xref: /linux/security/smack/smack.h (revision 109d59b900e78834c66657dd4748fcedb9a1fe8d)
1 /*
2  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3  *
4  *      This program is free software; you can redistribute it and/or modify
5  *      it under the terms of the GNU General Public License as published by
6  *      the Free Software Foundation, version 2.
7  *
8  * Author:
9  *      Casey Schaufler <casey@schaufler-ca.com>
10  *
11  */
12 
13 #ifndef _SECURITY_SMACK_H
14 #define _SECURITY_SMACK_H
15 
16 #include <linux/capability.h>
17 #include <linux/spinlock.h>
18 #include <linux/lsm_hooks.h>
19 #include <linux/in.h>
20 #if IS_ENABLED(CONFIG_IPV6)
21 #include <linux/in6.h>
22 #endif /* CONFIG_IPV6 */
23 #include <net/netlabel.h>
24 #include <linux/list.h>
25 #include <linux/rculist.h>
26 #include <linux/lsm_audit.h>
27 
28 /*
29  * Use IPv6 port labeling if IPv6 is enabled and secmarks
30  * are not being used.
31  */
32 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
33 #define SMACK_IPV6_PORT_LABELING 1
34 #endif
35 
36 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
37 #define SMACK_IPV6_SECMARK_LABELING 1
38 #endif
39 
40 /*
41  * Smack labels were limited to 23 characters for a long time.
42  */
43 #define SMK_LABELLEN	24
44 #define SMK_LONGLABEL	256
45 
46 /*
47  * This is the repository for labels seen so that it is
48  * not necessary to keep allocating tiny chuncks of memory
49  * and so that they can be shared.
50  *
51  * Labels are never modified in place. Anytime a label
52  * is imported (e.g. xattrset on a file) the list is checked
53  * for it and it is added if it doesn't exist. The address
54  * is passed out in either case. Entries are added, but
55  * never deleted.
56  *
57  * Since labels are hanging around anyway it doesn't
58  * hurt to maintain a secid for those awkward situations
59  * where kernel components that ought to use LSM independent
60  * interfaces don't. The secid should go away when all of
61  * these components have been repaired.
62  *
63  * The cipso value associated with the label gets stored here, too.
64  *
65  * Keep the access rules for this subject label here so that
66  * the entire set of rules does not need to be examined every
67  * time.
68  */
69 struct smack_known {
70 	struct list_head		list;
71 	struct hlist_node		smk_hashed;
72 	char				*smk_known;
73 	u32				smk_secid;
74 	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
75 	struct list_head		smk_rules;	/* access rules */
76 	struct mutex			smk_rules_lock;	/* lock for rules */
77 };
78 
79 /*
80  * Maximum number of bytes for the levels in a CIPSO IP option.
81  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
82  * bigger than can be used, and 24 is the next lower multiple
83  * of 8, and there are too many issues if there isn't space set
84  * aside for the terminating null byte.
85  */
86 #define SMK_CIPSOLEN	24
87 
88 struct superblock_smack {
89 	struct smack_known	*smk_root;
90 	struct smack_known	*smk_floor;
91 	struct smack_known	*smk_hat;
92 	struct smack_known	*smk_default;
93 	int			smk_flags;
94 };
95 
96 /*
97  * Superblock flags
98  */
99 #define SMK_SB_INITIALIZED	0x01
100 #define SMK_SB_UNTRUSTED	0x02
101 
102 struct socket_smack {
103 	struct smack_known	*smk_out;	/* outbound label */
104 	struct smack_known	*smk_in;	/* inbound label */
105 	struct smack_known	*smk_packet;	/* TCP peer label */
106 };
107 
108 /*
109  * Inode smack data
110  */
111 struct inode_smack {
112 	struct smack_known	*smk_inode;	/* label of the fso */
113 	struct smack_known	*smk_task;	/* label of the task */
114 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
115 	struct mutex		smk_lock;	/* initialization lock */
116 	int			smk_flags;	/* smack inode flags */
117 	struct rcu_head         smk_rcu;	/* for freeing inode_smack */
118 };
119 
120 struct task_smack {
121 	struct smack_known	*smk_task;	/* label for access control */
122 	struct smack_known	*smk_forked;	/* label when forked */
123 	struct list_head	smk_rules;	/* per task access rules */
124 	struct mutex		smk_rules_lock;	/* lock for the rules */
125 	struct list_head	smk_relabel;	/* transit allowed labels */
126 };
127 
128 #define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
129 #define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
130 #define	SMK_INODE_CHANGED	0x04	/* smack was transmuted */
131 #define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
132 
133 /*
134  * A label access rule.
135  */
136 struct smack_rule {
137 	struct list_head	list;
138 	struct smack_known	*smk_subject;
139 	struct smack_known	*smk_object;
140 	int			smk_access;
141 };
142 
143 /*
144  * An entry in the table identifying IPv4 hosts.
145  */
146 struct smk_net4addr {
147 	struct list_head	list;
148 	struct in_addr		smk_host;	/* network address */
149 	struct in_addr		smk_mask;	/* network mask */
150 	int			smk_masks;	/* mask size */
151 	struct smack_known	*smk_label;	/* label */
152 };
153 
154 #if IS_ENABLED(CONFIG_IPV6)
155 /*
156  * An entry in the table identifying IPv6 hosts.
157  */
158 struct smk_net6addr {
159 	struct list_head	list;
160 	struct in6_addr		smk_host;	/* network address */
161 	struct in6_addr		smk_mask;	/* network mask */
162 	int			smk_masks;	/* mask size */
163 	struct smack_known	*smk_label;	/* label */
164 };
165 #endif /* CONFIG_IPV6 */
166 
167 #ifdef SMACK_IPV6_PORT_LABELING
168 /*
169  * An entry in the table identifying ports.
170  */
171 struct smk_port_label {
172 	struct list_head	list;
173 	struct sock		*smk_sock;	/* socket initialized on */
174 	unsigned short		smk_port;	/* the port number */
175 	struct smack_known	*smk_in;	/* inbound label */
176 	struct smack_known	*smk_out;	/* outgoing label */
177 	short			smk_sock_type;	/* Socket type */
178 	short			smk_can_reuse;
179 };
180 #endif /* SMACK_IPV6_PORT_LABELING */
181 
182 struct smack_known_list_elem {
183 	struct list_head	list;
184 	struct smack_known	*smk_label;
185 };
186 
187 /* Super block security struct flags for mount options */
188 #define FSDEFAULT_MNT	0x01
189 #define FSFLOOR_MNT	0x02
190 #define FSHAT_MNT	0x04
191 #define FSROOT_MNT	0x08
192 #define FSTRANS_MNT	0x10
193 
194 #define NUM_SMK_MNT_OPTS	5
195 
196 enum {
197 	Opt_error = -1,
198 	Opt_fsdefault = 1,
199 	Opt_fsfloor = 2,
200 	Opt_fshat = 3,
201 	Opt_fsroot = 4,
202 	Opt_fstransmute = 5,
203 };
204 
205 /*
206  * Mount options
207  */
208 #define SMK_FSDEFAULT	"smackfsdef="
209 #define SMK_FSFLOOR	"smackfsfloor="
210 #define SMK_FSHAT	"smackfshat="
211 #define SMK_FSROOT	"smackfsroot="
212 #define SMK_FSTRANS	"smackfstransmute="
213 
214 #define SMACK_DELETE_OPTION	"-DELETE"
215 #define SMACK_CIPSO_OPTION 	"-CIPSO"
216 
217 /*
218  * How communications on this socket are treated.
219  * Usually it's determined by the underlying netlabel code
220  * but there are certain cases, including single label hosts
221  * and potentially single label interfaces for which the
222  * treatment can not be known in advance.
223  *
224  * The possibility of additional labeling schemes being
225  * introduced in the future exists as well.
226  */
227 #define SMACK_UNLABELED_SOCKET	0
228 #define SMACK_CIPSO_SOCKET	1
229 
230 /*
231  * CIPSO defaults.
232  */
233 #define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
234 #define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
235 #define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
236 #define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
237 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
238 /*
239  * CIPSO 2.2 standard is 239, but Smack wants to use the
240  * categories in a structured way that limits the value to
241  * the bits in 23 bytes, hence the unusual number.
242  */
243 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
244 
245 /*
246  * Ptrace rules
247  */
248 #define SMACK_PTRACE_DEFAULT	0
249 #define SMACK_PTRACE_EXACT	1
250 #define SMACK_PTRACE_DRACONIAN	2
251 #define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
252 
253 /*
254  * Flags for untraditional access modes.
255  * It shouldn't be necessary to avoid conflicts with definitions
256  * in fs.h, but do so anyway.
257  */
258 #define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
259 #define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
260 #define MAY_BRINGUP	0x00004000	/* Report use of this rule */
261 
262 /*
263  * The policy for delivering signals is configurable.
264  * It is usually "write", but can be "append".
265  */
266 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
267 #define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
268 #else
269 #define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
270 #endif
271 
272 #define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
273 #define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
274 #define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
275 
276 /*
277  * Just to make the common cases easier to deal with
278  */
279 #define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
280 #define MAY_READWRITE	(MAY_READ | MAY_WRITE)
281 #define MAY_NOT		0
282 
283 /*
284  * Number of access types used by Smack (rwxatlb)
285  */
286 #define SMK_NUM_ACCESS_TYPE 7
287 
288 /* SMACK data */
289 struct smack_audit_data {
290 	const char *function;
291 	char *subject;
292 	char *object;
293 	char *request;
294 	int result;
295 };
296 
297 /*
298  * Smack audit data; is empty if CONFIG_AUDIT not set
299  * to save some stack
300  */
301 struct smk_audit_info {
302 #ifdef CONFIG_AUDIT
303 	struct common_audit_data a;
304 	struct smack_audit_data sad;
305 #endif
306 };
307 
308 /*
309  * These functions are in smack_access.c
310  */
311 int smk_access_entry(char *, char *, struct list_head *);
312 int smk_access(struct smack_known *, struct smack_known *,
313 	       int, struct smk_audit_info *);
314 int smk_tskacc(struct task_smack *, struct smack_known *,
315 	       u32, struct smk_audit_info *);
316 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
317 struct smack_known *smack_from_secid(const u32);
318 char *smk_parse_smack(const char *string, int len);
319 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
320 struct smack_known *smk_import_entry(const char *, int);
321 void smk_insert_entry(struct smack_known *skp);
322 struct smack_known *smk_find_entry(const char *);
323 bool smack_privileged(int cap);
324 bool smack_privileged_cred(int cap, const struct cred *cred);
325 void smk_destroy_label_list(struct list_head *list);
326 
327 /*
328  * Shared data.
329  */
330 extern int smack_enabled;
331 extern int smack_cipso_direct;
332 extern int smack_cipso_mapped;
333 extern struct smack_known *smack_net_ambient;
334 extern struct smack_known *smack_syslog_label;
335 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
336 extern struct smack_known *smack_unconfined;
337 #endif
338 extern int smack_ptrace_rule;
339 
340 extern struct smack_known smack_known_floor;
341 extern struct smack_known smack_known_hat;
342 extern struct smack_known smack_known_huh;
343 extern struct smack_known smack_known_star;
344 extern struct smack_known smack_known_web;
345 
346 extern struct mutex	smack_known_lock;
347 extern struct list_head smack_known_list;
348 extern struct list_head smk_net4addr_list;
349 #if IS_ENABLED(CONFIG_IPV6)
350 extern struct list_head smk_net6addr_list;
351 #endif /* CONFIG_IPV6 */
352 
353 extern struct mutex     smack_onlycap_lock;
354 extern struct list_head smack_onlycap_list;
355 
356 #define SMACK_HASH_SLOTS 16
357 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
358 
359 /*
360  * Is the directory transmuting?
361  */
362 static inline int smk_inode_transmutable(const struct inode *isp)
363 {
364 	struct inode_smack *sip = isp->i_security;
365 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
366 }
367 
368 /*
369  * Present a pointer to the smack label entry in an inode blob.
370  */
371 static inline struct smack_known *smk_of_inode(const struct inode *isp)
372 {
373 	struct inode_smack *sip = isp->i_security;
374 	return sip->smk_inode;
375 }
376 
377 /*
378  * Present a pointer to the smack label entry in an task blob.
379  */
380 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
381 {
382 	return tsp->smk_task;
383 }
384 
385 static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
386 {
387 	struct smack_known *skp;
388 
389 	rcu_read_lock();
390 	skp = smk_of_task(__task_cred(t)->security);
391 	rcu_read_unlock();
392 	return skp;
393 }
394 
395 /*
396  * Present a pointer to the forked smack label entry in an task blob.
397  */
398 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
399 {
400 	return tsp->smk_forked;
401 }
402 
403 /*
404  * Present a pointer to the smack label in the current task blob.
405  */
406 static inline struct smack_known *smk_of_current(void)
407 {
408 	return smk_of_task(current_security());
409 }
410 
411 /*
412  * logging functions
413  */
414 #define SMACK_AUDIT_DENIED 0x1
415 #define SMACK_AUDIT_ACCEPT 0x2
416 extern int log_policy;
417 
418 void smack_log(char *subject_label, char *object_label,
419 		int request,
420 		int result, struct smk_audit_info *auditdata);
421 
422 #ifdef CONFIG_AUDIT
423 
424 /*
425  * some inline functions to set up audit data
426  * they do nothing if CONFIG_AUDIT is not set
427  *
428  */
429 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
430 			       char type)
431 {
432 	memset(&a->sad, 0, sizeof(a->sad));
433 	a->a.type = type;
434 	a->a.smack_audit_data = &a->sad;
435 	a->a.smack_audit_data->function = func;
436 }
437 
438 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
439 				   char type, struct lsm_network_audit *net)
440 {
441 	smk_ad_init(a, func, type);
442 	memset(net, 0, sizeof(*net));
443 	a->a.u.net = net;
444 }
445 
446 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
447 					 struct task_struct *t)
448 {
449 	a->a.u.tsk = t;
450 }
451 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
452 						    struct dentry *d)
453 {
454 	a->a.u.dentry = d;
455 }
456 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
457 					      struct inode *i)
458 {
459 	a->a.u.inode = i;
460 }
461 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
462 					     struct path p)
463 {
464 	a->a.u.path = p;
465 }
466 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
467 					    struct sock *sk)
468 {
469 	a->a.u.net->sk = sk;
470 }
471 
472 #else /* no AUDIT */
473 
474 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
475 			       char type)
476 {
477 }
478 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
479 					 struct task_struct *t)
480 {
481 }
482 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
483 						    struct dentry *d)
484 {
485 }
486 static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
487 						 struct vfsmount *m)
488 {
489 }
490 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
491 					      struct inode *i)
492 {
493 }
494 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
495 					     struct path p)
496 {
497 }
498 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
499 					    struct sock *sk)
500 {
501 }
502 #endif
503 
504 #endif  /* _SECURITY_SMACK_H */
505