1 /* 2 * Simplified MAC Kernel (smack) security module 3 * 4 * This file contains the smack hook function implementations. 5 * 6 * Authors: 7 * Casey Schaufler <casey@schaufler-ca.com> 8 * Jarkko Sakkinen <jarkko.sakkinen@intel.com> 9 * 10 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 11 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. 12 * Paul Moore <paul@paul-moore.com> 13 * Copyright (C) 2010 Nokia Corporation 14 * Copyright (C) 2011 Intel Corporation. 15 * 16 * This program is free software; you can redistribute it and/or modify 17 * it under the terms of the GNU General Public License version 2, 18 * as published by the Free Software Foundation. 19 */ 20 21 #include <linux/xattr.h> 22 #include <linux/pagemap.h> 23 #include <linux/mount.h> 24 #include <linux/stat.h> 25 #include <linux/kd.h> 26 #include <asm/ioctls.h> 27 #include <linux/ip.h> 28 #include <linux/tcp.h> 29 #include <linux/udp.h> 30 #include <linux/dccp.h> 31 #include <linux/slab.h> 32 #include <linux/mutex.h> 33 #include <linux/pipe_fs_i.h> 34 #include <net/cipso_ipv4.h> 35 #include <net/ip.h> 36 #include <net/ipv6.h> 37 #include <linux/audit.h> 38 #include <linux/magic.h> 39 #include <linux/dcache.h> 40 #include <linux/personality.h> 41 #include <linux/msg.h> 42 #include <linux/shm.h> 43 #include <linux/binfmts.h> 44 #include <linux/parser.h> 45 #include "smack.h" 46 47 #define TRANS_TRUE "TRUE" 48 #define TRANS_TRUE_SIZE 4 49 50 #define SMK_CONNECTING 0 51 #define SMK_RECEIVING 1 52 #define SMK_SENDING 2 53 54 #ifdef SMACK_IPV6_PORT_LABELING 55 DEFINE_MUTEX(smack_ipv6_lock); 56 static LIST_HEAD(smk_ipv6_port_list); 57 #endif 58 static struct kmem_cache *smack_inode_cache; 59 int smack_enabled; 60 61 static const match_table_t smk_mount_tokens = { 62 {Opt_fsdefault, SMK_FSDEFAULT "%s"}, 63 {Opt_fsfloor, SMK_FSFLOOR "%s"}, 64 {Opt_fshat, SMK_FSHAT "%s"}, 65 {Opt_fsroot, SMK_FSROOT "%s"}, 66 {Opt_fstransmute, SMK_FSTRANS "%s"}, 67 {Opt_error, NULL}, 68 }; 69 70 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 71 static char *smk_bu_mess[] = { 72 "Bringup Error", /* Unused */ 73 "Bringup", /* SMACK_BRINGUP_ALLOW */ 74 "Unconfined Subject", /* SMACK_UNCONFINED_SUBJECT */ 75 "Unconfined Object", /* SMACK_UNCONFINED_OBJECT */ 76 }; 77 78 static void smk_bu_mode(int mode, char *s) 79 { 80 int i = 0; 81 82 if (mode & MAY_READ) 83 s[i++] = 'r'; 84 if (mode & MAY_WRITE) 85 s[i++] = 'w'; 86 if (mode & MAY_EXEC) 87 s[i++] = 'x'; 88 if (mode & MAY_APPEND) 89 s[i++] = 'a'; 90 if (mode & MAY_TRANSMUTE) 91 s[i++] = 't'; 92 if (mode & MAY_LOCK) 93 s[i++] = 'l'; 94 if (i == 0) 95 s[i++] = '-'; 96 s[i] = '\0'; 97 } 98 #endif 99 100 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 101 static int smk_bu_note(char *note, struct smack_known *sskp, 102 struct smack_known *oskp, int mode, int rc) 103 { 104 char acc[SMK_NUM_ACCESS_TYPE + 1]; 105 106 if (rc <= 0) 107 return rc; 108 if (rc > SMACK_UNCONFINED_OBJECT) 109 rc = 0; 110 111 smk_bu_mode(mode, acc); 112 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc], 113 sskp->smk_known, oskp->smk_known, acc, note); 114 return 0; 115 } 116 #else 117 #define smk_bu_note(note, sskp, oskp, mode, RC) (RC) 118 #endif 119 120 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 121 static int smk_bu_current(char *note, struct smack_known *oskp, 122 int mode, int rc) 123 { 124 struct task_smack *tsp = current_security(); 125 char acc[SMK_NUM_ACCESS_TYPE + 1]; 126 127 if (rc <= 0) 128 return rc; 129 if (rc > SMACK_UNCONFINED_OBJECT) 130 rc = 0; 131 132 smk_bu_mode(mode, acc); 133 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc], 134 tsp->smk_task->smk_known, oskp->smk_known, 135 acc, current->comm, note); 136 return 0; 137 } 138 #else 139 #define smk_bu_current(note, oskp, mode, RC) (RC) 140 #endif 141 142 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 143 static int smk_bu_task(struct task_struct *otp, int mode, int rc) 144 { 145 struct task_smack *tsp = current_security(); 146 struct smack_known *smk_task = smk_of_task_struct(otp); 147 char acc[SMK_NUM_ACCESS_TYPE + 1]; 148 149 if (rc <= 0) 150 return rc; 151 if (rc > SMACK_UNCONFINED_OBJECT) 152 rc = 0; 153 154 smk_bu_mode(mode, acc); 155 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc], 156 tsp->smk_task->smk_known, smk_task->smk_known, acc, 157 current->comm, otp->comm); 158 return 0; 159 } 160 #else 161 #define smk_bu_task(otp, mode, RC) (RC) 162 #endif 163 164 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 165 static int smk_bu_inode(struct inode *inode, int mode, int rc) 166 { 167 struct task_smack *tsp = current_security(); 168 struct inode_smack *isp = inode->i_security; 169 char acc[SMK_NUM_ACCESS_TYPE + 1]; 170 171 if (isp->smk_flags & SMK_INODE_IMPURE) 172 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n", 173 inode->i_sb->s_id, inode->i_ino, current->comm); 174 175 if (rc <= 0) 176 return rc; 177 if (rc > SMACK_UNCONFINED_OBJECT) 178 rc = 0; 179 if (rc == SMACK_UNCONFINED_SUBJECT && 180 (mode & (MAY_WRITE | MAY_APPEND))) 181 isp->smk_flags |= SMK_INODE_IMPURE; 182 183 smk_bu_mode(mode, acc); 184 185 pr_info("Smack %s: (%s %s %s) inode=(%s %ld) %s\n", smk_bu_mess[rc], 186 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc, 187 inode->i_sb->s_id, inode->i_ino, current->comm); 188 return 0; 189 } 190 #else 191 #define smk_bu_inode(inode, mode, RC) (RC) 192 #endif 193 194 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 195 static int smk_bu_file(struct file *file, int mode, int rc) 196 { 197 struct task_smack *tsp = current_security(); 198 struct smack_known *sskp = tsp->smk_task; 199 struct inode *inode = file_inode(file); 200 struct inode_smack *isp = inode->i_security; 201 char acc[SMK_NUM_ACCESS_TYPE + 1]; 202 203 if (isp->smk_flags & SMK_INODE_IMPURE) 204 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n", 205 inode->i_sb->s_id, inode->i_ino, current->comm); 206 207 if (rc <= 0) 208 return rc; 209 if (rc > SMACK_UNCONFINED_OBJECT) 210 rc = 0; 211 212 smk_bu_mode(mode, acc); 213 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc], 214 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 215 inode->i_sb->s_id, inode->i_ino, file, 216 current->comm); 217 return 0; 218 } 219 #else 220 #define smk_bu_file(file, mode, RC) (RC) 221 #endif 222 223 #ifdef CONFIG_SECURITY_SMACK_BRINGUP 224 static int smk_bu_credfile(const struct cred *cred, struct file *file, 225 int mode, int rc) 226 { 227 struct task_smack *tsp = cred->security; 228 struct smack_known *sskp = tsp->smk_task; 229 struct inode *inode = file_inode(file); 230 struct inode_smack *isp = inode->i_security; 231 char acc[SMK_NUM_ACCESS_TYPE + 1]; 232 233 if (isp->smk_flags & SMK_INODE_IMPURE) 234 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n", 235 inode->i_sb->s_id, inode->i_ino, current->comm); 236 237 if (rc <= 0) 238 return rc; 239 if (rc > SMACK_UNCONFINED_OBJECT) 240 rc = 0; 241 242 smk_bu_mode(mode, acc); 243 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc], 244 sskp->smk_known, smk_of_inode(inode)->smk_known, acc, 245 inode->i_sb->s_id, inode->i_ino, file, 246 current->comm); 247 return 0; 248 } 249 #else 250 #define smk_bu_credfile(cred, file, mode, RC) (RC) 251 #endif 252 253 /** 254 * smk_fetch - Fetch the smack label from a file. 255 * @name: type of the label (attribute) 256 * @ip: a pointer to the inode 257 * @dp: a pointer to the dentry 258 * 259 * Returns a pointer to the master list entry for the Smack label, 260 * NULL if there was no label to fetch, or an error code. 261 */ 262 static struct smack_known *smk_fetch(const char *name, struct inode *ip, 263 struct dentry *dp) 264 { 265 int rc; 266 char *buffer; 267 struct smack_known *skp = NULL; 268 269 if (!(ip->i_opflags & IOP_XATTR)) 270 return ERR_PTR(-EOPNOTSUPP); 271 272 buffer = kzalloc(SMK_LONGLABEL, GFP_KERNEL); 273 if (buffer == NULL) 274 return ERR_PTR(-ENOMEM); 275 276 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL); 277 if (rc < 0) 278 skp = ERR_PTR(rc); 279 else if (rc == 0) 280 skp = NULL; 281 else 282 skp = smk_import_entry(buffer, rc); 283 284 kfree(buffer); 285 286 return skp; 287 } 288 289 /** 290 * new_inode_smack - allocate an inode security blob 291 * @skp: a pointer to the Smack label entry to use in the blob 292 * 293 * Returns the new blob or NULL if there's no memory available 294 */ 295 static struct inode_smack *new_inode_smack(struct smack_known *skp) 296 { 297 struct inode_smack *isp; 298 299 isp = kmem_cache_zalloc(smack_inode_cache, GFP_NOFS); 300 if (isp == NULL) 301 return NULL; 302 303 isp->smk_inode = skp; 304 isp->smk_flags = 0; 305 mutex_init(&isp->smk_lock); 306 307 return isp; 308 } 309 310 /** 311 * new_task_smack - allocate a task security blob 312 * @task: a pointer to the Smack label for the running task 313 * @forked: a pointer to the Smack label for the forked task 314 * @gfp: type of the memory for the allocation 315 * 316 * Returns the new blob or NULL if there's no memory available 317 */ 318 static struct task_smack *new_task_smack(struct smack_known *task, 319 struct smack_known *forked, gfp_t gfp) 320 { 321 struct task_smack *tsp; 322 323 tsp = kzalloc(sizeof(struct task_smack), gfp); 324 if (tsp == NULL) 325 return NULL; 326 327 tsp->smk_task = task; 328 tsp->smk_forked = forked; 329 INIT_LIST_HEAD(&tsp->smk_rules); 330 INIT_LIST_HEAD(&tsp->smk_relabel); 331 mutex_init(&tsp->smk_rules_lock); 332 333 return tsp; 334 } 335 336 /** 337 * smk_copy_rules - copy a rule set 338 * @nhead: new rules header pointer 339 * @ohead: old rules header pointer 340 * @gfp: type of the memory for the allocation 341 * 342 * Returns 0 on success, -ENOMEM on error 343 */ 344 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead, 345 gfp_t gfp) 346 { 347 struct smack_rule *nrp; 348 struct smack_rule *orp; 349 int rc = 0; 350 351 list_for_each_entry_rcu(orp, ohead, list) { 352 nrp = kzalloc(sizeof(struct smack_rule), gfp); 353 if (nrp == NULL) { 354 rc = -ENOMEM; 355 break; 356 } 357 *nrp = *orp; 358 list_add_rcu(&nrp->list, nhead); 359 } 360 return rc; 361 } 362 363 /** 364 * smk_copy_relabel - copy smk_relabel labels list 365 * @nhead: new rules header pointer 366 * @ohead: old rules header pointer 367 * @gfp: type of the memory for the allocation 368 * 369 * Returns 0 on success, -ENOMEM on error 370 */ 371 static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead, 372 gfp_t gfp) 373 { 374 struct smack_known_list_elem *nklep; 375 struct smack_known_list_elem *oklep; 376 377 list_for_each_entry(oklep, ohead, list) { 378 nklep = kzalloc(sizeof(struct smack_known_list_elem), gfp); 379 if (nklep == NULL) { 380 smk_destroy_label_list(nhead); 381 return -ENOMEM; 382 } 383 nklep->smk_label = oklep->smk_label; 384 list_add(&nklep->list, nhead); 385 } 386 387 return 0; 388 } 389 390 /** 391 * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_* 392 * @mode - input mode in form of PTRACE_MODE_* 393 * 394 * Returns a converted MAY_* mode usable by smack rules 395 */ 396 static inline unsigned int smk_ptrace_mode(unsigned int mode) 397 { 398 if (mode & PTRACE_MODE_ATTACH) 399 return MAY_READWRITE; 400 if (mode & PTRACE_MODE_READ) 401 return MAY_READ; 402 403 return 0; 404 } 405 406 /** 407 * smk_ptrace_rule_check - helper for ptrace access 408 * @tracer: tracer process 409 * @tracee_known: label entry of the process that's about to be traced 410 * @mode: ptrace attachment mode (PTRACE_MODE_*) 411 * @func: name of the function that called us, used for audit 412 * 413 * Returns 0 on access granted, -error on error 414 */ 415 static int smk_ptrace_rule_check(struct task_struct *tracer, 416 struct smack_known *tracee_known, 417 unsigned int mode, const char *func) 418 { 419 int rc; 420 struct smk_audit_info ad, *saip = NULL; 421 struct task_smack *tsp; 422 struct smack_known *tracer_known; 423 424 if ((mode & PTRACE_MODE_NOAUDIT) == 0) { 425 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); 426 smk_ad_setfield_u_tsk(&ad, tracer); 427 saip = &ad; 428 } 429 430 rcu_read_lock(); 431 tsp = __task_cred(tracer)->security; 432 tracer_known = smk_of_task(tsp); 433 434 if ((mode & PTRACE_MODE_ATTACH) && 435 (smack_ptrace_rule == SMACK_PTRACE_EXACT || 436 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) { 437 if (tracer_known->smk_known == tracee_known->smk_known) 438 rc = 0; 439 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) 440 rc = -EACCES; 441 else if (capable(CAP_SYS_PTRACE)) 442 rc = 0; 443 else 444 rc = -EACCES; 445 446 if (saip) 447 smack_log(tracer_known->smk_known, 448 tracee_known->smk_known, 449 0, rc, saip); 450 451 rcu_read_unlock(); 452 return rc; 453 } 454 455 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ 456 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip); 457 458 rcu_read_unlock(); 459 return rc; 460 } 461 462 /* 463 * LSM hooks. 464 * We he, that is fun! 465 */ 466 467 /** 468 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH 469 * @ctp: child task pointer 470 * @mode: ptrace attachment mode (PTRACE_MODE_*) 471 * 472 * Returns 0 if access is OK, an error code otherwise 473 * 474 * Do the capability checks. 475 */ 476 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) 477 { 478 struct smack_known *skp; 479 480 skp = smk_of_task_struct(ctp); 481 482 return smk_ptrace_rule_check(current, skp, mode, __func__); 483 } 484 485 /** 486 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME 487 * @ptp: parent task pointer 488 * 489 * Returns 0 if access is OK, an error code otherwise 490 * 491 * Do the capability checks, and require PTRACE_MODE_ATTACH. 492 */ 493 static int smack_ptrace_traceme(struct task_struct *ptp) 494 { 495 int rc; 496 struct smack_known *skp; 497 498 skp = smk_of_task(current_security()); 499 500 rc = smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__); 501 return rc; 502 } 503 504 /** 505 * smack_syslog - Smack approval on syslog 506 * @type: message type 507 * 508 * Returns 0 on success, error code otherwise. 509 */ 510 static int smack_syslog(int typefrom_file) 511 { 512 int rc = 0; 513 struct smack_known *skp = smk_of_current(); 514 515 if (smack_privileged(CAP_MAC_OVERRIDE)) 516 return 0; 517 518 if (smack_syslog_label != NULL && smack_syslog_label != skp) 519 rc = -EACCES; 520 521 return rc; 522 } 523 524 525 /* 526 * Superblock Hooks. 527 */ 528 529 /** 530 * smack_sb_alloc_security - allocate a superblock blob 531 * @sb: the superblock getting the blob 532 * 533 * Returns 0 on success or -ENOMEM on error. 534 */ 535 static int smack_sb_alloc_security(struct super_block *sb) 536 { 537 struct superblock_smack *sbsp; 538 539 sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL); 540 541 if (sbsp == NULL) 542 return -ENOMEM; 543 544 sbsp->smk_root = &smack_known_floor; 545 sbsp->smk_default = &smack_known_floor; 546 sbsp->smk_floor = &smack_known_floor; 547 sbsp->smk_hat = &smack_known_hat; 548 /* 549 * SMK_SB_INITIALIZED will be zero from kzalloc. 550 */ 551 sb->s_security = sbsp; 552 553 return 0; 554 } 555 556 /** 557 * smack_sb_free_security - free a superblock blob 558 * @sb: the superblock getting the blob 559 * 560 */ 561 static void smack_sb_free_security(struct super_block *sb) 562 { 563 kfree(sb->s_security); 564 sb->s_security = NULL; 565 } 566 567 /** 568 * smack_sb_copy_data - copy mount options data for processing 569 * @orig: where to start 570 * @smackopts: mount options string 571 * 572 * Returns 0 on success or -ENOMEM on error. 573 * 574 * Copy the Smack specific mount options out of the mount 575 * options list. 576 */ 577 static int smack_sb_copy_data(char *orig, char *smackopts) 578 { 579 char *cp, *commap, *otheropts, *dp; 580 581 otheropts = (char *)get_zeroed_page(GFP_KERNEL); 582 if (otheropts == NULL) 583 return -ENOMEM; 584 585 for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) { 586 if (strstr(cp, SMK_FSDEFAULT) == cp) 587 dp = smackopts; 588 else if (strstr(cp, SMK_FSFLOOR) == cp) 589 dp = smackopts; 590 else if (strstr(cp, SMK_FSHAT) == cp) 591 dp = smackopts; 592 else if (strstr(cp, SMK_FSROOT) == cp) 593 dp = smackopts; 594 else if (strstr(cp, SMK_FSTRANS) == cp) 595 dp = smackopts; 596 else 597 dp = otheropts; 598 599 commap = strchr(cp, ','); 600 if (commap != NULL) 601 *commap = '\0'; 602 603 if (*dp != '\0') 604 strcat(dp, ","); 605 strcat(dp, cp); 606 } 607 608 strcpy(orig, otheropts); 609 free_page((unsigned long)otheropts); 610 611 return 0; 612 } 613 614 /** 615 * smack_parse_opts_str - parse Smack specific mount options 616 * @options: mount options string 617 * @opts: where to store converted mount opts 618 * 619 * Returns 0 on success or -ENOMEM on error. 620 * 621 * converts Smack specific mount options to generic security option format 622 */ 623 static int smack_parse_opts_str(char *options, 624 struct security_mnt_opts *opts) 625 { 626 char *p; 627 char *fsdefault = NULL; 628 char *fsfloor = NULL; 629 char *fshat = NULL; 630 char *fsroot = NULL; 631 char *fstransmute = NULL; 632 int rc = -ENOMEM; 633 int num_mnt_opts = 0; 634 int token; 635 636 opts->num_mnt_opts = 0; 637 638 if (!options) 639 return 0; 640 641 while ((p = strsep(&options, ",")) != NULL) { 642 substring_t args[MAX_OPT_ARGS]; 643 644 if (!*p) 645 continue; 646 647 token = match_token(p, smk_mount_tokens, args); 648 649 switch (token) { 650 case Opt_fsdefault: 651 if (fsdefault) 652 goto out_opt_err; 653 fsdefault = match_strdup(&args[0]); 654 if (!fsdefault) 655 goto out_err; 656 break; 657 case Opt_fsfloor: 658 if (fsfloor) 659 goto out_opt_err; 660 fsfloor = match_strdup(&args[0]); 661 if (!fsfloor) 662 goto out_err; 663 break; 664 case Opt_fshat: 665 if (fshat) 666 goto out_opt_err; 667 fshat = match_strdup(&args[0]); 668 if (!fshat) 669 goto out_err; 670 break; 671 case Opt_fsroot: 672 if (fsroot) 673 goto out_opt_err; 674 fsroot = match_strdup(&args[0]); 675 if (!fsroot) 676 goto out_err; 677 break; 678 case Opt_fstransmute: 679 if (fstransmute) 680 goto out_opt_err; 681 fstransmute = match_strdup(&args[0]); 682 if (!fstransmute) 683 goto out_err; 684 break; 685 default: 686 rc = -EINVAL; 687 pr_warn("Smack: unknown mount option\n"); 688 goto out_err; 689 } 690 } 691 692 opts->mnt_opts = kcalloc(NUM_SMK_MNT_OPTS, sizeof(char *), GFP_KERNEL); 693 if (!opts->mnt_opts) 694 goto out_err; 695 696 opts->mnt_opts_flags = kcalloc(NUM_SMK_MNT_OPTS, sizeof(int), 697 GFP_KERNEL); 698 if (!opts->mnt_opts_flags) 699 goto out_err; 700 701 if (fsdefault) { 702 opts->mnt_opts[num_mnt_opts] = fsdefault; 703 opts->mnt_opts_flags[num_mnt_opts++] = FSDEFAULT_MNT; 704 } 705 if (fsfloor) { 706 opts->mnt_opts[num_mnt_opts] = fsfloor; 707 opts->mnt_opts_flags[num_mnt_opts++] = FSFLOOR_MNT; 708 } 709 if (fshat) { 710 opts->mnt_opts[num_mnt_opts] = fshat; 711 opts->mnt_opts_flags[num_mnt_opts++] = FSHAT_MNT; 712 } 713 if (fsroot) { 714 opts->mnt_opts[num_mnt_opts] = fsroot; 715 opts->mnt_opts_flags[num_mnt_opts++] = FSROOT_MNT; 716 } 717 if (fstransmute) { 718 opts->mnt_opts[num_mnt_opts] = fstransmute; 719 opts->mnt_opts_flags[num_mnt_opts++] = FSTRANS_MNT; 720 } 721 722 opts->num_mnt_opts = num_mnt_opts; 723 return 0; 724 725 out_opt_err: 726 rc = -EINVAL; 727 pr_warn("Smack: duplicate mount options\n"); 728 729 out_err: 730 kfree(fsdefault); 731 kfree(fsfloor); 732 kfree(fshat); 733 kfree(fsroot); 734 kfree(fstransmute); 735 return rc; 736 } 737 738 /** 739 * smack_set_mnt_opts - set Smack specific mount options 740 * @sb: the file system superblock 741 * @opts: Smack mount options 742 * @kern_flags: mount option from kernel space or user space 743 * @set_kern_flags: where to store converted mount opts 744 * 745 * Returns 0 on success, an error code on failure 746 * 747 * Allow filesystems with binary mount data to explicitly set Smack mount 748 * labels. 749 */ 750 static int smack_set_mnt_opts(struct super_block *sb, 751 struct security_mnt_opts *opts, 752 unsigned long kern_flags, 753 unsigned long *set_kern_flags) 754 { 755 struct dentry *root = sb->s_root; 756 struct inode *inode = d_backing_inode(root); 757 struct superblock_smack *sp = sb->s_security; 758 struct inode_smack *isp; 759 struct smack_known *skp; 760 int i; 761 int num_opts = opts->num_mnt_opts; 762 int transmute = 0; 763 764 if (sp->smk_flags & SMK_SB_INITIALIZED) 765 return 0; 766 767 if (!smack_privileged(CAP_MAC_ADMIN)) { 768 /* 769 * Unprivileged mounts don't get to specify Smack values. 770 */ 771 if (num_opts) 772 return -EPERM; 773 /* 774 * Unprivileged mounts get root and default from the caller. 775 */ 776 skp = smk_of_current(); 777 sp->smk_root = skp; 778 sp->smk_default = skp; 779 /* 780 * For a handful of fs types with no user-controlled 781 * backing store it's okay to trust security labels 782 * in the filesystem. The rest are untrusted. 783 */ 784 if (sb->s_user_ns != &init_user_ns && 785 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC && 786 sb->s_magic != RAMFS_MAGIC) { 787 transmute = 1; 788 sp->smk_flags |= SMK_SB_UNTRUSTED; 789 } 790 } 791 792 sp->smk_flags |= SMK_SB_INITIALIZED; 793 794 for (i = 0; i < num_opts; i++) { 795 switch (opts->mnt_opts_flags[i]) { 796 case FSDEFAULT_MNT: 797 skp = smk_import_entry(opts->mnt_opts[i], 0); 798 if (IS_ERR(skp)) 799 return PTR_ERR(skp); 800 sp->smk_default = skp; 801 break; 802 case FSFLOOR_MNT: 803 skp = smk_import_entry(opts->mnt_opts[i], 0); 804 if (IS_ERR(skp)) 805 return PTR_ERR(skp); 806 sp->smk_floor = skp; 807 break; 808 case FSHAT_MNT: 809 skp = smk_import_entry(opts->mnt_opts[i], 0); 810 if (IS_ERR(skp)) 811 return PTR_ERR(skp); 812 sp->smk_hat = skp; 813 break; 814 case FSROOT_MNT: 815 skp = smk_import_entry(opts->mnt_opts[i], 0); 816 if (IS_ERR(skp)) 817 return PTR_ERR(skp); 818 sp->smk_root = skp; 819 break; 820 case FSTRANS_MNT: 821 skp = smk_import_entry(opts->mnt_opts[i], 0); 822 if (IS_ERR(skp)) 823 return PTR_ERR(skp); 824 sp->smk_root = skp; 825 transmute = 1; 826 break; 827 default: 828 break; 829 } 830 } 831 832 /* 833 * Initialize the root inode. 834 */ 835 isp = inode->i_security; 836 if (isp == NULL) { 837 isp = new_inode_smack(sp->smk_root); 838 if (isp == NULL) 839 return -ENOMEM; 840 inode->i_security = isp; 841 } else 842 isp->smk_inode = sp->smk_root; 843 844 if (transmute) 845 isp->smk_flags |= SMK_INODE_TRANSMUTE; 846 847 return 0; 848 } 849 850 /** 851 * smack_sb_kern_mount - Smack specific mount processing 852 * @sb: the file system superblock 853 * @flags: the mount flags 854 * @data: the smack mount options 855 * 856 * Returns 0 on success, an error code on failure 857 */ 858 static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data) 859 { 860 int rc = 0; 861 char *options = data; 862 struct security_mnt_opts opts; 863 864 security_init_mnt_opts(&opts); 865 866 if (!options) 867 goto out; 868 869 rc = smack_parse_opts_str(options, &opts); 870 if (rc) 871 goto out_err; 872 873 out: 874 rc = smack_set_mnt_opts(sb, &opts, 0, NULL); 875 876 out_err: 877 security_free_mnt_opts(&opts); 878 return rc; 879 } 880 881 /** 882 * smack_sb_statfs - Smack check on statfs 883 * @dentry: identifies the file system in question 884 * 885 * Returns 0 if current can read the floor of the filesystem, 886 * and error code otherwise 887 */ 888 static int smack_sb_statfs(struct dentry *dentry) 889 { 890 struct superblock_smack *sbp = dentry->d_sb->s_security; 891 int rc; 892 struct smk_audit_info ad; 893 894 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 895 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 896 897 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 898 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc); 899 return rc; 900 } 901 902 /* 903 * BPRM hooks 904 */ 905 906 /** 907 * smack_bprm_set_creds - set creds for exec 908 * @bprm: the exec information 909 * 910 * Returns 0 if it gets a blob, -EPERM if exec forbidden and -ENOMEM otherwise 911 */ 912 static int smack_bprm_set_creds(struct linux_binprm *bprm) 913 { 914 struct inode *inode = file_inode(bprm->file); 915 struct task_smack *bsp = bprm->cred->security; 916 struct inode_smack *isp; 917 struct superblock_smack *sbsp; 918 int rc; 919 920 if (bprm->called_set_creds) 921 return 0; 922 923 isp = inode->i_security; 924 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) 925 return 0; 926 927 sbsp = inode->i_sb->s_security; 928 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && 929 isp->smk_task != sbsp->smk_root) 930 return 0; 931 932 if (bprm->unsafe & LSM_UNSAFE_PTRACE) { 933 struct task_struct *tracer; 934 rc = 0; 935 936 rcu_read_lock(); 937 tracer = ptrace_parent(current); 938 if (likely(tracer != NULL)) 939 rc = smk_ptrace_rule_check(tracer, 940 isp->smk_task, 941 PTRACE_MODE_ATTACH, 942 __func__); 943 rcu_read_unlock(); 944 945 if (rc != 0) 946 return rc; 947 } else if (bprm->unsafe) 948 return -EPERM; 949 950 bsp->smk_task = isp->smk_task; 951 bprm->per_clear |= PER_CLEAR_ON_SETID; 952 953 /* Decide if this is a secure exec. */ 954 if (bsp->smk_task != bsp->smk_forked) 955 bprm->secureexec = 1; 956 957 return 0; 958 } 959 960 /* 961 * Inode hooks 962 */ 963 964 /** 965 * smack_inode_alloc_security - allocate an inode blob 966 * @inode: the inode in need of a blob 967 * 968 * Returns 0 if it gets a blob, -ENOMEM otherwise 969 */ 970 static int smack_inode_alloc_security(struct inode *inode) 971 { 972 struct smack_known *skp = smk_of_current(); 973 974 inode->i_security = new_inode_smack(skp); 975 if (inode->i_security == NULL) 976 return -ENOMEM; 977 return 0; 978 } 979 980 /** 981 * smack_inode_free_rcu - Free inode_smack blob from cache 982 * @head: the rcu_head for getting inode_smack pointer 983 * 984 * Call back function called from call_rcu() to free 985 * the i_security blob pointer in inode 986 */ 987 static void smack_inode_free_rcu(struct rcu_head *head) 988 { 989 struct inode_smack *issp; 990 991 issp = container_of(head, struct inode_smack, smk_rcu); 992 kmem_cache_free(smack_inode_cache, issp); 993 } 994 995 /** 996 * smack_inode_free_security - free an inode blob using call_rcu() 997 * @inode: the inode with a blob 998 * 999 * Clears the blob pointer in inode using RCU 1000 */ 1001 static void smack_inode_free_security(struct inode *inode) 1002 { 1003 struct inode_smack *issp = inode->i_security; 1004 1005 /* 1006 * The inode may still be referenced in a path walk and 1007 * a call to smack_inode_permission() can be made 1008 * after smack_inode_free_security() is called. 1009 * To avoid race condition free the i_security via RCU 1010 * and leave the current inode->i_security pointer intact. 1011 * The inode will be freed after the RCU grace period too. 1012 */ 1013 call_rcu(&issp->smk_rcu, smack_inode_free_rcu); 1014 } 1015 1016 /** 1017 * smack_inode_init_security - copy out the smack from an inode 1018 * @inode: the newly created inode 1019 * @dir: containing directory object 1020 * @qstr: unused 1021 * @name: where to put the attribute name 1022 * @value: where to put the attribute value 1023 * @len: where to put the length of the attribute 1024 * 1025 * Returns 0 if it all works out, -ENOMEM if there's no memory 1026 */ 1027 static int smack_inode_init_security(struct inode *inode, struct inode *dir, 1028 const struct qstr *qstr, const char **name, 1029 void **value, size_t *len) 1030 { 1031 struct inode_smack *issp = inode->i_security; 1032 struct smack_known *skp = smk_of_current(); 1033 struct smack_known *isp = smk_of_inode(inode); 1034 struct smack_known *dsp = smk_of_inode(dir); 1035 int may; 1036 1037 if (name) 1038 *name = XATTR_SMACK_SUFFIX; 1039 1040 if (value && len) { 1041 rcu_read_lock(); 1042 may = smk_access_entry(skp->smk_known, dsp->smk_known, 1043 &skp->smk_rules); 1044 rcu_read_unlock(); 1045 1046 /* 1047 * If the access rule allows transmutation and 1048 * the directory requests transmutation then 1049 * by all means transmute. 1050 * Mark the inode as changed. 1051 */ 1052 if (may > 0 && ((may & MAY_TRANSMUTE) != 0) && 1053 smk_inode_transmutable(dir)) { 1054 isp = dsp; 1055 issp->smk_flags |= SMK_INODE_CHANGED; 1056 } 1057 1058 *value = kstrdup(isp->smk_known, GFP_NOFS); 1059 if (*value == NULL) 1060 return -ENOMEM; 1061 1062 *len = strlen(isp->smk_known); 1063 } 1064 1065 return 0; 1066 } 1067 1068 /** 1069 * smack_inode_link - Smack check on link 1070 * @old_dentry: the existing object 1071 * @dir: unused 1072 * @new_dentry: the new object 1073 * 1074 * Returns 0 if access is permitted, an error code otherwise 1075 */ 1076 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, 1077 struct dentry *new_dentry) 1078 { 1079 struct smack_known *isp; 1080 struct smk_audit_info ad; 1081 int rc; 1082 1083 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1084 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1085 1086 isp = smk_of_inode(d_backing_inode(old_dentry)); 1087 rc = smk_curacc(isp, MAY_WRITE, &ad); 1088 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc); 1089 1090 if (rc == 0 && d_is_positive(new_dentry)) { 1091 isp = smk_of_inode(d_backing_inode(new_dentry)); 1092 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1093 rc = smk_curacc(isp, MAY_WRITE, &ad); 1094 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc); 1095 } 1096 1097 return rc; 1098 } 1099 1100 /** 1101 * smack_inode_unlink - Smack check on inode deletion 1102 * @dir: containing directory object 1103 * @dentry: file to unlink 1104 * 1105 * Returns 0 if current can write the containing directory 1106 * and the object, error code otherwise 1107 */ 1108 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) 1109 { 1110 struct inode *ip = d_backing_inode(dentry); 1111 struct smk_audit_info ad; 1112 int rc; 1113 1114 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1115 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1116 1117 /* 1118 * You need write access to the thing you're unlinking 1119 */ 1120 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 1121 rc = smk_bu_inode(ip, MAY_WRITE, rc); 1122 if (rc == 0) { 1123 /* 1124 * You also need write access to the containing directory 1125 */ 1126 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1127 smk_ad_setfield_u_fs_inode(&ad, dir); 1128 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1129 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1130 } 1131 return rc; 1132 } 1133 1134 /** 1135 * smack_inode_rmdir - Smack check on directory deletion 1136 * @dir: containing directory object 1137 * @dentry: directory to unlink 1138 * 1139 * Returns 0 if current can write the containing directory 1140 * and the directory, error code otherwise 1141 */ 1142 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) 1143 { 1144 struct smk_audit_info ad; 1145 int rc; 1146 1147 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1148 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1149 1150 /* 1151 * You need write access to the thing you're removing 1152 */ 1153 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1154 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1155 if (rc == 0) { 1156 /* 1157 * You also need write access to the containing directory 1158 */ 1159 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1160 smk_ad_setfield_u_fs_inode(&ad, dir); 1161 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 1162 rc = smk_bu_inode(dir, MAY_WRITE, rc); 1163 } 1164 1165 return rc; 1166 } 1167 1168 /** 1169 * smack_inode_rename - Smack check on rename 1170 * @old_inode: unused 1171 * @old_dentry: the old object 1172 * @new_inode: unused 1173 * @new_dentry: the new object 1174 * 1175 * Read and write access is required on both the old and 1176 * new directories. 1177 * 1178 * Returns 0 if access is permitted, an error code otherwise 1179 */ 1180 static int smack_inode_rename(struct inode *old_inode, 1181 struct dentry *old_dentry, 1182 struct inode *new_inode, 1183 struct dentry *new_dentry) 1184 { 1185 int rc; 1186 struct smack_known *isp; 1187 struct smk_audit_info ad; 1188 1189 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1190 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 1191 1192 isp = smk_of_inode(d_backing_inode(old_dentry)); 1193 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1194 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc); 1195 1196 if (rc == 0 && d_is_positive(new_dentry)) { 1197 isp = smk_of_inode(d_backing_inode(new_dentry)); 1198 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 1199 rc = smk_curacc(isp, MAY_READWRITE, &ad); 1200 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc); 1201 } 1202 return rc; 1203 } 1204 1205 /** 1206 * smack_inode_permission - Smack version of permission() 1207 * @inode: the inode in question 1208 * @mask: the access requested 1209 * 1210 * This is the important Smack hook. 1211 * 1212 * Returns 0 if access is permitted, -EACCES otherwise 1213 */ 1214 static int smack_inode_permission(struct inode *inode, int mask) 1215 { 1216 struct superblock_smack *sbsp = inode->i_sb->s_security; 1217 struct smk_audit_info ad; 1218 int no_block = mask & MAY_NOT_BLOCK; 1219 int rc; 1220 1221 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 1222 /* 1223 * No permission to check. Existence test. Yup, it's there. 1224 */ 1225 if (mask == 0) 1226 return 0; 1227 1228 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) { 1229 if (smk_of_inode(inode) != sbsp->smk_root) 1230 return -EACCES; 1231 } 1232 1233 /* May be droppable after audit */ 1234 if (no_block) 1235 return -ECHILD; 1236 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 1237 smk_ad_setfield_u_fs_inode(&ad, inode); 1238 rc = smk_curacc(smk_of_inode(inode), mask, &ad); 1239 rc = smk_bu_inode(inode, mask, rc); 1240 return rc; 1241 } 1242 1243 /** 1244 * smack_inode_setattr - Smack check for setting attributes 1245 * @dentry: the object 1246 * @iattr: for the force flag 1247 * 1248 * Returns 0 if access is permitted, an error code otherwise 1249 */ 1250 static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) 1251 { 1252 struct smk_audit_info ad; 1253 int rc; 1254 1255 /* 1256 * Need to allow for clearing the setuid bit. 1257 */ 1258 if (iattr->ia_valid & ATTR_FORCE) 1259 return 0; 1260 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1261 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1262 1263 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1264 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1265 return rc; 1266 } 1267 1268 /** 1269 * smack_inode_getattr - Smack check for getting attributes 1270 * @mnt: vfsmount of the object 1271 * @dentry: the object 1272 * 1273 * Returns 0 if access is permitted, an error code otherwise 1274 */ 1275 static int smack_inode_getattr(const struct path *path) 1276 { 1277 struct smk_audit_info ad; 1278 struct inode *inode = d_backing_inode(path->dentry); 1279 int rc; 1280 1281 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1282 smk_ad_setfield_u_fs_path(&ad, *path); 1283 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1284 rc = smk_bu_inode(inode, MAY_READ, rc); 1285 return rc; 1286 } 1287 1288 /** 1289 * smack_inode_setxattr - Smack check for setting xattrs 1290 * @dentry: the object 1291 * @name: name of the attribute 1292 * @value: value of the attribute 1293 * @size: size of the value 1294 * @flags: unused 1295 * 1296 * This protects the Smack attribute explicitly. 1297 * 1298 * Returns 0 if access is permitted, an error code otherwise 1299 */ 1300 static int smack_inode_setxattr(struct dentry *dentry, const char *name, 1301 const void *value, size_t size, int flags) 1302 { 1303 struct smk_audit_info ad; 1304 struct smack_known *skp; 1305 int check_priv = 0; 1306 int check_import = 0; 1307 int check_star = 0; 1308 int rc = 0; 1309 1310 /* 1311 * Check label validity here so import won't fail in post_setxattr 1312 */ 1313 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1314 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1315 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) { 1316 check_priv = 1; 1317 check_import = 1; 1318 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1319 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1320 check_priv = 1; 1321 check_import = 1; 1322 check_star = 1; 1323 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1324 check_priv = 1; 1325 if (size != TRANS_TRUE_SIZE || 1326 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 1327 rc = -EINVAL; 1328 } else 1329 rc = cap_inode_setxattr(dentry, name, value, size, flags); 1330 1331 if (check_priv && !smack_privileged(CAP_MAC_ADMIN)) 1332 rc = -EPERM; 1333 1334 if (rc == 0 && check_import) { 1335 skp = size ? smk_import_entry(value, size) : NULL; 1336 if (IS_ERR(skp)) 1337 rc = PTR_ERR(skp); 1338 else if (skp == NULL || (check_star && 1339 (skp == &smack_known_star || skp == &smack_known_web))) 1340 rc = -EINVAL; 1341 } 1342 1343 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1344 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1345 1346 if (rc == 0) { 1347 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1348 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1349 } 1350 1351 return rc; 1352 } 1353 1354 /** 1355 * smack_inode_post_setxattr - Apply the Smack update approved above 1356 * @dentry: object 1357 * @name: attribute name 1358 * @value: attribute value 1359 * @size: attribute size 1360 * @flags: unused 1361 * 1362 * Set the pointer in the inode blob to the entry found 1363 * in the master label list. 1364 */ 1365 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, 1366 const void *value, size_t size, int flags) 1367 { 1368 struct smack_known *skp; 1369 struct inode_smack *isp = d_backing_inode(dentry)->i_security; 1370 1371 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 1372 isp->smk_flags |= SMK_INODE_TRANSMUTE; 1373 return; 1374 } 1375 1376 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1377 skp = smk_import_entry(value, size); 1378 if (!IS_ERR(skp)) 1379 isp->smk_inode = skp; 1380 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 1381 skp = smk_import_entry(value, size); 1382 if (!IS_ERR(skp)) 1383 isp->smk_task = skp; 1384 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1385 skp = smk_import_entry(value, size); 1386 if (!IS_ERR(skp)) 1387 isp->smk_mmap = skp; 1388 } 1389 1390 return; 1391 } 1392 1393 /** 1394 * smack_inode_getxattr - Smack check on getxattr 1395 * @dentry: the object 1396 * @name: unused 1397 * 1398 * Returns 0 if access is permitted, an error code otherwise 1399 */ 1400 static int smack_inode_getxattr(struct dentry *dentry, const char *name) 1401 { 1402 struct smk_audit_info ad; 1403 int rc; 1404 1405 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1406 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1407 1408 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad); 1409 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc); 1410 return rc; 1411 } 1412 1413 /** 1414 * smack_inode_removexattr - Smack check on removexattr 1415 * @dentry: the object 1416 * @name: name of the attribute 1417 * 1418 * Removing the Smack attribute requires CAP_MAC_ADMIN 1419 * 1420 * Returns 0 if access is permitted, an error code otherwise 1421 */ 1422 static int smack_inode_removexattr(struct dentry *dentry, const char *name) 1423 { 1424 struct inode_smack *isp; 1425 struct smk_audit_info ad; 1426 int rc = 0; 1427 1428 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 1429 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 1430 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 1431 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 1432 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 || 1433 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 1434 if (!smack_privileged(CAP_MAC_ADMIN)) 1435 rc = -EPERM; 1436 } else 1437 rc = cap_inode_removexattr(dentry, name); 1438 1439 if (rc != 0) 1440 return rc; 1441 1442 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1443 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1444 1445 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad); 1446 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc); 1447 if (rc != 0) 1448 return rc; 1449 1450 isp = d_backing_inode(dentry)->i_security; 1451 /* 1452 * Don't do anything special for these. 1453 * XATTR_NAME_SMACKIPIN 1454 * XATTR_NAME_SMACKIPOUT 1455 */ 1456 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1457 struct super_block *sbp = dentry->d_sb; 1458 struct superblock_smack *sbsp = sbp->s_security; 1459 1460 isp->smk_inode = sbsp->smk_default; 1461 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) 1462 isp->smk_task = NULL; 1463 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) 1464 isp->smk_mmap = NULL; 1465 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 1466 isp->smk_flags &= ~SMK_INODE_TRANSMUTE; 1467 1468 return 0; 1469 } 1470 1471 /** 1472 * smack_inode_getsecurity - get smack xattrs 1473 * @inode: the object 1474 * @name: attribute name 1475 * @buffer: where to put the result 1476 * @alloc: duplicate memory 1477 * 1478 * Returns the size of the attribute or an error code 1479 */ 1480 static int smack_inode_getsecurity(struct inode *inode, 1481 const char *name, void **buffer, 1482 bool alloc) 1483 { 1484 struct socket_smack *ssp; 1485 struct socket *sock; 1486 struct super_block *sbp; 1487 struct inode *ip = (struct inode *)inode; 1488 struct smack_known *isp; 1489 1490 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) 1491 isp = smk_of_inode(inode); 1492 else { 1493 /* 1494 * The rest of the Smack xattrs are only on sockets. 1495 */ 1496 sbp = ip->i_sb; 1497 if (sbp->s_magic != SOCKFS_MAGIC) 1498 return -EOPNOTSUPP; 1499 1500 sock = SOCKET_I(ip); 1501 if (sock == NULL || sock->sk == NULL) 1502 return -EOPNOTSUPP; 1503 1504 ssp = sock->sk->sk_security; 1505 1506 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1507 isp = ssp->smk_in; 1508 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 1509 isp = ssp->smk_out; 1510 else 1511 return -EOPNOTSUPP; 1512 } 1513 1514 if (alloc) { 1515 *buffer = kstrdup(isp->smk_known, GFP_KERNEL); 1516 if (*buffer == NULL) 1517 return -ENOMEM; 1518 } 1519 1520 return strlen(isp->smk_known); 1521 } 1522 1523 1524 /** 1525 * smack_inode_listsecurity - list the Smack attributes 1526 * @inode: the object 1527 * @buffer: where they go 1528 * @buffer_size: size of buffer 1529 */ 1530 static int smack_inode_listsecurity(struct inode *inode, char *buffer, 1531 size_t buffer_size) 1532 { 1533 int len = sizeof(XATTR_NAME_SMACK); 1534 1535 if (buffer != NULL && len <= buffer_size) 1536 memcpy(buffer, XATTR_NAME_SMACK, len); 1537 1538 return len; 1539 } 1540 1541 /** 1542 * smack_inode_getsecid - Extract inode's security id 1543 * @inode: inode to extract the info from 1544 * @secid: where result will be saved 1545 */ 1546 static void smack_inode_getsecid(struct inode *inode, u32 *secid) 1547 { 1548 struct inode_smack *isp = inode->i_security; 1549 1550 *secid = isp->smk_inode->smk_secid; 1551 } 1552 1553 /* 1554 * File Hooks 1555 */ 1556 1557 /* 1558 * There is no smack_file_permission hook 1559 * 1560 * Should access checks be done on each read or write? 1561 * UNICOS and SELinux say yes. 1562 * Trusted Solaris, Trusted Irix, and just about everyone else says no. 1563 * 1564 * I'll say no for now. Smack does not do the frequent 1565 * label changing that SELinux does. 1566 */ 1567 1568 /** 1569 * smack_file_alloc_security - assign a file security blob 1570 * @file: the object 1571 * 1572 * The security blob for a file is a pointer to the master 1573 * label list, so no allocation is done. 1574 * 1575 * f_security is the owner security information. It 1576 * isn't used on file access checks, it's for send_sigio. 1577 * 1578 * Returns 0 1579 */ 1580 static int smack_file_alloc_security(struct file *file) 1581 { 1582 struct smack_known *skp = smk_of_current(); 1583 1584 file->f_security = skp; 1585 return 0; 1586 } 1587 1588 /** 1589 * smack_file_free_security - clear a file security blob 1590 * @file: the object 1591 * 1592 * The security blob for a file is a pointer to the master 1593 * label list, so no memory is freed. 1594 */ 1595 static void smack_file_free_security(struct file *file) 1596 { 1597 file->f_security = NULL; 1598 } 1599 1600 /** 1601 * smack_file_ioctl - Smack check on ioctls 1602 * @file: the object 1603 * @cmd: what to do 1604 * @arg: unused 1605 * 1606 * Relies heavily on the correct use of the ioctl command conventions. 1607 * 1608 * Returns 0 if allowed, error code otherwise 1609 */ 1610 static int smack_file_ioctl(struct file *file, unsigned int cmd, 1611 unsigned long arg) 1612 { 1613 int rc = 0; 1614 struct smk_audit_info ad; 1615 struct inode *inode = file_inode(file); 1616 1617 if (unlikely(IS_PRIVATE(inode))) 1618 return 0; 1619 1620 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1621 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1622 1623 if (_IOC_DIR(cmd) & _IOC_WRITE) { 1624 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1625 rc = smk_bu_file(file, MAY_WRITE, rc); 1626 } 1627 1628 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) { 1629 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad); 1630 rc = smk_bu_file(file, MAY_READ, rc); 1631 } 1632 1633 return rc; 1634 } 1635 1636 /** 1637 * smack_file_lock - Smack check on file locking 1638 * @file: the object 1639 * @cmd: unused 1640 * 1641 * Returns 0 if current has lock access, error code otherwise 1642 */ 1643 static int smack_file_lock(struct file *file, unsigned int cmd) 1644 { 1645 struct smk_audit_info ad; 1646 int rc; 1647 struct inode *inode = file_inode(file); 1648 1649 if (unlikely(IS_PRIVATE(inode))) 1650 return 0; 1651 1652 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1653 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1654 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1655 rc = smk_bu_file(file, MAY_LOCK, rc); 1656 return rc; 1657 } 1658 1659 /** 1660 * smack_file_fcntl - Smack check on fcntl 1661 * @file: the object 1662 * @cmd: what action to check 1663 * @arg: unused 1664 * 1665 * Generally these operations are harmless. 1666 * File locking operations present an obvious mechanism 1667 * for passing information, so they require write access. 1668 * 1669 * Returns 0 if current has access, error code otherwise 1670 */ 1671 static int smack_file_fcntl(struct file *file, unsigned int cmd, 1672 unsigned long arg) 1673 { 1674 struct smk_audit_info ad; 1675 int rc = 0; 1676 struct inode *inode = file_inode(file); 1677 1678 if (unlikely(IS_PRIVATE(inode))) 1679 return 0; 1680 1681 switch (cmd) { 1682 case F_GETLK: 1683 break; 1684 case F_SETLK: 1685 case F_SETLKW: 1686 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1687 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1688 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad); 1689 rc = smk_bu_file(file, MAY_LOCK, rc); 1690 break; 1691 case F_SETOWN: 1692 case F_SETSIG: 1693 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1694 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1695 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad); 1696 rc = smk_bu_file(file, MAY_WRITE, rc); 1697 break; 1698 default: 1699 break; 1700 } 1701 1702 return rc; 1703 } 1704 1705 /** 1706 * smack_mmap_file : 1707 * Check permissions for a mmap operation. The @file may be NULL, e.g. 1708 * if mapping anonymous memory. 1709 * @file contains the file structure for file to map (may be NULL). 1710 * @reqprot contains the protection requested by the application. 1711 * @prot contains the protection that will be applied by the kernel. 1712 * @flags contains the operational flags. 1713 * Return 0 if permission is granted. 1714 */ 1715 static int smack_mmap_file(struct file *file, 1716 unsigned long reqprot, unsigned long prot, 1717 unsigned long flags) 1718 { 1719 struct smack_known *skp; 1720 struct smack_known *mkp; 1721 struct smack_rule *srp; 1722 struct task_smack *tsp; 1723 struct smack_known *okp; 1724 struct inode_smack *isp; 1725 struct superblock_smack *sbsp; 1726 int may; 1727 int mmay; 1728 int tmay; 1729 int rc; 1730 1731 if (file == NULL) 1732 return 0; 1733 1734 if (unlikely(IS_PRIVATE(file_inode(file)))) 1735 return 0; 1736 1737 isp = file_inode(file)->i_security; 1738 if (isp->smk_mmap == NULL) 1739 return 0; 1740 sbsp = file_inode(file)->i_sb->s_security; 1741 if (sbsp->smk_flags & SMK_SB_UNTRUSTED && 1742 isp->smk_mmap != sbsp->smk_root) 1743 return -EACCES; 1744 mkp = isp->smk_mmap; 1745 1746 tsp = current_security(); 1747 skp = smk_of_current(); 1748 rc = 0; 1749 1750 rcu_read_lock(); 1751 /* 1752 * For each Smack rule associated with the subject 1753 * label verify that the SMACK64MMAP also has access 1754 * to that rule's object label. 1755 */ 1756 list_for_each_entry_rcu(srp, &skp->smk_rules, list) { 1757 okp = srp->smk_object; 1758 /* 1759 * Matching labels always allows access. 1760 */ 1761 if (mkp->smk_known == okp->smk_known) 1762 continue; 1763 /* 1764 * If there is a matching local rule take 1765 * that into account as well. 1766 */ 1767 may = smk_access_entry(srp->smk_subject->smk_known, 1768 okp->smk_known, 1769 &tsp->smk_rules); 1770 if (may == -ENOENT) 1771 may = srp->smk_access; 1772 else 1773 may &= srp->smk_access; 1774 /* 1775 * If may is zero the SMACK64MMAP subject can't 1776 * possibly have less access. 1777 */ 1778 if (may == 0) 1779 continue; 1780 1781 /* 1782 * Fetch the global list entry. 1783 * If there isn't one a SMACK64MMAP subject 1784 * can't have as much access as current. 1785 */ 1786 mmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1787 &mkp->smk_rules); 1788 if (mmay == -ENOENT) { 1789 rc = -EACCES; 1790 break; 1791 } 1792 /* 1793 * If there is a local entry it modifies the 1794 * potential access, too. 1795 */ 1796 tmay = smk_access_entry(mkp->smk_known, okp->smk_known, 1797 &tsp->smk_rules); 1798 if (tmay != -ENOENT) 1799 mmay &= tmay; 1800 1801 /* 1802 * If there is any access available to current that is 1803 * not available to a SMACK64MMAP subject 1804 * deny access. 1805 */ 1806 if ((may | mmay) != mmay) { 1807 rc = -EACCES; 1808 break; 1809 } 1810 } 1811 1812 rcu_read_unlock(); 1813 1814 return rc; 1815 } 1816 1817 /** 1818 * smack_file_set_fowner - set the file security blob value 1819 * @file: object in question 1820 * 1821 */ 1822 static void smack_file_set_fowner(struct file *file) 1823 { 1824 file->f_security = smk_of_current(); 1825 } 1826 1827 /** 1828 * smack_file_send_sigiotask - Smack on sigio 1829 * @tsk: The target task 1830 * @fown: the object the signal come from 1831 * @signum: unused 1832 * 1833 * Allow a privileged task to get signals even if it shouldn't 1834 * 1835 * Returns 0 if a subject with the object's smack could 1836 * write to the task, an error code otherwise. 1837 */ 1838 static int smack_file_send_sigiotask(struct task_struct *tsk, 1839 struct fown_struct *fown, int signum) 1840 { 1841 struct smack_known *skp; 1842 struct smack_known *tkp = smk_of_task(tsk->cred->security); 1843 struct file *file; 1844 int rc; 1845 struct smk_audit_info ad; 1846 1847 /* 1848 * struct fown_struct is never outside the context of a struct file 1849 */ 1850 file = container_of(fown, struct file, f_owner); 1851 1852 /* we don't log here as rc can be overriden */ 1853 skp = file->f_security; 1854 rc = smk_access(skp, tkp, MAY_DELIVER, NULL); 1855 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc); 1856 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) 1857 rc = 0; 1858 1859 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1860 smk_ad_setfield_u_tsk(&ad, tsk); 1861 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad); 1862 return rc; 1863 } 1864 1865 /** 1866 * smack_file_receive - Smack file receive check 1867 * @file: the object 1868 * 1869 * Returns 0 if current has access, error code otherwise 1870 */ 1871 static int smack_file_receive(struct file *file) 1872 { 1873 int rc; 1874 int may = 0; 1875 struct smk_audit_info ad; 1876 struct inode *inode = file_inode(file); 1877 struct socket *sock; 1878 struct task_smack *tsp; 1879 struct socket_smack *ssp; 1880 1881 if (unlikely(IS_PRIVATE(inode))) 1882 return 0; 1883 1884 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1885 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1886 1887 if (inode->i_sb->s_magic == SOCKFS_MAGIC) { 1888 sock = SOCKET_I(inode); 1889 ssp = sock->sk->sk_security; 1890 tsp = current_security(); 1891 /* 1892 * If the receiving process can't write to the 1893 * passed socket or if the passed socket can't 1894 * write to the receiving process don't accept 1895 * the passed socket. 1896 */ 1897 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad); 1898 rc = smk_bu_file(file, may, rc); 1899 if (rc < 0) 1900 return rc; 1901 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad); 1902 rc = smk_bu_file(file, may, rc); 1903 return rc; 1904 } 1905 /* 1906 * This code relies on bitmasks. 1907 */ 1908 if (file->f_mode & FMODE_READ) 1909 may = MAY_READ; 1910 if (file->f_mode & FMODE_WRITE) 1911 may |= MAY_WRITE; 1912 1913 rc = smk_curacc(smk_of_inode(inode), may, &ad); 1914 rc = smk_bu_file(file, may, rc); 1915 return rc; 1916 } 1917 1918 /** 1919 * smack_file_open - Smack dentry open processing 1920 * @file: the object 1921 * @cred: task credential 1922 * 1923 * Set the security blob in the file structure. 1924 * Allow the open only if the task has read access. There are 1925 * many read operations (e.g. fstat) that you can do with an 1926 * fd even if you have the file open write-only. 1927 * 1928 * Returns 0 1929 */ 1930 static int smack_file_open(struct file *file, const struct cred *cred) 1931 { 1932 struct task_smack *tsp = cred->security; 1933 struct inode *inode = file_inode(file); 1934 struct smk_audit_info ad; 1935 int rc; 1936 1937 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1938 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1939 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad); 1940 rc = smk_bu_credfile(cred, file, MAY_READ, rc); 1941 1942 return rc; 1943 } 1944 1945 /* 1946 * Task hooks 1947 */ 1948 1949 /** 1950 * smack_cred_alloc_blank - "allocate" blank task-level security credentials 1951 * @new: the new credentials 1952 * @gfp: the atomicity of any memory allocations 1953 * 1954 * Prepare a blank set of credentials for modification. This must allocate all 1955 * the memory the LSM module might require such that cred_transfer() can 1956 * complete without error. 1957 */ 1958 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp) 1959 { 1960 struct task_smack *tsp; 1961 1962 tsp = new_task_smack(NULL, NULL, gfp); 1963 if (tsp == NULL) 1964 return -ENOMEM; 1965 1966 cred->security = tsp; 1967 1968 return 0; 1969 } 1970 1971 1972 /** 1973 * smack_cred_free - "free" task-level security credentials 1974 * @cred: the credentials in question 1975 * 1976 */ 1977 static void smack_cred_free(struct cred *cred) 1978 { 1979 struct task_smack *tsp = cred->security; 1980 struct smack_rule *rp; 1981 struct list_head *l; 1982 struct list_head *n; 1983 1984 if (tsp == NULL) 1985 return; 1986 cred->security = NULL; 1987 1988 smk_destroy_label_list(&tsp->smk_relabel); 1989 1990 list_for_each_safe(l, n, &tsp->smk_rules) { 1991 rp = list_entry(l, struct smack_rule, list); 1992 list_del(&rp->list); 1993 kfree(rp); 1994 } 1995 kfree(tsp); 1996 } 1997 1998 /** 1999 * smack_cred_prepare - prepare new set of credentials for modification 2000 * @new: the new credentials 2001 * @old: the original credentials 2002 * @gfp: the atomicity of any memory allocations 2003 * 2004 * Prepare a new set of credentials for modification. 2005 */ 2006 static int smack_cred_prepare(struct cred *new, const struct cred *old, 2007 gfp_t gfp) 2008 { 2009 struct task_smack *old_tsp = old->security; 2010 struct task_smack *new_tsp; 2011 int rc; 2012 2013 new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp); 2014 if (new_tsp == NULL) 2015 return -ENOMEM; 2016 2017 new->security = new_tsp; 2018 2019 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp); 2020 if (rc != 0) 2021 return rc; 2022 2023 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel, 2024 gfp); 2025 if (rc != 0) 2026 return rc; 2027 2028 return 0; 2029 } 2030 2031 /** 2032 * smack_cred_transfer - Transfer the old credentials to the new credentials 2033 * @new: the new credentials 2034 * @old: the original credentials 2035 * 2036 * Fill in a set of blank credentials from another set of credentials. 2037 */ 2038 static void smack_cred_transfer(struct cred *new, const struct cred *old) 2039 { 2040 struct task_smack *old_tsp = old->security; 2041 struct task_smack *new_tsp = new->security; 2042 2043 new_tsp->smk_task = old_tsp->smk_task; 2044 new_tsp->smk_forked = old_tsp->smk_task; 2045 mutex_init(&new_tsp->smk_rules_lock); 2046 INIT_LIST_HEAD(&new_tsp->smk_rules); 2047 2048 2049 /* cbs copy rule list */ 2050 } 2051 2052 /** 2053 * smack_kernel_act_as - Set the subjective context in a set of credentials 2054 * @new: points to the set of credentials to be modified. 2055 * @secid: specifies the security ID to be set 2056 * 2057 * Set the security data for a kernel service. 2058 */ 2059 static int smack_kernel_act_as(struct cred *new, u32 secid) 2060 { 2061 struct task_smack *new_tsp = new->security; 2062 2063 new_tsp->smk_task = smack_from_secid(secid); 2064 return 0; 2065 } 2066 2067 /** 2068 * smack_kernel_create_files_as - Set the file creation label in a set of creds 2069 * @new: points to the set of credentials to be modified 2070 * @inode: points to the inode to use as a reference 2071 * 2072 * Set the file creation context in a set of credentials to the same 2073 * as the objective context of the specified inode 2074 */ 2075 static int smack_kernel_create_files_as(struct cred *new, 2076 struct inode *inode) 2077 { 2078 struct inode_smack *isp = inode->i_security; 2079 struct task_smack *tsp = new->security; 2080 2081 tsp->smk_forked = isp->smk_inode; 2082 tsp->smk_task = tsp->smk_forked; 2083 return 0; 2084 } 2085 2086 /** 2087 * smk_curacc_on_task - helper to log task related access 2088 * @p: the task object 2089 * @access: the access requested 2090 * @caller: name of the calling function for audit 2091 * 2092 * Return 0 if access is permitted 2093 */ 2094 static int smk_curacc_on_task(struct task_struct *p, int access, 2095 const char *caller) 2096 { 2097 struct smk_audit_info ad; 2098 struct smack_known *skp = smk_of_task_struct(p); 2099 int rc; 2100 2101 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); 2102 smk_ad_setfield_u_tsk(&ad, p); 2103 rc = smk_curacc(skp, access, &ad); 2104 rc = smk_bu_task(p, access, rc); 2105 return rc; 2106 } 2107 2108 /** 2109 * smack_task_setpgid - Smack check on setting pgid 2110 * @p: the task object 2111 * @pgid: unused 2112 * 2113 * Return 0 if write access is permitted 2114 */ 2115 static int smack_task_setpgid(struct task_struct *p, pid_t pgid) 2116 { 2117 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2118 } 2119 2120 /** 2121 * smack_task_getpgid - Smack access check for getpgid 2122 * @p: the object task 2123 * 2124 * Returns 0 if current can read the object task, error code otherwise 2125 */ 2126 static int smack_task_getpgid(struct task_struct *p) 2127 { 2128 return smk_curacc_on_task(p, MAY_READ, __func__); 2129 } 2130 2131 /** 2132 * smack_task_getsid - Smack access check for getsid 2133 * @p: the object task 2134 * 2135 * Returns 0 if current can read the object task, error code otherwise 2136 */ 2137 static int smack_task_getsid(struct task_struct *p) 2138 { 2139 return smk_curacc_on_task(p, MAY_READ, __func__); 2140 } 2141 2142 /** 2143 * smack_task_getsecid - get the secid of the task 2144 * @p: the object task 2145 * @secid: where to put the result 2146 * 2147 * Sets the secid to contain a u32 version of the smack label. 2148 */ 2149 static void smack_task_getsecid(struct task_struct *p, u32 *secid) 2150 { 2151 struct smack_known *skp = smk_of_task_struct(p); 2152 2153 *secid = skp->smk_secid; 2154 } 2155 2156 /** 2157 * smack_task_setnice - Smack check on setting nice 2158 * @p: the task object 2159 * @nice: unused 2160 * 2161 * Return 0 if write access is permitted 2162 */ 2163 static int smack_task_setnice(struct task_struct *p, int nice) 2164 { 2165 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2166 } 2167 2168 /** 2169 * smack_task_setioprio - Smack check on setting ioprio 2170 * @p: the task object 2171 * @ioprio: unused 2172 * 2173 * Return 0 if write access is permitted 2174 */ 2175 static int smack_task_setioprio(struct task_struct *p, int ioprio) 2176 { 2177 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2178 } 2179 2180 /** 2181 * smack_task_getioprio - Smack check on reading ioprio 2182 * @p: the task object 2183 * 2184 * Return 0 if read access is permitted 2185 */ 2186 static int smack_task_getioprio(struct task_struct *p) 2187 { 2188 return smk_curacc_on_task(p, MAY_READ, __func__); 2189 } 2190 2191 /** 2192 * smack_task_setscheduler - Smack check on setting scheduler 2193 * @p: the task object 2194 * @policy: unused 2195 * @lp: unused 2196 * 2197 * Return 0 if read access is permitted 2198 */ 2199 static int smack_task_setscheduler(struct task_struct *p) 2200 { 2201 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2202 } 2203 2204 /** 2205 * smack_task_getscheduler - Smack check on reading scheduler 2206 * @p: the task object 2207 * 2208 * Return 0 if read access is permitted 2209 */ 2210 static int smack_task_getscheduler(struct task_struct *p) 2211 { 2212 return smk_curacc_on_task(p, MAY_READ, __func__); 2213 } 2214 2215 /** 2216 * smack_task_movememory - Smack check on moving memory 2217 * @p: the task object 2218 * 2219 * Return 0 if write access is permitted 2220 */ 2221 static int smack_task_movememory(struct task_struct *p) 2222 { 2223 return smk_curacc_on_task(p, MAY_WRITE, __func__); 2224 } 2225 2226 /** 2227 * smack_task_kill - Smack check on signal delivery 2228 * @p: the task object 2229 * @info: unused 2230 * @sig: unused 2231 * @cred: identifies the cred to use in lieu of current's 2232 * 2233 * Return 0 if write access is permitted 2234 * 2235 */ 2236 static int smack_task_kill(struct task_struct *p, struct siginfo *info, 2237 int sig, const struct cred *cred) 2238 { 2239 struct smk_audit_info ad; 2240 struct smack_known *skp; 2241 struct smack_known *tkp = smk_of_task_struct(p); 2242 int rc; 2243 2244 if (!sig) 2245 return 0; /* null signal; existence test */ 2246 2247 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 2248 smk_ad_setfield_u_tsk(&ad, p); 2249 /* 2250 * Sending a signal requires that the sender 2251 * can write the receiver. 2252 */ 2253 if (cred == NULL) { 2254 rc = smk_curacc(tkp, MAY_DELIVER, &ad); 2255 rc = smk_bu_task(p, MAY_DELIVER, rc); 2256 return rc; 2257 } 2258 /* 2259 * If the cred isn't NULL we're dealing with some USB IO 2260 * specific behavior. This is not clean. For one thing 2261 * we can't take privilege into account. 2262 */ 2263 skp = smk_of_task(cred->security); 2264 rc = smk_access(skp, tkp, MAY_DELIVER, &ad); 2265 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc); 2266 return rc; 2267 } 2268 2269 /** 2270 * smack_task_to_inode - copy task smack into the inode blob 2271 * @p: task to copy from 2272 * @inode: inode to copy to 2273 * 2274 * Sets the smack pointer in the inode security blob 2275 */ 2276 static void smack_task_to_inode(struct task_struct *p, struct inode *inode) 2277 { 2278 struct inode_smack *isp = inode->i_security; 2279 struct smack_known *skp = smk_of_task_struct(p); 2280 2281 isp->smk_inode = skp; 2282 } 2283 2284 /* 2285 * Socket hooks. 2286 */ 2287 2288 /** 2289 * smack_sk_alloc_security - Allocate a socket blob 2290 * @sk: the socket 2291 * @family: unused 2292 * @gfp_flags: memory allocation flags 2293 * 2294 * Assign Smack pointers to current 2295 * 2296 * Returns 0 on success, -ENOMEM is there's no memory 2297 */ 2298 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) 2299 { 2300 struct smack_known *skp = smk_of_current(); 2301 struct socket_smack *ssp; 2302 2303 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags); 2304 if (ssp == NULL) 2305 return -ENOMEM; 2306 2307 /* 2308 * Sockets created by kernel threads receive web label. 2309 */ 2310 if (unlikely(current->flags & PF_KTHREAD)) { 2311 ssp->smk_in = &smack_known_web; 2312 ssp->smk_out = &smack_known_web; 2313 } else { 2314 ssp->smk_in = skp; 2315 ssp->smk_out = skp; 2316 } 2317 ssp->smk_packet = NULL; 2318 2319 sk->sk_security = ssp; 2320 2321 return 0; 2322 } 2323 2324 /** 2325 * smack_sk_free_security - Free a socket blob 2326 * @sk: the socket 2327 * 2328 * Clears the blob pointer 2329 */ 2330 static void smack_sk_free_security(struct sock *sk) 2331 { 2332 #ifdef SMACK_IPV6_PORT_LABELING 2333 struct smk_port_label *spp; 2334 2335 if (sk->sk_family == PF_INET6) { 2336 rcu_read_lock(); 2337 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2338 if (spp->smk_sock != sk) 2339 continue; 2340 spp->smk_can_reuse = 1; 2341 break; 2342 } 2343 rcu_read_unlock(); 2344 } 2345 #endif 2346 kfree(sk->sk_security); 2347 } 2348 2349 /** 2350 * smack_ipv4host_label - check host based restrictions 2351 * @sip: the object end 2352 * 2353 * looks for host based access restrictions 2354 * 2355 * This version will only be appropriate for really small sets of single label 2356 * hosts. The caller is responsible for ensuring that the RCU read lock is 2357 * taken before calling this function. 2358 * 2359 * Returns the label of the far end or NULL if it's not special. 2360 */ 2361 static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip) 2362 { 2363 struct smk_net4addr *snp; 2364 struct in_addr *siap = &sip->sin_addr; 2365 2366 if (siap->s_addr == 0) 2367 return NULL; 2368 2369 list_for_each_entry_rcu(snp, &smk_net4addr_list, list) 2370 /* 2371 * we break after finding the first match because 2372 * the list is sorted from longest to shortest mask 2373 * so we have found the most specific match 2374 */ 2375 if (snp->smk_host.s_addr == 2376 (siap->s_addr & snp->smk_mask.s_addr)) 2377 return snp->smk_label; 2378 2379 return NULL; 2380 } 2381 2382 #if IS_ENABLED(CONFIG_IPV6) 2383 /* 2384 * smk_ipv6_localhost - Check for local ipv6 host address 2385 * @sip: the address 2386 * 2387 * Returns boolean true if this is the localhost address 2388 */ 2389 static bool smk_ipv6_localhost(struct sockaddr_in6 *sip) 2390 { 2391 __be16 *be16p = (__be16 *)&sip->sin6_addr; 2392 __be32 *be32p = (__be32 *)&sip->sin6_addr; 2393 2394 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 && 2395 ntohs(be16p[7]) == 1) 2396 return true; 2397 return false; 2398 } 2399 2400 /** 2401 * smack_ipv6host_label - check host based restrictions 2402 * @sip: the object end 2403 * 2404 * looks for host based access restrictions 2405 * 2406 * This version will only be appropriate for really small sets of single label 2407 * hosts. The caller is responsible for ensuring that the RCU read lock is 2408 * taken before calling this function. 2409 * 2410 * Returns the label of the far end or NULL if it's not special. 2411 */ 2412 static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) 2413 { 2414 struct smk_net6addr *snp; 2415 struct in6_addr *sap = &sip->sin6_addr; 2416 int i; 2417 int found = 0; 2418 2419 /* 2420 * It's local. Don't look for a host label. 2421 */ 2422 if (smk_ipv6_localhost(sip)) 2423 return NULL; 2424 2425 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) { 2426 /* 2427 * If the label is NULL the entry has 2428 * been renounced. Ignore it. 2429 */ 2430 if (snp->smk_label == NULL) 2431 continue; 2432 /* 2433 * we break after finding the first match because 2434 * the list is sorted from longest to shortest mask 2435 * so we have found the most specific match 2436 */ 2437 for (found = 1, i = 0; i < 8; i++) { 2438 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) != 2439 snp->smk_host.s6_addr16[i]) { 2440 found = 0; 2441 break; 2442 } 2443 } 2444 if (found) 2445 return snp->smk_label; 2446 } 2447 2448 return NULL; 2449 } 2450 #endif /* CONFIG_IPV6 */ 2451 2452 /** 2453 * smack_netlabel - Set the secattr on a socket 2454 * @sk: the socket 2455 * @labeled: socket label scheme 2456 * 2457 * Convert the outbound smack value (smk_out) to a 2458 * secattr and attach it to the socket. 2459 * 2460 * Returns 0 on success or an error code 2461 */ 2462 static int smack_netlabel(struct sock *sk, int labeled) 2463 { 2464 struct smack_known *skp; 2465 struct socket_smack *ssp = sk->sk_security; 2466 int rc = 0; 2467 2468 /* 2469 * Usually the netlabel code will handle changing the 2470 * packet labeling based on the label. 2471 * The case of a single label host is different, because 2472 * a single label host should never get a labeled packet 2473 * even though the label is usually associated with a packet 2474 * label. 2475 */ 2476 local_bh_disable(); 2477 bh_lock_sock_nested(sk); 2478 2479 if (ssp->smk_out == smack_net_ambient || 2480 labeled == SMACK_UNLABELED_SOCKET) 2481 netlbl_sock_delattr(sk); 2482 else { 2483 skp = ssp->smk_out; 2484 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel); 2485 } 2486 2487 bh_unlock_sock(sk); 2488 local_bh_enable(); 2489 2490 return rc; 2491 } 2492 2493 /** 2494 * smack_netlbel_send - Set the secattr on a socket and perform access checks 2495 * @sk: the socket 2496 * @sap: the destination address 2497 * 2498 * Set the correct secattr for the given socket based on the destination 2499 * address and perform any outbound access checks needed. 2500 * 2501 * Returns 0 on success or an error code. 2502 * 2503 */ 2504 static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) 2505 { 2506 struct smack_known *skp; 2507 int rc; 2508 int sk_lbl; 2509 struct smack_known *hkp; 2510 struct socket_smack *ssp = sk->sk_security; 2511 struct smk_audit_info ad; 2512 2513 rcu_read_lock(); 2514 hkp = smack_ipv4host_label(sap); 2515 if (hkp != NULL) { 2516 #ifdef CONFIG_AUDIT 2517 struct lsm_network_audit net; 2518 2519 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2520 ad.a.u.net->family = sap->sin_family; 2521 ad.a.u.net->dport = sap->sin_port; 2522 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr; 2523 #endif 2524 sk_lbl = SMACK_UNLABELED_SOCKET; 2525 skp = ssp->smk_out; 2526 rc = smk_access(skp, hkp, MAY_WRITE, &ad); 2527 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc); 2528 } else { 2529 sk_lbl = SMACK_CIPSO_SOCKET; 2530 rc = 0; 2531 } 2532 rcu_read_unlock(); 2533 if (rc != 0) 2534 return rc; 2535 2536 return smack_netlabel(sk, sk_lbl); 2537 } 2538 2539 #if IS_ENABLED(CONFIG_IPV6) 2540 /** 2541 * smk_ipv6_check - check Smack access 2542 * @subject: subject Smack label 2543 * @object: object Smack label 2544 * @address: address 2545 * @act: the action being taken 2546 * 2547 * Check an IPv6 access 2548 */ 2549 static int smk_ipv6_check(struct smack_known *subject, 2550 struct smack_known *object, 2551 struct sockaddr_in6 *address, int act) 2552 { 2553 #ifdef CONFIG_AUDIT 2554 struct lsm_network_audit net; 2555 #endif 2556 struct smk_audit_info ad; 2557 int rc; 2558 2559 #ifdef CONFIG_AUDIT 2560 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 2561 ad.a.u.net->family = PF_INET6; 2562 ad.a.u.net->dport = ntohs(address->sin6_port); 2563 if (act == SMK_RECEIVING) 2564 ad.a.u.net->v6info.saddr = address->sin6_addr; 2565 else 2566 ad.a.u.net->v6info.daddr = address->sin6_addr; 2567 #endif 2568 rc = smk_access(subject, object, MAY_WRITE, &ad); 2569 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc); 2570 return rc; 2571 } 2572 #endif /* CONFIG_IPV6 */ 2573 2574 #ifdef SMACK_IPV6_PORT_LABELING 2575 /** 2576 * smk_ipv6_port_label - Smack port access table management 2577 * @sock: socket 2578 * @address: address 2579 * 2580 * Create or update the port list entry 2581 */ 2582 static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) 2583 { 2584 struct sock *sk = sock->sk; 2585 struct sockaddr_in6 *addr6; 2586 struct socket_smack *ssp = sock->sk->sk_security; 2587 struct smk_port_label *spp; 2588 unsigned short port = 0; 2589 2590 if (address == NULL) { 2591 /* 2592 * This operation is changing the Smack information 2593 * on the bound socket. Take the changes to the port 2594 * as well. 2595 */ 2596 rcu_read_lock(); 2597 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2598 if (sk != spp->smk_sock) 2599 continue; 2600 spp->smk_in = ssp->smk_in; 2601 spp->smk_out = ssp->smk_out; 2602 rcu_read_unlock(); 2603 return; 2604 } 2605 /* 2606 * A NULL address is only used for updating existing 2607 * bound entries. If there isn't one, it's OK. 2608 */ 2609 rcu_read_unlock(); 2610 return; 2611 } 2612 2613 addr6 = (struct sockaddr_in6 *)address; 2614 port = ntohs(addr6->sin6_port); 2615 /* 2616 * This is a special case that is safely ignored. 2617 */ 2618 if (port == 0) 2619 return; 2620 2621 /* 2622 * Look for an existing port list entry. 2623 * This is an indication that a port is getting reused. 2624 */ 2625 rcu_read_lock(); 2626 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2627 if (spp->smk_port != port || spp->smk_sock_type != sock->type) 2628 continue; 2629 if (spp->smk_can_reuse != 1) { 2630 rcu_read_unlock(); 2631 return; 2632 } 2633 spp->smk_port = port; 2634 spp->smk_sock = sk; 2635 spp->smk_in = ssp->smk_in; 2636 spp->smk_out = ssp->smk_out; 2637 spp->smk_can_reuse = 0; 2638 rcu_read_unlock(); 2639 return; 2640 } 2641 rcu_read_unlock(); 2642 /* 2643 * A new port entry is required. 2644 */ 2645 spp = kzalloc(sizeof(*spp), GFP_KERNEL); 2646 if (spp == NULL) 2647 return; 2648 2649 spp->smk_port = port; 2650 spp->smk_sock = sk; 2651 spp->smk_in = ssp->smk_in; 2652 spp->smk_out = ssp->smk_out; 2653 spp->smk_sock_type = sock->type; 2654 spp->smk_can_reuse = 0; 2655 2656 mutex_lock(&smack_ipv6_lock); 2657 list_add_rcu(&spp->list, &smk_ipv6_port_list); 2658 mutex_unlock(&smack_ipv6_lock); 2659 return; 2660 } 2661 2662 /** 2663 * smk_ipv6_port_check - check Smack port access 2664 * @sock: socket 2665 * @address: address 2666 * 2667 * Create or update the port list entry 2668 */ 2669 static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, 2670 int act) 2671 { 2672 struct smk_port_label *spp; 2673 struct socket_smack *ssp = sk->sk_security; 2674 struct smack_known *skp = NULL; 2675 unsigned short port; 2676 struct smack_known *object; 2677 2678 if (act == SMK_RECEIVING) { 2679 skp = smack_ipv6host_label(address); 2680 object = ssp->smk_in; 2681 } else { 2682 skp = ssp->smk_out; 2683 object = smack_ipv6host_label(address); 2684 } 2685 2686 /* 2687 * The other end is a single label host. 2688 */ 2689 if (skp != NULL && object != NULL) 2690 return smk_ipv6_check(skp, object, address, act); 2691 if (skp == NULL) 2692 skp = smack_net_ambient; 2693 if (object == NULL) 2694 object = smack_net_ambient; 2695 2696 /* 2697 * It's remote, so port lookup does no good. 2698 */ 2699 if (!smk_ipv6_localhost(address)) 2700 return smk_ipv6_check(skp, object, address, act); 2701 2702 /* 2703 * It's local so the send check has to have passed. 2704 */ 2705 if (act == SMK_RECEIVING) 2706 return 0; 2707 2708 port = ntohs(address->sin6_port); 2709 rcu_read_lock(); 2710 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) { 2711 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type) 2712 continue; 2713 object = spp->smk_in; 2714 if (act == SMK_CONNECTING) 2715 ssp->smk_packet = spp->smk_out; 2716 break; 2717 } 2718 rcu_read_unlock(); 2719 2720 return smk_ipv6_check(skp, object, address, act); 2721 } 2722 #endif /* SMACK_IPV6_PORT_LABELING */ 2723 2724 /** 2725 * smack_inode_setsecurity - set smack xattrs 2726 * @inode: the object 2727 * @name: attribute name 2728 * @value: attribute value 2729 * @size: size of the attribute 2730 * @flags: unused 2731 * 2732 * Sets the named attribute in the appropriate blob 2733 * 2734 * Returns 0 on success, or an error code 2735 */ 2736 static int smack_inode_setsecurity(struct inode *inode, const char *name, 2737 const void *value, size_t size, int flags) 2738 { 2739 struct smack_known *skp; 2740 struct inode_smack *nsp = inode->i_security; 2741 struct socket_smack *ssp; 2742 struct socket *sock; 2743 int rc = 0; 2744 2745 if (value == NULL || size > SMK_LONGLABEL || size == 0) 2746 return -EINVAL; 2747 2748 skp = smk_import_entry(value, size); 2749 if (IS_ERR(skp)) 2750 return PTR_ERR(skp); 2751 2752 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 2753 nsp->smk_inode = skp; 2754 nsp->smk_flags |= SMK_INODE_INSTANT; 2755 return 0; 2756 } 2757 /* 2758 * The rest of the Smack xattrs are only on sockets. 2759 */ 2760 if (inode->i_sb->s_magic != SOCKFS_MAGIC) 2761 return -EOPNOTSUPP; 2762 2763 sock = SOCKET_I(inode); 2764 if (sock == NULL || sock->sk == NULL) 2765 return -EOPNOTSUPP; 2766 2767 ssp = sock->sk->sk_security; 2768 2769 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 2770 ssp->smk_in = skp; 2771 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) { 2772 ssp->smk_out = skp; 2773 if (sock->sk->sk_family == PF_INET) { 2774 rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); 2775 if (rc != 0) 2776 printk(KERN_WARNING 2777 "Smack: \"%s\" netlbl error %d.\n", 2778 __func__, -rc); 2779 } 2780 } else 2781 return -EOPNOTSUPP; 2782 2783 #ifdef SMACK_IPV6_PORT_LABELING 2784 if (sock->sk->sk_family == PF_INET6) 2785 smk_ipv6_port_label(sock, NULL); 2786 #endif 2787 2788 return 0; 2789 } 2790 2791 /** 2792 * smack_socket_post_create - finish socket setup 2793 * @sock: the socket 2794 * @family: protocol family 2795 * @type: unused 2796 * @protocol: unused 2797 * @kern: unused 2798 * 2799 * Sets the netlabel information on the socket 2800 * 2801 * Returns 0 on success, and error code otherwise 2802 */ 2803 static int smack_socket_post_create(struct socket *sock, int family, 2804 int type, int protocol, int kern) 2805 { 2806 struct socket_smack *ssp; 2807 2808 if (sock->sk == NULL) 2809 return 0; 2810 2811 /* 2812 * Sockets created by kernel threads receive web label. 2813 */ 2814 if (unlikely(current->flags & PF_KTHREAD)) { 2815 ssp = sock->sk->sk_security; 2816 ssp->smk_in = &smack_known_web; 2817 ssp->smk_out = &smack_known_web; 2818 } 2819 2820 if (family != PF_INET) 2821 return 0; 2822 /* 2823 * Set the outbound netlbl. 2824 */ 2825 return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); 2826 } 2827 2828 #ifdef SMACK_IPV6_PORT_LABELING 2829 /** 2830 * smack_socket_bind - record port binding information. 2831 * @sock: the socket 2832 * @address: the port address 2833 * @addrlen: size of the address 2834 * 2835 * Records the label bound to a port. 2836 * 2837 * Returns 0 2838 */ 2839 static int smack_socket_bind(struct socket *sock, struct sockaddr *address, 2840 int addrlen) 2841 { 2842 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) 2843 smk_ipv6_port_label(sock, address); 2844 return 0; 2845 } 2846 #endif /* SMACK_IPV6_PORT_LABELING */ 2847 2848 /** 2849 * smack_socket_connect - connect access check 2850 * @sock: the socket 2851 * @sap: the other end 2852 * @addrlen: size of sap 2853 * 2854 * Verifies that a connection may be possible 2855 * 2856 * Returns 0 on success, and error code otherwise 2857 */ 2858 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 2859 int addrlen) 2860 { 2861 int rc = 0; 2862 #if IS_ENABLED(CONFIG_IPV6) 2863 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap; 2864 #endif 2865 #ifdef SMACK_IPV6_SECMARK_LABELING 2866 struct smack_known *rsp; 2867 struct socket_smack *ssp; 2868 #endif 2869 2870 if (sock->sk == NULL) 2871 return 0; 2872 2873 #ifdef SMACK_IPV6_SECMARK_LABELING 2874 ssp = sock->sk->sk_security; 2875 #endif 2876 2877 switch (sock->sk->sk_family) { 2878 case PF_INET: 2879 if (addrlen < sizeof(struct sockaddr_in)) 2880 return -EINVAL; 2881 rc = smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap); 2882 break; 2883 case PF_INET6: 2884 if (addrlen < sizeof(struct sockaddr_in6)) 2885 return -EINVAL; 2886 #ifdef SMACK_IPV6_SECMARK_LABELING 2887 rsp = smack_ipv6host_label(sip); 2888 if (rsp != NULL) 2889 rc = smk_ipv6_check(ssp->smk_out, rsp, sip, 2890 SMK_CONNECTING); 2891 #endif 2892 #ifdef SMACK_IPV6_PORT_LABELING 2893 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING); 2894 #endif 2895 break; 2896 } 2897 return rc; 2898 } 2899 2900 /** 2901 * smack_flags_to_may - convert S_ to MAY_ values 2902 * @flags: the S_ value 2903 * 2904 * Returns the equivalent MAY_ value 2905 */ 2906 static int smack_flags_to_may(int flags) 2907 { 2908 int may = 0; 2909 2910 if (flags & S_IRUGO) 2911 may |= MAY_READ; 2912 if (flags & S_IWUGO) 2913 may |= MAY_WRITE; 2914 if (flags & S_IXUGO) 2915 may |= MAY_EXEC; 2916 2917 return may; 2918 } 2919 2920 /** 2921 * smack_msg_msg_alloc_security - Set the security blob for msg_msg 2922 * @msg: the object 2923 * 2924 * Returns 0 2925 */ 2926 static int smack_msg_msg_alloc_security(struct msg_msg *msg) 2927 { 2928 struct smack_known *skp = smk_of_current(); 2929 2930 msg->security = skp; 2931 return 0; 2932 } 2933 2934 /** 2935 * smack_msg_msg_free_security - Clear the security blob for msg_msg 2936 * @msg: the object 2937 * 2938 * Clears the blob pointer 2939 */ 2940 static void smack_msg_msg_free_security(struct msg_msg *msg) 2941 { 2942 msg->security = NULL; 2943 } 2944 2945 /** 2946 * smack_of_ipc - the smack pointer for the ipc 2947 * @isp: the object 2948 * 2949 * Returns a pointer to the smack value 2950 */ 2951 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp) 2952 { 2953 return (struct smack_known *)isp->security; 2954 } 2955 2956 /** 2957 * smack_ipc_alloc_security - Set the security blob for ipc 2958 * @isp: the object 2959 * 2960 * Returns 0 2961 */ 2962 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp) 2963 { 2964 struct smack_known *skp = smk_of_current(); 2965 2966 isp->security = skp; 2967 return 0; 2968 } 2969 2970 /** 2971 * smack_ipc_free_security - Clear the security blob for ipc 2972 * @isp: the object 2973 * 2974 * Clears the blob pointer 2975 */ 2976 static void smack_ipc_free_security(struct kern_ipc_perm *isp) 2977 { 2978 isp->security = NULL; 2979 } 2980 2981 /** 2982 * smk_curacc_shm : check if current has access on shm 2983 * @isp : the object 2984 * @access : access requested 2985 * 2986 * Returns 0 if current has the requested access, error code otherwise 2987 */ 2988 static int smk_curacc_shm(struct kern_ipc_perm *isp, int access) 2989 { 2990 struct smack_known *ssp = smack_of_ipc(isp); 2991 struct smk_audit_info ad; 2992 int rc; 2993 2994 #ifdef CONFIG_AUDIT 2995 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2996 ad.a.u.ipc_id = isp->id; 2997 #endif 2998 rc = smk_curacc(ssp, access, &ad); 2999 rc = smk_bu_current("shm", ssp, access, rc); 3000 return rc; 3001 } 3002 3003 /** 3004 * smack_shm_associate - Smack access check for shm 3005 * @isp: the object 3006 * @shmflg: access requested 3007 * 3008 * Returns 0 if current has the requested access, error code otherwise 3009 */ 3010 static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg) 3011 { 3012 int may; 3013 3014 may = smack_flags_to_may(shmflg); 3015 return smk_curacc_shm(isp, may); 3016 } 3017 3018 /** 3019 * smack_shm_shmctl - Smack access check for shm 3020 * @isp: the object 3021 * @cmd: what it wants to do 3022 * 3023 * Returns 0 if current has the requested access, error code otherwise 3024 */ 3025 static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd) 3026 { 3027 int may; 3028 3029 switch (cmd) { 3030 case IPC_STAT: 3031 case SHM_STAT: 3032 may = MAY_READ; 3033 break; 3034 case IPC_SET: 3035 case SHM_LOCK: 3036 case SHM_UNLOCK: 3037 case IPC_RMID: 3038 may = MAY_READWRITE; 3039 break; 3040 case IPC_INFO: 3041 case SHM_INFO: 3042 /* 3043 * System level information. 3044 */ 3045 return 0; 3046 default: 3047 return -EINVAL; 3048 } 3049 return smk_curacc_shm(isp, may); 3050 } 3051 3052 /** 3053 * smack_shm_shmat - Smack access for shmat 3054 * @isp: the object 3055 * @shmaddr: unused 3056 * @shmflg: access requested 3057 * 3058 * Returns 0 if current has the requested access, error code otherwise 3059 */ 3060 static int smack_shm_shmat(struct kern_ipc_perm *ipc, char __user *shmaddr, 3061 int shmflg) 3062 { 3063 int may; 3064 3065 may = smack_flags_to_may(shmflg); 3066 return smk_curacc_shm(ipc, may); 3067 } 3068 3069 /** 3070 * smk_curacc_sem : check if current has access on sem 3071 * @isp : the object 3072 * @access : access requested 3073 * 3074 * Returns 0 if current has the requested access, error code otherwise 3075 */ 3076 static int smk_curacc_sem(struct kern_ipc_perm *isp, int access) 3077 { 3078 struct smack_known *ssp = smack_of_ipc(isp); 3079 struct smk_audit_info ad; 3080 int rc; 3081 3082 #ifdef CONFIG_AUDIT 3083 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3084 ad.a.u.ipc_id = isp->id; 3085 #endif 3086 rc = smk_curacc(ssp, access, &ad); 3087 rc = smk_bu_current("sem", ssp, access, rc); 3088 return rc; 3089 } 3090 3091 /** 3092 * smack_sem_associate - Smack access check for sem 3093 * @isp: the object 3094 * @semflg: access requested 3095 * 3096 * Returns 0 if current has the requested access, error code otherwise 3097 */ 3098 static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg) 3099 { 3100 int may; 3101 3102 may = smack_flags_to_may(semflg); 3103 return smk_curacc_sem(isp, may); 3104 } 3105 3106 /** 3107 * smack_sem_shmctl - Smack access check for sem 3108 * @isp: the object 3109 * @cmd: what it wants to do 3110 * 3111 * Returns 0 if current has the requested access, error code otherwise 3112 */ 3113 static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd) 3114 { 3115 int may; 3116 3117 switch (cmd) { 3118 case GETPID: 3119 case GETNCNT: 3120 case GETZCNT: 3121 case GETVAL: 3122 case GETALL: 3123 case IPC_STAT: 3124 case SEM_STAT: 3125 may = MAY_READ; 3126 break; 3127 case SETVAL: 3128 case SETALL: 3129 case IPC_RMID: 3130 case IPC_SET: 3131 may = MAY_READWRITE; 3132 break; 3133 case IPC_INFO: 3134 case SEM_INFO: 3135 /* 3136 * System level information 3137 */ 3138 return 0; 3139 default: 3140 return -EINVAL; 3141 } 3142 3143 return smk_curacc_sem(isp, may); 3144 } 3145 3146 /** 3147 * smack_sem_semop - Smack checks of semaphore operations 3148 * @isp: the object 3149 * @sops: unused 3150 * @nsops: unused 3151 * @alter: unused 3152 * 3153 * Treated as read and write in all cases. 3154 * 3155 * Returns 0 if access is allowed, error code otherwise 3156 */ 3157 static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops, 3158 unsigned nsops, int alter) 3159 { 3160 return smk_curacc_sem(isp, MAY_READWRITE); 3161 } 3162 3163 /** 3164 * smk_curacc_msq : helper to check if current has access on msq 3165 * @isp : the msq 3166 * @access : access requested 3167 * 3168 * return 0 if current has access, error otherwise 3169 */ 3170 static int smk_curacc_msq(struct kern_ipc_perm *isp, int access) 3171 { 3172 struct smack_known *msp = smack_of_ipc(isp); 3173 struct smk_audit_info ad; 3174 int rc; 3175 3176 #ifdef CONFIG_AUDIT 3177 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3178 ad.a.u.ipc_id = isp->id; 3179 #endif 3180 rc = smk_curacc(msp, access, &ad); 3181 rc = smk_bu_current("msq", msp, access, rc); 3182 return rc; 3183 } 3184 3185 /** 3186 * smack_msg_queue_associate - Smack access check for msg_queue 3187 * @isp: the object 3188 * @msqflg: access requested 3189 * 3190 * Returns 0 if current has the requested access, error code otherwise 3191 */ 3192 static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg) 3193 { 3194 int may; 3195 3196 may = smack_flags_to_may(msqflg); 3197 return smk_curacc_msq(isp, may); 3198 } 3199 3200 /** 3201 * smack_msg_queue_msgctl - Smack access check for msg_queue 3202 * @isp: the object 3203 * @cmd: what it wants to do 3204 * 3205 * Returns 0 if current has the requested access, error code otherwise 3206 */ 3207 static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd) 3208 { 3209 int may; 3210 3211 switch (cmd) { 3212 case IPC_STAT: 3213 case MSG_STAT: 3214 may = MAY_READ; 3215 break; 3216 case IPC_SET: 3217 case IPC_RMID: 3218 may = MAY_READWRITE; 3219 break; 3220 case IPC_INFO: 3221 case MSG_INFO: 3222 /* 3223 * System level information 3224 */ 3225 return 0; 3226 default: 3227 return -EINVAL; 3228 } 3229 3230 return smk_curacc_msq(isp, may); 3231 } 3232 3233 /** 3234 * smack_msg_queue_msgsnd - Smack access check for msg_queue 3235 * @isp: the object 3236 * @msg: unused 3237 * @msqflg: access requested 3238 * 3239 * Returns 0 if current has the requested access, error code otherwise 3240 */ 3241 static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg, 3242 int msqflg) 3243 { 3244 int may; 3245 3246 may = smack_flags_to_may(msqflg); 3247 return smk_curacc_msq(isp, may); 3248 } 3249 3250 /** 3251 * smack_msg_queue_msgsnd - Smack access check for msg_queue 3252 * @isp: the object 3253 * @msg: unused 3254 * @target: unused 3255 * @type: unused 3256 * @mode: unused 3257 * 3258 * Returns 0 if current has read and write access, error code otherwise 3259 */ 3260 static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp, struct msg_msg *msg, 3261 struct task_struct *target, long type, int mode) 3262 { 3263 return smk_curacc_msq(isp, MAY_READWRITE); 3264 } 3265 3266 /** 3267 * smack_ipc_permission - Smack access for ipc_permission() 3268 * @ipp: the object permissions 3269 * @flag: access requested 3270 * 3271 * Returns 0 if current has read and write access, error code otherwise 3272 */ 3273 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 3274 { 3275 struct smack_known *iskp = ipp->security; 3276 int may = smack_flags_to_may(flag); 3277 struct smk_audit_info ad; 3278 int rc; 3279 3280 #ifdef CONFIG_AUDIT 3281 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 3282 ad.a.u.ipc_id = ipp->id; 3283 #endif 3284 rc = smk_curacc(iskp, may, &ad); 3285 rc = smk_bu_current("svipc", iskp, may, rc); 3286 return rc; 3287 } 3288 3289 /** 3290 * smack_ipc_getsecid - Extract smack security id 3291 * @ipp: the object permissions 3292 * @secid: where result will be saved 3293 */ 3294 static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid) 3295 { 3296 struct smack_known *iskp = ipp->security; 3297 3298 *secid = iskp->smk_secid; 3299 } 3300 3301 /** 3302 * smack_d_instantiate - Make sure the blob is correct on an inode 3303 * @opt_dentry: dentry where inode will be attached 3304 * @inode: the object 3305 * 3306 * Set the inode's security blob if it hasn't been done already. 3307 */ 3308 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) 3309 { 3310 struct super_block *sbp; 3311 struct superblock_smack *sbsp; 3312 struct inode_smack *isp; 3313 struct smack_known *skp; 3314 struct smack_known *ckp = smk_of_current(); 3315 struct smack_known *final; 3316 char trattr[TRANS_TRUE_SIZE]; 3317 int transflag = 0; 3318 int rc; 3319 struct dentry *dp; 3320 3321 if (inode == NULL) 3322 return; 3323 3324 isp = inode->i_security; 3325 3326 mutex_lock(&isp->smk_lock); 3327 /* 3328 * If the inode is already instantiated 3329 * take the quick way out 3330 */ 3331 if (isp->smk_flags & SMK_INODE_INSTANT) 3332 goto unlockandout; 3333 3334 sbp = inode->i_sb; 3335 sbsp = sbp->s_security; 3336 /* 3337 * We're going to use the superblock default label 3338 * if there's no label on the file. 3339 */ 3340 final = sbsp->smk_default; 3341 3342 /* 3343 * If this is the root inode the superblock 3344 * may be in the process of initialization. 3345 * If that is the case use the root value out 3346 * of the superblock. 3347 */ 3348 if (opt_dentry->d_parent == opt_dentry) { 3349 switch (sbp->s_magic) { 3350 case CGROUP_SUPER_MAGIC: 3351 /* 3352 * The cgroup filesystem is never mounted, 3353 * so there's no opportunity to set the mount 3354 * options. 3355 */ 3356 sbsp->smk_root = &smack_known_star; 3357 sbsp->smk_default = &smack_known_star; 3358 isp->smk_inode = sbsp->smk_root; 3359 break; 3360 case TMPFS_MAGIC: 3361 /* 3362 * What about shmem/tmpfs anonymous files with dentry 3363 * obtained from d_alloc_pseudo()? 3364 */ 3365 isp->smk_inode = smk_of_current(); 3366 break; 3367 case PIPEFS_MAGIC: 3368 isp->smk_inode = smk_of_current(); 3369 break; 3370 case SOCKFS_MAGIC: 3371 /* 3372 * Socket access is controlled by the socket 3373 * structures associated with the task involved. 3374 */ 3375 isp->smk_inode = &smack_known_star; 3376 break; 3377 default: 3378 isp->smk_inode = sbsp->smk_root; 3379 break; 3380 } 3381 isp->smk_flags |= SMK_INODE_INSTANT; 3382 goto unlockandout; 3383 } 3384 3385 /* 3386 * This is pretty hackish. 3387 * Casey says that we shouldn't have to do 3388 * file system specific code, but it does help 3389 * with keeping it simple. 3390 */ 3391 switch (sbp->s_magic) { 3392 case SMACK_MAGIC: 3393 case CGROUP_SUPER_MAGIC: 3394 /* 3395 * Casey says that it's a little embarrassing 3396 * that the smack file system doesn't do 3397 * extended attributes. 3398 * 3399 * Cgroupfs is special 3400 */ 3401 final = &smack_known_star; 3402 break; 3403 case DEVPTS_SUPER_MAGIC: 3404 /* 3405 * devpts seems content with the label of the task. 3406 * Programs that change smack have to treat the 3407 * pty with respect. 3408 */ 3409 final = ckp; 3410 break; 3411 case PROC_SUPER_MAGIC: 3412 /* 3413 * Casey says procfs appears not to care. 3414 * The superblock default suffices. 3415 */ 3416 break; 3417 case TMPFS_MAGIC: 3418 /* 3419 * Device labels should come from the filesystem, 3420 * but watch out, because they're volitile, 3421 * getting recreated on every reboot. 3422 */ 3423 final = &smack_known_star; 3424 /* 3425 * No break. 3426 * 3427 * If a smack value has been set we want to use it, 3428 * but since tmpfs isn't giving us the opportunity 3429 * to set mount options simulate setting the 3430 * superblock default. 3431 */ 3432 default: 3433 /* 3434 * This isn't an understood special case. 3435 * Get the value from the xattr. 3436 */ 3437 3438 /* 3439 * UNIX domain sockets use lower level socket data. 3440 */ 3441 if (S_ISSOCK(inode->i_mode)) { 3442 final = &smack_known_star; 3443 break; 3444 } 3445 /* 3446 * No xattr support means, alas, no SMACK label. 3447 * Use the aforeapplied default. 3448 * It would be curious if the label of the task 3449 * does not match that assigned. 3450 */ 3451 if (!(inode->i_opflags & IOP_XATTR)) 3452 break; 3453 /* 3454 * Get the dentry for xattr. 3455 */ 3456 dp = dget(opt_dentry); 3457 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp); 3458 if (!IS_ERR_OR_NULL(skp)) 3459 final = skp; 3460 3461 /* 3462 * Transmuting directory 3463 */ 3464 if (S_ISDIR(inode->i_mode)) { 3465 /* 3466 * If this is a new directory and the label was 3467 * transmuted when the inode was initialized 3468 * set the transmute attribute on the directory 3469 * and mark the inode. 3470 * 3471 * If there is a transmute attribute on the 3472 * directory mark the inode. 3473 */ 3474 if (isp->smk_flags & SMK_INODE_CHANGED) { 3475 isp->smk_flags &= ~SMK_INODE_CHANGED; 3476 rc = __vfs_setxattr(dp, inode, 3477 XATTR_NAME_SMACKTRANSMUTE, 3478 TRANS_TRUE, TRANS_TRUE_SIZE, 3479 0); 3480 } else { 3481 rc = __vfs_getxattr(dp, inode, 3482 XATTR_NAME_SMACKTRANSMUTE, trattr, 3483 TRANS_TRUE_SIZE); 3484 if (rc >= 0 && strncmp(trattr, TRANS_TRUE, 3485 TRANS_TRUE_SIZE) != 0) 3486 rc = -EINVAL; 3487 } 3488 if (rc >= 0) 3489 transflag = SMK_INODE_TRANSMUTE; 3490 } 3491 /* 3492 * Don't let the exec or mmap label be "*" or "@". 3493 */ 3494 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); 3495 if (IS_ERR(skp) || skp == &smack_known_star || 3496 skp == &smack_known_web) 3497 skp = NULL; 3498 isp->smk_task = skp; 3499 3500 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); 3501 if (IS_ERR(skp) || skp == &smack_known_star || 3502 skp == &smack_known_web) 3503 skp = NULL; 3504 isp->smk_mmap = skp; 3505 3506 dput(dp); 3507 break; 3508 } 3509 3510 if (final == NULL) 3511 isp->smk_inode = ckp; 3512 else 3513 isp->smk_inode = final; 3514 3515 isp->smk_flags |= (SMK_INODE_INSTANT | transflag); 3516 3517 unlockandout: 3518 mutex_unlock(&isp->smk_lock); 3519 return; 3520 } 3521 3522 /** 3523 * smack_getprocattr - Smack process attribute access 3524 * @p: the object task 3525 * @name: the name of the attribute in /proc/.../attr 3526 * @value: where to put the result 3527 * 3528 * Places a copy of the task Smack into value 3529 * 3530 * Returns the length of the smack label or an error code 3531 */ 3532 static int smack_getprocattr(struct task_struct *p, char *name, char **value) 3533 { 3534 struct smack_known *skp = smk_of_task_struct(p); 3535 char *cp; 3536 int slen; 3537 3538 if (strcmp(name, "current") != 0) 3539 return -EINVAL; 3540 3541 cp = kstrdup(skp->smk_known, GFP_KERNEL); 3542 if (cp == NULL) 3543 return -ENOMEM; 3544 3545 slen = strlen(cp); 3546 *value = cp; 3547 return slen; 3548 } 3549 3550 /** 3551 * smack_setprocattr - Smack process attribute setting 3552 * @name: the name of the attribute in /proc/.../attr 3553 * @value: the value to set 3554 * @size: the size of the value 3555 * 3556 * Sets the Smack value of the task. Only setting self 3557 * is permitted and only with privilege 3558 * 3559 * Returns the length of the smack label or an error code 3560 */ 3561 static int smack_setprocattr(const char *name, void *value, size_t size) 3562 { 3563 struct task_smack *tsp = current_security(); 3564 struct cred *new; 3565 struct smack_known *skp; 3566 struct smack_known_list_elem *sklep; 3567 int rc; 3568 3569 if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel)) 3570 return -EPERM; 3571 3572 if (value == NULL || size == 0 || size >= SMK_LONGLABEL) 3573 return -EINVAL; 3574 3575 if (strcmp(name, "current") != 0) 3576 return -EINVAL; 3577 3578 skp = smk_import_entry(value, size); 3579 if (IS_ERR(skp)) 3580 return PTR_ERR(skp); 3581 3582 /* 3583 * No process is ever allowed the web ("@") label 3584 * and the star ("*") label. 3585 */ 3586 if (skp == &smack_known_web || skp == &smack_known_star) 3587 return -EINVAL; 3588 3589 if (!smack_privileged(CAP_MAC_ADMIN)) { 3590 rc = -EPERM; 3591 list_for_each_entry(sklep, &tsp->smk_relabel, list) 3592 if (sklep->smk_label == skp) { 3593 rc = 0; 3594 break; 3595 } 3596 if (rc) 3597 return rc; 3598 } 3599 3600 new = prepare_creds(); 3601 if (new == NULL) 3602 return -ENOMEM; 3603 3604 tsp = new->security; 3605 tsp->smk_task = skp; 3606 /* 3607 * process can change its label only once 3608 */ 3609 smk_destroy_label_list(&tsp->smk_relabel); 3610 3611 commit_creds(new); 3612 return size; 3613 } 3614 3615 /** 3616 * smack_unix_stream_connect - Smack access on UDS 3617 * @sock: one sock 3618 * @other: the other sock 3619 * @newsk: unused 3620 * 3621 * Return 0 if a subject with the smack of sock could access 3622 * an object with the smack of other, otherwise an error code 3623 */ 3624 static int smack_unix_stream_connect(struct sock *sock, 3625 struct sock *other, struct sock *newsk) 3626 { 3627 struct smack_known *skp; 3628 struct smack_known *okp; 3629 struct socket_smack *ssp = sock->sk_security; 3630 struct socket_smack *osp = other->sk_security; 3631 struct socket_smack *nsp = newsk->sk_security; 3632 struct smk_audit_info ad; 3633 int rc = 0; 3634 #ifdef CONFIG_AUDIT 3635 struct lsm_network_audit net; 3636 #endif 3637 3638 if (!smack_privileged(CAP_MAC_OVERRIDE)) { 3639 skp = ssp->smk_out; 3640 okp = osp->smk_in; 3641 #ifdef CONFIG_AUDIT 3642 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3643 smk_ad_setfield_u_net_sk(&ad, other); 3644 #endif 3645 rc = smk_access(skp, okp, MAY_WRITE, &ad); 3646 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc); 3647 if (rc == 0) { 3648 okp = osp->smk_out; 3649 skp = ssp->smk_in; 3650 rc = smk_access(okp, skp, MAY_WRITE, &ad); 3651 rc = smk_bu_note("UDS connect", okp, skp, 3652 MAY_WRITE, rc); 3653 } 3654 } 3655 3656 /* 3657 * Cross reference the peer labels for SO_PEERSEC. 3658 */ 3659 if (rc == 0) { 3660 nsp->smk_packet = ssp->smk_out; 3661 ssp->smk_packet = osp->smk_out; 3662 } 3663 3664 return rc; 3665 } 3666 3667 /** 3668 * smack_unix_may_send - Smack access on UDS 3669 * @sock: one socket 3670 * @other: the other socket 3671 * 3672 * Return 0 if a subject with the smack of sock could access 3673 * an object with the smack of other, otherwise an error code 3674 */ 3675 static int smack_unix_may_send(struct socket *sock, struct socket *other) 3676 { 3677 struct socket_smack *ssp = sock->sk->sk_security; 3678 struct socket_smack *osp = other->sk->sk_security; 3679 struct smk_audit_info ad; 3680 int rc; 3681 3682 #ifdef CONFIG_AUDIT 3683 struct lsm_network_audit net; 3684 3685 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3686 smk_ad_setfield_u_net_sk(&ad, other->sk); 3687 #endif 3688 3689 if (smack_privileged(CAP_MAC_OVERRIDE)) 3690 return 0; 3691 3692 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad); 3693 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc); 3694 return rc; 3695 } 3696 3697 /** 3698 * smack_socket_sendmsg - Smack check based on destination host 3699 * @sock: the socket 3700 * @msg: the message 3701 * @size: the size of the message 3702 * 3703 * Return 0 if the current subject can write to the destination host. 3704 * For IPv4 this is only a question if the destination is a single label host. 3705 * For IPv6 this is a check against the label of the port. 3706 */ 3707 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, 3708 int size) 3709 { 3710 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name; 3711 #if IS_ENABLED(CONFIG_IPV6) 3712 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name; 3713 #endif 3714 #ifdef SMACK_IPV6_SECMARK_LABELING 3715 struct socket_smack *ssp = sock->sk->sk_security; 3716 struct smack_known *rsp; 3717 #endif 3718 int rc = 0; 3719 3720 /* 3721 * Perfectly reasonable for this to be NULL 3722 */ 3723 if (sip == NULL) 3724 return 0; 3725 3726 switch (sock->sk->sk_family) { 3727 case AF_INET: 3728 rc = smack_netlabel_send(sock->sk, sip); 3729 break; 3730 case AF_INET6: 3731 #ifdef SMACK_IPV6_SECMARK_LABELING 3732 rsp = smack_ipv6host_label(sap); 3733 if (rsp != NULL) 3734 rc = smk_ipv6_check(ssp->smk_out, rsp, sap, 3735 SMK_CONNECTING); 3736 #endif 3737 #ifdef SMACK_IPV6_PORT_LABELING 3738 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING); 3739 #endif 3740 break; 3741 } 3742 return rc; 3743 } 3744 3745 /** 3746 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack 3747 * @sap: netlabel secattr 3748 * @ssp: socket security information 3749 * 3750 * Returns a pointer to a Smack label entry found on the label list. 3751 */ 3752 static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap, 3753 struct socket_smack *ssp) 3754 { 3755 struct smack_known *skp; 3756 int found = 0; 3757 int acat; 3758 int kcat; 3759 3760 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) { 3761 /* 3762 * Looks like a CIPSO packet. 3763 * If there are flags but no level netlabel isn't 3764 * behaving the way we expect it to. 3765 * 3766 * Look it up in the label table 3767 * Without guidance regarding the smack value 3768 * for the packet fall back on the network 3769 * ambient value. 3770 */ 3771 rcu_read_lock(); 3772 list_for_each_entry_rcu(skp, &smack_known_list, list) { 3773 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl) 3774 continue; 3775 /* 3776 * Compare the catsets. Use the netlbl APIs. 3777 */ 3778 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) { 3779 if ((skp->smk_netlabel.flags & 3780 NETLBL_SECATTR_MLS_CAT) == 0) 3781 found = 1; 3782 break; 3783 } 3784 for (acat = -1, kcat = -1; acat == kcat; ) { 3785 acat = netlbl_catmap_walk(sap->attr.mls.cat, 3786 acat + 1); 3787 kcat = netlbl_catmap_walk( 3788 skp->smk_netlabel.attr.mls.cat, 3789 kcat + 1); 3790 if (acat < 0 || kcat < 0) 3791 break; 3792 } 3793 if (acat == kcat) { 3794 found = 1; 3795 break; 3796 } 3797 } 3798 rcu_read_unlock(); 3799 3800 if (found) 3801 return skp; 3802 3803 if (ssp != NULL && ssp->smk_in == &smack_known_star) 3804 return &smack_known_web; 3805 return &smack_known_star; 3806 } 3807 if ((sap->flags & NETLBL_SECATTR_SECID) != 0) 3808 /* 3809 * Looks like a fallback, which gives us a secid. 3810 */ 3811 return smack_from_secid(sap->attr.secid); 3812 /* 3813 * Without guidance regarding the smack value 3814 * for the packet fall back on the network 3815 * ambient value. 3816 */ 3817 return smack_net_ambient; 3818 } 3819 3820 #if IS_ENABLED(CONFIG_IPV6) 3821 static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) 3822 { 3823 u8 nexthdr; 3824 int offset; 3825 int proto = -EINVAL; 3826 struct ipv6hdr _ipv6h; 3827 struct ipv6hdr *ip6; 3828 __be16 frag_off; 3829 struct tcphdr _tcph, *th; 3830 struct udphdr _udph, *uh; 3831 struct dccp_hdr _dccph, *dh; 3832 3833 sip->sin6_port = 0; 3834 3835 offset = skb_network_offset(skb); 3836 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 3837 if (ip6 == NULL) 3838 return -EINVAL; 3839 sip->sin6_addr = ip6->saddr; 3840 3841 nexthdr = ip6->nexthdr; 3842 offset += sizeof(_ipv6h); 3843 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 3844 if (offset < 0) 3845 return -EINVAL; 3846 3847 proto = nexthdr; 3848 switch (proto) { 3849 case IPPROTO_TCP: 3850 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 3851 if (th != NULL) 3852 sip->sin6_port = th->source; 3853 break; 3854 case IPPROTO_UDP: 3855 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 3856 if (uh != NULL) 3857 sip->sin6_port = uh->source; 3858 break; 3859 case IPPROTO_DCCP: 3860 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 3861 if (dh != NULL) 3862 sip->sin6_port = dh->dccph_sport; 3863 break; 3864 } 3865 return proto; 3866 } 3867 #endif /* CONFIG_IPV6 */ 3868 3869 /** 3870 * smack_socket_sock_rcv_skb - Smack packet delivery access check 3871 * @sk: socket 3872 * @skb: packet 3873 * 3874 * Returns 0 if the packet should be delivered, an error code otherwise 3875 */ 3876 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 3877 { 3878 struct netlbl_lsm_secattr secattr; 3879 struct socket_smack *ssp = sk->sk_security; 3880 struct smack_known *skp = NULL; 3881 int rc = 0; 3882 struct smk_audit_info ad; 3883 #ifdef CONFIG_AUDIT 3884 struct lsm_network_audit net; 3885 #endif 3886 #if IS_ENABLED(CONFIG_IPV6) 3887 struct sockaddr_in6 sadd; 3888 int proto; 3889 #endif /* CONFIG_IPV6 */ 3890 3891 switch (sk->sk_family) { 3892 case PF_INET: 3893 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 3894 /* 3895 * If there is a secmark use it rather than the CIPSO label. 3896 * If there is no secmark fall back to CIPSO. 3897 * The secmark is assumed to reflect policy better. 3898 */ 3899 if (skb && skb->secmark != 0) { 3900 skp = smack_from_secid(skb->secmark); 3901 goto access_check; 3902 } 3903 #endif /* CONFIG_SECURITY_SMACK_NETFILTER */ 3904 /* 3905 * Translate what netlabel gave us. 3906 */ 3907 netlbl_secattr_init(&secattr); 3908 3909 rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr); 3910 if (rc == 0) 3911 skp = smack_from_secattr(&secattr, ssp); 3912 else 3913 skp = smack_net_ambient; 3914 3915 netlbl_secattr_destroy(&secattr); 3916 3917 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 3918 access_check: 3919 #endif 3920 #ifdef CONFIG_AUDIT 3921 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3922 ad.a.u.net->family = sk->sk_family; 3923 ad.a.u.net->netif = skb->skb_iif; 3924 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 3925 #endif 3926 /* 3927 * Receiving a packet requires that the other end 3928 * be able to write here. Read access is not required. 3929 * This is the simplist possible security model 3930 * for networking. 3931 */ 3932 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 3933 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, 3934 MAY_WRITE, rc); 3935 if (rc != 0) 3936 netlbl_skbuff_err(skb, sk->sk_family, rc, 0); 3937 break; 3938 #if IS_ENABLED(CONFIG_IPV6) 3939 case PF_INET6: 3940 proto = smk_skb_to_addr_ipv6(skb, &sadd); 3941 if (proto != IPPROTO_UDP && proto != IPPROTO_TCP) 3942 break; 3943 #ifdef SMACK_IPV6_SECMARK_LABELING 3944 if (skb && skb->secmark != 0) 3945 skp = smack_from_secid(skb->secmark); 3946 else 3947 skp = smack_ipv6host_label(&sadd); 3948 if (skp == NULL) 3949 skp = smack_net_ambient; 3950 #ifdef CONFIG_AUDIT 3951 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3952 ad.a.u.net->family = sk->sk_family; 3953 ad.a.u.net->netif = skb->skb_iif; 3954 ipv6_skb_to_auditdata(skb, &ad.a, NULL); 3955 #endif /* CONFIG_AUDIT */ 3956 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 3957 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in, 3958 MAY_WRITE, rc); 3959 #endif /* SMACK_IPV6_SECMARK_LABELING */ 3960 #ifdef SMACK_IPV6_PORT_LABELING 3961 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING); 3962 #endif /* SMACK_IPV6_PORT_LABELING */ 3963 break; 3964 #endif /* CONFIG_IPV6 */ 3965 } 3966 3967 return rc; 3968 } 3969 3970 /** 3971 * smack_socket_getpeersec_stream - pull in packet label 3972 * @sock: the socket 3973 * @optval: user's destination 3974 * @optlen: size thereof 3975 * @len: max thereof 3976 * 3977 * returns zero on success, an error code otherwise 3978 */ 3979 static int smack_socket_getpeersec_stream(struct socket *sock, 3980 char __user *optval, 3981 int __user *optlen, unsigned len) 3982 { 3983 struct socket_smack *ssp; 3984 char *rcp = ""; 3985 int slen = 1; 3986 int rc = 0; 3987 3988 ssp = sock->sk->sk_security; 3989 if (ssp->smk_packet != NULL) { 3990 rcp = ssp->smk_packet->smk_known; 3991 slen = strlen(rcp) + 1; 3992 } 3993 3994 if (slen > len) 3995 rc = -ERANGE; 3996 else if (copy_to_user(optval, rcp, slen) != 0) 3997 rc = -EFAULT; 3998 3999 if (put_user(slen, optlen) != 0) 4000 rc = -EFAULT; 4001 4002 return rc; 4003 } 4004 4005 4006 /** 4007 * smack_socket_getpeersec_dgram - pull in packet label 4008 * @sock: the peer socket 4009 * @skb: packet data 4010 * @secid: pointer to where to put the secid of the packet 4011 * 4012 * Sets the netlabel socket state on sk from parent 4013 */ 4014 static int smack_socket_getpeersec_dgram(struct socket *sock, 4015 struct sk_buff *skb, u32 *secid) 4016 4017 { 4018 struct netlbl_lsm_secattr secattr; 4019 struct socket_smack *ssp = NULL; 4020 struct smack_known *skp; 4021 int family = PF_UNSPEC; 4022 u32 s = 0; /* 0 is the invalid secid */ 4023 int rc; 4024 4025 if (skb != NULL) { 4026 if (skb->protocol == htons(ETH_P_IP)) 4027 family = PF_INET; 4028 #if IS_ENABLED(CONFIG_IPV6) 4029 else if (skb->protocol == htons(ETH_P_IPV6)) 4030 family = PF_INET6; 4031 #endif /* CONFIG_IPV6 */ 4032 } 4033 if (family == PF_UNSPEC && sock != NULL) 4034 family = sock->sk->sk_family; 4035 4036 switch (family) { 4037 case PF_UNIX: 4038 ssp = sock->sk->sk_security; 4039 s = ssp->smk_out->smk_secid; 4040 break; 4041 case PF_INET: 4042 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 4043 s = skb->secmark; 4044 if (s != 0) 4045 break; 4046 #endif 4047 /* 4048 * Translate what netlabel gave us. 4049 */ 4050 if (sock != NULL && sock->sk != NULL) 4051 ssp = sock->sk->sk_security; 4052 netlbl_secattr_init(&secattr); 4053 rc = netlbl_skbuff_getattr(skb, family, &secattr); 4054 if (rc == 0) { 4055 skp = smack_from_secattr(&secattr, ssp); 4056 s = skp->smk_secid; 4057 } 4058 netlbl_secattr_destroy(&secattr); 4059 break; 4060 case PF_INET6: 4061 #ifdef SMACK_IPV6_SECMARK_LABELING 4062 s = skb->secmark; 4063 #endif 4064 break; 4065 } 4066 *secid = s; 4067 if (s == 0) 4068 return -EINVAL; 4069 return 0; 4070 } 4071 4072 /** 4073 * smack_sock_graft - Initialize a newly created socket with an existing sock 4074 * @sk: child sock 4075 * @parent: parent socket 4076 * 4077 * Set the smk_{in,out} state of an existing sock based on the process that 4078 * is creating the new socket. 4079 */ 4080 static void smack_sock_graft(struct sock *sk, struct socket *parent) 4081 { 4082 struct socket_smack *ssp; 4083 struct smack_known *skp = smk_of_current(); 4084 4085 if (sk == NULL || 4086 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)) 4087 return; 4088 4089 ssp = sk->sk_security; 4090 ssp->smk_in = skp; 4091 ssp->smk_out = skp; 4092 /* cssp->smk_packet is already set in smack_inet_csk_clone() */ 4093 } 4094 4095 /** 4096 * smack_inet_conn_request - Smack access check on connect 4097 * @sk: socket involved 4098 * @skb: packet 4099 * @req: unused 4100 * 4101 * Returns 0 if a task with the packet label could write to 4102 * the socket, otherwise an error code 4103 */ 4104 static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, 4105 struct request_sock *req) 4106 { 4107 u16 family = sk->sk_family; 4108 struct smack_known *skp; 4109 struct socket_smack *ssp = sk->sk_security; 4110 struct netlbl_lsm_secattr secattr; 4111 struct sockaddr_in addr; 4112 struct iphdr *hdr; 4113 struct smack_known *hskp; 4114 int rc; 4115 struct smk_audit_info ad; 4116 #ifdef CONFIG_AUDIT 4117 struct lsm_network_audit net; 4118 #endif 4119 4120 #if IS_ENABLED(CONFIG_IPV6) 4121 if (family == PF_INET6) { 4122 /* 4123 * Handle mapped IPv4 packets arriving 4124 * via IPv6 sockets. Don't set up netlabel 4125 * processing on IPv6. 4126 */ 4127 if (skb->protocol == htons(ETH_P_IP)) 4128 family = PF_INET; 4129 else 4130 return 0; 4131 } 4132 #endif /* CONFIG_IPV6 */ 4133 4134 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 4135 /* 4136 * If there is a secmark use it rather than the CIPSO label. 4137 * If there is no secmark fall back to CIPSO. 4138 * The secmark is assumed to reflect policy better. 4139 */ 4140 if (skb && skb->secmark != 0) { 4141 skp = smack_from_secid(skb->secmark); 4142 goto access_check; 4143 } 4144 #endif /* CONFIG_SECURITY_SMACK_NETFILTER */ 4145 4146 netlbl_secattr_init(&secattr); 4147 rc = netlbl_skbuff_getattr(skb, family, &secattr); 4148 if (rc == 0) 4149 skp = smack_from_secattr(&secattr, ssp); 4150 else 4151 skp = &smack_known_huh; 4152 netlbl_secattr_destroy(&secattr); 4153 4154 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 4155 access_check: 4156 #endif 4157 4158 #ifdef CONFIG_AUDIT 4159 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 4160 ad.a.u.net->family = family; 4161 ad.a.u.net->netif = skb->skb_iif; 4162 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 4163 #endif 4164 /* 4165 * Receiving a packet requires that the other end be able to write 4166 * here. Read access is not required. 4167 */ 4168 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad); 4169 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc); 4170 if (rc != 0) 4171 return rc; 4172 4173 /* 4174 * Save the peer's label in the request_sock so we can later setup 4175 * smk_packet in the child socket so that SO_PEERCRED can report it. 4176 */ 4177 req->peer_secid = skp->smk_secid; 4178 4179 /* 4180 * We need to decide if we want to label the incoming connection here 4181 * if we do we only need to label the request_sock and the stack will 4182 * propagate the wire-label to the sock when it is created. 4183 */ 4184 hdr = ip_hdr(skb); 4185 addr.sin_addr.s_addr = hdr->saddr; 4186 rcu_read_lock(); 4187 hskp = smack_ipv4host_label(&addr); 4188 rcu_read_unlock(); 4189 4190 if (hskp == NULL) 4191 rc = netlbl_req_setattr(req, &skp->smk_netlabel); 4192 else 4193 netlbl_req_delattr(req); 4194 4195 return rc; 4196 } 4197 4198 /** 4199 * smack_inet_csk_clone - Copy the connection information to the new socket 4200 * @sk: the new socket 4201 * @req: the connection's request_sock 4202 * 4203 * Transfer the connection's peer label to the newly created socket. 4204 */ 4205 static void smack_inet_csk_clone(struct sock *sk, 4206 const struct request_sock *req) 4207 { 4208 struct socket_smack *ssp = sk->sk_security; 4209 struct smack_known *skp; 4210 4211 if (req->peer_secid != 0) { 4212 skp = smack_from_secid(req->peer_secid); 4213 ssp->smk_packet = skp; 4214 } else 4215 ssp->smk_packet = NULL; 4216 } 4217 4218 /* 4219 * Key management security hooks 4220 * 4221 * Casey has not tested key support very heavily. 4222 * The permission check is most likely too restrictive. 4223 * If you care about keys please have a look. 4224 */ 4225 #ifdef CONFIG_KEYS 4226 4227 /** 4228 * smack_key_alloc - Set the key security blob 4229 * @key: object 4230 * @cred: the credentials to use 4231 * @flags: unused 4232 * 4233 * No allocation required 4234 * 4235 * Returns 0 4236 */ 4237 static int smack_key_alloc(struct key *key, const struct cred *cred, 4238 unsigned long flags) 4239 { 4240 struct smack_known *skp = smk_of_task(cred->security); 4241 4242 key->security = skp; 4243 return 0; 4244 } 4245 4246 /** 4247 * smack_key_free - Clear the key security blob 4248 * @key: the object 4249 * 4250 * Clear the blob pointer 4251 */ 4252 static void smack_key_free(struct key *key) 4253 { 4254 key->security = NULL; 4255 } 4256 4257 /** 4258 * smack_key_permission - Smack access on a key 4259 * @key_ref: gets to the object 4260 * @cred: the credentials to use 4261 * @perm: requested key permissions 4262 * 4263 * Return 0 if the task has read and write to the object, 4264 * an error code otherwise 4265 */ 4266 static int smack_key_permission(key_ref_t key_ref, 4267 const struct cred *cred, unsigned perm) 4268 { 4269 struct key *keyp; 4270 struct smk_audit_info ad; 4271 struct smack_known *tkp = smk_of_task(cred->security); 4272 int request = 0; 4273 int rc; 4274 4275 keyp = key_ref_to_ptr(key_ref); 4276 if (keyp == NULL) 4277 return -EINVAL; 4278 /* 4279 * If the key hasn't been initialized give it access so that 4280 * it may do so. 4281 */ 4282 if (keyp->security == NULL) 4283 return 0; 4284 /* 4285 * This should not occur 4286 */ 4287 if (tkp == NULL) 4288 return -EACCES; 4289 4290 if (smack_privileged_cred(CAP_MAC_OVERRIDE, cred)) 4291 return 0; 4292 4293 #ifdef CONFIG_AUDIT 4294 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 4295 ad.a.u.key_struct.key = keyp->serial; 4296 ad.a.u.key_struct.key_desc = keyp->description; 4297 #endif 4298 if (perm & KEY_NEED_READ) 4299 request = MAY_READ; 4300 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) 4301 request = MAY_WRITE; 4302 rc = smk_access(tkp, keyp->security, request, &ad); 4303 rc = smk_bu_note("key access", tkp, keyp->security, request, rc); 4304 return rc; 4305 } 4306 4307 /* 4308 * smack_key_getsecurity - Smack label tagging the key 4309 * @key points to the key to be queried 4310 * @_buffer points to a pointer that should be set to point to the 4311 * resulting string (if no label or an error occurs). 4312 * Return the length of the string (including terminating NUL) or -ve if 4313 * an error. 4314 * May also return 0 (and a NULL buffer pointer) if there is no label. 4315 */ 4316 static int smack_key_getsecurity(struct key *key, char **_buffer) 4317 { 4318 struct smack_known *skp = key->security; 4319 size_t length; 4320 char *copy; 4321 4322 if (key->security == NULL) { 4323 *_buffer = NULL; 4324 return 0; 4325 } 4326 4327 copy = kstrdup(skp->smk_known, GFP_KERNEL); 4328 if (copy == NULL) 4329 return -ENOMEM; 4330 length = strlen(copy) + 1; 4331 4332 *_buffer = copy; 4333 return length; 4334 } 4335 4336 #endif /* CONFIG_KEYS */ 4337 4338 /* 4339 * Smack Audit hooks 4340 * 4341 * Audit requires a unique representation of each Smack specific 4342 * rule. This unique representation is used to distinguish the 4343 * object to be audited from remaining kernel objects and also 4344 * works as a glue between the audit hooks. 4345 * 4346 * Since repository entries are added but never deleted, we'll use 4347 * the smack_known label address related to the given audit rule as 4348 * the needed unique representation. This also better fits the smack 4349 * model where nearly everything is a label. 4350 */ 4351 #ifdef CONFIG_AUDIT 4352 4353 /** 4354 * smack_audit_rule_init - Initialize a smack audit rule 4355 * @field: audit rule fields given from user-space (audit.h) 4356 * @op: required testing operator (=, !=, >, <, ...) 4357 * @rulestr: smack label to be audited 4358 * @vrule: pointer to save our own audit rule representation 4359 * 4360 * Prepare to audit cases where (@field @op @rulestr) is true. 4361 * The label to be audited is created if necessay. 4362 */ 4363 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 4364 { 4365 struct smack_known *skp; 4366 char **rule = (char **)vrule; 4367 *rule = NULL; 4368 4369 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4370 return -EINVAL; 4371 4372 if (op != Audit_equal && op != Audit_not_equal) 4373 return -EINVAL; 4374 4375 skp = smk_import_entry(rulestr, 0); 4376 if (IS_ERR(skp)) 4377 return PTR_ERR(skp); 4378 4379 *rule = skp->smk_known; 4380 4381 return 0; 4382 } 4383 4384 /** 4385 * smack_audit_rule_known - Distinguish Smack audit rules 4386 * @krule: rule of interest, in Audit kernel representation format 4387 * 4388 * This is used to filter Smack rules from remaining Audit ones. 4389 * If it's proved that this rule belongs to us, the 4390 * audit_rule_match hook will be called to do the final judgement. 4391 */ 4392 static int smack_audit_rule_known(struct audit_krule *krule) 4393 { 4394 struct audit_field *f; 4395 int i; 4396 4397 for (i = 0; i < krule->field_count; i++) { 4398 f = &krule->fields[i]; 4399 4400 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER) 4401 return 1; 4402 } 4403 4404 return 0; 4405 } 4406 4407 /** 4408 * smack_audit_rule_match - Audit given object ? 4409 * @secid: security id for identifying the object to test 4410 * @field: audit rule flags given from user-space 4411 * @op: required testing operator 4412 * @vrule: smack internal rule presentation 4413 * @actx: audit context associated with the check 4414 * 4415 * The core Audit hook. It's used to take the decision of 4416 * whether to audit or not to audit a given object. 4417 */ 4418 static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule, 4419 struct audit_context *actx) 4420 { 4421 struct smack_known *skp; 4422 char *rule = vrule; 4423 4424 if (unlikely(!rule)) { 4425 WARN_ONCE(1, "Smack: missing rule\n"); 4426 return -ENOENT; 4427 } 4428 4429 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 4430 return 0; 4431 4432 skp = smack_from_secid(secid); 4433 4434 /* 4435 * No need to do string comparisons. If a match occurs, 4436 * both pointers will point to the same smack_known 4437 * label. 4438 */ 4439 if (op == Audit_equal) 4440 return (rule == skp->smk_known); 4441 if (op == Audit_not_equal) 4442 return (rule != skp->smk_known); 4443 4444 return 0; 4445 } 4446 4447 /* 4448 * There is no need for a smack_audit_rule_free hook. 4449 * No memory was allocated. 4450 */ 4451 4452 #endif /* CONFIG_AUDIT */ 4453 4454 /** 4455 * smack_ismaclabel - check if xattr @name references a smack MAC label 4456 * @name: Full xattr name to check. 4457 */ 4458 static int smack_ismaclabel(const char *name) 4459 { 4460 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); 4461 } 4462 4463 4464 /** 4465 * smack_secid_to_secctx - return the smack label for a secid 4466 * @secid: incoming integer 4467 * @secdata: destination 4468 * @seclen: how long it is 4469 * 4470 * Exists for networking code. 4471 */ 4472 static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 4473 { 4474 struct smack_known *skp = smack_from_secid(secid); 4475 4476 if (secdata) 4477 *secdata = skp->smk_known; 4478 *seclen = strlen(skp->smk_known); 4479 return 0; 4480 } 4481 4482 /** 4483 * smack_secctx_to_secid - return the secid for a smack label 4484 * @secdata: smack label 4485 * @seclen: how long result is 4486 * @secid: outgoing integer 4487 * 4488 * Exists for audit and networking code. 4489 */ 4490 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 4491 { 4492 struct smack_known *skp = smk_find_entry(secdata); 4493 4494 if (skp) 4495 *secid = skp->smk_secid; 4496 else 4497 *secid = 0; 4498 return 0; 4499 } 4500 4501 /* 4502 * There used to be a smack_release_secctx hook 4503 * that did nothing back when hooks were in a vector. 4504 * Now that there's a list such a hook adds cost. 4505 */ 4506 4507 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 4508 { 4509 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0); 4510 } 4511 4512 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 4513 { 4514 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0); 4515 } 4516 4517 static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 4518 { 4519 int len = 0; 4520 len = smack_inode_getsecurity(inode, XATTR_SMACK_SUFFIX, ctx, true); 4521 4522 if (len < 0) 4523 return len; 4524 *ctxlen = len; 4525 return 0; 4526 } 4527 4528 static int smack_inode_copy_up(struct dentry *dentry, struct cred **new) 4529 { 4530 4531 struct task_smack *tsp; 4532 struct smack_known *skp; 4533 struct inode_smack *isp; 4534 struct cred *new_creds = *new; 4535 4536 if (new_creds == NULL) { 4537 new_creds = prepare_creds(); 4538 if (new_creds == NULL) 4539 return -ENOMEM; 4540 } 4541 4542 tsp = new_creds->security; 4543 4544 /* 4545 * Get label from overlay inode and set it in create_sid 4546 */ 4547 isp = d_inode(dentry->d_parent)->i_security; 4548 skp = isp->smk_inode; 4549 tsp->smk_task = skp; 4550 *new = new_creds; 4551 return 0; 4552 } 4553 4554 static int smack_inode_copy_up_xattr(const char *name) 4555 { 4556 /* 4557 * Return 1 if this is the smack access Smack attribute. 4558 */ 4559 if (strcmp(name, XATTR_NAME_SMACK) == 0) 4560 return 1; 4561 4562 return -EOPNOTSUPP; 4563 } 4564 4565 static int smack_dentry_create_files_as(struct dentry *dentry, int mode, 4566 struct qstr *name, 4567 const struct cred *old, 4568 struct cred *new) 4569 { 4570 struct task_smack *otsp = old->security; 4571 struct task_smack *ntsp = new->security; 4572 struct inode_smack *isp; 4573 int may; 4574 4575 /* 4576 * Use the process credential unless all of 4577 * the transmuting criteria are met 4578 */ 4579 ntsp->smk_task = otsp->smk_task; 4580 4581 /* 4582 * the attribute of the containing directory 4583 */ 4584 isp = d_inode(dentry->d_parent)->i_security; 4585 4586 if (isp->smk_flags & SMK_INODE_TRANSMUTE) { 4587 rcu_read_lock(); 4588 may = smk_access_entry(otsp->smk_task->smk_known, 4589 isp->smk_inode->smk_known, 4590 &otsp->smk_task->smk_rules); 4591 rcu_read_unlock(); 4592 4593 /* 4594 * If the directory is transmuting and the rule 4595 * providing access is transmuting use the containing 4596 * directory label instead of the process label. 4597 */ 4598 if (may > 0 && (may & MAY_TRANSMUTE)) 4599 ntsp->smk_task = isp->smk_inode; 4600 } 4601 return 0; 4602 } 4603 4604 static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { 4605 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), 4606 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), 4607 LSM_HOOK_INIT(syslog, smack_syslog), 4608 4609 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security), 4610 LSM_HOOK_INIT(sb_free_security, smack_sb_free_security), 4611 LSM_HOOK_INIT(sb_copy_data, smack_sb_copy_data), 4612 LSM_HOOK_INIT(sb_kern_mount, smack_sb_kern_mount), 4613 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs), 4614 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts), 4615 LSM_HOOK_INIT(sb_parse_opts_str, smack_parse_opts_str), 4616 4617 LSM_HOOK_INIT(bprm_set_creds, smack_bprm_set_creds), 4618 4619 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security), 4620 LSM_HOOK_INIT(inode_free_security, smack_inode_free_security), 4621 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security), 4622 LSM_HOOK_INIT(inode_link, smack_inode_link), 4623 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink), 4624 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir), 4625 LSM_HOOK_INIT(inode_rename, smack_inode_rename), 4626 LSM_HOOK_INIT(inode_permission, smack_inode_permission), 4627 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr), 4628 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr), 4629 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr), 4630 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr), 4631 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr), 4632 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr), 4633 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity), 4634 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity), 4635 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity), 4636 LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid), 4637 4638 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security), 4639 LSM_HOOK_INIT(file_free_security, smack_file_free_security), 4640 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl), 4641 LSM_HOOK_INIT(file_lock, smack_file_lock), 4642 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl), 4643 LSM_HOOK_INIT(mmap_file, smack_mmap_file), 4644 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr), 4645 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner), 4646 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask), 4647 LSM_HOOK_INIT(file_receive, smack_file_receive), 4648 4649 LSM_HOOK_INIT(file_open, smack_file_open), 4650 4651 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank), 4652 LSM_HOOK_INIT(cred_free, smack_cred_free), 4653 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare), 4654 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer), 4655 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as), 4656 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as), 4657 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid), 4658 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid), 4659 LSM_HOOK_INIT(task_getsid, smack_task_getsid), 4660 LSM_HOOK_INIT(task_getsecid, smack_task_getsecid), 4661 LSM_HOOK_INIT(task_setnice, smack_task_setnice), 4662 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio), 4663 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio), 4664 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler), 4665 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler), 4666 LSM_HOOK_INIT(task_movememory, smack_task_movememory), 4667 LSM_HOOK_INIT(task_kill, smack_task_kill), 4668 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode), 4669 4670 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission), 4671 LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid), 4672 4673 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security), 4674 LSM_HOOK_INIT(msg_msg_free_security, smack_msg_msg_free_security), 4675 4676 LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security), 4677 LSM_HOOK_INIT(msg_queue_free_security, smack_ipc_free_security), 4678 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate), 4679 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl), 4680 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd), 4681 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv), 4682 4683 LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security), 4684 LSM_HOOK_INIT(shm_free_security, smack_ipc_free_security), 4685 LSM_HOOK_INIT(shm_associate, smack_shm_associate), 4686 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl), 4687 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat), 4688 4689 LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security), 4690 LSM_HOOK_INIT(sem_free_security, smack_ipc_free_security), 4691 LSM_HOOK_INIT(sem_associate, smack_sem_associate), 4692 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl), 4693 LSM_HOOK_INIT(sem_semop, smack_sem_semop), 4694 4695 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate), 4696 4697 LSM_HOOK_INIT(getprocattr, smack_getprocattr), 4698 LSM_HOOK_INIT(setprocattr, smack_setprocattr), 4699 4700 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect), 4701 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send), 4702 4703 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create), 4704 #ifdef SMACK_IPV6_PORT_LABELING 4705 LSM_HOOK_INIT(socket_bind, smack_socket_bind), 4706 #endif 4707 LSM_HOOK_INIT(socket_connect, smack_socket_connect), 4708 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg), 4709 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb), 4710 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream), 4711 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram), 4712 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), 4713 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), 4714 LSM_HOOK_INIT(sock_graft, smack_sock_graft), 4715 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), 4716 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone), 4717 4718 /* key management security hooks */ 4719 #ifdef CONFIG_KEYS 4720 LSM_HOOK_INIT(key_alloc, smack_key_alloc), 4721 LSM_HOOK_INIT(key_free, smack_key_free), 4722 LSM_HOOK_INIT(key_permission, smack_key_permission), 4723 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity), 4724 #endif /* CONFIG_KEYS */ 4725 4726 /* Audit hooks */ 4727 #ifdef CONFIG_AUDIT 4728 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init), 4729 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known), 4730 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match), 4731 #endif /* CONFIG_AUDIT */ 4732 4733 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel), 4734 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), 4735 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), 4736 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), 4737 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), 4738 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), 4739 LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up), 4740 LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr), 4741 LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as), 4742 }; 4743 4744 4745 static __init void init_smack_known_list(void) 4746 { 4747 /* 4748 * Initialize rule list locks 4749 */ 4750 mutex_init(&smack_known_huh.smk_rules_lock); 4751 mutex_init(&smack_known_hat.smk_rules_lock); 4752 mutex_init(&smack_known_floor.smk_rules_lock); 4753 mutex_init(&smack_known_star.smk_rules_lock); 4754 mutex_init(&smack_known_web.smk_rules_lock); 4755 /* 4756 * Initialize rule lists 4757 */ 4758 INIT_LIST_HEAD(&smack_known_huh.smk_rules); 4759 INIT_LIST_HEAD(&smack_known_hat.smk_rules); 4760 INIT_LIST_HEAD(&smack_known_star.smk_rules); 4761 INIT_LIST_HEAD(&smack_known_floor.smk_rules); 4762 INIT_LIST_HEAD(&smack_known_web.smk_rules); 4763 /* 4764 * Create the known labels list 4765 */ 4766 smk_insert_entry(&smack_known_huh); 4767 smk_insert_entry(&smack_known_hat); 4768 smk_insert_entry(&smack_known_star); 4769 smk_insert_entry(&smack_known_floor); 4770 smk_insert_entry(&smack_known_web); 4771 } 4772 4773 /** 4774 * smack_init - initialize the smack system 4775 * 4776 * Returns 0 4777 */ 4778 static __init int smack_init(void) 4779 { 4780 struct cred *cred; 4781 struct task_smack *tsp; 4782 4783 if (!security_module_enable("smack")) 4784 return 0; 4785 4786 smack_inode_cache = KMEM_CACHE(inode_smack, 0); 4787 if (!smack_inode_cache) 4788 return -ENOMEM; 4789 4790 tsp = new_task_smack(&smack_known_floor, &smack_known_floor, 4791 GFP_KERNEL); 4792 if (tsp == NULL) { 4793 kmem_cache_destroy(smack_inode_cache); 4794 return -ENOMEM; 4795 } 4796 4797 smack_enabled = 1; 4798 4799 pr_info("Smack: Initializing.\n"); 4800 #ifdef CONFIG_SECURITY_SMACK_NETFILTER 4801 pr_info("Smack: Netfilter enabled.\n"); 4802 #endif 4803 #ifdef SMACK_IPV6_PORT_LABELING 4804 pr_info("Smack: IPv6 port labeling enabled.\n"); 4805 #endif 4806 #ifdef SMACK_IPV6_SECMARK_LABELING 4807 pr_info("Smack: IPv6 Netfilter enabled.\n"); 4808 #endif 4809 4810 /* 4811 * Set the security state for the initial task. 4812 */ 4813 cred = (struct cred *) current->cred; 4814 cred->security = tsp; 4815 4816 /* initialize the smack_known_list */ 4817 init_smack_known_list(); 4818 4819 /* 4820 * Register with LSM 4821 */ 4822 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack"); 4823 4824 return 0; 4825 } 4826 4827 /* 4828 * Smack requires early initialization in order to label 4829 * all processes and objects when they are created. 4830 */ 4831 security_initcall(smack_init); 4832