size: available size in, actual size out 3742 * @flags: reserved, currently zero 3743 * 3744 * Fill the passed user space @ctx with the details of the requested 3745 * attribute. 3746 * 3747 * Returns the number of attributes on success, an error code otherwise. 3748 * There will only ever be one attribute. 3749 */ 3750 static int smack_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx, 3751 u32 *size, u32 flags) 3752 { 3753 int rc; 3754 struct smack_known *skp; 3755 3756 if (attr != LSM_ATTR_CURRENT) 3757 return -EOPNOTSUPP; 3758 3759 skp = smk_of_current(); 3760 rc = lsm_fill_user_ctx(ctx, size, 3761 skp->smk_known, strlen(skp->smk_known) + 1, 3762 LSM_ID_SMACK, 0); 3763 return (!rc ? 1 : rc); 3764 } 3765 3766 /** 3767 * smack_getprocattr - Smack process attribute access 3768 * @p: the object task 3769 * @name: the name of the attribute in /proc/.../attr 3770 * @value: where to put the result 3771 * 3772 * Places a copy of the task Smack into value 3773 * 3774 * Returns the length of the smack label or an error code 3775 */ 3776 static int smack_getprocattr(struct task_struct *p, const char *name, char **value) 3777 { 3778 struct smack_known *skp = smk_of_task_struct_obj(p); 3779 char *cp; 3780 int slen; 3781 3782 if (strcmp(name, "current") != 0) 3783 return -EINVAL; 3784 3785 cp = kstrdup(skp->smk_known, GFP_KERNEL); 3786 if (cp == NULL) 3787 return -ENOMEM; 3788 3789 slen = strlen(cp); 3790 *value = cp; 3791 return slen; 3792 } 3793 3794 /** 3795 * do_setattr - Smack process attribute setting 3796 * @attr: the ID of the attribute 3797 * @value: the value to set 3798 * @size: the size of the value 3799 * 3800 * Sets the Smack value of the task. Only setting self 3801 * is permitted and only with privilege 3802 * 3803 * Returns zero on success or an error code 3804 */ 3805 static int do_setattr(unsigned int attr, void *value, size_t size) 3806 { 3807 struct task_smack *tsp = smack_cred(current_cred()); 3808 struct cred *new; 3809 struct smack_known *skp; 3810 int label_len; 3811 3812 /* 3813 * let unprivileged user validate input, check permissions later 3814 */ 3815 if (value == NULL || size == 0 || size >= SMK_LONGLABEL) 3816 return -EINVAL; 3817 3818 label_len = smk_parse_label_len(value, size); 3819 if (label_len < 0 || label_len != size) 3820 return -EINVAL; 3821 3822 /* 3823 * No process is ever allowed the web ("@") label 3824 * and the star ("*") label. 3825 */ 3826 if (label_len == 1 /* '@', '*' */) { 3827 const char c = *(const char *)value; 3828 3829 if (c == *smack_known_web.smk_known || 3830 c == *smack_known_star.smk_known) 3831 return -EPERM; 3832 } 3833 3834 if (!smack_privileged(CAP_MAC_ADMIN)) { 3835 const struct smack_known_list_elem *sklep; 3836 list_for_each_entry(sklep, &tsp->smk_relabel, list) { 3837 const char *cp = sklep->smk_label->smk_known; 3838 3839 if (strlen(cp) == label_len && 3840 strncmp(cp, value, label_len) == 0) 3841 goto in_relabel; 3842 } 3843 return -EPERM; 3844 in_relabel: 3845 ; 3846 } 3847 3848 skp = smk_import_valid_label(value, label_len, GFP_KERNEL); 3849 if (IS_ERR(skp)) 3850 return PTR_ERR(skp); 3851 3852 new = prepare_creds(); 3853 if (new == NULL) 3854 return -ENOMEM; 3855 3856 tsp = smack_cred(new); 3857 tsp->smk_task = skp; 3858 /* 3859 * process can change its label only once 3860 */ 3861 smk_destroy_label_list(&tsp->smk_relabel); 3862 3863 commit_creds(new); 3864 return 0; 3865 } 3866 3867 /** 3868 * smack_setselfattr - Set a Smack process attribute 3869 * @attr: which attribute to set 3870 * @ctx: buffer containing the data 3871 * @size: size of @ctx 3872 * @flags: reserved, must be zero 3873 * 3874 * Fill the passed user space @ctx with the details of the requested 3875 * attribute. 3876 * 3877 * Returns 0 on success, an error code otherwise. 3878 */ 3879 static int smack_setselfattr(unsigned int attr, struct lsm_ctx *ctx, 3880 u32 size, u32 flags) 3881 { 3882 if (attr != LSM_ATTR_CURRENT) 3883 return -EOPNOTSUPP; 3884 3885 if (ctx->flags) 3886 return -EINVAL; 3887 /* 3888 * string must have \0 terminator, included in ctx->ctx 3889 * (see description of struct lsm_ctx) 3890 */ 3891 if (ctx->ctx_len == 0) 3892 return -EINVAL; 3893 3894 if (ctx->ctx[ctx->ctx_len - 1] != '\0') 3895 return -EINVAL; 3896 /* 3897 * other do_setattr() caller, smack_setprocattr(), 3898 * does not count \0 into size, so 3899 * decreasing length by 1 to accommodate the divergence. 3900 */ 3901 return do_setattr(attr, ctx->ctx, ctx->ctx_len - 1); 3902 } 3903 3904 /** 3905 * smack_setprocattr - Smack process attribute setting 3906 * @name: the name of the attribute in /proc/.../attr 3907 * @value: the value to set 3908 * @size: the size of the value 3909 * 3910 * Sets the Smack value of the task. Only setting self 3911 * is permitted and only with privilege 3912 * 3913 * Returns the size of the input value or an error code 3914 */ 3915 static int smack_setprocattr(const char *name, void *value, size_t size) 3916 { 3917 size_t realsize = size; 3918 unsigned int attr = lsm_name_to_attr(name); 3919 3920 switch (attr) { 3921 case LSM_ATTR_UNDEF: return -EINVAL; 3922 default: return -EOPNOTSUPP; 3923 case LSM_ATTR_CURRENT: 3924 ; 3925 } 3926 3927 /* 3928 * The value for the "current" attribute is the label 3929 * followed by one of the 4 trailers: none, \0, \n, \n\0 3930 * 3931 * I.e. following inputs are accepted as 3-characters long label "foo": 3932 * 3933 * "foo" (3 characters) 3934 * "foo\0" (4 characters) 3935 * "foo\n" (4 characters) 3936 * "foo\n\0" (5 characters) 3937 */ 3938 3939 if (realsize && (((const char *)value)[realsize - 1] == '\0')) 3940 --realsize; 3941 3942 if (realsize && (((const char *)value)[realsize - 1] == '\n')) 3943 --realsize; 3944 3945 return do_setattr(attr, value, realsize) ? : size; 3946 } 3947 3948 /** 3949 * smack_unix_stream_connect - Smack access on UDS 3950 * @sock: one sock 3951 * @other: the other sock 3952 * @newsk: unused 3953 * 3954 * Return 0 if a subject with the smack of sock could access 3955 * an object with the smack of other, otherwise an error code 3956 */ 3957 static int smack_unix_stream_connect(struct sock *sock, 3958 struct sock *other, struct sock *newsk) 3959 { 3960 struct smack_known *skp; 3961 struct smack_known *okp; 3962 struct socket_smack *ssp = smack_sock(sock); 3963 struct socket_smack *osp = smack_sock(other); 3964 struct socket_smack *nsp = smack_sock(newsk); 3965 struct smk_audit_info ad; 3966 int rc = 0; 3967 #ifdef CONFIG_AUDIT 3968 struct lsm_network_audit net; 3969 #endif 3970 3971 if (!smack_privileged(CAP_MAC_OVERRIDE)) { 3972 skp = ssp->smk_out; 3973 okp = osp->smk_in; 3974 #ifdef CONFIG_AUDIT 3975 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3976 smk_ad_setfield_u_net_sk(&ad, other); 3977 #endif 3978 rc = smk_access(skp, okp, MAY_WRITE, &ad); 3979 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc); 3980 if (rc == 0) { 3981 okp = osp->smk_out; 3982 skp = ssp->smk_in; 3983 rc = smk_access(okp, skp, MAY_WRITE, &ad); 3984 rc = smk_bu_note("UDS connect", okp, skp, 3985 MAY_WRITE, rc); 3986 } 3987 } 3988 3989 if (rc == 0) { 3990 /* 3991 * Cross reference the peer labels for SO_PEERSEC. 3992 */ 3993 nsp->smk_packet = ssp->smk_out; 3994 ssp->smk_packet = osp->smk_out; 3995 3996 /* 3997 * new/child/established socket must inherit listening socket labels 3998 */ 3999 nsp->smk_out = osp->smk_out; 4000 nsp->smk_in = osp->smk_in; 4001 } 4002 4003 return rc; 4004 } 4005 4006 /** 4007 * smack_unix_may_send - Smack access on UDS 4008 * @sock: one socket 4009 * @other: the other socket 4010 * 4011 * Return 0 if a subject with the smack of sock could access 4012 * an object with the smack of other, otherwise an error code 4013 */ 4014 static int smack_unix_may_send(struct socket *sock, struct socket *other) 4015 { 4016 struct socket_smack *ssp = smack_sock(sock->sk); 4017 struct socket_smack *osp = smack_sock(other->sk); 4018 struct smk_audit_info ad; 4019 int rc; 4020 4021 #ifdef CONFIG_AUDIT 4022 struct lsm_network_audit net; 4023 4024 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4025 smk_ad_setfield_u_net_sk(&ad, other->sk); 4026 #endif 4027 4028 if (smack_privileged(CAP_MAC_OVERRIDE)) 4029 return 0; 4030 4031 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad); 4032 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc); 4033 return rc; 4034 } 4035 4036 /** 4037 * smack_socket_sendmsg - Smack check based on destination host 4038 * @sock: the socket 4039 * @msg: the message 4040 * @size: the size of the message 4041 * 4042 * Return 0 if the current subject can write to the destination host. 4043 * For IPv4 this is only a question if the destination is a single label host. 4044 * For IPv6 this is a check against the label of the port. 4045 */ 4046 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, 4047 int size) 4048 { 4049 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name; 4050 #if IS_ENABLED(CONFIG_IPV6) 4051 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name; 4052 #endif 4053 #ifdef SMACK_IPV6_SECMARK_LABELING 4054 struct socket_smack *ssp = smack_sock(sock->sk); 4055 struct smack_known *rsp; 4056 #endif 4057 int rc = 0; 4058 4059 /* 4060 * Perfectly reasonable for this to be NULL 4061 */ 4062 if (sip == NULL) 4063 return 0; 4064 4065 switch (sock->sk->sk_family) { 4066 case AF_INET: 4067 if (msg->msg_namelen < sizeof(struct sockaddr_in) || 4068 sip->sin_family != AF_INET) 4069 return -EINVAL; 4070 rc = smk_ipv4_check(sock->sk, sip); 4071 break; 4072 #if IS_ENABLED(CONFIG_IPV6) 4073 case AF_INET6: 4074 if (msg->msg_namelen < SIN6_LEN_RFC2133 || 4075 sap->sin6_family != AF_INET6) 4076 return -EINVAL; 4077 #ifdef SMACK_IPV6_SECMARK_LABELING 4078 rsp = smack_ipv6host_label(sap); 4079 if (rsp != NULL) 4080 rc = smk_ipv6_check(ssp->smk_out, rsp, sap, 4081 SMK_CONNECTING); 4082 #endif 4083 #ifdef SMACK_IPV6_PORT_LABELING 4084 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING); 4085 #endif 4086 #endif /* IS_ENABLED(CONFIG_IPV6) */ 4087 break; 4088 } 4089 return rc; 4090 } 4091 4092 /** 4093 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack 4094 * @sap: netlabel secattr 4095 * @ssp: socket security information 4096 * 4097 * Returns a pointer to a Smack label entry found on the label list. 4098 */ 4099 static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap, 4100 struct socket_smack *ssp) 4101 { 4102 struct smack_known *skp; 4103 int found = 0; 4104 int acat; 4105 int kcat; 4106 4107 /* 4108 * Netlabel found it in the cache. 4109 */ 4110 if ((sap->flags & NETLBL_SECATTR_CACHE) != 0) 4111 return (struct smack_known *)sap->cache->data; 4112 4113 if ((sap->flags & NETLBL_SECATTR_SECID) != 0) 4114 /* 4115 * Looks like a fallback, which gives us a secid. 4116 */ 4117 return smack_from_secid(sap->attr.secid); 4118 4119 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) { 4120 /* 4121 * Looks like a CIPSO packet. 4122 * If there are flags but no level netlabel isn't 4123 * behaving the way we expect it to. 4124 * 4125 * Look it up in the label table 4126 * Without guidance regarding the smack value 4127 * for the packet fall back on the network 4128 * ambient value. 4129 */ 4130 rcu_read_lock(); 4131 list_for_each_entry_rcu(skp, &smack_known_list, list) { 4132 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl) 4133 continue; 4134 /* 4135 * Compare the catsets. Use the netlbl APIs. 4136 */ 4137 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) { 4138 if ((skp->smk_netlabel.flags & 4139 NETLBL_SECATTR_MLS_CAT) == 0) 4140 found = 1; 4141 break; 4142 } 4143 for (acat = -1, kcat = -1; acat == kcat; ) { 4144 acat = netlbl_catmap_walk(sap->attr.mls.cat, 4145 acat + 1); 4146 kcat = netlbl_catmap_walk( 4147 skp->smk_netlabel.attr.mls.cat, 4148 kcat + 1); 4149 if (acat < 0 || kcat < 0) 4150 break; 4151 } 4152 if (acat == kcat) { 4153 found = 1; 4154 break; 4155 } 4156 } 4157 rcu_read_unlock(); 4158 4159 if (found) 4160 return skp; 4161 4162 if (ssp != NULL && ssp->smk_in == &smack_known_star) 4163 return &smack_known_web; 4164 return &smack_known_star; 4165 } 4166 /* 4167 * Without guidance regarding the smack value 4168 * for the packet fall back on the network 4169 * ambient value. 4170 */ 4171 return smack_net_ambient; 4172 } 4173 4174 #if IS_ENABLED(CONFIG_IPV6) 4175 static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) 4176 { 4177 u8 nexthdr; 4178 int offset; 4179 int proto = -EINVAL; 4180 struct ipv6hdr _ipv6h; 4181 struct ipv6hdr *ip6; 4182 __be16 frag_off; 4183 struct tcphdr _tcph, *th; 4184 struct udphdr _udph, *uh; 4185 4186 sip->sin6_port = 0; 4187 4188 offset = skb_network_offset(skb); 4189 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 4190 if (ip6 == NULL) 4191 return -EINVAL; 4192 sip->sin6_addr = ip6->saddr; 4193 4194 nexthdr = ip6->nexthdr; 4195 offset += sizeof(_ipv6h); 4196 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 4197 if (offset < 0) 4198 return -EINVAL; 4199 4200 proto = nexthdr; 4201 switch (proto) { 4202 case IPPROTO_TCP: 4203 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4204 if (th != NULL) 4205 sip->sin6_port = th->source; 4206 break; 4207 case IPPROTO_UDP: 4208 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4209 if (uh != NULL) 4210 sip->sin6_port = uh->source; 4211 break; 4212 } 4213 return proto; 4214 } 4215 #endif /* CONFIG_IPV6 */ 4216 4217 /** 4218 * smack_from_skb - Smack data from the secmark in an skb 4219 * @skb: packet 4220 * 4221 * Returns smack_known of the secmark or NULL if that won't work. 4222 */ 4223 #ifdef CONFIG_NETWORK_SECMARK 4224 static struct smack_known *smack_from_skb(struct sk_buff *skb) 4225 { 4226 if (skb == NULL || skb->secmark == 0) 4227 return NULL; 4228 4229 return smack_from_secid(skb->secmark); 4230 } 4231 #else 4232 static inline struct smack_known *smack_from_skb(struct sk_buff *skb) 4233 { 4234 return NULL; 4235 } 4236 #endif 4237 4238 /** 4239 * smack_from_netlbl - Smack data from the IP options in an skb 4240 * @sk: socket data came in on 4241 * @family: address family 4242 * @skb: packet 4243 * 4244 * Find the Smack label in the IP options. If it hasn't been 4245 * added to the netlabel cache, add it here. 4246 * 4247 * Returns smack_known of the IP options or NULL if that won't work. 4248 */ 4249 static struct smack_known *smack_from_netlbl(const struct sock *sk, u16 family, 4250 struct sk_buff *skb) 4251 { 4252 struct netlbl_lsm_secattr secattr; 4253 struct socket_smack *ssp = NULL; 4254 struct smack_known *skp = NULL; 4255 4256 netlbl_secattr_init(&secattr); 4257 4258 if (sk) 4259 ssp = smack_sock(sk); 4260 4261 if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) { 4262 skp = smack_from_secattr(&secattr, ssp); 4263 if (secattr.flags & NETLBL_SECATTR_CACHEABLE) 4264 netlbl_cache_add(skb, family, &skp->smk_netlabel); 4265 } 4266 4267 netlbl_secattr_destroy(&secattr); 4268 4269 return skp; 4270 } 4271 4272 /** 4273 * smack_socket_sock_rcv_skb - Smack packet delivery access check 4274 * @sk: socket 4275 * @skb: packet 4276 * 4277 * Returns 0 if the packet should be delivered, an error code otherwise 4278 */ 4279 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 4280 { 4281 struct socket_smack *ssp = smack_sock(sk); 4282 struct smack_known *skp = NULL; 4283 int rc = 0; 4284 struct smk_audit_info ad; 4285 u16 family = sk->sk_family; 4286 #ifdef CONFIG_AUDIT 4287 struct lsm_network_audit net; 4288 #endif 4289 #if IS_ENABLED(CONFIG_IPV6) 4290 struct sockaddr_in6 sadd; 4291 int proto; 4292 4293 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 4294 family = PF_INET; 4295 #endif /* CONFIG_IPV6 */ 4296 4297 switch (family) { 4298 case PF_INET: 4299 /* 4300 * If there is a secmark use it rather than the CIPSO label. 4301 * If there is no secmark fall back to CIPSO. 4302 * The secmark is assumed to reflect policy better. 4303 */ 4304 skp = smack_from_skb(skb); 4305 if (skp == NULL) { 4306 skp = smack_from_netlbl(sk, family, skb); 4307 if (skp == NULL) 4308 skp = smack_net_ambient; 4309 } 4310 4311 #ifdef CONFIG_AUDIT 4312 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4313 ad.a.u.net->family = family; 4314 ad.a.u.net->netif = skb->skb_iif; 4315 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 4316 #endif 4317 /* 4318 * Receiving a packet requires that the other end 4319 * be able to write here. Read access is not required. 4320 * This is the simplest possible security model 4321 * for networking. 4322 */ 4323 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4324 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, 4325 MAY_WRITE, rc); 4326 if (rc != 0) 4327 netlbl_skbuff_err(skb, family, rc, 0); 4328 break; 4329 #if IS_ENABLED(CONFIG_IPV6) 4330 case PF_INET6: 4331 proto = smk_skb_to_addr_ipv6(skb, &sadd); 4332 if (proto != IPPROTO_UDP && proto != IPPROTO_TCP) 4333 break; 4334 #ifdef SMACK_IPV6_SECMARK_LABELING 4335 skp = smack_from_skb(skb); 4336 if (skp == NULL) { 4337 if (smk_ipv6_localhost(&sadd)) 4338 break; 4339 skp = smack_ipv6host_label(&sadd); 4340 if (skp == NULL) 4341 skp = smack_net_ambient; 4342 } 4343 #ifdef CONFIG_AUDIT 4344 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4345 ad.a.u.net->family = family; 4346 ad.a.u.net->netif = skb->skb_iif; 4347 ipv6_skb_to_auditdata(skb, &ad.a, NULL); 4348 #endif /* CONFIG_AUDIT */ 4349 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4350 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in, 4351 MAY_WRITE, rc); 4352 #endif /* SMACK_IPV6_SECMARK_LABELING */ 4353 #ifdef SMACK_IPV6_PORT_LABELING 4354 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING); 4355 #endif /* SMACK_IPV6_PORT_LABELING */ 4356 if (rc != 0) 4357 icmpv6_send(skb, ICMPV6_DEST_UNREACH, 4358 ICMPV6_ADM_PROHIBITED, 0); 4359 break; 4360 #endif /* CONFIG_IPV6 */ 4361 } 4362 4363 return rc; 4364 } 4365 4366 /** 4367 * smack_socket_getpeersec_stream - pull in packet label 4368 * @sock: the socket 4369 * @optval: user's destination 4370 * @optlen: size thereof 4371 * @len: max thereof 4372 * 4373 * returns zero on success, an error code otherwise 4374 */ 4375 static int smack_socket_getpeersec_stream(struct socket *sock, 4376 sockptr_t optval, sockptr_t optlen, 4377 unsigned int len) 4378 { 4379 struct socket_smack *ssp; 4380 char *rcp = ""; 4381 u32 slen = 1; 4382 int rc = 0; 4383 4384 ssp = smack_sock(sock->sk); 4385 if (ssp->smk_packet != NULL) { 4386 rcp = ssp->smk_packet->smk_known; 4387 slen = strlen(rcp) + 1; 4388 } 4389 if (slen > len) { 4390 rc = -ERANGE; 4391 goto out_len; 4392 } 4393 4394 if (copy_to_sockptr(optval, rcp, slen)) 4395 rc = -EFAULT; 4396 out_len: 4397 if (copy_to_sockptr(optlen, &slen, sizeof(slen))) 4398 rc = -EFAULT; 4399 return rc; 4400 } 4401 4402 4403 /** 4404 * smack_socket_getpeersec_dgram - pull in packet label 4405 * @sock: the peer socket 4406 * @skb: packet data 4407 * @secid: pointer to where to put the secid of the packet 4408 * 4409 * Sets the netlabel socket state on sk from parent 4410 */ 4411 static int smack_socket_getpeersec_dgram(struct socket *sock, 4412 struct sk_buff *skb, u32 *secid) 4413 4414 { 4415 struct socket_smack *ssp = NULL; 4416 struct smack_known *skp; 4417 struct sock *sk = NULL; 4418 int family = PF_UNSPEC; 4419 u32 s = 0; /* 0 is the invalid secid */ 4420 4421 if (skb != NULL) { 4422 if (skb->protocol == htons(ETH_P_IP)) 4423 family = PF_INET; 4424 #if IS_ENABLED(CONFIG_IPV6) 4425 else if (skb->protocol == htons(ETH_P_IPV6)) 4426 family = PF_INET6; 4427 #endif /* CONFIG_IPV6 */ 4428 } 4429 if (family == PF_UNSPEC && sock != NULL) 4430 family = sock->sk->sk_family; 4431 4432 switch (family) { 4433 case PF_UNIX: 4434 ssp = smack_sock(sock->sk); 4435 s = ssp->smk_out->smk_secid; 4436 break; 4437 case PF_INET: 4438 skp = smack_from_skb(skb); 4439 if (skp) { 4440 s = skp->smk_secid; 4441 break; 4442 } 4443 /* 4444 * Translate what netlabel gave us. 4445 */ 4446 if (sock != NULL) 4447 sk = sock->sk; 4448 skp = smack_from_netlbl(sk, family, skb); 4449 if (skp != NULL) 4450 s = skp->smk_secid; 4451 break; 4452 case PF_INET6: 4453 #ifdef SMACK_IPV6_SECMARK_LABELING 4454 skp = smack_from_skb(skb); 4455 if (skp) 4456 s = skp->smk_secid; 4457 #endif 4458 break; 4459 } 4460 *secid = s; 4461 if (s == 0) 4462 return -EINVAL; 4463 return 0; 4464 } 4465 4466 /** 4467 * smack_inet_conn_request - Smack access check on connect 4468 * @sk: socket involved 4469 * @skb: packet 4470 * @req: unused 4471 * 4472 * Returns 0 if a task with the packet label could write to 4473 * the socket, otherwise an error code 4474 */ 4475 static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb, 4476 struct request_sock *req) 4477 { 4478 u16 family = sk->sk_family; 4479 struct smack_known *skp; 4480 struct socket_smack *ssp = smack_sock(sk); 4481 struct sockaddr_in addr; 4482 struct iphdr *hdr; 4483 struct smack_known *hskp; 4484 int rc; 4485 struct smk_audit_info ad; 4486 #ifdef CONFIG_AUDIT 4487 struct lsm_network_audit net; 4488 #endif 4489 4490 #if IS_ENABLED(CONFIG_IPV6) 4491 if (family == PF_INET6) { 4492 /* 4493 * Handle mapped IPv4 packets arriving 4494 * via IPv6 sockets. Don't set up netlabel 4495 * processing on IPv6. 4496 */ 4497 if (skb->protocol == htons(ETH_P_IP)) 4498 family = PF_INET; 4499 else 4500 return 0; 4501 } 4502 #endif /* CONFIG_IPV6 */ 4503 4504 /* 4505 * If there is a secmark use it rather than the CIPSO label. 4506 * If there is no secmark fall back to CIPSO. 4507 * The secmark is assumed to reflect policy better. 4508 */ 4509 skp = smack_from_skb(skb); 4510 if (skp == NULL) { 4511 skp = smack_from_netlbl(sk, family, skb); 4512 if (skp == NULL) 4513 skp = &smack_known_huh; 4514 } 4515 4516 #ifdef CONFIG_AUDIT 4517 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4518 ad.a.u.net->family = family; 4519 ad.a.u.net->netif = skb->skb_iif; 4520 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 4521 #endif 4522 /* 4523 * Receiving a packet requires that the other end be able to write 4524 * here. Read access is not required. 4525 */ 4526 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4527 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc); 4528 if (rc != 0) 4529 return rc; 4530 4531 /* 4532 * Save the peer's label in the request_sock so we can later setup 4533 * smk_packet in the child socket so that SO_PEERCRED can report it. 4534 */ 4535 req->peer_secid = skp->smk_secid; 4536 4537 /* 4538 * We need to decide if we want to label the incoming connection here 4539 * if we do we only need to label the request_sock and the stack will 4540 * propagate the wire-label to the sock when it is created. 4541 */ 4542 hdr = ip_hdr(skb); 4543 addr.sin_addr.s_addr = hdr->saddr; 4544 rcu_read_lock(); 4545 hskp = smack_ipv4host_label(&addr); 4546 rcu_read_unlock(); 4547 4548 if (hskp == NULL) 4549 rc = netlbl_req_setattr(req, &ssp->smk_out->smk_netlabel); 4550 else 4551 netlbl_req_delattr(req); 4552 4553 return rc; 4554 } 4555 4556 /** 4557 * smack_inet_csk_clone - Copy the connection information to the new socket 4558 * @sk: the new socket 4559 * @req: the connection's request_sock 4560 * 4561 * Transfer the connection's peer label to the newly created socket. 4562 */ 4563 static void smack_inet_csk_clone(struct sock *sk, 4564 const struct request_sock *req) 4565 { 4566 struct socket_smack *ssp = smack_sock(sk); 4567 struct smack_known *skp; 4568 4569 if (req->peer_secid != 0) { 4570 skp = smack_from_secid(req->peer_secid); 4571 ssp->smk_packet = skp; 4572 } else 4573 ssp->smk_packet = NULL; 4574 } 4575 4576 /* 4577 * Key management security hooks 4578 * 4579 * Casey has not tested key support very heavily. 4580 * The permission check is most likely too restrictive. 4581 * If you care about keys please have a look. 4582 */ 4583 #ifdef CONFIG_KEYS 4584 4585 /** 4586 * smack_key_alloc - Set the key security blob 4587 * @key: object 4588 * @cred: the credentials to use 4589 * @flags: unused 4590 * 4591 * No allocation required 4592 * 4593 * Returns 0 4594 */ 4595 static int smack_key_alloc(struct key *key, const struct cred *cred, 4596 unsigned long flags) 4597 { 4598 struct smack_known **blob = smack_key(key); 4599 struct smack_known *skp = smk_of_task(smack_cred(cred)); 4600 4601 *blob = skp; 4602 return 0; 4603 } 4604 4605 /** 4606 * smack_key_permission - Smack access on a key 4607 * @key_ref: gets to the object 4608 * @cred: the credentials to use 4609 * @need_perm: requested key permission 4610 * 4611 * Return 0 if the task has read and write to the object, 4612 * an error code otherwise 4613 */ 4614 static int smack_key_permission(key_ref_t key_ref, 4615 const struct cred *cred, 4616 enum key_need_perm need_perm) 4617 { 4618 struct smack_known **blob; 4619 struct smack_known *skp; 4620 struct key *keyp; 4621 struct smk_audit_info ad; 4622 struct smack_known *tkp = smk_of_task(smack_cred(cred)); 4623 int request = 0; 4624 int rc; 4625 4626 /* 4627 * Validate requested permissions 4628 */ 4629 switch (need_perm) { 4630 case KEY_NEED_READ: 4631 case KEY_NEED_SEARCH: 4632 case KEY_NEED_VIEW: 4633 request |= MAY_READ; 4634 break; 4635 case KEY_NEED_WRITE: 4636 case KEY_NEED_LINK: 4637 case KEY_NEED_SETATTR: 4638 request |= MAY_WRITE; 4639 break; 4640 case KEY_NEED_UNSPECIFIED: 4641 case KEY_NEED_UNLINK: 4642 case KEY_SYSADMIN_OVERRIDE: 4643 case KEY_AUTHTOKEN_OVERRIDE: 4644 case KEY_DEFER_PERM_CHECK: 4645 return 0; 4646 default: 4647 return -EINVAL; 4648 } 4649 4650 keyp = key_ref_to_ptr(key_ref); 4651 if (keyp == NULL) 4652 return -EINVAL; 4653 /* 4654 * If the key hasn't been initialized give it access so that 4655 * it may do so. 4656 */ 4657 blob = smack_key(keyp); 4658 skp = *blob; 4659 if (skp == NULL) 4660 return 0; 4661 /* 4662 * This should not occur 4663 */ 4664 if (tkp == NULL) 4665 return -EACCES; 4666 4667 if (smack_privileged(CAP_MAC_OVERRIDE)) 4668 return 0; 4669 4670 #ifdef CONFIG_AUDIT 4671 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 4672 ad.a.u.key_struct.key = keyp->serial; 4673 ad.a.u.key_struct.key_desc = keyp->description; 4674 #endif 4675 rc = smk_access(tkp, skp, request, &ad); 4676 rc = smk_bu_note("key access", tkp, skp, request, rc); 4677 return rc; 4678 } 4679 4680 /* 4681 * smack_key_getsecurity - Smack label tagging the key 4682 * @key points to the key to be queried 4683 * @_buffer points to a pointer that should be set to point to the 4684 * resulting string (if no label or an error occurs). 4685 * Return the length of the string (including terminating NUL) or -ve if 4686 * an error. 4687 * May also return 0 (and a NULL buffer pointer) if there is no label. 4688 */ 4689 static int smack_key_getsecurity(struct key *key, char **_buffer) 4690 { 4691 struct smack_known **blob = smack_key(key); 4692 struct smack_known *skp = *blob; 4693 size_t length; 4694 char *copy; 4695 4696 if (skp == NULL) { 4697 *_buffer = NULL; 4698 return 0; 4699 } 4700 4701 copy = kstrdup(skp->smk_known, GFP_KERNEL); 4702 if (copy == NULL) 4703 return -ENOMEM; 4704 length = strlen(copy) + 1; 4705 4706 *_buffer = copy; 4707 return length; 4708 } 4709 4710 4711 #ifdef CONFIG_KEY_NOTIFICATIONS 4712 /** 4713 * smack_watch_key - Smack access to watch a key for notifications. 4714 * @key: The key to be watched 4715 * 4716 * Return 0 if the @watch->cred has permission to read from the key object and 4717 * an error otherwise. 4718 */ 4719 static int smack_watch_key(struct key *key) 4720 { 4721 struct smk_audit_info ad; 4722 struct smack_known *tkp = smk_of_current(); 4723 struct smack_known **blob = smack_key(key); 4724 int rc; 4725 4726 /* 4727 * This should not occur 4728 */ 4729 if (tkp == NULL) 4730 return -EACCES; 4731 4732 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred())) 4733 return 0; 4734 4735 #ifdef CONFIG_AUDIT 4736 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 4737 ad.a.u.key_struct.key = key->serial; 4738 ad.a.u.key_struct.key_desc = key->description; 4739 #endif 4740 rc = smk_access(tkp, *blob, MAY_READ, &ad); 4741 rc = smk_bu_note("key watch", tkp, *blob, MAY_READ, rc); 4742 return rc; 4743 } 4744 #endif /* CONFIG_KEY_NOTIFICATIONS */ 4745 #endif /* CONFIG_KEYS */ 4746 4747 #ifdef CONFIG_WATCH_QUEUE 4748 /** 4749 * smack_post_notification - Smack access to post a notification to a queue 4750 * @w_cred: The credentials of the watcher. 4751 * @cred: The credentials of the event source (may be NULL). 4752 * @n: The notification message to be posted. 4753 */ 4754 static int smack_post_notification(const struct cred *w_cred, 4755 const struct cred *cred, 4756 struct watch_notification *n) 4757 { 4758 struct smk_audit_info ad; 4759 struct smack_known *subj, *obj; 4760 int rc; 4761 4762 /* Always let maintenance notifications through. */ 4763 if (n->type == WATCH_TYPE_META) 4764 return 0; 4765 4766 if (!cred) 4767 return 0; 4768 subj = smk_of_task(smack_cred(cred)); 4769 obj = smk_of_task(smack_cred(w_cred)); 4770 4771 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NOTIFICATION); 4772 rc = smk_access(subj, obj, MAY_WRITE, &ad); 4773 rc = smk_bu_note("notification", subj, obj, MAY_WRITE, rc); 4774 return rc; 4775 } 4776 #endif /* CONFIG_WATCH_QUEUE */ 4777 4778 /* 4779 * Smack Audit hooks 4780 * 4781 * Audit requires a unique representation of each Smack specific 4782 * rule. This unique representation is used to distinguish the 4783 * object to be audited from remaining kernel objects and also 4784 * works as a glue between the audit hooks. 4785 * 4786 * Since repository entries are added but never deleted, we'll use 4787 * the smack_known label address related to the given audit rule as 4788 * the needed unique representation. This also better fits the smack 4789 * model where nearly everything is a label. 4790 */ 4791 #ifdef CONFIG_AUDIT 4792 4793 /** 4794 * smack_audit_rule_init - Initialize a smack audit rule 4795 * @field: audit rule fields given from user-space (audit.h) 4796 * @op: required testing operator (=, !=, >, <, ...) 4797 * @rulestr: smack label to be audited 4798 * @vrule: pointer to save our own audit rule representation 4799 * @gfp: type of the memory for the allocation 4800 * 4801 * Prepare to audit cases where (@field @op @rulestr) is true. 4802 * The label to be audited is created if necessary. 4803 */ 4804 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, 4805 gfp_t gfp) 4806 { 4807 struct smack_known *skp; 4808 char **rule = (char **)vrule; 4809 *rule = NULL; 4810 4811 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4812 return -EINVAL; 4813 4814 if (op != Audit_equal && op != Audit_not_equal) 4815 return -EINVAL; 4816 4817 skp = smk_import_entry(rulestr, 0); 4818 if (IS_ERR(skp)) 4819 return PTR_ERR(skp); 4820 4821 *rule = skp->smk_known; 4822 4823 return 0; 4824 } 4825 4826 /** 4827 * smack_audit_rule_known - Distinguish Smack audit rules 4828 * @krule: rule of interest, in Audit kernel representation format 4829 * 4830 * This is used to filter Smack rules from remaining Audit ones. 4831 * If it's proved that this rule belongs to us, the 4832 * audit_rule_match hook will be called to do the final judgement. 4833 */ 4834 static int smack_audit_rule_known(struct audit_krule *krule) 4835 { 4836 struct audit_field *f; 4837 int i; 4838 4839 for (i = 0; i < krule->field_count; i++) { 4840 f = &krule->fields[i]; 4841 4842 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER) 4843 return 1; 4844 } 4845 4846 return 0; 4847 } 4848 4849 /** 4850 * smack_audit_rule_match - Audit given object ? 4851 * @prop: security id for identifying the object to test 4852 * @field: audit rule flags given from user-space 4853 * @op: required testing operator 4854 * @vrule: smack internal rule presentation 4855 * 4856 * The core Audit hook. It's used to take the decision of 4857 * whether to audit or not to audit a given object. 4858 */ 4859 static int smack_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, 4860 void *vrule) 4861 { 4862 struct smack_known *skp = prop->smack.skp; 4863 char *rule = vrule; 4864 4865 if (unlikely(!rule)) { 4866 WARN_ONCE(1, "Smack: missing rule\n"); 4867 return -ENOENT; 4868 } 4869 4870 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4871 return 0; 4872 4873 /* 4874 * No need to do string comparisons. If a match occurs, 4875 * both pointers will point to the same smack_known 4876 * label. 4877 */ 4878 if (op == Audit_equal) 4879 return (rule == skp->smk_known); 4880 if (op == Audit_not_equal) 4881 return (rule != skp->smk_known); 4882 4883 return 0; 4884 } 4885 4886 /* 4887 * There is no need for a smack_audit_rule_free hook. 4888 * No memory was allocated. 4889 */ 4890 4891 #endif /* CONFIG_AUDIT */ 4892 4893 /** 4894 * smack_ismaclabel - check if xattr @name references a smack MAC label 4895 * @name: Full xattr name to check. 4896 */ 4897 static int smack_ismaclabel(const char *name) 4898 { 4899 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); 4900 } 4901 4902 /** 4903 * smack_to_secctx - fill a lsm_context 4904 * @skp: Smack label 4905 * @cp: destination 4906 * 4907 * Fill the passed @cp and return the length of the string 4908 */ 4909 static int smack_to_secctx(struct smack_known *skp, struct lsm_context *cp) 4910 { 4911 int len = strlen(skp->smk_known); 4912 4913 if (cp) { 4914 cp->context = skp->smk_known; 4915 cp->len = len; 4916 cp->id = LSM_ID_SMACK; 4917 } 4918 return len; 4919 } 4920 4921 /** 4922 * smack_secid_to_secctx - return the smack label for a secid 4923 * @secid: incoming integer 4924 * @cp: destination 4925 * 4926 * Exists for networking code. 4927 */ 4928 static int smack_secid_to_secctx(u32 secid, struct lsm_context *cp) 4929 { 4930 return smack_to_secctx(smack_from_secid(secid), cp); 4931 } 4932 4933 /** 4934 * smack_lsmprop_to_secctx - return the smack label 4935 * @prop: includes incoming Smack data 4936 * @cp: destination 4937 * 4938 * Exists for audit code. 4939 */ 4940 static int smack_lsmprop_to_secctx(struct lsm_prop *prop, 4941 struct lsm_context *cp) 4942 { 4943 return smack_to_secctx(prop->smack.skp, cp); 4944 } 4945 4946 /** 4947 * smack_secctx_to_secid - return the secid for a smack label 4948 * @secdata: smack label 4949 * @seclen: how long result is 4950 * @secid: outgoing integer 4951 * 4952 * Exists for audit and networking code. 4953 */ 4954 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 4955 { 4956 struct smack_known *skp = smk_find_entry(secdata); 4957 4958 if (skp) 4959 *secid = skp->smk_secid; 4960 else 4961 *secid = 0; 4962 return 0; 4963 } 4964 4965 /* 4966 * There used to be a smack_release_secctx hook 4967 * that did nothing back when hooks were in a vector. 4968 * Now that there's a list such a hook adds cost. 4969 */ 4970 4971 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 4972 { 4973 /* 4974 * UDS inode has fixed label. Ignore nfs label. 4975 */ 4976 if (S_ISSOCK(inode->i_mode)) 4977 return 0; 4978 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, 4979 ctxlen, 0); 4980 } 4981 4982 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 4983 { 4984 return __vfs_setxattr_locked(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK, 4985 ctx, ctxlen, 0, NULL); 4986 } 4987 4988 static int smack_inode_getsecctx(struct inode *inode, struct lsm_context *cp) 4989 { 4990 struct smack_known *skp = smk_of_inode(inode); 4991 4992 cp->context = skp->smk_known; 4993 cp->len = strlen(skp->smk_known); 4994 cp->id = LSM_ID_SMACK; 4995 return 0; 4996 } 4997 4998 static int smack_inode_copy_up(struct dentry *dentry, struct cred **new) 4999 { 5000 5001 struct task_smack *tsp; 5002 struct smack_known *skp; 5003 struct inode_smack *isp; 5004 struct cred *new_creds = *new; 5005 5006 if (new_creds == NULL) { 5007 new_creds = prepare_creds(); 5008 if (new_creds == NULL) 5009 return -ENOMEM; 5010 } 5011 5012 tsp = smack_cred(new_creds); 5013 5014 /* 5015 * Get label from overlay inode and set it in create_sid 5016 */ 5017 isp = smack_inode(d_inode(dentry)); 5018 skp = isp->smk_inode; 5019 tsp->smk_task = skp; 5020 *new = new_creds; 5021 return 0; 5022 } 5023 5024 static int smack_inode_copy_up_xattr(struct dentry *src, const char *name) 5025 { 5026 /* 5027 * Return -ECANCELED if this is the smack access Smack attribute. 5028 */ 5029 if (!strcmp(name, XATTR_NAME_SMACK)) 5030 return -ECANCELED; 5031 5032 return -EOPNOTSUPP; 5033 } 5034 5035 static int smack_dentry_create_files_as(struct dentry *dentry, int mode, 5036 const struct qstr *name, 5037 const struct cred *old, 5038 struct cred *new) 5039 { 5040 struct task_smack *otsp = smack_cred(old); 5041 struct task_smack *ntsp = smack_cred(new); 5042 struct inode_smack *isp; 5043 5044 /* 5045 * Use the process credential unless all of 5046 * the transmuting criteria are met 5047 */ 5048 ntsp->smk_task = otsp->smk_task; 5049 5050 /* 5051 * the attribute of the containing directory 5052 */ 5053 isp = smack_inode(d_inode(dentry->d_parent)); 5054 5055 if (isp->smk_flags & SMK_INODE_TRANSMUTE) { 5056 /* 5057 * If the directory is transmuting and the rule 5058 * providing access is transmuting use the containing 5059 * directory label instead of the process label. 5060 */ 5061 if (smk_rule_transmutes(otsp->smk_task, isp->smk_inode)) { 5062 ntsp->smk_task = isp->smk_inode; 5063 ntsp->smk_transmuted = ntsp->smk_task; 5064 } 5065 } 5066 return 0; 5067 } 5068 5069 #ifdef CONFIG_IO_URING 5070 /** 5071 * smack_uring_override_creds - Is io_uring cred override allowed? 5072 * @new: the target creds 5073 * 5074 * Check to see if the current task is allowed to override it's credentials 5075 * to service an io_uring operation. 5076 */ 5077 static int smack_uring_override_creds(const struct cred *new) 5078 { 5079 struct task_smack *tsp = smack_cred(current_cred()); 5080 struct task_smack *nsp = smack_cred(new); 5081 5082 /* 5083 * Allow the degenerate case where the new Smack value is 5084 * the same as the current Smack value. 5085 */ 5086 if (tsp->smk_task == nsp->smk_task) 5087 return 0; 5088 5089 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred())) 5090 return 0; 5091 5092 return -EPERM; 5093 } 5094 5095 /** 5096 * smack_uring_sqpoll - check if a io_uring polling thread can be created 5097 * 5098 * Check to see if the current task is allowed to create a new io_uring 5099 * kernel polling thread. 5100 */ 5101 static int smack_uring_sqpoll(void) 5102 { 5103 if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred())) 5104 return 0; 5105 5106 return -EPERM; 5107 } 5108 5109 /** 5110 * smack_uring_cmd - check on file operations for io_uring 5111 * @ioucmd: the command in question 5112 * 5113 * Make a best guess about whether a io_uring "command" should 5114 * be allowed. Use the same logic used for determining if the 5115 * file could be opened for read in the absence of better criteria. 5116 */ 5117 static int smack_uring_cmd(struct io_uring_cmd *ioucmd) 5118 { 5119 struct file *file = ioucmd->file; 5120 struct smk_audit_info ad; 5121 struct task_smack *tsp; 5122 struct inode *inode; 5123 int rc; 5124 5125 if (!file) 5126 return -EINVAL; 5127 5128 tsp = smack_cred(file->f_cred); 5129 inode = file_inode(file); 5130 5131 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 5132 smk_ad_setfield_u_fs_path(&ad, file->f_path); 5133 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad); 5134 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc); 5135 5136 return rc; 5137 } 5138 5139 #endif /* CONFIG_IO_URING */ 5140 5141 struct lsm_blob_sizes smack_blob_sizes __ro_after_init = { 5142 .lbs_cred = sizeof(struct task_smack), 5143 .lbs_file = sizeof(struct smack_known *), 5144 .lbs_inode = sizeof(struct inode_smack), 5145 .lbs_ipc = sizeof(struct smack_known *), 5146 .lbs_key = sizeof(struct smack_known *), 5147 .lbs_msg_msg = sizeof(struct smack_known *), 5148 .lbs_sock = sizeof(struct socket_smack), 5149 .lbs_superblock = sizeof(struct superblock_smack), 5150 .lbs_xattr_count = SMACK_INODE_INIT_XATTRS, 5151 }; 5152 5153 static const struct lsm_id smack_lsmid = { 5154 .name = "smack", 5155 .id = LSM_ID_SMACK, 5156 }; 5157 5158 static struct security_hook_list smack_hooks[] __ro_after_init = { 5159 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), 5160 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), 5161 LSM_HOOK_INIT(syslog, smack_syslog), 5162 5163 LSM_HOOK_INIT(fs_context_submount, smack_fs_context_submount), 5164 LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup), 5165 LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param), 5166 5167 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security), 5168 LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts), 5169 LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts), 5170 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs), 5171 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts), 5172 5173 LSM_HOOK_INIT(bprm_creds_for_exec, smack_bprm_creds_for_exec), 5174 5175 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security), 5176 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security), 5177 LSM_HOOK_INIT(inode_link, smack_inode_link), 5178 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink), 5179 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir), 5180 LSM_HOOK_INIT(inode_rename, smack_inode_rename), 5181 LSM_HOOK_INIT(inode_permission, smack_inode_permission), 5182 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr), 5183 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr), 5184 LSM_HOOK_INIT(inode_xattr_skipcap, smack_inode_xattr_skipcap), 5185 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr), 5186 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr), 5187 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr), 5188 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr), 5189 LSM_HOOK_INIT(inode_set_acl, smack_inode_set_acl), 5190 LSM_HOOK_INIT(inode_get_acl, smack_inode_get_acl), 5191 LSM_HOOK_INIT(inode_remove_acl, smack_inode_remove_acl), 5192 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity), 5193 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity), 5194 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity), 5195 LSM_HOOK_INIT(inode_getlsmprop, smack_inode_getlsmprop), 5196 5197 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security), 5198 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl), 5199 LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl), 5200 LSM_HOOK_INIT(file_lock, smack_file_lock), 5201 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl), 5202 LSM_HOOK_INIT(mmap_file, smack_mmap_file), 5203 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr), 5204 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner), 5205 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask), 5206 LSM_HOOK_INIT(file_receive, smack_file_receive), 5207 5208 LSM_HOOK_INIT(file_open, smack_file_open), 5209 5210 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank), 5211 LSM_HOOK_INIT(cred_free, smack_cred_free), 5212 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare), 5213 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer), 5214 LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid), 5215 LSM_HOOK_INIT(cred_getlsmprop, smack_cred_getlsmprop), 5216 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as), 5217 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as), 5218 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid), 5219 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid), 5220 LSM_HOOK_INIT(task_getsid, smack_task_getsid), 5221 LSM_HOOK_INIT(current_getlsmprop_subj, smack_current_getlsmprop_subj), 5222 LSM_HOOK_INIT(task_getlsmprop_obj, smack_task_getlsmprop_obj), 5223 LSM_HOOK_INIT(task_setnice, smack_task_setnice), 5224 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio), 5225 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio), 5226 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler), 5227 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler), 5228 LSM_HOOK_INIT(task_movememory, smack_task_movememory), 5229 LSM_HOOK_INIT(task_kill, smack_task_kill), 5230 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode), 5231 5232 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission), 5233 LSM_HOOK_INIT(ipc_getlsmprop, smack_ipc_getlsmprop), 5234 5235 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security), 5236 5237 LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security), 5238 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate), 5239 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl), 5240 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd), 5241 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv), 5242 5243 LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security), 5244 LSM_HOOK_INIT(shm_associate, smack_shm_associate), 5245 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl), 5246 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat), 5247 5248 LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security), 5249 LSM_HOOK_INIT(sem_associate, smack_sem_associate), 5250 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl), 5251 LSM_HOOK_INIT(sem_semop, smack_sem_semop), 5252 5253 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate), 5254 5255 LSM_HOOK_INIT(getselfattr, smack_getselfattr), 5256 LSM_HOOK_INIT(setselfattr, smack_setselfattr), 5257 LSM_HOOK_INIT(getprocattr, smack_getprocattr), 5258 LSM_HOOK_INIT(setprocattr, smack_setprocattr), 5259 5260 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect), 5261 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send), 5262 5263 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create), 5264 LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair), 5265 #ifdef SMACK_IPV6_PORT_LABELING 5266 LSM_HOOK_INIT(socket_bind, smack_socket_bind), 5267 #endif 5268 LSM_HOOK_INIT(socket_connect, smack_socket_connect), 5269 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg), 5270 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb), 5271 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream), 5272 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram), 5273 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), 5274 #ifdef SMACK_IPV6_PORT_LABELING 5275 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), 5276 #endif 5277 LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security), 5278 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), 5279 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone), 5280 5281 /* key management security hooks */ 5282 #ifdef CONFIG_KEYS 5283 LSM_HOOK_INIT(key_alloc, smack_key_alloc), 5284 LSM_HOOK_INIT(key_permission, smack_key_permission), 5285 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity), 5286 #ifdef CONFIG_KEY_NOTIFICATIONS 5287 LSM_HOOK_INIT(watch_key, smack_watch_key), 5288 #endif 5289 #endif /* CONFIG_KEYS */ 5290 5291 #ifdef CONFIG_WATCH_QUEUE 5292 LSM_HOOK_INIT(post_notification, smack_post_notification), 5293 #endif 5294 5295 /* Audit hooks */ 5296 #ifdef CONFIG_AUDIT 5297 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init), 5298 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known), 5299 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match), 5300 #endif /* CONFIG_AUDIT */ 5301 5302 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel), 5303 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), 5304 LSM_HOOK_INIT(lsmprop_to_secctx, smack_lsmprop_to_secctx), 5305 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), 5306 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), 5307 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), 5308 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), 5309 LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up), 5310 LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr), 5311 LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as), 5312 #ifdef CONFIG_IO_URING 5313 LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds), 5314 LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll), 5315 LSM_HOOK_INIT(uring_cmd, smack_uring_cmd), 5316 #endif 5317 }; 5318 5319 5320 static __init void init_smack_known_list(void) 5321 { 5322 /* 5323 * Initialize rule list locks 5324 */ 5325 mutex_init(&smack_known_huh.smk_rules_lock); 5326 mutex_init(&smack_known_hat.smk_rules_lock); 5327 mutex_init(&smack_known_floor.smk_rules_lock); 5328 mutex_init(&smack_known_star.smk_rules_lock); 5329 mutex_init(&smack_known_web.smk_rules_lock); 5330 /* 5331 * Initialize rule lists 5332 */ 5333 INIT_LIST_HEAD(&smack_known_huh.smk_rules); 5334 INIT_LIST_HEAD(&smack_known_hat.smk_rules); 5335 INIT_LIST_HEAD(&smack_known_star.smk_rules); 5336 INIT_LIST_HEAD(&smack_known_floor.smk_rules); 5337 INIT_LIST_HEAD(&smack_known_web.smk_rules); 5338 /* 5339 * Create the known labels list 5340 */ 5341 smk_insert_entry(&smack_known_huh); 5342 smk_insert_entry(&smack_known_hat); 5343 smk_insert_entry(&smack_known_star); 5344 smk_insert_entry(&smack_known_floor); 5345 smk_insert_entry(&smack_known_web); 5346 } 5347 5348 /** 5349 * smack_init - initialize the smack system 5350 * 5351 * Returns 0 on success, -ENOMEM is there's no memory 5352 */ 5353 static __init int smack_init(void) 5354 { 5355 struct cred *cred = (struct cred *) current->cred; 5356 struct task_smack *tsp; 5357 5358 smack_rule_cache = KMEM_CACHE(smack_rule, 0); 5359 if (!smack_rule_cache) 5360 return -ENOMEM; 5361 5362 /* 5363 * Set the security state for the initial task. 5364 */ 5365 tsp = smack_cred(cred); 5366 init_task_smack(tsp, &smack_known_floor, &smack_known_floor); 5367 5368 /* 5369 * Register with LSM 5370 */ 5371 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), &smack_lsmid); 5372 smack_enabled = 1; 5373 5374 pr_info("Smack: Initializing.\n"); 5375 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 5376 pr_info("Smack: Netfilter enabled.\n"); 5377 #endif 5378 #ifdef SMACK_IPV6_PORT_LABELING 5379 pr_info("Smack: IPv6 port labeling enabled.\n"); 5380 #endif 5381 #ifdef SMACK_IPV6_SECMARK_LABELING 5382 pr_info("Smack: IPv6 Netfilter enabled.\n"); 5383 #endif 5384 5385 /* initialize the smack_known_list */ 5386 init_smack_known_list(); 5387 5388 /* Inform the audit system that secctx is used */ 5389 audit_cfg_lsm(&smack_lsmid, 5390 AUDIT_CFG_LSM_SECCTX_SUBJECT | 5391 AUDIT_CFG_LSM_SECCTX_OBJECT); 5392 5393 return 0; 5394 } 5395 5396 int __init smack_initcall(void) 5397 { 5398 int rc_fs = init_smk_fs(); 5399 int rc_nf = smack_nf_ip_init(); 5400 5401 return rc_fs ? rc_fs : rc_nf; 5402 } 5403 5404 /* 5405 * Smack requires early initialization in order to label 5406 * all processes and objects when they are created. 5407 */ 5408 DEFINE_LSM(smack) = { 5409 .id = &smack_lsmid, 5410 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, 5411 .blobs = &smack_blob_sizes, 5412 .init = smack_init, 5413 .initcall_device = smack_initcall, 5414 }; 5415