1 /* 2 * Simplified MAC Kernel (smack) security module 3 * 4 * This file contains the smack hook function implementations. 5 * 6 * Authors: 7 * Casey Schaufler <casey@schaufler-ca.com> 8 * Jarkko Sakkinen <ext-jarkko.2.sakkinen@nokia.com> 9 * 10 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> 11 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P. 12 * Paul Moore <paul.moore@hp.com> 13 * Copyright (C) 2010 Nokia Corporation 14 * 15 * This program is free software; you can redistribute it and/or modify 16 * it under the terms of the GNU General Public License version 2, 17 * as published by the Free Software Foundation. 18 */ 19 20 #include <linux/xattr.h> 21 #include <linux/pagemap.h> 22 #include <linux/mount.h> 23 #include <linux/stat.h> 24 #include <linux/kd.h> 25 #include <asm/ioctls.h> 26 #include <linux/ip.h> 27 #include <linux/tcp.h> 28 #include <linux/udp.h> 29 #include <linux/slab.h> 30 #include <linux/mutex.h> 31 #include <linux/pipe_fs_i.h> 32 #include <net/netlabel.h> 33 #include <net/cipso_ipv4.h> 34 #include <linux/audit.h> 35 #include <linux/magic.h> 36 #include <linux/dcache.h> 37 #include "smack.h" 38 39 #define task_security(task) (task_cred_xxx((task), security)) 40 41 #define TRANS_TRUE "TRUE" 42 #define TRANS_TRUE_SIZE 4 43 44 /** 45 * smk_fetch - Fetch the smack label from a file. 46 * @ip: a pointer to the inode 47 * @dp: a pointer to the dentry 48 * 49 * Returns a pointer to the master list entry for the Smack label 50 * or NULL if there was no label to fetch. 51 */ 52 static char *smk_fetch(const char *name, struct inode *ip, struct dentry *dp) 53 { 54 int rc; 55 char in[SMK_LABELLEN]; 56 57 if (ip->i_op->getxattr == NULL) 58 return NULL; 59 60 rc = ip->i_op->getxattr(dp, name, in, SMK_LABELLEN); 61 if (rc < 0) 62 return NULL; 63 64 return smk_import(in, rc); 65 } 66 67 /** 68 * new_inode_smack - allocate an inode security blob 69 * @smack: a pointer to the Smack label to use in the blob 70 * 71 * Returns the new blob or NULL if there's no memory available 72 */ 73 struct inode_smack *new_inode_smack(char *smack) 74 { 75 struct inode_smack *isp; 76 77 isp = kzalloc(sizeof(struct inode_smack), GFP_KERNEL); 78 if (isp == NULL) 79 return NULL; 80 81 isp->smk_inode = smack; 82 isp->smk_flags = 0; 83 mutex_init(&isp->smk_lock); 84 85 return isp; 86 } 87 88 /** 89 * new_task_smack - allocate a task security blob 90 * @smack: a pointer to the Smack label to use in the blob 91 * 92 * Returns the new blob or NULL if there's no memory available 93 */ 94 static struct task_smack *new_task_smack(char *task, char *forked, gfp_t gfp) 95 { 96 struct task_smack *tsp; 97 98 tsp = kzalloc(sizeof(struct task_smack), gfp); 99 if (tsp == NULL) 100 return NULL; 101 102 tsp->smk_task = task; 103 tsp->smk_forked = forked; 104 INIT_LIST_HEAD(&tsp->smk_rules); 105 mutex_init(&tsp->smk_rules_lock); 106 107 return tsp; 108 } 109 110 /** 111 * smk_copy_rules - copy a rule set 112 * @nhead - new rules header pointer 113 * @ohead - old rules header pointer 114 * 115 * Returns 0 on success, -ENOMEM on error 116 */ 117 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead, 118 gfp_t gfp) 119 { 120 struct smack_rule *nrp; 121 struct smack_rule *orp; 122 int rc = 0; 123 124 INIT_LIST_HEAD(nhead); 125 126 list_for_each_entry_rcu(orp, ohead, list) { 127 nrp = kzalloc(sizeof(struct smack_rule), gfp); 128 if (nrp == NULL) { 129 rc = -ENOMEM; 130 break; 131 } 132 *nrp = *orp; 133 list_add_rcu(&nrp->list, nhead); 134 } 135 return rc; 136 } 137 138 /* 139 * LSM hooks. 140 * We he, that is fun! 141 */ 142 143 /** 144 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH 145 * @ctp: child task pointer 146 * @mode: ptrace attachment mode 147 * 148 * Returns 0 if access is OK, an error code otherwise 149 * 150 * Do the capability checks, and require read and write. 151 */ 152 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) 153 { 154 int rc; 155 struct smk_audit_info ad; 156 char *tsp; 157 158 rc = cap_ptrace_access_check(ctp, mode); 159 if (rc != 0) 160 return rc; 161 162 tsp = smk_of_task(task_security(ctp)); 163 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 164 smk_ad_setfield_u_tsk(&ad, ctp); 165 166 rc = smk_curacc(tsp, MAY_READWRITE, &ad); 167 return rc; 168 } 169 170 /** 171 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME 172 * @ptp: parent task pointer 173 * 174 * Returns 0 if access is OK, an error code otherwise 175 * 176 * Do the capability checks, and require read and write. 177 */ 178 static int smack_ptrace_traceme(struct task_struct *ptp) 179 { 180 int rc; 181 struct smk_audit_info ad; 182 char *tsp; 183 184 rc = cap_ptrace_traceme(ptp); 185 if (rc != 0) 186 return rc; 187 188 tsp = smk_of_task(task_security(ptp)); 189 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 190 smk_ad_setfield_u_tsk(&ad, ptp); 191 192 rc = smk_curacc(tsp, MAY_READWRITE, &ad); 193 return rc; 194 } 195 196 /** 197 * smack_syslog - Smack approval on syslog 198 * @type: message type 199 * 200 * Require that the task has the floor label 201 * 202 * Returns 0 on success, error code otherwise. 203 */ 204 static int smack_syslog(int typefrom_file) 205 { 206 int rc = 0; 207 char *sp = smk_of_current(); 208 209 if (capable(CAP_MAC_OVERRIDE)) 210 return 0; 211 212 if (sp != smack_known_floor.smk_known) 213 rc = -EACCES; 214 215 return rc; 216 } 217 218 219 /* 220 * Superblock Hooks. 221 */ 222 223 /** 224 * smack_sb_alloc_security - allocate a superblock blob 225 * @sb: the superblock getting the blob 226 * 227 * Returns 0 on success or -ENOMEM on error. 228 */ 229 static int smack_sb_alloc_security(struct super_block *sb) 230 { 231 struct superblock_smack *sbsp; 232 233 sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL); 234 235 if (sbsp == NULL) 236 return -ENOMEM; 237 238 sbsp->smk_root = smack_known_floor.smk_known; 239 sbsp->smk_default = smack_known_floor.smk_known; 240 sbsp->smk_floor = smack_known_floor.smk_known; 241 sbsp->smk_hat = smack_known_hat.smk_known; 242 sbsp->smk_initialized = 0; 243 spin_lock_init(&sbsp->smk_sblock); 244 245 sb->s_security = sbsp; 246 247 return 0; 248 } 249 250 /** 251 * smack_sb_free_security - free a superblock blob 252 * @sb: the superblock getting the blob 253 * 254 */ 255 static void smack_sb_free_security(struct super_block *sb) 256 { 257 kfree(sb->s_security); 258 sb->s_security = NULL; 259 } 260 261 /** 262 * smack_sb_copy_data - copy mount options data for processing 263 * @orig: where to start 264 * @smackopts: mount options string 265 * 266 * Returns 0 on success or -ENOMEM on error. 267 * 268 * Copy the Smack specific mount options out of the mount 269 * options list. 270 */ 271 static int smack_sb_copy_data(char *orig, char *smackopts) 272 { 273 char *cp, *commap, *otheropts, *dp; 274 275 otheropts = (char *)get_zeroed_page(GFP_KERNEL); 276 if (otheropts == NULL) 277 return -ENOMEM; 278 279 for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) { 280 if (strstr(cp, SMK_FSDEFAULT) == cp) 281 dp = smackopts; 282 else if (strstr(cp, SMK_FSFLOOR) == cp) 283 dp = smackopts; 284 else if (strstr(cp, SMK_FSHAT) == cp) 285 dp = smackopts; 286 else if (strstr(cp, SMK_FSROOT) == cp) 287 dp = smackopts; 288 else 289 dp = otheropts; 290 291 commap = strchr(cp, ','); 292 if (commap != NULL) 293 *commap = '\0'; 294 295 if (*dp != '\0') 296 strcat(dp, ","); 297 strcat(dp, cp); 298 } 299 300 strcpy(orig, otheropts); 301 free_page((unsigned long)otheropts); 302 303 return 0; 304 } 305 306 /** 307 * smack_sb_kern_mount - Smack specific mount processing 308 * @sb: the file system superblock 309 * @flags: the mount flags 310 * @data: the smack mount options 311 * 312 * Returns 0 on success, an error code on failure 313 */ 314 static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data) 315 { 316 struct dentry *root = sb->s_root; 317 struct inode *inode = root->d_inode; 318 struct superblock_smack *sp = sb->s_security; 319 struct inode_smack *isp; 320 char *op; 321 char *commap; 322 char *nsp; 323 324 spin_lock(&sp->smk_sblock); 325 if (sp->smk_initialized != 0) { 326 spin_unlock(&sp->smk_sblock); 327 return 0; 328 } 329 sp->smk_initialized = 1; 330 spin_unlock(&sp->smk_sblock); 331 332 for (op = data; op != NULL; op = commap) { 333 commap = strchr(op, ','); 334 if (commap != NULL) 335 *commap++ = '\0'; 336 337 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) { 338 op += strlen(SMK_FSHAT); 339 nsp = smk_import(op, 0); 340 if (nsp != NULL) 341 sp->smk_hat = nsp; 342 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) { 343 op += strlen(SMK_FSFLOOR); 344 nsp = smk_import(op, 0); 345 if (nsp != NULL) 346 sp->smk_floor = nsp; 347 } else if (strncmp(op, SMK_FSDEFAULT, 348 strlen(SMK_FSDEFAULT)) == 0) { 349 op += strlen(SMK_FSDEFAULT); 350 nsp = smk_import(op, 0); 351 if (nsp != NULL) 352 sp->smk_default = nsp; 353 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) { 354 op += strlen(SMK_FSROOT); 355 nsp = smk_import(op, 0); 356 if (nsp != NULL) 357 sp->smk_root = nsp; 358 } 359 } 360 361 /* 362 * Initialize the root inode. 363 */ 364 isp = inode->i_security; 365 if (isp == NULL) 366 inode->i_security = new_inode_smack(sp->smk_root); 367 else 368 isp->smk_inode = sp->smk_root; 369 370 return 0; 371 } 372 373 /** 374 * smack_sb_statfs - Smack check on statfs 375 * @dentry: identifies the file system in question 376 * 377 * Returns 0 if current can read the floor of the filesystem, 378 * and error code otherwise 379 */ 380 static int smack_sb_statfs(struct dentry *dentry) 381 { 382 struct superblock_smack *sbp = dentry->d_sb->s_security; 383 int rc; 384 struct smk_audit_info ad; 385 386 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 387 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 388 389 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 390 return rc; 391 } 392 393 /** 394 * smack_sb_mount - Smack check for mounting 395 * @dev_name: unused 396 * @path: mount point 397 * @type: unused 398 * @flags: unused 399 * @data: unused 400 * 401 * Returns 0 if current can write the floor of the filesystem 402 * being mounted on, an error code otherwise. 403 */ 404 static int smack_sb_mount(char *dev_name, struct path *path, 405 char *type, unsigned long flags, void *data) 406 { 407 struct superblock_smack *sbp = path->mnt->mnt_sb->s_security; 408 struct smk_audit_info ad; 409 410 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 411 smk_ad_setfield_u_fs_path(&ad, *path); 412 413 return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad); 414 } 415 416 /** 417 * smack_sb_umount - Smack check for unmounting 418 * @mnt: file system to unmount 419 * @flags: unused 420 * 421 * Returns 0 if current can write the floor of the filesystem 422 * being unmounted, an error code otherwise. 423 */ 424 static int smack_sb_umount(struct vfsmount *mnt, int flags) 425 { 426 struct superblock_smack *sbp; 427 struct smk_audit_info ad; 428 struct path path; 429 430 path.dentry = mnt->mnt_root; 431 path.mnt = mnt; 432 433 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 434 smk_ad_setfield_u_fs_path(&ad, path); 435 436 sbp = mnt->mnt_sb->s_security; 437 return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad); 438 } 439 440 /* 441 * BPRM hooks 442 */ 443 444 static int smack_bprm_set_creds(struct linux_binprm *bprm) 445 { 446 struct task_smack *tsp = bprm->cred->security; 447 struct inode_smack *isp; 448 struct dentry *dp; 449 int rc; 450 451 rc = cap_bprm_set_creds(bprm); 452 if (rc != 0) 453 return rc; 454 455 if (bprm->cred_prepared) 456 return 0; 457 458 if (bprm->file == NULL || bprm->file->f_dentry == NULL) 459 return 0; 460 461 dp = bprm->file->f_dentry; 462 463 if (dp->d_inode == NULL) 464 return 0; 465 466 isp = dp->d_inode->i_security; 467 468 if (isp->smk_task != NULL) 469 tsp->smk_task = isp->smk_task; 470 471 return 0; 472 } 473 474 /* 475 * Inode hooks 476 */ 477 478 /** 479 * smack_inode_alloc_security - allocate an inode blob 480 * @inode: the inode in need of a blob 481 * 482 * Returns 0 if it gets a blob, -ENOMEM otherwise 483 */ 484 static int smack_inode_alloc_security(struct inode *inode) 485 { 486 inode->i_security = new_inode_smack(smk_of_current()); 487 if (inode->i_security == NULL) 488 return -ENOMEM; 489 return 0; 490 } 491 492 /** 493 * smack_inode_free_security - free an inode blob 494 * @inode: the inode with a blob 495 * 496 * Clears the blob pointer in inode 497 */ 498 static void smack_inode_free_security(struct inode *inode) 499 { 500 kfree(inode->i_security); 501 inode->i_security = NULL; 502 } 503 504 /** 505 * smack_inode_init_security - copy out the smack from an inode 506 * @inode: the inode 507 * @dir: unused 508 * @qstr: unused 509 * @name: where to put the attribute name 510 * @value: where to put the attribute value 511 * @len: where to put the length of the attribute 512 * 513 * Returns 0 if it all works out, -ENOMEM if there's no memory 514 */ 515 static int smack_inode_init_security(struct inode *inode, struct inode *dir, 516 const struct qstr *qstr, char **name, 517 void **value, size_t *len) 518 { 519 char *isp = smk_of_inode(inode); 520 char *dsp = smk_of_inode(dir); 521 int may; 522 523 if (name) { 524 *name = kstrdup(XATTR_SMACK_SUFFIX, GFP_KERNEL); 525 if (*name == NULL) 526 return -ENOMEM; 527 } 528 529 if (value) { 530 rcu_read_lock(); 531 may = smk_access_entry(smk_of_current(), dsp, &smack_rule_list); 532 rcu_read_unlock(); 533 534 /* 535 * If the access rule allows transmutation and 536 * the directory requests transmutation then 537 * by all means transmute. 538 */ 539 if (may > 0 && ((may & MAY_TRANSMUTE) != 0) && 540 smk_inode_transmutable(dir)) 541 isp = dsp; 542 543 *value = kstrdup(isp, GFP_KERNEL); 544 if (*value == NULL) 545 return -ENOMEM; 546 } 547 548 if (len) 549 *len = strlen(isp) + 1; 550 551 return 0; 552 } 553 554 /** 555 * smack_inode_link - Smack check on link 556 * @old_dentry: the existing object 557 * @dir: unused 558 * @new_dentry: the new object 559 * 560 * Returns 0 if access is permitted, an error code otherwise 561 */ 562 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, 563 struct dentry *new_dentry) 564 { 565 char *isp; 566 struct smk_audit_info ad; 567 int rc; 568 569 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 570 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 571 572 isp = smk_of_inode(old_dentry->d_inode); 573 rc = smk_curacc(isp, MAY_WRITE, &ad); 574 575 if (rc == 0 && new_dentry->d_inode != NULL) { 576 isp = smk_of_inode(new_dentry->d_inode); 577 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 578 rc = smk_curacc(isp, MAY_WRITE, &ad); 579 } 580 581 return rc; 582 } 583 584 /** 585 * smack_inode_unlink - Smack check on inode deletion 586 * @dir: containing directory object 587 * @dentry: file to unlink 588 * 589 * Returns 0 if current can write the containing directory 590 * and the object, error code otherwise 591 */ 592 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry) 593 { 594 struct inode *ip = dentry->d_inode; 595 struct smk_audit_info ad; 596 int rc; 597 598 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 599 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 600 601 /* 602 * You need write access to the thing you're unlinking 603 */ 604 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 605 if (rc == 0) { 606 /* 607 * You also need write access to the containing directory 608 */ 609 smk_ad_setfield_u_fs_path_dentry(&ad, NULL); 610 smk_ad_setfield_u_fs_inode(&ad, dir); 611 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 612 } 613 return rc; 614 } 615 616 /** 617 * smack_inode_rmdir - Smack check on directory deletion 618 * @dir: containing directory object 619 * @dentry: directory to unlink 620 * 621 * Returns 0 if current can write the containing directory 622 * and the directory, error code otherwise 623 */ 624 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry) 625 { 626 struct smk_audit_info ad; 627 int rc; 628 629 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 630 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 631 632 /* 633 * You need write access to the thing you're removing 634 */ 635 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 636 if (rc == 0) { 637 /* 638 * You also need write access to the containing directory 639 */ 640 smk_ad_setfield_u_fs_path_dentry(&ad, NULL); 641 smk_ad_setfield_u_fs_inode(&ad, dir); 642 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 643 } 644 645 return rc; 646 } 647 648 /** 649 * smack_inode_rename - Smack check on rename 650 * @old_inode: the old directory 651 * @old_dentry: unused 652 * @new_inode: the new directory 653 * @new_dentry: unused 654 * 655 * Read and write access is required on both the old and 656 * new directories. 657 * 658 * Returns 0 if access is permitted, an error code otherwise 659 */ 660 static int smack_inode_rename(struct inode *old_inode, 661 struct dentry *old_dentry, 662 struct inode *new_inode, 663 struct dentry *new_dentry) 664 { 665 int rc; 666 char *isp; 667 struct smk_audit_info ad; 668 669 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 670 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry); 671 672 isp = smk_of_inode(old_dentry->d_inode); 673 rc = smk_curacc(isp, MAY_READWRITE, &ad); 674 675 if (rc == 0 && new_dentry->d_inode != NULL) { 676 isp = smk_of_inode(new_dentry->d_inode); 677 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 678 rc = smk_curacc(isp, MAY_READWRITE, &ad); 679 } 680 return rc; 681 } 682 683 /** 684 * smack_inode_permission - Smack version of permission() 685 * @inode: the inode in question 686 * @mask: the access requested 687 * 688 * This is the important Smack hook. 689 * 690 * Returns 0 if access is permitted, -EACCES otherwise 691 */ 692 static int smack_inode_permission(struct inode *inode, int mask, unsigned flags) 693 { 694 struct smk_audit_info ad; 695 696 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 697 /* 698 * No permission to check. Existence test. Yup, it's there. 699 */ 700 if (mask == 0) 701 return 0; 702 703 /* May be droppable after audit */ 704 if (flags & IPERM_FLAG_RCU) 705 return -ECHILD; 706 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 707 smk_ad_setfield_u_fs_inode(&ad, inode); 708 return smk_curacc(smk_of_inode(inode), mask, &ad); 709 } 710 711 /** 712 * smack_inode_setattr - Smack check for setting attributes 713 * @dentry: the object 714 * @iattr: for the force flag 715 * 716 * Returns 0 if access is permitted, an error code otherwise 717 */ 718 static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) 719 { 720 struct smk_audit_info ad; 721 /* 722 * Need to allow for clearing the setuid bit. 723 */ 724 if (iattr->ia_valid & ATTR_FORCE) 725 return 0; 726 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 727 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 728 729 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 730 } 731 732 /** 733 * smack_inode_getattr - Smack check for getting attributes 734 * @mnt: unused 735 * @dentry: the object 736 * 737 * Returns 0 if access is permitted, an error code otherwise 738 */ 739 static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) 740 { 741 struct smk_audit_info ad; 742 struct path path; 743 744 path.dentry = dentry; 745 path.mnt = mnt; 746 747 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 748 smk_ad_setfield_u_fs_path(&ad, path); 749 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 750 } 751 752 /** 753 * smack_inode_setxattr - Smack check for setting xattrs 754 * @dentry: the object 755 * @name: name of the attribute 756 * @value: unused 757 * @size: unused 758 * @flags: unused 759 * 760 * This protects the Smack attribute explicitly. 761 * 762 * Returns 0 if access is permitted, an error code otherwise 763 */ 764 static int smack_inode_setxattr(struct dentry *dentry, const char *name, 765 const void *value, size_t size, int flags) 766 { 767 struct smk_audit_info ad; 768 int rc = 0; 769 770 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 771 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 772 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 773 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 774 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 775 if (!capable(CAP_MAC_ADMIN)) 776 rc = -EPERM; 777 /* 778 * check label validity here so import wont fail on 779 * post_setxattr 780 */ 781 if (size == 0 || size >= SMK_LABELLEN || 782 smk_import(value, size) == NULL) 783 rc = -EINVAL; 784 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) { 785 if (!capable(CAP_MAC_ADMIN)) 786 rc = -EPERM; 787 if (size != TRANS_TRUE_SIZE || 788 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0) 789 rc = -EINVAL; 790 } else 791 rc = cap_inode_setxattr(dentry, name, value, size, flags); 792 793 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 794 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 795 796 if (rc == 0) 797 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 798 799 return rc; 800 } 801 802 /** 803 * smack_inode_post_setxattr - Apply the Smack update approved above 804 * @dentry: object 805 * @name: attribute name 806 * @value: attribute value 807 * @size: attribute size 808 * @flags: unused 809 * 810 * Set the pointer in the inode blob to the entry found 811 * in the master label list. 812 */ 813 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name, 814 const void *value, size_t size, int flags) 815 { 816 char *nsp; 817 struct inode_smack *isp = dentry->d_inode->i_security; 818 819 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 820 nsp = smk_import(value, size); 821 if (nsp != NULL) 822 isp->smk_inode = nsp; 823 else 824 isp->smk_inode = smack_known_invalid.smk_known; 825 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 826 nsp = smk_import(value, size); 827 if (nsp != NULL) 828 isp->smk_task = nsp; 829 else 830 isp->smk_task = smack_known_invalid.smk_known; 831 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { 832 nsp = smk_import(value, size); 833 if (nsp != NULL) 834 isp->smk_mmap = nsp; 835 else 836 isp->smk_mmap = smack_known_invalid.smk_known; 837 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) 838 isp->smk_flags |= SMK_INODE_TRANSMUTE; 839 840 return; 841 } 842 843 /* 844 * smack_inode_getxattr - Smack check on getxattr 845 * @dentry: the object 846 * @name: unused 847 * 848 * Returns 0 if access is permitted, an error code otherwise 849 */ 850 static int smack_inode_getxattr(struct dentry *dentry, const char *name) 851 { 852 struct smk_audit_info ad; 853 854 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 855 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 856 857 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 858 } 859 860 /* 861 * smack_inode_removexattr - Smack check on removexattr 862 * @dentry: the object 863 * @name: name of the attribute 864 * 865 * Removing the Smack attribute requires CAP_MAC_ADMIN 866 * 867 * Returns 0 if access is permitted, an error code otherwise 868 */ 869 static int smack_inode_removexattr(struct dentry *dentry, const char *name) 870 { 871 struct inode_smack *isp; 872 struct smk_audit_info ad; 873 int rc = 0; 874 875 if (strcmp(name, XATTR_NAME_SMACK) == 0 || 876 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 || 877 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 || 878 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 || 879 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 || 880 strcmp(name, XATTR_NAME_SMACKMMAP)) { 881 if (!capable(CAP_MAC_ADMIN)) 882 rc = -EPERM; 883 } else 884 rc = cap_inode_removexattr(dentry, name); 885 886 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 887 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 888 if (rc == 0) 889 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 890 891 if (rc == 0) { 892 isp = dentry->d_inode->i_security; 893 isp->smk_task = NULL; 894 isp->smk_mmap = NULL; 895 } 896 897 return rc; 898 } 899 900 /** 901 * smack_inode_getsecurity - get smack xattrs 902 * @inode: the object 903 * @name: attribute name 904 * @buffer: where to put the result 905 * @alloc: unused 906 * 907 * Returns the size of the attribute or an error code 908 */ 909 static int smack_inode_getsecurity(const struct inode *inode, 910 const char *name, void **buffer, 911 bool alloc) 912 { 913 struct socket_smack *ssp; 914 struct socket *sock; 915 struct super_block *sbp; 916 struct inode *ip = (struct inode *)inode; 917 char *isp; 918 int ilen; 919 int rc = 0; 920 921 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 922 isp = smk_of_inode(inode); 923 ilen = strlen(isp) + 1; 924 *buffer = isp; 925 return ilen; 926 } 927 928 /* 929 * The rest of the Smack xattrs are only on sockets. 930 */ 931 sbp = ip->i_sb; 932 if (sbp->s_magic != SOCKFS_MAGIC) 933 return -EOPNOTSUPP; 934 935 sock = SOCKET_I(ip); 936 if (sock == NULL || sock->sk == NULL) 937 return -EOPNOTSUPP; 938 939 ssp = sock->sk->sk_security; 940 941 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 942 isp = ssp->smk_in; 943 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 944 isp = ssp->smk_out; 945 else 946 return -EOPNOTSUPP; 947 948 ilen = strlen(isp) + 1; 949 if (rc == 0) { 950 *buffer = isp; 951 rc = ilen; 952 } 953 954 return rc; 955 } 956 957 958 /** 959 * smack_inode_listsecurity - list the Smack attributes 960 * @inode: the object 961 * @buffer: where they go 962 * @buffer_size: size of buffer 963 * 964 * Returns 0 on success, -EINVAL otherwise 965 */ 966 static int smack_inode_listsecurity(struct inode *inode, char *buffer, 967 size_t buffer_size) 968 { 969 int len = strlen(XATTR_NAME_SMACK); 970 971 if (buffer != NULL && len <= buffer_size) { 972 memcpy(buffer, XATTR_NAME_SMACK, len); 973 return len; 974 } 975 return -EINVAL; 976 } 977 978 /** 979 * smack_inode_getsecid - Extract inode's security id 980 * @inode: inode to extract the info from 981 * @secid: where result will be saved 982 */ 983 static void smack_inode_getsecid(const struct inode *inode, u32 *secid) 984 { 985 struct inode_smack *isp = inode->i_security; 986 987 *secid = smack_to_secid(isp->smk_inode); 988 } 989 990 /* 991 * File Hooks 992 */ 993 994 /** 995 * smack_file_permission - Smack check on file operations 996 * @file: unused 997 * @mask: unused 998 * 999 * Returns 0 1000 * 1001 * Should access checks be done on each read or write? 1002 * UNICOS and SELinux say yes. 1003 * Trusted Solaris, Trusted Irix, and just about everyone else says no. 1004 * 1005 * I'll say no for now. Smack does not do the frequent 1006 * label changing that SELinux does. 1007 */ 1008 static int smack_file_permission(struct file *file, int mask) 1009 { 1010 return 0; 1011 } 1012 1013 /** 1014 * smack_file_alloc_security - assign a file security blob 1015 * @file: the object 1016 * 1017 * The security blob for a file is a pointer to the master 1018 * label list, so no allocation is done. 1019 * 1020 * Returns 0 1021 */ 1022 static int smack_file_alloc_security(struct file *file) 1023 { 1024 file->f_security = smk_of_current(); 1025 return 0; 1026 } 1027 1028 /** 1029 * smack_file_free_security - clear a file security blob 1030 * @file: the object 1031 * 1032 * The security blob for a file is a pointer to the master 1033 * label list, so no memory is freed. 1034 */ 1035 static void smack_file_free_security(struct file *file) 1036 { 1037 file->f_security = NULL; 1038 } 1039 1040 /** 1041 * smack_file_ioctl - Smack check on ioctls 1042 * @file: the object 1043 * @cmd: what to do 1044 * @arg: unused 1045 * 1046 * Relies heavily on the correct use of the ioctl command conventions. 1047 * 1048 * Returns 0 if allowed, error code otherwise 1049 */ 1050 static int smack_file_ioctl(struct file *file, unsigned int cmd, 1051 unsigned long arg) 1052 { 1053 int rc = 0; 1054 struct smk_audit_info ad; 1055 1056 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1057 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1058 1059 if (_IOC_DIR(cmd) & _IOC_WRITE) 1060 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1061 1062 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) 1063 rc = smk_curacc(file->f_security, MAY_READ, &ad); 1064 1065 return rc; 1066 } 1067 1068 /** 1069 * smack_file_lock - Smack check on file locking 1070 * @file: the object 1071 * @cmd: unused 1072 * 1073 * Returns 0 if current has write access, error code otherwise 1074 */ 1075 static int smack_file_lock(struct file *file, unsigned int cmd) 1076 { 1077 struct smk_audit_info ad; 1078 1079 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1080 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1081 return smk_curacc(file->f_security, MAY_WRITE, &ad); 1082 } 1083 1084 /** 1085 * smack_file_fcntl - Smack check on fcntl 1086 * @file: the object 1087 * @cmd: what action to check 1088 * @arg: unused 1089 * 1090 * Returns 0 if current has access, error code otherwise 1091 */ 1092 static int smack_file_fcntl(struct file *file, unsigned int cmd, 1093 unsigned long arg) 1094 { 1095 struct smk_audit_info ad; 1096 int rc; 1097 1098 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1099 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1100 1101 switch (cmd) { 1102 case F_DUPFD: 1103 case F_GETFD: 1104 case F_GETFL: 1105 case F_GETLK: 1106 case F_GETOWN: 1107 case F_GETSIG: 1108 rc = smk_curacc(file->f_security, MAY_READ, &ad); 1109 break; 1110 case F_SETFD: 1111 case F_SETFL: 1112 case F_SETLK: 1113 case F_SETLKW: 1114 case F_SETOWN: 1115 case F_SETSIG: 1116 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1117 break; 1118 default: 1119 rc = smk_curacc(file->f_security, MAY_READWRITE, &ad); 1120 } 1121 1122 return rc; 1123 } 1124 1125 /** 1126 * smack_file_mmap : 1127 * Check permissions for a mmap operation. The @file may be NULL, e.g. 1128 * if mapping anonymous memory. 1129 * @file contains the file structure for file to map (may be NULL). 1130 * @reqprot contains the protection requested by the application. 1131 * @prot contains the protection that will be applied by the kernel. 1132 * @flags contains the operational flags. 1133 * Return 0 if permission is granted. 1134 */ 1135 static int smack_file_mmap(struct file *file, 1136 unsigned long reqprot, unsigned long prot, 1137 unsigned long flags, unsigned long addr, 1138 unsigned long addr_only) 1139 { 1140 struct smack_rule *srp; 1141 struct task_smack *tsp; 1142 char *sp; 1143 char *msmack; 1144 char *osmack; 1145 struct inode_smack *isp; 1146 struct dentry *dp; 1147 int may; 1148 int mmay; 1149 int tmay; 1150 int rc; 1151 1152 /* do DAC check on address space usage */ 1153 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only); 1154 if (rc || addr_only) 1155 return rc; 1156 1157 if (file == NULL || file->f_dentry == NULL) 1158 return 0; 1159 1160 dp = file->f_dentry; 1161 1162 if (dp->d_inode == NULL) 1163 return 0; 1164 1165 isp = dp->d_inode->i_security; 1166 if (isp->smk_mmap == NULL) 1167 return 0; 1168 msmack = isp->smk_mmap; 1169 1170 tsp = current_security(); 1171 sp = smk_of_current(); 1172 rc = 0; 1173 1174 rcu_read_lock(); 1175 /* 1176 * For each Smack rule associated with the subject 1177 * label verify that the SMACK64MMAP also has access 1178 * to that rule's object label. 1179 * 1180 * Because neither of the labels comes 1181 * from the networking code it is sufficient 1182 * to compare pointers. 1183 */ 1184 list_for_each_entry_rcu(srp, &smack_rule_list, list) { 1185 if (srp->smk_subject != sp) 1186 continue; 1187 1188 osmack = srp->smk_object; 1189 /* 1190 * Matching labels always allows access. 1191 */ 1192 if (msmack == osmack) 1193 continue; 1194 /* 1195 * If there is a matching local rule take 1196 * that into account as well. 1197 */ 1198 may = smk_access_entry(srp->smk_subject, osmack, 1199 &tsp->smk_rules); 1200 if (may == -ENOENT) 1201 may = srp->smk_access; 1202 else 1203 may &= srp->smk_access; 1204 /* 1205 * If may is zero the SMACK64MMAP subject can't 1206 * possibly have less access. 1207 */ 1208 if (may == 0) 1209 continue; 1210 1211 /* 1212 * Fetch the global list entry. 1213 * If there isn't one a SMACK64MMAP subject 1214 * can't have as much access as current. 1215 */ 1216 mmay = smk_access_entry(msmack, osmack, &smack_rule_list); 1217 if (mmay == -ENOENT) { 1218 rc = -EACCES; 1219 break; 1220 } 1221 /* 1222 * If there is a local entry it modifies the 1223 * potential access, too. 1224 */ 1225 tmay = smk_access_entry(msmack, osmack, &tsp->smk_rules); 1226 if (tmay != -ENOENT) 1227 mmay &= tmay; 1228 1229 /* 1230 * If there is any access available to current that is 1231 * not available to a SMACK64MMAP subject 1232 * deny access. 1233 */ 1234 if ((may | mmay) != mmay) { 1235 rc = -EACCES; 1236 break; 1237 } 1238 } 1239 1240 rcu_read_unlock(); 1241 1242 return rc; 1243 } 1244 1245 /** 1246 * smack_file_set_fowner - set the file security blob value 1247 * @file: object in question 1248 * 1249 * Returns 0 1250 * Further research may be required on this one. 1251 */ 1252 static int smack_file_set_fowner(struct file *file) 1253 { 1254 file->f_security = smk_of_current(); 1255 return 0; 1256 } 1257 1258 /** 1259 * smack_file_send_sigiotask - Smack on sigio 1260 * @tsk: The target task 1261 * @fown: the object the signal come from 1262 * @signum: unused 1263 * 1264 * Allow a privileged task to get signals even if it shouldn't 1265 * 1266 * Returns 0 if a subject with the object's smack could 1267 * write to the task, an error code otherwise. 1268 */ 1269 static int smack_file_send_sigiotask(struct task_struct *tsk, 1270 struct fown_struct *fown, int signum) 1271 { 1272 struct file *file; 1273 int rc; 1274 char *tsp = smk_of_task(tsk->cred->security); 1275 struct smk_audit_info ad; 1276 1277 /* 1278 * struct fown_struct is never outside the context of a struct file 1279 */ 1280 file = container_of(fown, struct file, f_owner); 1281 1282 /* we don't log here as rc can be overriden */ 1283 rc = smk_access(file->f_security, tsp, MAY_WRITE, NULL); 1284 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) 1285 rc = 0; 1286 1287 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1288 smk_ad_setfield_u_tsk(&ad, tsk); 1289 smack_log(file->f_security, tsp, MAY_WRITE, rc, &ad); 1290 return rc; 1291 } 1292 1293 /** 1294 * smack_file_receive - Smack file receive check 1295 * @file: the object 1296 * 1297 * Returns 0 if current has access, error code otherwise 1298 */ 1299 static int smack_file_receive(struct file *file) 1300 { 1301 int may = 0; 1302 struct smk_audit_info ad; 1303 1304 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1305 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1306 /* 1307 * This code relies on bitmasks. 1308 */ 1309 if (file->f_mode & FMODE_READ) 1310 may = MAY_READ; 1311 if (file->f_mode & FMODE_WRITE) 1312 may |= MAY_WRITE; 1313 1314 return smk_curacc(file->f_security, may, &ad); 1315 } 1316 1317 /* 1318 * Task hooks 1319 */ 1320 1321 /** 1322 * smack_cred_alloc_blank - "allocate" blank task-level security credentials 1323 * @new: the new credentials 1324 * @gfp: the atomicity of any memory allocations 1325 * 1326 * Prepare a blank set of credentials for modification. This must allocate all 1327 * the memory the LSM module might require such that cred_transfer() can 1328 * complete without error. 1329 */ 1330 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp) 1331 { 1332 struct task_smack *tsp; 1333 1334 tsp = new_task_smack(NULL, NULL, gfp); 1335 if (tsp == NULL) 1336 return -ENOMEM; 1337 1338 cred->security = tsp; 1339 1340 return 0; 1341 } 1342 1343 1344 /** 1345 * smack_cred_free - "free" task-level security credentials 1346 * @cred: the credentials in question 1347 * 1348 */ 1349 static void smack_cred_free(struct cred *cred) 1350 { 1351 struct task_smack *tsp = cred->security; 1352 struct smack_rule *rp; 1353 struct list_head *l; 1354 struct list_head *n; 1355 1356 if (tsp == NULL) 1357 return; 1358 cred->security = NULL; 1359 1360 list_for_each_safe(l, n, &tsp->smk_rules) { 1361 rp = list_entry(l, struct smack_rule, list); 1362 list_del(&rp->list); 1363 kfree(rp); 1364 } 1365 kfree(tsp); 1366 } 1367 1368 /** 1369 * smack_cred_prepare - prepare new set of credentials for modification 1370 * @new: the new credentials 1371 * @old: the original credentials 1372 * @gfp: the atomicity of any memory allocations 1373 * 1374 * Prepare a new set of credentials for modification. 1375 */ 1376 static int smack_cred_prepare(struct cred *new, const struct cred *old, 1377 gfp_t gfp) 1378 { 1379 struct task_smack *old_tsp = old->security; 1380 struct task_smack *new_tsp; 1381 int rc; 1382 1383 new_tsp = new_task_smack(old_tsp->smk_task, old_tsp->smk_task, gfp); 1384 if (new_tsp == NULL) 1385 return -ENOMEM; 1386 1387 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp); 1388 if (rc != 0) 1389 return rc; 1390 1391 new->security = new_tsp; 1392 return 0; 1393 } 1394 1395 /** 1396 * smack_cred_transfer - Transfer the old credentials to the new credentials 1397 * @new: the new credentials 1398 * @old: the original credentials 1399 * 1400 * Fill in a set of blank credentials from another set of credentials. 1401 */ 1402 static void smack_cred_transfer(struct cred *new, const struct cred *old) 1403 { 1404 struct task_smack *old_tsp = old->security; 1405 struct task_smack *new_tsp = new->security; 1406 1407 new_tsp->smk_task = old_tsp->smk_task; 1408 new_tsp->smk_forked = old_tsp->smk_task; 1409 mutex_init(&new_tsp->smk_rules_lock); 1410 INIT_LIST_HEAD(&new_tsp->smk_rules); 1411 1412 1413 /* cbs copy rule list */ 1414 } 1415 1416 /** 1417 * smack_kernel_act_as - Set the subjective context in a set of credentials 1418 * @new: points to the set of credentials to be modified. 1419 * @secid: specifies the security ID to be set 1420 * 1421 * Set the security data for a kernel service. 1422 */ 1423 static int smack_kernel_act_as(struct cred *new, u32 secid) 1424 { 1425 struct task_smack *new_tsp = new->security; 1426 char *smack = smack_from_secid(secid); 1427 1428 if (smack == NULL) 1429 return -EINVAL; 1430 1431 new_tsp->smk_task = smack; 1432 return 0; 1433 } 1434 1435 /** 1436 * smack_kernel_create_files_as - Set the file creation label in a set of creds 1437 * @new: points to the set of credentials to be modified 1438 * @inode: points to the inode to use as a reference 1439 * 1440 * Set the file creation context in a set of credentials to the same 1441 * as the objective context of the specified inode 1442 */ 1443 static int smack_kernel_create_files_as(struct cred *new, 1444 struct inode *inode) 1445 { 1446 struct inode_smack *isp = inode->i_security; 1447 struct task_smack *tsp = new->security; 1448 1449 tsp->smk_forked = isp->smk_inode; 1450 tsp->smk_task = isp->smk_inode; 1451 return 0; 1452 } 1453 1454 /** 1455 * smk_curacc_on_task - helper to log task related access 1456 * @p: the task object 1457 * @access : the access requested 1458 * 1459 * Return 0 if access is permitted 1460 */ 1461 static int smk_curacc_on_task(struct task_struct *p, int access) 1462 { 1463 struct smk_audit_info ad; 1464 1465 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1466 smk_ad_setfield_u_tsk(&ad, p); 1467 return smk_curacc(smk_of_task(task_security(p)), access, &ad); 1468 } 1469 1470 /** 1471 * smack_task_setpgid - Smack check on setting pgid 1472 * @p: the task object 1473 * @pgid: unused 1474 * 1475 * Return 0 if write access is permitted 1476 */ 1477 static int smack_task_setpgid(struct task_struct *p, pid_t pgid) 1478 { 1479 return smk_curacc_on_task(p, MAY_WRITE); 1480 } 1481 1482 /** 1483 * smack_task_getpgid - Smack access check for getpgid 1484 * @p: the object task 1485 * 1486 * Returns 0 if current can read the object task, error code otherwise 1487 */ 1488 static int smack_task_getpgid(struct task_struct *p) 1489 { 1490 return smk_curacc_on_task(p, MAY_READ); 1491 } 1492 1493 /** 1494 * smack_task_getsid - Smack access check for getsid 1495 * @p: the object task 1496 * 1497 * Returns 0 if current can read the object task, error code otherwise 1498 */ 1499 static int smack_task_getsid(struct task_struct *p) 1500 { 1501 return smk_curacc_on_task(p, MAY_READ); 1502 } 1503 1504 /** 1505 * smack_task_getsecid - get the secid of the task 1506 * @p: the object task 1507 * @secid: where to put the result 1508 * 1509 * Sets the secid to contain a u32 version of the smack label. 1510 */ 1511 static void smack_task_getsecid(struct task_struct *p, u32 *secid) 1512 { 1513 *secid = smack_to_secid(smk_of_task(task_security(p))); 1514 } 1515 1516 /** 1517 * smack_task_setnice - Smack check on setting nice 1518 * @p: the task object 1519 * @nice: unused 1520 * 1521 * Return 0 if write access is permitted 1522 */ 1523 static int smack_task_setnice(struct task_struct *p, int nice) 1524 { 1525 int rc; 1526 1527 rc = cap_task_setnice(p, nice); 1528 if (rc == 0) 1529 rc = smk_curacc_on_task(p, MAY_WRITE); 1530 return rc; 1531 } 1532 1533 /** 1534 * smack_task_setioprio - Smack check on setting ioprio 1535 * @p: the task object 1536 * @ioprio: unused 1537 * 1538 * Return 0 if write access is permitted 1539 */ 1540 static int smack_task_setioprio(struct task_struct *p, int ioprio) 1541 { 1542 int rc; 1543 1544 rc = cap_task_setioprio(p, ioprio); 1545 if (rc == 0) 1546 rc = smk_curacc_on_task(p, MAY_WRITE); 1547 return rc; 1548 } 1549 1550 /** 1551 * smack_task_getioprio - Smack check on reading ioprio 1552 * @p: the task object 1553 * 1554 * Return 0 if read access is permitted 1555 */ 1556 static int smack_task_getioprio(struct task_struct *p) 1557 { 1558 return smk_curacc_on_task(p, MAY_READ); 1559 } 1560 1561 /** 1562 * smack_task_setscheduler - Smack check on setting scheduler 1563 * @p: the task object 1564 * @policy: unused 1565 * @lp: unused 1566 * 1567 * Return 0 if read access is permitted 1568 */ 1569 static int smack_task_setscheduler(struct task_struct *p) 1570 { 1571 int rc; 1572 1573 rc = cap_task_setscheduler(p); 1574 if (rc == 0) 1575 rc = smk_curacc_on_task(p, MAY_WRITE); 1576 return rc; 1577 } 1578 1579 /** 1580 * smack_task_getscheduler - Smack check on reading scheduler 1581 * @p: the task object 1582 * 1583 * Return 0 if read access is permitted 1584 */ 1585 static int smack_task_getscheduler(struct task_struct *p) 1586 { 1587 return smk_curacc_on_task(p, MAY_READ); 1588 } 1589 1590 /** 1591 * smack_task_movememory - Smack check on moving memory 1592 * @p: the task object 1593 * 1594 * Return 0 if write access is permitted 1595 */ 1596 static int smack_task_movememory(struct task_struct *p) 1597 { 1598 return smk_curacc_on_task(p, MAY_WRITE); 1599 } 1600 1601 /** 1602 * smack_task_kill - Smack check on signal delivery 1603 * @p: the task object 1604 * @info: unused 1605 * @sig: unused 1606 * @secid: identifies the smack to use in lieu of current's 1607 * 1608 * Return 0 if write access is permitted 1609 * 1610 * The secid behavior is an artifact of an SELinux hack 1611 * in the USB code. Someday it may go away. 1612 */ 1613 static int smack_task_kill(struct task_struct *p, struct siginfo *info, 1614 int sig, u32 secid) 1615 { 1616 struct smk_audit_info ad; 1617 1618 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1619 smk_ad_setfield_u_tsk(&ad, p); 1620 /* 1621 * Sending a signal requires that the sender 1622 * can write the receiver. 1623 */ 1624 if (secid == 0) 1625 return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE, 1626 &ad); 1627 /* 1628 * If the secid isn't 0 we're dealing with some USB IO 1629 * specific behavior. This is not clean. For one thing 1630 * we can't take privilege into account. 1631 */ 1632 return smk_access(smack_from_secid(secid), 1633 smk_of_task(task_security(p)), MAY_WRITE, &ad); 1634 } 1635 1636 /** 1637 * smack_task_wait - Smack access check for waiting 1638 * @p: task to wait for 1639 * 1640 * Returns 0 if current can wait for p, error code otherwise 1641 */ 1642 static int smack_task_wait(struct task_struct *p) 1643 { 1644 struct smk_audit_info ad; 1645 char *sp = smk_of_current(); 1646 char *tsp = smk_of_forked(task_security(p)); 1647 int rc; 1648 1649 /* we don't log here, we can be overriden */ 1650 rc = smk_access(tsp, sp, MAY_WRITE, NULL); 1651 if (rc == 0) 1652 goto out_log; 1653 1654 /* 1655 * Allow the operation to succeed if either task 1656 * has privilege to perform operations that might 1657 * account for the smack labels having gotten to 1658 * be different in the first place. 1659 * 1660 * This breaks the strict subject/object access 1661 * control ideal, taking the object's privilege 1662 * state into account in the decision as well as 1663 * the smack value. 1664 */ 1665 if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE)) 1666 rc = 0; 1667 /* we log only if we didn't get overriden */ 1668 out_log: 1669 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1670 smk_ad_setfield_u_tsk(&ad, p); 1671 smack_log(tsp, sp, MAY_WRITE, rc, &ad); 1672 return rc; 1673 } 1674 1675 /** 1676 * smack_task_to_inode - copy task smack into the inode blob 1677 * @p: task to copy from 1678 * @inode: inode to copy to 1679 * 1680 * Sets the smack pointer in the inode security blob 1681 */ 1682 static void smack_task_to_inode(struct task_struct *p, struct inode *inode) 1683 { 1684 struct inode_smack *isp = inode->i_security; 1685 isp->smk_inode = smk_of_task(task_security(p)); 1686 } 1687 1688 /* 1689 * Socket hooks. 1690 */ 1691 1692 /** 1693 * smack_sk_alloc_security - Allocate a socket blob 1694 * @sk: the socket 1695 * @family: unused 1696 * @gfp_flags: memory allocation flags 1697 * 1698 * Assign Smack pointers to current 1699 * 1700 * Returns 0 on success, -ENOMEM is there's no memory 1701 */ 1702 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) 1703 { 1704 char *csp = smk_of_current(); 1705 struct socket_smack *ssp; 1706 1707 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags); 1708 if (ssp == NULL) 1709 return -ENOMEM; 1710 1711 ssp->smk_in = csp; 1712 ssp->smk_out = csp; 1713 ssp->smk_packet[0] = '\0'; 1714 1715 sk->sk_security = ssp; 1716 1717 return 0; 1718 } 1719 1720 /** 1721 * smack_sk_free_security - Free a socket blob 1722 * @sk: the socket 1723 * 1724 * Clears the blob pointer 1725 */ 1726 static void smack_sk_free_security(struct sock *sk) 1727 { 1728 kfree(sk->sk_security); 1729 } 1730 1731 /** 1732 * smack_host_label - check host based restrictions 1733 * @sip: the object end 1734 * 1735 * looks for host based access restrictions 1736 * 1737 * This version will only be appropriate for really small sets of single label 1738 * hosts. The caller is responsible for ensuring that the RCU read lock is 1739 * taken before calling this function. 1740 * 1741 * Returns the label of the far end or NULL if it's not special. 1742 */ 1743 static char *smack_host_label(struct sockaddr_in *sip) 1744 { 1745 struct smk_netlbladdr *snp; 1746 struct in_addr *siap = &sip->sin_addr; 1747 1748 if (siap->s_addr == 0) 1749 return NULL; 1750 1751 list_for_each_entry_rcu(snp, &smk_netlbladdr_list, list) 1752 /* 1753 * we break after finding the first match because 1754 * the list is sorted from longest to shortest mask 1755 * so we have found the most specific match 1756 */ 1757 if ((&snp->smk_host.sin_addr)->s_addr == 1758 (siap->s_addr & (&snp->smk_mask)->s_addr)) { 1759 /* we have found the special CIPSO option */ 1760 if (snp->smk_label == smack_cipso_option) 1761 return NULL; 1762 return snp->smk_label; 1763 } 1764 1765 return NULL; 1766 } 1767 1768 /** 1769 * smack_set_catset - convert a capset to netlabel mls categories 1770 * @catset: the Smack categories 1771 * @sap: where to put the netlabel categories 1772 * 1773 * Allocates and fills attr.mls.cat 1774 */ 1775 static void smack_set_catset(char *catset, struct netlbl_lsm_secattr *sap) 1776 { 1777 unsigned char *cp; 1778 unsigned char m; 1779 int cat; 1780 int rc; 1781 int byte; 1782 1783 if (!catset) 1784 return; 1785 1786 sap->flags |= NETLBL_SECATTR_MLS_CAT; 1787 sap->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC); 1788 sap->attr.mls.cat->startbit = 0; 1789 1790 for (cat = 1, cp = catset, byte = 0; byte < SMK_LABELLEN; cp++, byte++) 1791 for (m = 0x80; m != 0; m >>= 1, cat++) { 1792 if ((m & *cp) == 0) 1793 continue; 1794 rc = netlbl_secattr_catmap_setbit(sap->attr.mls.cat, 1795 cat, GFP_ATOMIC); 1796 } 1797 } 1798 1799 /** 1800 * smack_to_secattr - fill a secattr from a smack value 1801 * @smack: the smack value 1802 * @nlsp: where the result goes 1803 * 1804 * Casey says that CIPSO is good enough for now. 1805 * It can be used to effect. 1806 * It can also be abused to effect when necessary. 1807 * Apologies to the TSIG group in general and GW in particular. 1808 */ 1809 static void smack_to_secattr(char *smack, struct netlbl_lsm_secattr *nlsp) 1810 { 1811 struct smack_cipso cipso; 1812 int rc; 1813 1814 nlsp->domain = smack; 1815 nlsp->flags = NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; 1816 1817 rc = smack_to_cipso(smack, &cipso); 1818 if (rc == 0) { 1819 nlsp->attr.mls.lvl = cipso.smk_level; 1820 smack_set_catset(cipso.smk_catset, nlsp); 1821 } else { 1822 nlsp->attr.mls.lvl = smack_cipso_direct; 1823 smack_set_catset(smack, nlsp); 1824 } 1825 } 1826 1827 /** 1828 * smack_netlabel - Set the secattr on a socket 1829 * @sk: the socket 1830 * @labeled: socket label scheme 1831 * 1832 * Convert the outbound smack value (smk_out) to a 1833 * secattr and attach it to the socket. 1834 * 1835 * Returns 0 on success or an error code 1836 */ 1837 static int smack_netlabel(struct sock *sk, int labeled) 1838 { 1839 struct socket_smack *ssp = sk->sk_security; 1840 struct netlbl_lsm_secattr secattr; 1841 int rc = 0; 1842 1843 /* 1844 * Usually the netlabel code will handle changing the 1845 * packet labeling based on the label. 1846 * The case of a single label host is different, because 1847 * a single label host should never get a labeled packet 1848 * even though the label is usually associated with a packet 1849 * label. 1850 */ 1851 local_bh_disable(); 1852 bh_lock_sock_nested(sk); 1853 1854 if (ssp->smk_out == smack_net_ambient || 1855 labeled == SMACK_UNLABELED_SOCKET) 1856 netlbl_sock_delattr(sk); 1857 else { 1858 netlbl_secattr_init(&secattr); 1859 smack_to_secattr(ssp->smk_out, &secattr); 1860 rc = netlbl_sock_setattr(sk, sk->sk_family, &secattr); 1861 netlbl_secattr_destroy(&secattr); 1862 } 1863 1864 bh_unlock_sock(sk); 1865 local_bh_enable(); 1866 1867 return rc; 1868 } 1869 1870 /** 1871 * smack_netlbel_send - Set the secattr on a socket and perform access checks 1872 * @sk: the socket 1873 * @sap: the destination address 1874 * 1875 * Set the correct secattr for the given socket based on the destination 1876 * address and perform any outbound access checks needed. 1877 * 1878 * Returns 0 on success or an error code. 1879 * 1880 */ 1881 static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) 1882 { 1883 int rc; 1884 int sk_lbl; 1885 char *hostsp; 1886 struct socket_smack *ssp = sk->sk_security; 1887 struct smk_audit_info ad; 1888 1889 rcu_read_lock(); 1890 hostsp = smack_host_label(sap); 1891 if (hostsp != NULL) { 1892 sk_lbl = SMACK_UNLABELED_SOCKET; 1893 #ifdef CONFIG_AUDIT 1894 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET); 1895 ad.a.u.net.family = sap->sin_family; 1896 ad.a.u.net.dport = sap->sin_port; 1897 ad.a.u.net.v4info.daddr = sap->sin_addr.s_addr; 1898 #endif 1899 rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad); 1900 } else { 1901 sk_lbl = SMACK_CIPSO_SOCKET; 1902 rc = 0; 1903 } 1904 rcu_read_unlock(); 1905 if (rc != 0) 1906 return rc; 1907 1908 return smack_netlabel(sk, sk_lbl); 1909 } 1910 1911 /** 1912 * smack_inode_setsecurity - set smack xattrs 1913 * @inode: the object 1914 * @name: attribute name 1915 * @value: attribute value 1916 * @size: size of the attribute 1917 * @flags: unused 1918 * 1919 * Sets the named attribute in the appropriate blob 1920 * 1921 * Returns 0 on success, or an error code 1922 */ 1923 static int smack_inode_setsecurity(struct inode *inode, const char *name, 1924 const void *value, size_t size, int flags) 1925 { 1926 char *sp; 1927 struct inode_smack *nsp = inode->i_security; 1928 struct socket_smack *ssp; 1929 struct socket *sock; 1930 int rc = 0; 1931 1932 if (value == NULL || size > SMK_LABELLEN || size == 0) 1933 return -EACCES; 1934 1935 sp = smk_import(value, size); 1936 if (sp == NULL) 1937 return -EINVAL; 1938 1939 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 1940 nsp->smk_inode = sp; 1941 nsp->smk_flags |= SMK_INODE_INSTANT; 1942 return 0; 1943 } 1944 /* 1945 * The rest of the Smack xattrs are only on sockets. 1946 */ 1947 if (inode->i_sb->s_magic != SOCKFS_MAGIC) 1948 return -EOPNOTSUPP; 1949 1950 sock = SOCKET_I(inode); 1951 if (sock == NULL || sock->sk == NULL) 1952 return -EOPNOTSUPP; 1953 1954 ssp = sock->sk->sk_security; 1955 1956 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1957 ssp->smk_in = sp; 1958 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) { 1959 ssp->smk_out = sp; 1960 if (sock->sk->sk_family != PF_UNIX) { 1961 rc = smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); 1962 if (rc != 0) 1963 printk(KERN_WARNING 1964 "Smack: \"%s\" netlbl error %d.\n", 1965 __func__, -rc); 1966 } 1967 } else 1968 return -EOPNOTSUPP; 1969 1970 return 0; 1971 } 1972 1973 /** 1974 * smack_socket_post_create - finish socket setup 1975 * @sock: the socket 1976 * @family: protocol family 1977 * @type: unused 1978 * @protocol: unused 1979 * @kern: unused 1980 * 1981 * Sets the netlabel information on the socket 1982 * 1983 * Returns 0 on success, and error code otherwise 1984 */ 1985 static int smack_socket_post_create(struct socket *sock, int family, 1986 int type, int protocol, int kern) 1987 { 1988 if (family != PF_INET || sock->sk == NULL) 1989 return 0; 1990 /* 1991 * Set the outbound netlbl. 1992 */ 1993 return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET); 1994 } 1995 1996 /** 1997 * smack_socket_connect - connect access check 1998 * @sock: the socket 1999 * @sap: the other end 2000 * @addrlen: size of sap 2001 * 2002 * Verifies that a connection may be possible 2003 * 2004 * Returns 0 on success, and error code otherwise 2005 */ 2006 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, 2007 int addrlen) 2008 { 2009 if (sock->sk == NULL || sock->sk->sk_family != PF_INET) 2010 return 0; 2011 if (addrlen < sizeof(struct sockaddr_in)) 2012 return -EINVAL; 2013 2014 return smack_netlabel_send(sock->sk, (struct sockaddr_in *)sap); 2015 } 2016 2017 /** 2018 * smack_flags_to_may - convert S_ to MAY_ values 2019 * @flags: the S_ value 2020 * 2021 * Returns the equivalent MAY_ value 2022 */ 2023 static int smack_flags_to_may(int flags) 2024 { 2025 int may = 0; 2026 2027 if (flags & S_IRUGO) 2028 may |= MAY_READ; 2029 if (flags & S_IWUGO) 2030 may |= MAY_WRITE; 2031 if (flags & S_IXUGO) 2032 may |= MAY_EXEC; 2033 2034 return may; 2035 } 2036 2037 /** 2038 * smack_msg_msg_alloc_security - Set the security blob for msg_msg 2039 * @msg: the object 2040 * 2041 * Returns 0 2042 */ 2043 static int smack_msg_msg_alloc_security(struct msg_msg *msg) 2044 { 2045 msg->security = smk_of_current(); 2046 return 0; 2047 } 2048 2049 /** 2050 * smack_msg_msg_free_security - Clear the security blob for msg_msg 2051 * @msg: the object 2052 * 2053 * Clears the blob pointer 2054 */ 2055 static void smack_msg_msg_free_security(struct msg_msg *msg) 2056 { 2057 msg->security = NULL; 2058 } 2059 2060 /** 2061 * smack_of_shm - the smack pointer for the shm 2062 * @shp: the object 2063 * 2064 * Returns a pointer to the smack value 2065 */ 2066 static char *smack_of_shm(struct shmid_kernel *shp) 2067 { 2068 return (char *)shp->shm_perm.security; 2069 } 2070 2071 /** 2072 * smack_shm_alloc_security - Set the security blob for shm 2073 * @shp: the object 2074 * 2075 * Returns 0 2076 */ 2077 static int smack_shm_alloc_security(struct shmid_kernel *shp) 2078 { 2079 struct kern_ipc_perm *isp = &shp->shm_perm; 2080 2081 isp->security = smk_of_current(); 2082 return 0; 2083 } 2084 2085 /** 2086 * smack_shm_free_security - Clear the security blob for shm 2087 * @shp: the object 2088 * 2089 * Clears the blob pointer 2090 */ 2091 static void smack_shm_free_security(struct shmid_kernel *shp) 2092 { 2093 struct kern_ipc_perm *isp = &shp->shm_perm; 2094 2095 isp->security = NULL; 2096 } 2097 2098 /** 2099 * smk_curacc_shm : check if current has access on shm 2100 * @shp : the object 2101 * @access : access requested 2102 * 2103 * Returns 0 if current has the requested access, error code otherwise 2104 */ 2105 static int smk_curacc_shm(struct shmid_kernel *shp, int access) 2106 { 2107 char *ssp = smack_of_shm(shp); 2108 struct smk_audit_info ad; 2109 2110 #ifdef CONFIG_AUDIT 2111 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2112 ad.a.u.ipc_id = shp->shm_perm.id; 2113 #endif 2114 return smk_curacc(ssp, access, &ad); 2115 } 2116 2117 /** 2118 * smack_shm_associate - Smack access check for shm 2119 * @shp: the object 2120 * @shmflg: access requested 2121 * 2122 * Returns 0 if current has the requested access, error code otherwise 2123 */ 2124 static int smack_shm_associate(struct shmid_kernel *shp, int shmflg) 2125 { 2126 int may; 2127 2128 may = smack_flags_to_may(shmflg); 2129 return smk_curacc_shm(shp, may); 2130 } 2131 2132 /** 2133 * smack_shm_shmctl - Smack access check for shm 2134 * @shp: the object 2135 * @cmd: what it wants to do 2136 * 2137 * Returns 0 if current has the requested access, error code otherwise 2138 */ 2139 static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd) 2140 { 2141 int may; 2142 2143 switch (cmd) { 2144 case IPC_STAT: 2145 case SHM_STAT: 2146 may = MAY_READ; 2147 break; 2148 case IPC_SET: 2149 case SHM_LOCK: 2150 case SHM_UNLOCK: 2151 case IPC_RMID: 2152 may = MAY_READWRITE; 2153 break; 2154 case IPC_INFO: 2155 case SHM_INFO: 2156 /* 2157 * System level information. 2158 */ 2159 return 0; 2160 default: 2161 return -EINVAL; 2162 } 2163 return smk_curacc_shm(shp, may); 2164 } 2165 2166 /** 2167 * smack_shm_shmat - Smack access for shmat 2168 * @shp: the object 2169 * @shmaddr: unused 2170 * @shmflg: access requested 2171 * 2172 * Returns 0 if current has the requested access, error code otherwise 2173 */ 2174 static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, 2175 int shmflg) 2176 { 2177 int may; 2178 2179 may = smack_flags_to_may(shmflg); 2180 return smk_curacc_shm(shp, may); 2181 } 2182 2183 /** 2184 * smack_of_sem - the smack pointer for the sem 2185 * @sma: the object 2186 * 2187 * Returns a pointer to the smack value 2188 */ 2189 static char *smack_of_sem(struct sem_array *sma) 2190 { 2191 return (char *)sma->sem_perm.security; 2192 } 2193 2194 /** 2195 * smack_sem_alloc_security - Set the security blob for sem 2196 * @sma: the object 2197 * 2198 * Returns 0 2199 */ 2200 static int smack_sem_alloc_security(struct sem_array *sma) 2201 { 2202 struct kern_ipc_perm *isp = &sma->sem_perm; 2203 2204 isp->security = smk_of_current(); 2205 return 0; 2206 } 2207 2208 /** 2209 * smack_sem_free_security - Clear the security blob for sem 2210 * @sma: the object 2211 * 2212 * Clears the blob pointer 2213 */ 2214 static void smack_sem_free_security(struct sem_array *sma) 2215 { 2216 struct kern_ipc_perm *isp = &sma->sem_perm; 2217 2218 isp->security = NULL; 2219 } 2220 2221 /** 2222 * smk_curacc_sem : check if current has access on sem 2223 * @sma : the object 2224 * @access : access requested 2225 * 2226 * Returns 0 if current has the requested access, error code otherwise 2227 */ 2228 static int smk_curacc_sem(struct sem_array *sma, int access) 2229 { 2230 char *ssp = smack_of_sem(sma); 2231 struct smk_audit_info ad; 2232 2233 #ifdef CONFIG_AUDIT 2234 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2235 ad.a.u.ipc_id = sma->sem_perm.id; 2236 #endif 2237 return smk_curacc(ssp, access, &ad); 2238 } 2239 2240 /** 2241 * smack_sem_associate - Smack access check for sem 2242 * @sma: the object 2243 * @semflg: access requested 2244 * 2245 * Returns 0 if current has the requested access, error code otherwise 2246 */ 2247 static int smack_sem_associate(struct sem_array *sma, int semflg) 2248 { 2249 int may; 2250 2251 may = smack_flags_to_may(semflg); 2252 return smk_curacc_sem(sma, may); 2253 } 2254 2255 /** 2256 * smack_sem_shmctl - Smack access check for sem 2257 * @sma: the object 2258 * @cmd: what it wants to do 2259 * 2260 * Returns 0 if current has the requested access, error code otherwise 2261 */ 2262 static int smack_sem_semctl(struct sem_array *sma, int cmd) 2263 { 2264 int may; 2265 2266 switch (cmd) { 2267 case GETPID: 2268 case GETNCNT: 2269 case GETZCNT: 2270 case GETVAL: 2271 case GETALL: 2272 case IPC_STAT: 2273 case SEM_STAT: 2274 may = MAY_READ; 2275 break; 2276 case SETVAL: 2277 case SETALL: 2278 case IPC_RMID: 2279 case IPC_SET: 2280 may = MAY_READWRITE; 2281 break; 2282 case IPC_INFO: 2283 case SEM_INFO: 2284 /* 2285 * System level information 2286 */ 2287 return 0; 2288 default: 2289 return -EINVAL; 2290 } 2291 2292 return smk_curacc_sem(sma, may); 2293 } 2294 2295 /** 2296 * smack_sem_semop - Smack checks of semaphore operations 2297 * @sma: the object 2298 * @sops: unused 2299 * @nsops: unused 2300 * @alter: unused 2301 * 2302 * Treated as read and write in all cases. 2303 * 2304 * Returns 0 if access is allowed, error code otherwise 2305 */ 2306 static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops, 2307 unsigned nsops, int alter) 2308 { 2309 return smk_curacc_sem(sma, MAY_READWRITE); 2310 } 2311 2312 /** 2313 * smack_msg_alloc_security - Set the security blob for msg 2314 * @msq: the object 2315 * 2316 * Returns 0 2317 */ 2318 static int smack_msg_queue_alloc_security(struct msg_queue *msq) 2319 { 2320 struct kern_ipc_perm *kisp = &msq->q_perm; 2321 2322 kisp->security = smk_of_current(); 2323 return 0; 2324 } 2325 2326 /** 2327 * smack_msg_free_security - Clear the security blob for msg 2328 * @msq: the object 2329 * 2330 * Clears the blob pointer 2331 */ 2332 static void smack_msg_queue_free_security(struct msg_queue *msq) 2333 { 2334 struct kern_ipc_perm *kisp = &msq->q_perm; 2335 2336 kisp->security = NULL; 2337 } 2338 2339 /** 2340 * smack_of_msq - the smack pointer for the msq 2341 * @msq: the object 2342 * 2343 * Returns a pointer to the smack value 2344 */ 2345 static char *smack_of_msq(struct msg_queue *msq) 2346 { 2347 return (char *)msq->q_perm.security; 2348 } 2349 2350 /** 2351 * smk_curacc_msq : helper to check if current has access on msq 2352 * @msq : the msq 2353 * @access : access requested 2354 * 2355 * return 0 if current has access, error otherwise 2356 */ 2357 static int smk_curacc_msq(struct msg_queue *msq, int access) 2358 { 2359 char *msp = smack_of_msq(msq); 2360 struct smk_audit_info ad; 2361 2362 #ifdef CONFIG_AUDIT 2363 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2364 ad.a.u.ipc_id = msq->q_perm.id; 2365 #endif 2366 return smk_curacc(msp, access, &ad); 2367 } 2368 2369 /** 2370 * smack_msg_queue_associate - Smack access check for msg_queue 2371 * @msq: the object 2372 * @msqflg: access requested 2373 * 2374 * Returns 0 if current has the requested access, error code otherwise 2375 */ 2376 static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg) 2377 { 2378 int may; 2379 2380 may = smack_flags_to_may(msqflg); 2381 return smk_curacc_msq(msq, may); 2382 } 2383 2384 /** 2385 * smack_msg_queue_msgctl - Smack access check for msg_queue 2386 * @msq: the object 2387 * @cmd: what it wants to do 2388 * 2389 * Returns 0 if current has the requested access, error code otherwise 2390 */ 2391 static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd) 2392 { 2393 int may; 2394 2395 switch (cmd) { 2396 case IPC_STAT: 2397 case MSG_STAT: 2398 may = MAY_READ; 2399 break; 2400 case IPC_SET: 2401 case IPC_RMID: 2402 may = MAY_READWRITE; 2403 break; 2404 case IPC_INFO: 2405 case MSG_INFO: 2406 /* 2407 * System level information 2408 */ 2409 return 0; 2410 default: 2411 return -EINVAL; 2412 } 2413 2414 return smk_curacc_msq(msq, may); 2415 } 2416 2417 /** 2418 * smack_msg_queue_msgsnd - Smack access check for msg_queue 2419 * @msq: the object 2420 * @msg: unused 2421 * @msqflg: access requested 2422 * 2423 * Returns 0 if current has the requested access, error code otherwise 2424 */ 2425 static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, 2426 int msqflg) 2427 { 2428 int may; 2429 2430 may = smack_flags_to_may(msqflg); 2431 return smk_curacc_msq(msq, may); 2432 } 2433 2434 /** 2435 * smack_msg_queue_msgsnd - Smack access check for msg_queue 2436 * @msq: the object 2437 * @msg: unused 2438 * @target: unused 2439 * @type: unused 2440 * @mode: unused 2441 * 2442 * Returns 0 if current has read and write access, error code otherwise 2443 */ 2444 static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg, 2445 struct task_struct *target, long type, int mode) 2446 { 2447 return smk_curacc_msq(msq, MAY_READWRITE); 2448 } 2449 2450 /** 2451 * smack_ipc_permission - Smack access for ipc_permission() 2452 * @ipp: the object permissions 2453 * @flag: access requested 2454 * 2455 * Returns 0 if current has read and write access, error code otherwise 2456 */ 2457 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 2458 { 2459 char *isp = ipp->security; 2460 int may = smack_flags_to_may(flag); 2461 struct smk_audit_info ad; 2462 2463 #ifdef CONFIG_AUDIT 2464 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2465 ad.a.u.ipc_id = ipp->id; 2466 #endif 2467 return smk_curacc(isp, may, &ad); 2468 } 2469 2470 /** 2471 * smack_ipc_getsecid - Extract smack security id 2472 * @ipp: the object permissions 2473 * @secid: where result will be saved 2474 */ 2475 static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid) 2476 { 2477 char *smack = ipp->security; 2478 2479 *secid = smack_to_secid(smack); 2480 } 2481 2482 /** 2483 * smack_d_instantiate - Make sure the blob is correct on an inode 2484 * @opt_dentry: dentry where inode will be attached 2485 * @inode: the object 2486 * 2487 * Set the inode's security blob if it hasn't been done already. 2488 */ 2489 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) 2490 { 2491 struct super_block *sbp; 2492 struct superblock_smack *sbsp; 2493 struct inode_smack *isp; 2494 char *csp = smk_of_current(); 2495 char *fetched; 2496 char *final; 2497 char trattr[TRANS_TRUE_SIZE]; 2498 int transflag = 0; 2499 struct dentry *dp; 2500 2501 if (inode == NULL) 2502 return; 2503 2504 isp = inode->i_security; 2505 2506 mutex_lock(&isp->smk_lock); 2507 /* 2508 * If the inode is already instantiated 2509 * take the quick way out 2510 */ 2511 if (isp->smk_flags & SMK_INODE_INSTANT) 2512 goto unlockandout; 2513 2514 sbp = inode->i_sb; 2515 sbsp = sbp->s_security; 2516 /* 2517 * We're going to use the superblock default label 2518 * if there's no label on the file. 2519 */ 2520 final = sbsp->smk_default; 2521 2522 /* 2523 * If this is the root inode the superblock 2524 * may be in the process of initialization. 2525 * If that is the case use the root value out 2526 * of the superblock. 2527 */ 2528 if (opt_dentry->d_parent == opt_dentry) { 2529 isp->smk_inode = sbsp->smk_root; 2530 isp->smk_flags |= SMK_INODE_INSTANT; 2531 goto unlockandout; 2532 } 2533 2534 /* 2535 * This is pretty hackish. 2536 * Casey says that we shouldn't have to do 2537 * file system specific code, but it does help 2538 * with keeping it simple. 2539 */ 2540 switch (sbp->s_magic) { 2541 case SMACK_MAGIC: 2542 /* 2543 * Casey says that it's a little embarrassing 2544 * that the smack file system doesn't do 2545 * extended attributes. 2546 */ 2547 final = smack_known_star.smk_known; 2548 break; 2549 case PIPEFS_MAGIC: 2550 /* 2551 * Casey says pipes are easy (?) 2552 */ 2553 final = smack_known_star.smk_known; 2554 break; 2555 case DEVPTS_SUPER_MAGIC: 2556 /* 2557 * devpts seems content with the label of the task. 2558 * Programs that change smack have to treat the 2559 * pty with respect. 2560 */ 2561 final = csp; 2562 break; 2563 case SOCKFS_MAGIC: 2564 /* 2565 * Socket access is controlled by the socket 2566 * structures associated with the task involved. 2567 */ 2568 final = smack_known_star.smk_known; 2569 break; 2570 case PROC_SUPER_MAGIC: 2571 /* 2572 * Casey says procfs appears not to care. 2573 * The superblock default suffices. 2574 */ 2575 break; 2576 case TMPFS_MAGIC: 2577 /* 2578 * Device labels should come from the filesystem, 2579 * but watch out, because they're volitile, 2580 * getting recreated on every reboot. 2581 */ 2582 final = smack_known_star.smk_known; 2583 /* 2584 * No break. 2585 * 2586 * If a smack value has been set we want to use it, 2587 * but since tmpfs isn't giving us the opportunity 2588 * to set mount options simulate setting the 2589 * superblock default. 2590 */ 2591 default: 2592 /* 2593 * This isn't an understood special case. 2594 * Get the value from the xattr. 2595 */ 2596 2597 /* 2598 * UNIX domain sockets use lower level socket data. 2599 */ 2600 if (S_ISSOCK(inode->i_mode)) { 2601 final = smack_known_star.smk_known; 2602 break; 2603 } 2604 /* 2605 * No xattr support means, alas, no SMACK label. 2606 * Use the aforeapplied default. 2607 * It would be curious if the label of the task 2608 * does not match that assigned. 2609 */ 2610 if (inode->i_op->getxattr == NULL) 2611 break; 2612 /* 2613 * Get the dentry for xattr. 2614 */ 2615 dp = dget(opt_dentry); 2616 fetched = smk_fetch(XATTR_NAME_SMACK, inode, dp); 2617 if (fetched != NULL) { 2618 final = fetched; 2619 if (S_ISDIR(inode->i_mode)) { 2620 trattr[0] = '\0'; 2621 inode->i_op->getxattr(dp, 2622 XATTR_NAME_SMACKTRANSMUTE, 2623 trattr, TRANS_TRUE_SIZE); 2624 if (strncmp(trattr, TRANS_TRUE, 2625 TRANS_TRUE_SIZE) == 0) 2626 transflag = SMK_INODE_TRANSMUTE; 2627 } 2628 } 2629 isp->smk_task = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); 2630 isp->smk_mmap = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); 2631 2632 dput(dp); 2633 break; 2634 } 2635 2636 if (final == NULL) 2637 isp->smk_inode = csp; 2638 else 2639 isp->smk_inode = final; 2640 2641 isp->smk_flags |= (SMK_INODE_INSTANT | transflag); 2642 2643 unlockandout: 2644 mutex_unlock(&isp->smk_lock); 2645 return; 2646 } 2647 2648 /** 2649 * smack_getprocattr - Smack process attribute access 2650 * @p: the object task 2651 * @name: the name of the attribute in /proc/.../attr 2652 * @value: where to put the result 2653 * 2654 * Places a copy of the task Smack into value 2655 * 2656 * Returns the length of the smack label or an error code 2657 */ 2658 static int smack_getprocattr(struct task_struct *p, char *name, char **value) 2659 { 2660 char *cp; 2661 int slen; 2662 2663 if (strcmp(name, "current") != 0) 2664 return -EINVAL; 2665 2666 cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL); 2667 if (cp == NULL) 2668 return -ENOMEM; 2669 2670 slen = strlen(cp); 2671 *value = cp; 2672 return slen; 2673 } 2674 2675 /** 2676 * smack_setprocattr - Smack process attribute setting 2677 * @p: the object task 2678 * @name: the name of the attribute in /proc/.../attr 2679 * @value: the value to set 2680 * @size: the size of the value 2681 * 2682 * Sets the Smack value of the task. Only setting self 2683 * is permitted and only with privilege 2684 * 2685 * Returns the length of the smack label or an error code 2686 */ 2687 static int smack_setprocattr(struct task_struct *p, char *name, 2688 void *value, size_t size) 2689 { 2690 int rc; 2691 struct task_smack *tsp; 2692 struct task_smack *oldtsp; 2693 struct cred *new; 2694 char *newsmack; 2695 2696 /* 2697 * Changing another process' Smack value is too dangerous 2698 * and supports no sane use case. 2699 */ 2700 if (p != current) 2701 return -EPERM; 2702 2703 if (!capable(CAP_MAC_ADMIN)) 2704 return -EPERM; 2705 2706 if (value == NULL || size == 0 || size >= SMK_LABELLEN) 2707 return -EINVAL; 2708 2709 if (strcmp(name, "current") != 0) 2710 return -EINVAL; 2711 2712 newsmack = smk_import(value, size); 2713 if (newsmack == NULL) 2714 return -EINVAL; 2715 2716 /* 2717 * No process is ever allowed the web ("@") label. 2718 */ 2719 if (newsmack == smack_known_web.smk_known) 2720 return -EPERM; 2721 2722 oldtsp = p->cred->security; 2723 new = prepare_creds(); 2724 if (new == NULL) 2725 return -ENOMEM; 2726 2727 tsp = new_task_smack(newsmack, oldtsp->smk_forked, GFP_KERNEL); 2728 if (tsp == NULL) { 2729 kfree(new); 2730 return -ENOMEM; 2731 } 2732 rc = smk_copy_rules(&tsp->smk_rules, &oldtsp->smk_rules, GFP_KERNEL); 2733 if (rc != 0) 2734 return rc; 2735 2736 new->security = tsp; 2737 commit_creds(new); 2738 return size; 2739 } 2740 2741 /** 2742 * smack_unix_stream_connect - Smack access on UDS 2743 * @sock: one sock 2744 * @other: the other sock 2745 * @newsk: unused 2746 * 2747 * Return 0 if a subject with the smack of sock could access 2748 * an object with the smack of other, otherwise an error code 2749 */ 2750 static int smack_unix_stream_connect(struct sock *sock, 2751 struct sock *other, struct sock *newsk) 2752 { 2753 struct socket_smack *ssp = sock->sk_security; 2754 struct socket_smack *osp = other->sk_security; 2755 struct smk_audit_info ad; 2756 int rc = 0; 2757 2758 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET); 2759 smk_ad_setfield_u_net_sk(&ad, other); 2760 2761 if (!capable(CAP_MAC_OVERRIDE)) 2762 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad); 2763 2764 return rc; 2765 } 2766 2767 /** 2768 * smack_unix_may_send - Smack access on UDS 2769 * @sock: one socket 2770 * @other: the other socket 2771 * 2772 * Return 0 if a subject with the smack of sock could access 2773 * an object with the smack of other, otherwise an error code 2774 */ 2775 static int smack_unix_may_send(struct socket *sock, struct socket *other) 2776 { 2777 struct socket_smack *ssp = sock->sk->sk_security; 2778 struct socket_smack *osp = other->sk->sk_security; 2779 struct smk_audit_info ad; 2780 int rc = 0; 2781 2782 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET); 2783 smk_ad_setfield_u_net_sk(&ad, other->sk); 2784 2785 if (!capable(CAP_MAC_OVERRIDE)) 2786 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad); 2787 2788 return rc; 2789 } 2790 2791 /** 2792 * smack_socket_sendmsg - Smack check based on destination host 2793 * @sock: the socket 2794 * @msg: the message 2795 * @size: the size of the message 2796 * 2797 * Return 0 if the current subject can write to the destination 2798 * host. This is only a question if the destination is a single 2799 * label host. 2800 */ 2801 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, 2802 int size) 2803 { 2804 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name; 2805 2806 /* 2807 * Perfectly reasonable for this to be NULL 2808 */ 2809 if (sip == NULL || sip->sin_family != AF_INET) 2810 return 0; 2811 2812 return smack_netlabel_send(sock->sk, sip); 2813 } 2814 2815 2816 /** 2817 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack 2818 * @sap: netlabel secattr 2819 * @sip: where to put the result 2820 * 2821 * Copies a smack label into sip 2822 */ 2823 static void smack_from_secattr(struct netlbl_lsm_secattr *sap, char *sip) 2824 { 2825 char smack[SMK_LABELLEN]; 2826 char *sp; 2827 int pcat; 2828 2829 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) { 2830 /* 2831 * Looks like a CIPSO packet. 2832 * If there are flags but no level netlabel isn't 2833 * behaving the way we expect it to. 2834 * 2835 * Get the categories, if any 2836 * Without guidance regarding the smack value 2837 * for the packet fall back on the network 2838 * ambient value. 2839 */ 2840 memset(smack, '\0', SMK_LABELLEN); 2841 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) != 0) 2842 for (pcat = -1;;) { 2843 pcat = netlbl_secattr_catmap_walk( 2844 sap->attr.mls.cat, pcat + 1); 2845 if (pcat < 0) 2846 break; 2847 smack_catset_bit(pcat, smack); 2848 } 2849 /* 2850 * If it is CIPSO using smack direct mapping 2851 * we are already done. WeeHee. 2852 */ 2853 if (sap->attr.mls.lvl == smack_cipso_direct) { 2854 memcpy(sip, smack, SMK_MAXLEN); 2855 return; 2856 } 2857 /* 2858 * Look it up in the supplied table if it is not 2859 * a direct mapping. 2860 */ 2861 smack_from_cipso(sap->attr.mls.lvl, smack, sip); 2862 return; 2863 } 2864 if ((sap->flags & NETLBL_SECATTR_SECID) != 0) { 2865 /* 2866 * Looks like a fallback, which gives us a secid. 2867 */ 2868 sp = smack_from_secid(sap->attr.secid); 2869 /* 2870 * This has got to be a bug because it is 2871 * impossible to specify a fallback without 2872 * specifying the label, which will ensure 2873 * it has a secid, and the only way to get a 2874 * secid is from a fallback. 2875 */ 2876 BUG_ON(sp == NULL); 2877 strncpy(sip, sp, SMK_MAXLEN); 2878 return; 2879 } 2880 /* 2881 * Without guidance regarding the smack value 2882 * for the packet fall back on the network 2883 * ambient value. 2884 */ 2885 strncpy(sip, smack_net_ambient, SMK_MAXLEN); 2886 return; 2887 } 2888 2889 /** 2890 * smack_socket_sock_rcv_skb - Smack packet delivery access check 2891 * @sk: socket 2892 * @skb: packet 2893 * 2894 * Returns 0 if the packet should be delivered, an error code otherwise 2895 */ 2896 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 2897 { 2898 struct netlbl_lsm_secattr secattr; 2899 struct socket_smack *ssp = sk->sk_security; 2900 char smack[SMK_LABELLEN]; 2901 char *csp; 2902 int rc; 2903 struct smk_audit_info ad; 2904 if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6) 2905 return 0; 2906 2907 /* 2908 * Translate what netlabel gave us. 2909 */ 2910 netlbl_secattr_init(&secattr); 2911 2912 rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr); 2913 if (rc == 0) { 2914 smack_from_secattr(&secattr, smack); 2915 csp = smack; 2916 } else 2917 csp = smack_net_ambient; 2918 2919 netlbl_secattr_destroy(&secattr); 2920 2921 #ifdef CONFIG_AUDIT 2922 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET); 2923 ad.a.u.net.family = sk->sk_family; 2924 ad.a.u.net.netif = skb->skb_iif; 2925 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 2926 #endif 2927 /* 2928 * Receiving a packet requires that the other end 2929 * be able to write here. Read access is not required. 2930 * This is the simplist possible security model 2931 * for networking. 2932 */ 2933 rc = smk_access(csp, ssp->smk_in, MAY_WRITE, &ad); 2934 if (rc != 0) 2935 netlbl_skbuff_err(skb, rc, 0); 2936 return rc; 2937 } 2938 2939 /** 2940 * smack_socket_getpeersec_stream - pull in packet label 2941 * @sock: the socket 2942 * @optval: user's destination 2943 * @optlen: size thereof 2944 * @len: max thereof 2945 * 2946 * returns zero on success, an error code otherwise 2947 */ 2948 static int smack_socket_getpeersec_stream(struct socket *sock, 2949 char __user *optval, 2950 int __user *optlen, unsigned len) 2951 { 2952 struct socket_smack *ssp; 2953 int slen; 2954 int rc = 0; 2955 2956 ssp = sock->sk->sk_security; 2957 slen = strlen(ssp->smk_packet) + 1; 2958 2959 if (slen > len) 2960 rc = -ERANGE; 2961 else if (copy_to_user(optval, ssp->smk_packet, slen) != 0) 2962 rc = -EFAULT; 2963 2964 if (put_user(slen, optlen) != 0) 2965 rc = -EFAULT; 2966 2967 return rc; 2968 } 2969 2970 2971 /** 2972 * smack_socket_getpeersec_dgram - pull in packet label 2973 * @sock: the peer socket 2974 * @skb: packet data 2975 * @secid: pointer to where to put the secid of the packet 2976 * 2977 * Sets the netlabel socket state on sk from parent 2978 */ 2979 static int smack_socket_getpeersec_dgram(struct socket *sock, 2980 struct sk_buff *skb, u32 *secid) 2981 2982 { 2983 struct netlbl_lsm_secattr secattr; 2984 struct socket_smack *sp; 2985 char smack[SMK_LABELLEN]; 2986 int family = PF_UNSPEC; 2987 u32 s = 0; /* 0 is the invalid secid */ 2988 int rc; 2989 2990 if (skb != NULL) { 2991 if (skb->protocol == htons(ETH_P_IP)) 2992 family = PF_INET; 2993 else if (skb->protocol == htons(ETH_P_IPV6)) 2994 family = PF_INET6; 2995 } 2996 if (family == PF_UNSPEC && sock != NULL) 2997 family = sock->sk->sk_family; 2998 2999 if (family == PF_UNIX) { 3000 sp = sock->sk->sk_security; 3001 s = smack_to_secid(sp->smk_out); 3002 } else if (family == PF_INET || family == PF_INET6) { 3003 /* 3004 * Translate what netlabel gave us. 3005 */ 3006 netlbl_secattr_init(&secattr); 3007 rc = netlbl_skbuff_getattr(skb, family, &secattr); 3008 if (rc == 0) { 3009 smack_from_secattr(&secattr, smack); 3010 s = smack_to_secid(smack); 3011 } 3012 netlbl_secattr_destroy(&secattr); 3013 } 3014 *secid = s; 3015 if (s == 0) 3016 return -EINVAL; 3017 return 0; 3018 } 3019 3020 /** 3021 * smack_sock_graft - Initialize a newly created socket with an existing sock 3022 * @sk: child sock 3023 * @parent: parent socket 3024 * 3025 * Set the smk_{in,out} state of an existing sock based on the process that 3026 * is creating the new socket. 3027 */ 3028 static void smack_sock_graft(struct sock *sk, struct socket *parent) 3029 { 3030 struct socket_smack *ssp; 3031 3032 if (sk == NULL || 3033 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)) 3034 return; 3035 3036 ssp = sk->sk_security; 3037 ssp->smk_in = ssp->smk_out = smk_of_current(); 3038 /* cssp->smk_packet is already set in smack_inet_csk_clone() */ 3039 } 3040 3041 /** 3042 * smack_inet_conn_request - Smack access check on connect 3043 * @sk: socket involved 3044 * @skb: packet 3045 * @req: unused 3046 * 3047 * Returns 0 if a task with the packet label could write to 3048 * the socket, otherwise an error code 3049 */ 3050 static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, 3051 struct request_sock *req) 3052 { 3053 u16 family = sk->sk_family; 3054 struct socket_smack *ssp = sk->sk_security; 3055 struct netlbl_lsm_secattr secattr; 3056 struct sockaddr_in addr; 3057 struct iphdr *hdr; 3058 char smack[SMK_LABELLEN]; 3059 int rc; 3060 struct smk_audit_info ad; 3061 3062 /* handle mapped IPv4 packets arriving via IPv6 sockets */ 3063 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 3064 family = PF_INET; 3065 3066 netlbl_secattr_init(&secattr); 3067 rc = netlbl_skbuff_getattr(skb, family, &secattr); 3068 if (rc == 0) 3069 smack_from_secattr(&secattr, smack); 3070 else 3071 strncpy(smack, smack_known_huh.smk_known, SMK_MAXLEN); 3072 netlbl_secattr_destroy(&secattr); 3073 3074 #ifdef CONFIG_AUDIT 3075 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET); 3076 ad.a.u.net.family = family; 3077 ad.a.u.net.netif = skb->skb_iif; 3078 ipv4_skb_to_auditdata(skb, &ad.a, NULL); 3079 #endif 3080 /* 3081 * Receiving a packet requires that the other end be able to write 3082 * here. Read access is not required. 3083 */ 3084 rc = smk_access(smack, ssp->smk_in, MAY_WRITE, &ad); 3085 if (rc != 0) 3086 return rc; 3087 3088 /* 3089 * Save the peer's label in the request_sock so we can later setup 3090 * smk_packet in the child socket so that SO_PEERCRED can report it. 3091 */ 3092 req->peer_secid = smack_to_secid(smack); 3093 3094 /* 3095 * We need to decide if we want to label the incoming connection here 3096 * if we do we only need to label the request_sock and the stack will 3097 * propagate the wire-label to the sock when it is created. 3098 */ 3099 hdr = ip_hdr(skb); 3100 addr.sin_addr.s_addr = hdr->saddr; 3101 rcu_read_lock(); 3102 if (smack_host_label(&addr) == NULL) { 3103 rcu_read_unlock(); 3104 netlbl_secattr_init(&secattr); 3105 smack_to_secattr(smack, &secattr); 3106 rc = netlbl_req_setattr(req, &secattr); 3107 netlbl_secattr_destroy(&secattr); 3108 } else { 3109 rcu_read_unlock(); 3110 netlbl_req_delattr(req); 3111 } 3112 3113 return rc; 3114 } 3115 3116 /** 3117 * smack_inet_csk_clone - Copy the connection information to the new socket 3118 * @sk: the new socket 3119 * @req: the connection's request_sock 3120 * 3121 * Transfer the connection's peer label to the newly created socket. 3122 */ 3123 static void smack_inet_csk_clone(struct sock *sk, 3124 const struct request_sock *req) 3125 { 3126 struct socket_smack *ssp = sk->sk_security; 3127 char *smack; 3128 3129 if (req->peer_secid != 0) { 3130 smack = smack_from_secid(req->peer_secid); 3131 strncpy(ssp->smk_packet, smack, SMK_MAXLEN); 3132 } else 3133 ssp->smk_packet[0] = '\0'; 3134 } 3135 3136 /* 3137 * Key management security hooks 3138 * 3139 * Casey has not tested key support very heavily. 3140 * The permission check is most likely too restrictive. 3141 * If you care about keys please have a look. 3142 */ 3143 #ifdef CONFIG_KEYS 3144 3145 /** 3146 * smack_key_alloc - Set the key security blob 3147 * @key: object 3148 * @cred: the credentials to use 3149 * @flags: unused 3150 * 3151 * No allocation required 3152 * 3153 * Returns 0 3154 */ 3155 static int smack_key_alloc(struct key *key, const struct cred *cred, 3156 unsigned long flags) 3157 { 3158 key->security = smk_of_task(cred->security); 3159 return 0; 3160 } 3161 3162 /** 3163 * smack_key_free - Clear the key security blob 3164 * @key: the object 3165 * 3166 * Clear the blob pointer 3167 */ 3168 static void smack_key_free(struct key *key) 3169 { 3170 key->security = NULL; 3171 } 3172 3173 /* 3174 * smack_key_permission - Smack access on a key 3175 * @key_ref: gets to the object 3176 * @cred: the credentials to use 3177 * @perm: unused 3178 * 3179 * Return 0 if the task has read and write to the object, 3180 * an error code otherwise 3181 */ 3182 static int smack_key_permission(key_ref_t key_ref, 3183 const struct cred *cred, key_perm_t perm) 3184 { 3185 struct key *keyp; 3186 struct smk_audit_info ad; 3187 char *tsp = smk_of_task(cred->security); 3188 3189 keyp = key_ref_to_ptr(key_ref); 3190 if (keyp == NULL) 3191 return -EINVAL; 3192 /* 3193 * If the key hasn't been initialized give it access so that 3194 * it may do so. 3195 */ 3196 if (keyp->security == NULL) 3197 return 0; 3198 /* 3199 * This should not occur 3200 */ 3201 if (tsp == NULL) 3202 return -EACCES; 3203 #ifdef CONFIG_AUDIT 3204 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY); 3205 ad.a.u.key_struct.key = keyp->serial; 3206 ad.a.u.key_struct.key_desc = keyp->description; 3207 #endif 3208 return smk_access(tsp, keyp->security, 3209 MAY_READWRITE, &ad); 3210 } 3211 #endif /* CONFIG_KEYS */ 3212 3213 /* 3214 * Smack Audit hooks 3215 * 3216 * Audit requires a unique representation of each Smack specific 3217 * rule. This unique representation is used to distinguish the 3218 * object to be audited from remaining kernel objects and also 3219 * works as a glue between the audit hooks. 3220 * 3221 * Since repository entries are added but never deleted, we'll use 3222 * the smack_known label address related to the given audit rule as 3223 * the needed unique representation. This also better fits the smack 3224 * model where nearly everything is a label. 3225 */ 3226 #ifdef CONFIG_AUDIT 3227 3228 /** 3229 * smack_audit_rule_init - Initialize a smack audit rule 3230 * @field: audit rule fields given from user-space (audit.h) 3231 * @op: required testing operator (=, !=, >, <, ...) 3232 * @rulestr: smack label to be audited 3233 * @vrule: pointer to save our own audit rule representation 3234 * 3235 * Prepare to audit cases where (@field @op @rulestr) is true. 3236 * The label to be audited is created if necessay. 3237 */ 3238 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3239 { 3240 char **rule = (char **)vrule; 3241 *rule = NULL; 3242 3243 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 3244 return -EINVAL; 3245 3246 if (op != Audit_equal && op != Audit_not_equal) 3247 return -EINVAL; 3248 3249 *rule = smk_import(rulestr, 0); 3250 3251 return 0; 3252 } 3253 3254 /** 3255 * smack_audit_rule_known - Distinguish Smack audit rules 3256 * @krule: rule of interest, in Audit kernel representation format 3257 * 3258 * This is used to filter Smack rules from remaining Audit ones. 3259 * If it's proved that this rule belongs to us, the 3260 * audit_rule_match hook will be called to do the final judgement. 3261 */ 3262 static int smack_audit_rule_known(struct audit_krule *krule) 3263 { 3264 struct audit_field *f; 3265 int i; 3266 3267 for (i = 0; i < krule->field_count; i++) { 3268 f = &krule->fields[i]; 3269 3270 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER) 3271 return 1; 3272 } 3273 3274 return 0; 3275 } 3276 3277 /** 3278 * smack_audit_rule_match - Audit given object ? 3279 * @secid: security id for identifying the object to test 3280 * @field: audit rule flags given from user-space 3281 * @op: required testing operator 3282 * @vrule: smack internal rule presentation 3283 * @actx: audit context associated with the check 3284 * 3285 * The core Audit hook. It's used to take the decision of 3286 * whether to audit or not to audit a given object. 3287 */ 3288 static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule, 3289 struct audit_context *actx) 3290 { 3291 char *smack; 3292 char *rule = vrule; 3293 3294 if (!rule) { 3295 audit_log(actx, GFP_KERNEL, AUDIT_SELINUX_ERR, 3296 "Smack: missing rule\n"); 3297 return -ENOENT; 3298 } 3299 3300 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER) 3301 return 0; 3302 3303 smack = smack_from_secid(secid); 3304 3305 /* 3306 * No need to do string comparisons. If a match occurs, 3307 * both pointers will point to the same smack_known 3308 * label. 3309 */ 3310 if (op == Audit_equal) 3311 return (rule == smack); 3312 if (op == Audit_not_equal) 3313 return (rule != smack); 3314 3315 return 0; 3316 } 3317 3318 /** 3319 * smack_audit_rule_free - free smack rule representation 3320 * @vrule: rule to be freed. 3321 * 3322 * No memory was allocated. 3323 */ 3324 static void smack_audit_rule_free(void *vrule) 3325 { 3326 /* No-op */ 3327 } 3328 3329 #endif /* CONFIG_AUDIT */ 3330 3331 /** 3332 * smack_secid_to_secctx - return the smack label for a secid 3333 * @secid: incoming integer 3334 * @secdata: destination 3335 * @seclen: how long it is 3336 * 3337 * Exists for networking code. 3338 */ 3339 static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 3340 { 3341 char *sp = smack_from_secid(secid); 3342 3343 if (secdata) 3344 *secdata = sp; 3345 *seclen = strlen(sp); 3346 return 0; 3347 } 3348 3349 /** 3350 * smack_secctx_to_secid - return the secid for a smack label 3351 * @secdata: smack label 3352 * @seclen: how long result is 3353 * @secid: outgoing integer 3354 * 3355 * Exists for audit and networking code. 3356 */ 3357 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 3358 { 3359 *secid = smack_to_secid(secdata); 3360 return 0; 3361 } 3362 3363 /** 3364 * smack_release_secctx - don't do anything. 3365 * @secdata: unused 3366 * @seclen: unused 3367 * 3368 * Exists to make sure nothing gets done, and properly 3369 */ 3370 static void smack_release_secctx(char *secdata, u32 seclen) 3371 { 3372 } 3373 3374 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 3375 { 3376 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx, ctxlen, 0); 3377 } 3378 3379 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 3380 { 3381 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SMACK, ctx, ctxlen, 0); 3382 } 3383 3384 static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 3385 { 3386 int len = 0; 3387 len = smack_inode_getsecurity(inode, XATTR_SMACK_SUFFIX, ctx, true); 3388 3389 if (len < 0) 3390 return len; 3391 *ctxlen = len; 3392 return 0; 3393 } 3394 3395 struct security_operations smack_ops = { 3396 .name = "smack", 3397 3398 .ptrace_access_check = smack_ptrace_access_check, 3399 .ptrace_traceme = smack_ptrace_traceme, 3400 .syslog = smack_syslog, 3401 3402 .sb_alloc_security = smack_sb_alloc_security, 3403 .sb_free_security = smack_sb_free_security, 3404 .sb_copy_data = smack_sb_copy_data, 3405 .sb_kern_mount = smack_sb_kern_mount, 3406 .sb_statfs = smack_sb_statfs, 3407 .sb_mount = smack_sb_mount, 3408 .sb_umount = smack_sb_umount, 3409 3410 .bprm_set_creds = smack_bprm_set_creds, 3411 3412 .inode_alloc_security = smack_inode_alloc_security, 3413 .inode_free_security = smack_inode_free_security, 3414 .inode_init_security = smack_inode_init_security, 3415 .inode_link = smack_inode_link, 3416 .inode_unlink = smack_inode_unlink, 3417 .inode_rmdir = smack_inode_rmdir, 3418 .inode_rename = smack_inode_rename, 3419 .inode_permission = smack_inode_permission, 3420 .inode_setattr = smack_inode_setattr, 3421 .inode_getattr = smack_inode_getattr, 3422 .inode_setxattr = smack_inode_setxattr, 3423 .inode_post_setxattr = smack_inode_post_setxattr, 3424 .inode_getxattr = smack_inode_getxattr, 3425 .inode_removexattr = smack_inode_removexattr, 3426 .inode_getsecurity = smack_inode_getsecurity, 3427 .inode_setsecurity = smack_inode_setsecurity, 3428 .inode_listsecurity = smack_inode_listsecurity, 3429 .inode_getsecid = smack_inode_getsecid, 3430 3431 .file_permission = smack_file_permission, 3432 .file_alloc_security = smack_file_alloc_security, 3433 .file_free_security = smack_file_free_security, 3434 .file_ioctl = smack_file_ioctl, 3435 .file_lock = smack_file_lock, 3436 .file_fcntl = smack_file_fcntl, 3437 .file_mmap = smack_file_mmap, 3438 .file_set_fowner = smack_file_set_fowner, 3439 .file_send_sigiotask = smack_file_send_sigiotask, 3440 .file_receive = smack_file_receive, 3441 3442 .cred_alloc_blank = smack_cred_alloc_blank, 3443 .cred_free = smack_cred_free, 3444 .cred_prepare = smack_cred_prepare, 3445 .cred_transfer = smack_cred_transfer, 3446 .kernel_act_as = smack_kernel_act_as, 3447 .kernel_create_files_as = smack_kernel_create_files_as, 3448 .task_setpgid = smack_task_setpgid, 3449 .task_getpgid = smack_task_getpgid, 3450 .task_getsid = smack_task_getsid, 3451 .task_getsecid = smack_task_getsecid, 3452 .task_setnice = smack_task_setnice, 3453 .task_setioprio = smack_task_setioprio, 3454 .task_getioprio = smack_task_getioprio, 3455 .task_setscheduler = smack_task_setscheduler, 3456 .task_getscheduler = smack_task_getscheduler, 3457 .task_movememory = smack_task_movememory, 3458 .task_kill = smack_task_kill, 3459 .task_wait = smack_task_wait, 3460 .task_to_inode = smack_task_to_inode, 3461 3462 .ipc_permission = smack_ipc_permission, 3463 .ipc_getsecid = smack_ipc_getsecid, 3464 3465 .msg_msg_alloc_security = smack_msg_msg_alloc_security, 3466 .msg_msg_free_security = smack_msg_msg_free_security, 3467 3468 .msg_queue_alloc_security = smack_msg_queue_alloc_security, 3469 .msg_queue_free_security = smack_msg_queue_free_security, 3470 .msg_queue_associate = smack_msg_queue_associate, 3471 .msg_queue_msgctl = smack_msg_queue_msgctl, 3472 .msg_queue_msgsnd = smack_msg_queue_msgsnd, 3473 .msg_queue_msgrcv = smack_msg_queue_msgrcv, 3474 3475 .shm_alloc_security = smack_shm_alloc_security, 3476 .shm_free_security = smack_shm_free_security, 3477 .shm_associate = smack_shm_associate, 3478 .shm_shmctl = smack_shm_shmctl, 3479 .shm_shmat = smack_shm_shmat, 3480 3481 .sem_alloc_security = smack_sem_alloc_security, 3482 .sem_free_security = smack_sem_free_security, 3483 .sem_associate = smack_sem_associate, 3484 .sem_semctl = smack_sem_semctl, 3485 .sem_semop = smack_sem_semop, 3486 3487 .d_instantiate = smack_d_instantiate, 3488 3489 .getprocattr = smack_getprocattr, 3490 .setprocattr = smack_setprocattr, 3491 3492 .unix_stream_connect = smack_unix_stream_connect, 3493 .unix_may_send = smack_unix_may_send, 3494 3495 .socket_post_create = smack_socket_post_create, 3496 .socket_connect = smack_socket_connect, 3497 .socket_sendmsg = smack_socket_sendmsg, 3498 .socket_sock_rcv_skb = smack_socket_sock_rcv_skb, 3499 .socket_getpeersec_stream = smack_socket_getpeersec_stream, 3500 .socket_getpeersec_dgram = smack_socket_getpeersec_dgram, 3501 .sk_alloc_security = smack_sk_alloc_security, 3502 .sk_free_security = smack_sk_free_security, 3503 .sock_graft = smack_sock_graft, 3504 .inet_conn_request = smack_inet_conn_request, 3505 .inet_csk_clone = smack_inet_csk_clone, 3506 3507 /* key management security hooks */ 3508 #ifdef CONFIG_KEYS 3509 .key_alloc = smack_key_alloc, 3510 .key_free = smack_key_free, 3511 .key_permission = smack_key_permission, 3512 #endif /* CONFIG_KEYS */ 3513 3514 /* Audit hooks */ 3515 #ifdef CONFIG_AUDIT 3516 .audit_rule_init = smack_audit_rule_init, 3517 .audit_rule_known = smack_audit_rule_known, 3518 .audit_rule_match = smack_audit_rule_match, 3519 .audit_rule_free = smack_audit_rule_free, 3520 #endif /* CONFIG_AUDIT */ 3521 3522 .secid_to_secctx = smack_secid_to_secctx, 3523 .secctx_to_secid = smack_secctx_to_secid, 3524 .release_secctx = smack_release_secctx, 3525 .inode_notifysecctx = smack_inode_notifysecctx, 3526 .inode_setsecctx = smack_inode_setsecctx, 3527 .inode_getsecctx = smack_inode_getsecctx, 3528 }; 3529 3530 3531 static __init void init_smack_know_list(void) 3532 { 3533 list_add(&smack_known_huh.list, &smack_known_list); 3534 list_add(&smack_known_hat.list, &smack_known_list); 3535 list_add(&smack_known_star.list, &smack_known_list); 3536 list_add(&smack_known_floor.list, &smack_known_list); 3537 list_add(&smack_known_invalid.list, &smack_known_list); 3538 list_add(&smack_known_web.list, &smack_known_list); 3539 } 3540 3541 /** 3542 * smack_init - initialize the smack system 3543 * 3544 * Returns 0 3545 */ 3546 static __init int smack_init(void) 3547 { 3548 struct cred *cred; 3549 struct task_smack *tsp; 3550 3551 if (!security_module_enable(&smack_ops)) 3552 return 0; 3553 3554 tsp = new_task_smack(smack_known_floor.smk_known, 3555 smack_known_floor.smk_known, GFP_KERNEL); 3556 if (tsp == NULL) 3557 return -ENOMEM; 3558 3559 printk(KERN_INFO "Smack: Initializing.\n"); 3560 3561 /* 3562 * Set the security state for the initial task. 3563 */ 3564 cred = (struct cred *) current->cred; 3565 cred->security = tsp; 3566 3567 /* initialize the smack_know_list */ 3568 init_smack_know_list(); 3569 /* 3570 * Initialize locks 3571 */ 3572 spin_lock_init(&smack_known_huh.smk_cipsolock); 3573 spin_lock_init(&smack_known_hat.smk_cipsolock); 3574 spin_lock_init(&smack_known_star.smk_cipsolock); 3575 spin_lock_init(&smack_known_floor.smk_cipsolock); 3576 spin_lock_init(&smack_known_invalid.smk_cipsolock); 3577 3578 /* 3579 * Register with LSM 3580 */ 3581 if (register_security(&smack_ops)) 3582 panic("smack: Unable to register with kernel.\n"); 3583 3584 return 0; 3585 } 3586 3587 /* 3588 * Smack requires early initialization in order to label 3589 * all processes and objects when they are created. 3590 */ 3591 security_initcall(smack_init); 3592