Blame view
security/smack/smackfs.c
37.1 KB
e114e4737 Smack: Simplified... |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
/* * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation, version 2. * * Authors: * Casey Schaufler <casey@schaufler-ca.com> * Ahmed S. Darwish <darwish.07@gmail.com> * * Special thanks to the authors of selinuxfs. * * Karl MacMillan <kmacmillan@tresys.com> * James Morris <jmorris@redhat.com> * */ #include <linux/kernel.h> #include <linux/vmalloc.h> #include <linux/security.h> #include <linux/mutex.h> |
5a0e3ad6a include cleanup: ... |
23 |
#include <linux/slab.h> |
6d3dc07cb smack: Add suppor... |
24 |
#include <net/net_namespace.h> |
e114e4737 Smack: Simplified... |
25 26 27 28 |
#include <net/netlabel.h> #include <net/cipso_ipv4.h> #include <linux/seq_file.h> #include <linux/ctype.h> |
4bc87e627 Smack: unlabeled ... |
29 |
#include <linux/audit.h> |
e114e4737 Smack: Simplified... |
30 31 32 33 34 35 36 37 38 39 40 41 42 |
#include "smack.h" /* * smackfs pseudo filesystem. */ enum smk_inos { SMK_ROOT_INO = 2, SMK_LOAD = 3, /* load policy */ SMK_CIPSO = 4, /* load label -> CIPSO mapping */ SMK_DOI = 5, /* CIPSO DOI */ SMK_DIRECT = 6, /* CIPSO level indicating direct label */ SMK_AMBIENT = 7, /* internet ambient label */ |
6d3dc07cb smack: Add suppor... |
43 |
SMK_NETLBLADDR = 8, /* single label hosts */ |
154462353 smack: limit priv... |
44 |
SMK_ONLYCAP = 9, /* the only "capable" label */ |
ecfcc53fe smack: implement ... |
45 |
SMK_LOGGING = 10, /* logging */ |
7898e1f8e Subject: [PATCH] ... |
46 |
SMK_LOAD_SELF = 11, /* task specific rules */ |
828716c28 Smack: check perm... |
47 |
SMK_ACCESSES = 12, /* access policy */ |
e114e4737 Smack: Simplified... |
48 49 50 51 52 53 54 |
}; /* * List locks */ static DEFINE_MUTEX(smack_list_lock); static DEFINE_MUTEX(smack_cipso_lock); |
4bc87e627 Smack: unlabeled ... |
55 |
static DEFINE_MUTEX(smack_ambient_lock); |
6d3dc07cb smack: Add suppor... |
56 |
static DEFINE_MUTEX(smk_netlbladdr_lock); |
e114e4737 Smack: Simplified... |
57 58 59 60 61 62 63 64 65 |
/* * This is the "ambient" label for network traffic. * If it isn't somehow marked, use this. * It can be reset via smackfs/ambient */ char *smack_net_ambient = smack_known_floor.smk_known; /* |
e114e4737 Smack: Simplified... |
66 67 68 69 70 |
* This is the level in a CIPSO header that indicates a * smack label is contained directly in the category set. * It can be reset via smackfs/direct */ int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT; |
154462353 smack: limit priv... |
71 72 73 74 75 76 77 78 79 |
/* * Unless a process is running with this label even * having CAP_MAC_OVERRIDE isn't enough to grant * privilege to violate MAC policy. If no label is * designated (the NULL case) capabilities apply to * everyone. It is expected that the hat (^) label * will be used if any label is used. */ char *smack_onlycap; |
6d3dc07cb smack: Add suppor... |
80 81 82 83 84 |
/* * Certain IP addresses may be designated as single label hosts. * Packets are sent there unlabeled, but only from tasks that * can write to the specified label. */ |
7198e2eeb smack: convert sm... |
85 86 |
LIST_HEAD(smk_netlbladdr_list); |
272cd7a8c Smack: Rule list ... |
87 88 89 90 91 92 93 94 95 |
/* * Rule lists are maintained for each label. * This master list is just for reading /smack/load. */ struct smack_master_list { struct list_head list; struct smack_rule *smk_rule; }; |
7198e2eeb smack: convert sm... |
96 |
LIST_HEAD(smack_rule_list); |
6d3dc07cb smack: Add suppor... |
97 |
|
e114e4737 Smack: Simplified... |
98 |
static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT; |
e114e4737 Smack: Simplified... |
99 |
|
4303154e8 smack: Add a new ... |
100 |
const char *smack_cipso_option = SMACK_CIPSO_OPTION; |
e114e4737 Smack: Simplified... |
101 |
/* |
e114e4737 Smack: Simplified... |
102 103 |
* Values for parsing cipso rules * SMK_DIGITLEN: Length of a digit field in a rule. |
b500ce8d2 smackfs: do not t... |
104 105 |
* SMK_CIPSOMIN: Minimum possible cipso rule length. * SMK_CIPSOMAX: Maximum possible cipso rule length. |
e114e4737 Smack: Simplified... |
106 107 |
*/ #define SMK_DIGITLEN 4 |
b500ce8d2 smackfs: do not t... |
108 109 110 111 112 113 114 115 116 |
#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN) #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN) /* * Values for parsing MAC rules * SMK_ACCESS: Maximum possible combination of access permissions * SMK_ACCESSLEN: Maximum length for a rule access field * SMK_LOADLEN: Smack rule length */ |
5c6d1125f Smack: Transmute ... |
117 118 119 120 121 122 |
#define SMK_OACCESS "rwxa" #define SMK_ACCESS "rwxat" #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1) #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1) #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN) #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN) |
b500ce8d2 smackfs: do not t... |
123 |
|
6d3dc07cb smack: Add suppor... |
124 125 126 127 128 129 130 131 |
/** * smk_netlabel_audit_set - fill a netlbl_audit struct * @nap: structure to fill */ static void smk_netlabel_audit_set(struct netlbl_audit *nap) { nap->loginuid = audit_get_loginuid(current); nap->sessionid = audit_get_sessionid(current); |
676dac4b1 This patch adds a... |
132 |
nap->secid = smack_to_secid(smk_of_current()); |
6d3dc07cb smack: Add suppor... |
133 134 135 136 137 138 139 140 141 |
} /* * Values for parsing single label host rules * "1.2.3.4 X" * "192.168.138.129/32 abcdefghijklmnopqrstuvw" */ #define SMK_NETLBLADDRMIN 9 #define SMK_NETLBLADDRMAX 42 |
e114e4737 Smack: Simplified... |
142 |
|
e114e4737 Smack: Simplified... |
143 144 145 |
/** * smk_set_access - add a rule to the rule list * @srp: the new rule to add |
7898e1f8e Subject: [PATCH] ... |
146 147 |
* @rule_list: the list of rules * @rule_lock: the rule list lock |
e114e4737 Smack: Simplified... |
148 149 150 151 152 |
* * Looks through the current subject/object/access list for * the subject/object pair and replaces the access that was * there. If the pair isn't found add it with the specified * access. |
81ea714bf smackfs: check fo... |
153 |
* |
7898e1f8e Subject: [PATCH] ... |
154 |
* Returns 1 if a rule was found to exist already, 0 if it is new |
81ea714bf smackfs: check fo... |
155 156 |
* Returns 0 if nothing goes wrong or -ENOMEM if it fails * during the allocation of the new pair to add. |
e114e4737 Smack: Simplified... |
157 |
*/ |
7898e1f8e Subject: [PATCH] ... |
158 159 |
static int smk_set_access(struct smack_rule *srp, struct list_head *rule_list, struct mutex *rule_lock) |
e114e4737 Smack: Simplified... |
160 |
{ |
7198e2eeb smack: convert sm... |
161 |
struct smack_rule *sp; |
7898e1f8e Subject: [PATCH] ... |
162 |
int found = 0; |
e114e4737 Smack: Simplified... |
163 |
|
7898e1f8e Subject: [PATCH] ... |
164 |
mutex_lock(rule_lock); |
272cd7a8c Smack: Rule list ... |
165 166 167 168 |
/* * Because the object label is less likely to match * than the subject label check it first */ |
7898e1f8e Subject: [PATCH] ... |
169 |
list_for_each_entry_rcu(sp, rule_list, list) { |
272cd7a8c Smack: Rule list ... |
170 171 |
if (sp->smk_object == srp->smk_object && sp->smk_subject == srp->smk_subject) { |
7198e2eeb smack: convert sm... |
172 173 |
found = 1; sp->smk_access = srp->smk_access; |
e114e4737 Smack: Simplified... |
174 175 |
break; } |
e114e4737 Smack: Simplified... |
176 |
} |
7198e2eeb smack: convert sm... |
177 |
if (found == 0) |
7898e1f8e Subject: [PATCH] ... |
178 |
list_add_rcu(&srp->list, rule_list); |
e114e4737 Smack: Simplified... |
179 |
|
7898e1f8e Subject: [PATCH] ... |
180 |
mutex_unlock(rule_lock); |
e114e4737 Smack: Simplified... |
181 |
|
7898e1f8e Subject: [PATCH] ... |
182 |
return found; |
e114e4737 Smack: Simplified... |
183 184 185 |
} /** |
0e94ae17c Smack: allow to a... |
186 |
* smk_parse_rule - parse Smack rule from load string |
828716c28 Smack: check perm... |
187 |
* @data: string to be parsed whose size is SMK_LOADLEN |
0e94ae17c Smack: allow to a... |
188 189 |
* @rule: Smack rule * @import: if non-zero, import labels |
e114e4737 Smack: Simplified... |
190 |
*/ |
0e94ae17c Smack: allow to a... |
191 |
static int smk_parse_rule(const char *data, struct smack_rule *rule, int import) |
e114e4737 Smack: Simplified... |
192 |
{ |
0e94ae17c Smack: allow to a... |
193 194 |
char smack[SMK_LABELLEN]; struct smack_known *skp; |
e114e4737 Smack: Simplified... |
195 |
|
0e94ae17c Smack: allow to a... |
196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 |
if (import) { rule->smk_subject = smk_import(data, 0); if (rule->smk_subject == NULL) return -1; rule->smk_object = smk_import(data + SMK_LABELLEN, 0); if (rule->smk_object == NULL) return -1; } else { smk_parse_smack(data, 0, smack); skp = smk_find_entry(smack); if (skp == NULL) return -1; rule->smk_subject = skp->smk_known; smk_parse_smack(data + SMK_LABELLEN, 0, smack); skp = smk_find_entry(smack); if (skp == NULL) return -1; rule->smk_object = skp->smk_known; } |
7198e2eeb smack: convert sm... |
217 218 |
rule->smk_access = 0; |
e114e4737 Smack: Simplified... |
219 220 221 222 223 224 |
switch (data[SMK_LABELLEN + SMK_LABELLEN]) { case '-': break; case 'r': case 'R': |
7198e2eeb smack: convert sm... |
225 |
rule->smk_access |= MAY_READ; |
e114e4737 Smack: Simplified... |
226 227 |
break; default: |
828716c28 Smack: check perm... |
228 |
return -1; |
e114e4737 Smack: Simplified... |
229 230 231 232 233 234 235 |
} switch (data[SMK_LABELLEN + SMK_LABELLEN + 1]) { case '-': break; case 'w': case 'W': |
7198e2eeb smack: convert sm... |
236 |
rule->smk_access |= MAY_WRITE; |
e114e4737 Smack: Simplified... |
237 238 |
break; default: |
828716c28 Smack: check perm... |
239 |
return -1; |
e114e4737 Smack: Simplified... |
240 241 242 243 244 245 246 |
} switch (data[SMK_LABELLEN + SMK_LABELLEN + 2]) { case '-': break; case 'x': case 'X': |
7198e2eeb smack: convert sm... |
247 |
rule->smk_access |= MAY_EXEC; |
e114e4737 Smack: Simplified... |
248 249 |
break; default: |
828716c28 Smack: check perm... |
250 |
return -1; |
e114e4737 Smack: Simplified... |
251 252 253 254 255 256 257 |
} switch (data[SMK_LABELLEN + SMK_LABELLEN + 3]) { case '-': break; case 'a': case 'A': |
7198e2eeb smack: convert sm... |
258 |
rule->smk_access |= MAY_APPEND; |
e114e4737 Smack: Simplified... |
259 260 |
break; default: |
828716c28 Smack: check perm... |
261 |
return -1; |
e114e4737 Smack: Simplified... |
262 |
} |
5c6d1125f Smack: Transmute ... |
263 264 265 266 267 268 269 270 |
switch (data[SMK_LABELLEN + SMK_LABELLEN + 4]) { case '-': break; case 't': case 'T': rule->smk_access |= MAY_TRANSMUTE; break; default: |
828716c28 Smack: check perm... |
271 |
return -1; |
5c6d1125f Smack: Transmute ... |
272 |
} |
828716c28 Smack: check perm... |
273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 |
return 0; } /** * smk_write_load_list - write() for any /smack/load * @file: file pointer, not actually used * @buf: where to get the data from * @count: bytes sent * @ppos: where to start - must be 0 * @rule_list: the list of rules to write to * @rule_lock: lock for the rule list * * Get one smack access rule from above. * The format is exactly: * char subject[SMK_LABELLEN] * char object[SMK_LABELLEN] * char access[SMK_ACCESSLEN] * * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes. */ static ssize_t smk_write_load_list(struct file *file, const char __user *buf, size_t count, loff_t *ppos, struct list_head *rule_list, struct mutex *rule_lock) { |
272cd7a8c Smack: Rule list ... |
298 299 |
struct smack_master_list *smlp; struct smack_known *skp; |
828716c28 Smack: check perm... |
300 301 302 |
struct smack_rule *rule; char *data; int rc = -EINVAL; |
272cd7a8c Smack: Rule list ... |
303 |
int load = 0; |
828716c28 Smack: check perm... |
304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 |
/* * No partial writes. * Enough data must be present. */ if (*ppos != 0) return -EINVAL; /* * Minor hack for backward compatibility */ if (count < (SMK_OLOADLEN) || count > SMK_LOADLEN) return -EINVAL; data = kzalloc(SMK_LOADLEN, GFP_KERNEL); if (data == NULL) return -ENOMEM; if (copy_from_user(data, buf, count) != 0) { rc = -EFAULT; goto out; } /* * More on the minor hack for backward compatibility */ if (count == (SMK_OLOADLEN)) data[SMK_OLOADLEN] = '-'; rule = kzalloc(sizeof(*rule), GFP_KERNEL); if (rule == NULL) { rc = -ENOMEM; goto out; } |
0e94ae17c Smack: allow to a... |
337 |
if (smk_parse_rule(data, rule, 1)) |
828716c28 Smack: check perm... |
338 |
goto out_free_rule; |
272cd7a8c Smack: Rule list ... |
339 340 341 342 343 344 |
if (rule_list == NULL) { load = 1; skp = smk_find_entry(rule->smk_subject); rule_list = &skp->smk_rules; rule_lock = &skp->smk_rules_lock; } |
7898e1f8e Subject: [PATCH] ... |
345 346 |
rc = count; /* |
40809565c Smack: smackfs ci... |
347 348 |
* If this is "load" as opposed to "load-self" and a new rule * it needs to get added for reporting. |
7898e1f8e Subject: [PATCH] ... |
349 350 351 |
* smk_set_access returns true if there was already a rule * for the subject/object pair, and false if it was new. */ |
40809565c Smack: smackfs ci... |
352 |
if (load && !smk_set_access(rule, rule_list, rule_lock)) { |
272cd7a8c Smack: Rule list ... |
353 354 355 356 357 358 |
smlp = kzalloc(sizeof(*smlp), GFP_KERNEL); if (smlp != NULL) { smlp->smk_rule = rule; list_add_rcu(&smlp->list, &smack_rule_list); } else rc = -ENOMEM; |
7898e1f8e Subject: [PATCH] ... |
359 |
goto out; |
272cd7a8c Smack: Rule list ... |
360 |
} |
e114e4737 Smack: Simplified... |
361 |
|
7198e2eeb smack: convert sm... |
362 363 |
out_free_rule: kfree(rule); |
e114e4737 Smack: Simplified... |
364 365 366 367 |
out: kfree(data); return rc; } |
7898e1f8e Subject: [PATCH] ... |
368 |
/* |
40809565c Smack: smackfs ci... |
369 |
* Core logic for smackfs seq list operations. |
7898e1f8e Subject: [PATCH] ... |
370 |
*/ |
40809565c Smack: smackfs ci... |
371 372 |
static void *smk_seq_start(struct seq_file *s, loff_t *pos, struct list_head *head) |
7898e1f8e Subject: [PATCH] ... |
373 |
{ |
272cd7a8c Smack: Rule list ... |
374 375 376 377 378 379 |
struct list_head *list; /* * This is 0 the first time through. */ if (s->index == 0) |
40809565c Smack: smackfs ci... |
380 |
s->private = head; |
272cd7a8c Smack: Rule list ... |
381 382 |
if (s->private == NULL) |
7898e1f8e Subject: [PATCH] ... |
383 |
return NULL; |
272cd7a8c Smack: Rule list ... |
384 385 386 |
list = s->private; if (list_empty(list)) |
7898e1f8e Subject: [PATCH] ... |
387 |
return NULL; |
272cd7a8c Smack: Rule list ... |
388 389 390 391 |
if (s->index == 0) return list->next; return list; |
7898e1f8e Subject: [PATCH] ... |
392 |
} |
40809565c Smack: smackfs ci... |
393 394 |
static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos, struct list_head *head) |
7898e1f8e Subject: [PATCH] ... |
395 396 |
{ struct list_head *list = v; |
40809565c Smack: smackfs ci... |
397 |
if (list_is_last(list, head)) { |
272cd7a8c Smack: Rule list ... |
398 |
s->private = NULL; |
7898e1f8e Subject: [PATCH] ... |
399 400 |
return NULL; } |
272cd7a8c Smack: Rule list ... |
401 |
s->private = list->next; |
7898e1f8e Subject: [PATCH] ... |
402 403 |
return list->next; } |
40809565c Smack: smackfs ci... |
404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 |
static void smk_seq_stop(struct seq_file *s, void *v) { /* No-op */ } /* * Seq_file read operations for /smack/load */ static void *load_seq_start(struct seq_file *s, loff_t *pos) { return smk_seq_start(s, pos, &smack_rule_list); } static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos) { return smk_seq_next(s, v, pos, &smack_rule_list); } |
7898e1f8e Subject: [PATCH] ... |
422 423 424 |
static int load_seq_show(struct seq_file *s, void *v) { struct list_head *list = v; |
272cd7a8c Smack: Rule list ... |
425 426 427 |
struct smack_master_list *smlp = list_entry(list, struct smack_master_list, list); struct smack_rule *srp = smlp->smk_rule; |
7898e1f8e Subject: [PATCH] ... |
428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 |
seq_printf(s, "%s %s", (char *)srp->smk_subject, (char *)srp->smk_object); seq_putc(s, ' '); if (srp->smk_access & MAY_READ) seq_putc(s, 'r'); if (srp->smk_access & MAY_WRITE) seq_putc(s, 'w'); if (srp->smk_access & MAY_EXEC) seq_putc(s, 'x'); if (srp->smk_access & MAY_APPEND) seq_putc(s, 'a'); if (srp->smk_access & MAY_TRANSMUTE) seq_putc(s, 't'); if (srp->smk_access == 0) seq_putc(s, '-'); seq_putc(s, ' '); return 0; } |
7898e1f8e Subject: [PATCH] ... |
452 453 454 455 |
static const struct seq_operations load_seq_ops = { .start = load_seq_start, .next = load_seq_next, .show = load_seq_show, |
40809565c Smack: smackfs ci... |
456 |
.stop = smk_seq_stop, |
7898e1f8e Subject: [PATCH] ... |
457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 |
}; /** * smk_open_load - open() for /smack/load * @inode: inode structure representing file * @file: "load" file pointer * * For reading, use load_seq_* seq_file reading operations. */ static int smk_open_load(struct inode *inode, struct file *file) { return seq_open(file, &load_seq_ops); } /** * smk_write_load - write() for /smack/load * @file: file pointer, not actually used * @buf: where to get the data from * @count: bytes sent * @ppos: where to start - must be 0 * */ static ssize_t smk_write_load(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { /* * Must have privilege. * No partial writes. * Enough data must be present. */ if (!capable(CAP_MAC_ADMIN)) return -EPERM; |
272cd7a8c Smack: Rule list ... |
490 |
return smk_write_load_list(file, buf, count, ppos, NULL, NULL); |
7898e1f8e Subject: [PATCH] ... |
491 |
} |
e114e4737 Smack: Simplified... |
492 493 494 495 496 |
static const struct file_operations smk_load_ops = { .open = smk_open_load, .read = seq_read, .llseek = seq_lseek, .write = smk_write_load, |
cb622bbb6 smackfs: remove r... |
497 |
.release = seq_release, |
e114e4737 Smack: Simplified... |
498 499 500 501 502 |
}; /** * smk_cipso_doi - initialize the CIPSO domain */ |
30aa4faf6 smack: make smk_c... |
503 |
static void smk_cipso_doi(void) |
e114e4737 Smack: Simplified... |
504 505 506 |
{ int rc; struct cipso_v4_doi *doip; |
6d3dc07cb smack: Add suppor... |
507 |
struct netlbl_audit nai; |
e114e4737 Smack: Simplified... |
508 |
|
6d3dc07cb smack: Add suppor... |
509 |
smk_netlabel_audit_set(&nai); |
4bc87e627 Smack: unlabeled ... |
510 |
|
6d3dc07cb smack: Add suppor... |
511 |
rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai); |
e114e4737 Smack: Simplified... |
512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 |
if (rc != 0) printk(KERN_WARNING "%s:%d remove rc = %d ", __func__, __LINE__, rc); doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL); if (doip == NULL) panic("smack: Failed to initialize cipso DOI. "); doip->map.std = NULL; doip->doi = smk_cipso_doi_value; doip->type = CIPSO_V4_MAP_PASS; doip->tags[0] = CIPSO_V4_TAG_RBITMAP; for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++) doip->tags[rc] = CIPSO_V4_TAG_INVALID; |
6d3dc07cb smack: Add suppor... |
527 |
rc = netlbl_cfg_cipsov4_add(doip, &nai); |
b1edeb102 netlabel: Replace... |
528 |
if (rc != 0) { |
6c2e8ac09 netlabel: Update ... |
529 530 531 532 533 534 |
printk(KERN_WARNING "%s:%d cipso add rc = %d ", __func__, __LINE__, rc); kfree(doip); return; } |
6d3dc07cb smack: Add suppor... |
535 |
rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai); |
6c2e8ac09 netlabel: Update ... |
536 537 538 |
if (rc != 0) { printk(KERN_WARNING "%s:%d map add rc = %d ", |
e114e4737 Smack: Simplified... |
539 |
__func__, __LINE__, rc); |
b1edeb102 netlabel: Replace... |
540 |
kfree(doip); |
6c2e8ac09 netlabel: Update ... |
541 |
return; |
b1edeb102 netlabel: Replace... |
542 |
} |
e114e4737 Smack: Simplified... |
543 |
} |
4bc87e627 Smack: unlabeled ... |
544 545 |
/** * smk_unlbl_ambient - initialize the unlabeled domain |
251a2a958 smack: fix lots o... |
546 |
* @oldambient: previous domain string |
4bc87e627 Smack: unlabeled ... |
547 |
*/ |
30aa4faf6 smack: make smk_c... |
548 |
static void smk_unlbl_ambient(char *oldambient) |
4bc87e627 Smack: unlabeled ... |
549 550 |
{ int rc; |
6d3dc07cb smack: Add suppor... |
551 |
struct netlbl_audit nai; |
4bc87e627 Smack: unlabeled ... |
552 |
|
6d3dc07cb smack: Add suppor... |
553 |
smk_netlabel_audit_set(&nai); |
4bc87e627 Smack: unlabeled ... |
554 555 |
if (oldambient != NULL) { |
6d3dc07cb smack: Add suppor... |
556 |
rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai); |
4bc87e627 Smack: unlabeled ... |
557 558 559 560 561 |
if (rc != 0) printk(KERN_WARNING "%s:%d remove rc = %d ", __func__, __LINE__, rc); } |
6d3dc07cb smack: Add suppor... |
562 563 |
rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET, NULL, NULL, &nai); |
4bc87e627 Smack: unlabeled ... |
564 565 566 567 568 |
if (rc != 0) printk(KERN_WARNING "%s:%d add rc = %d ", __func__, __LINE__, rc); } |
e114e4737 Smack: Simplified... |
569 570 571 572 573 574 |
/* * Seq_file read operations for /smack/cipso */ static void *cipso_seq_start(struct seq_file *s, loff_t *pos) { |
40809565c Smack: smackfs ci... |
575 |
return smk_seq_start(s, pos, &smack_known_list); |
e114e4737 Smack: Simplified... |
576 577 578 579 |
} static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos) { |
40809565c Smack: smackfs ci... |
580 |
return smk_seq_next(s, v, pos, &smack_known_list); |
e114e4737 Smack: Simplified... |
581 582 583 584 585 586 587 588 |
} /* * Print cipso labels in format: * label level[/cat[,cat]] */ static int cipso_seq_show(struct seq_file *s, void *v) { |
7198e2eeb smack: convert sm... |
589 590 591 |
struct list_head *list = v; struct smack_known *skp = list_entry(list, struct smack_known, list); |
e114e4737 Smack: Simplified... |
592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 |
struct smack_cipso *scp = skp->smk_cipso; char *cbp; char sep = '/'; int cat = 1; int i; unsigned char m; if (scp == NULL) return 0; seq_printf(s, "%s %3d", (char *)&skp->smk_known, scp->smk_level); cbp = scp->smk_catset; for (i = 0; i < SMK_LABELLEN; i++) for (m = 0x80; m != 0; m >>= 1) { if (m & cbp[i]) { seq_printf(s, "%c%d", sep, cat); sep = ','; } cat++; } seq_putc(s, ' '); return 0; } |
88e9d34c7 seq_file: constif... |
619 |
static const struct seq_operations cipso_seq_ops = { |
e114e4737 Smack: Simplified... |
620 |
.start = cipso_seq_start, |
e114e4737 Smack: Simplified... |
621 622 |
.next = cipso_seq_next, .show = cipso_seq_show, |
40809565c Smack: smackfs ci... |
623 |
.stop = smk_seq_stop, |
e114e4737 Smack: Simplified... |
624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 |
}; /** * smk_open_cipso - open() for /smack/cipso * @inode: inode structure representing file * @file: "cipso" file pointer * * Connect our cipso_seq_* operations with /smack/cipso * file_operations */ static int smk_open_cipso(struct inode *inode, struct file *file) { return seq_open(file, &cipso_seq_ops); } /** * smk_write_cipso - write() for /smack/cipso |
251a2a958 smack: fix lots o... |
641 |
* @file: file pointer, not actually used |
e114e4737 Smack: Simplified... |
642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Accepts only one cipso rule per write call. * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_cipso(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct smack_known *skp; struct smack_cipso *scp = NULL; char mapcatset[SMK_LABELLEN]; int maplevel; int cat; int catlen; ssize_t rc = -EINVAL; char *data = NULL; char *rule; int ret; int i; /* * Must have privilege. * No partial writes. * Enough data must be present. */ if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (*ppos != 0) return -EINVAL; |
b500ce8d2 smackfs: do not t... |
673 |
if (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX) |
e114e4737 Smack: Simplified... |
674 675 676 677 678 679 680 681 682 683 |
return -EINVAL; data = kzalloc(count + 1, GFP_KERNEL); if (data == NULL) return -ENOMEM; if (copy_from_user(data, buf, count) != 0) { rc = -EFAULT; goto unlockedout; } |
4303154e8 smack: Add a new ... |
684 685 686 687 688 |
/* labels cannot begin with a '-' */ if (data[0] == '-') { rc = -EINVAL; goto unlockedout; } |
e114e4737 Smack: Simplified... |
689 690 691 692 693 694 695 696 697 698 699 |
data[count] = '\0'; rule = data; /* * Only allow one writer at a time. Writes should be * quite rare and small in any case. */ mutex_lock(&smack_cipso_lock); skp = smk_import_entry(rule, 0); if (skp == NULL) goto out; |
c19a28e11 remove lots of do... |
700 |
rule += SMK_LABELLEN; |
e114e4737 Smack: Simplified... |
701 702 703 704 705 706 707 708 |
ret = sscanf(rule, "%d", &maplevel); if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL) goto out; rule += SMK_DIGITLEN; ret = sscanf(rule, "%d", &catlen); if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM) goto out; |
b500ce8d2 smackfs: do not t... |
709 |
if (count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN)) |
e114e4737 Smack: Simplified... |
710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 |
goto out; memset(mapcatset, 0, sizeof(mapcatset)); for (i = 0; i < catlen; i++) { rule += SMK_DIGITLEN; ret = sscanf(rule, "%d", &cat); if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL) goto out; smack_catset_bit(cat, mapcatset); } if (skp->smk_cipso == NULL) { scp = kzalloc(sizeof(struct smack_cipso), GFP_KERNEL); if (scp == NULL) { rc = -ENOMEM; goto out; } } spin_lock_bh(&skp->smk_cipsolock); if (scp == NULL) scp = skp->smk_cipso; else skp->smk_cipso = scp; scp->smk_level = maplevel; memcpy(scp->smk_catset, mapcatset, sizeof(mapcatset)); spin_unlock_bh(&skp->smk_cipsolock); rc = count; out: mutex_unlock(&smack_cipso_lock); unlockedout: kfree(data); return rc; } static const struct file_operations smk_cipso_ops = { .open = smk_open_cipso, .read = seq_read, .llseek = seq_lseek, .write = smk_write_cipso, .release = seq_release, }; |
6d3dc07cb smack: Add suppor... |
758 759 760 761 762 763 |
/* * Seq_file read operations for /smack/netlabel */ static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos) { |
40809565c Smack: smackfs ci... |
764 |
return smk_seq_start(s, pos, &smk_netlbladdr_list); |
6d3dc07cb smack: Add suppor... |
765 766 767 768 |
} static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos) { |
40809565c Smack: smackfs ci... |
769 |
return smk_seq_next(s, v, pos, &smk_netlbladdr_list); |
6d3dc07cb smack: Add suppor... |
770 |
} |
6d3dc07cb smack: Add suppor... |
771 772 773 774 775 776 777 |
#define BEBITS (sizeof(__be32) * 8) /* * Print host/label pairs */ static int netlbladdr_seq_show(struct seq_file *s, void *v) { |
7198e2eeb smack: convert sm... |
778 779 780 |
struct list_head *list = v; struct smk_netlbladdr *skp = list_entry(list, struct smk_netlbladdr, list); |
6d3dc07cb smack: Add suppor... |
781 |
unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr; |
113a0e459 smack: fixes for ... |
782 783 |
int maskn; u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr); |
6d3dc07cb smack: Add suppor... |
784 |
|
113a0e459 smack: fixes for ... |
785 |
for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++); |
6d3dc07cb smack: Add suppor... |
786 787 788 789 790 791 792 |
seq_printf(s, "%u.%u.%u.%u/%d %s ", hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label); return 0; } |
88e9d34c7 seq_file: constif... |
793 |
static const struct seq_operations netlbladdr_seq_ops = { |
6d3dc07cb smack: Add suppor... |
794 |
.start = netlbladdr_seq_start, |
6d3dc07cb smack: Add suppor... |
795 796 |
.next = netlbladdr_seq_next, .show = netlbladdr_seq_show, |
40809565c Smack: smackfs ci... |
797 |
.stop = smk_seq_stop, |
6d3dc07cb smack: Add suppor... |
798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 |
}; /** * smk_open_netlbladdr - open() for /smack/netlabel * @inode: inode structure representing file * @file: "netlabel" file pointer * * Connect our netlbladdr_seq_* operations with /smack/netlabel * file_operations */ static int smk_open_netlbladdr(struct inode *inode, struct file *file) { return seq_open(file, &netlbladdr_seq_ops); } /** |
113a0e459 smack: fixes for ... |
814 815 816 817 818 |
* smk_netlbladdr_insert * @new : netlabel to insert * * This helper insert netlabel in the smack_netlbladdrs list * sorted by netmask length (longest to smallest) |
7198e2eeb smack: convert sm... |
819 820 |
* locked by &smk_netlbladdr_lock in smk_write_netlbladdr * |
113a0e459 smack: fixes for ... |
821 822 823 |
*/ static void smk_netlbladdr_insert(struct smk_netlbladdr *new) { |
7198e2eeb smack: convert sm... |
824 |
struct smk_netlbladdr *m, *m_next; |
113a0e459 smack: fixes for ... |
825 |
|
7198e2eeb smack: convert sm... |
826 827 |
if (list_empty(&smk_netlbladdr_list)) { list_add_rcu(&new->list, &smk_netlbladdr_list); |
113a0e459 smack: fixes for ... |
828 829 |
return; } |
05725f7eb rculist: use list... |
830 831 |
m = list_entry_rcu(smk_netlbladdr_list.next, struct smk_netlbladdr, list); |
7198e2eeb smack: convert sm... |
832 |
|
113a0e459 smack: fixes for ... |
833 |
/* the comparison '>' is a bit hacky, but works */ |
7198e2eeb smack: convert sm... |
834 835 |
if (new->smk_mask.s_addr > m->smk_mask.s_addr) { list_add_rcu(&new->list, &smk_netlbladdr_list); |
113a0e459 smack: fixes for ... |
836 837 |
return; } |
7198e2eeb smack: convert sm... |
838 839 840 841 |
list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) { if (list_is_last(&m->list, &smk_netlbladdr_list)) { list_add_rcu(&new->list, &m->list); |
113a0e459 smack: fixes for ... |
842 843 |
return; } |
05725f7eb rculist: use list... |
844 845 |
m_next = list_entry_rcu(m->list.next, struct smk_netlbladdr, list); |
7198e2eeb smack: convert sm... |
846 847 |
if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) { list_add_rcu(&new->list, &m->list); |
113a0e459 smack: fixes for ... |
848 849 850 851 852 853 854 |
return; } } } /** |
6d3dc07cb smack: Add suppor... |
855 |
* smk_write_netlbladdr - write() for /smack/netlabel |
251a2a958 smack: fix lots o... |
856 |
* @file: file pointer, not actually used |
6d3dc07cb smack: Add suppor... |
857 858 859 860 861 862 863 864 865 866 867 868 869 870 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Accepts only one netlbladdr per write call. * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct smk_netlbladdr *skp; struct sockaddr_in newname; char smack[SMK_LABELLEN]; char *sp; |
6470c077c smack: do not bey... |
871 |
char data[SMK_NETLBLADDRMAX + 1]; |
6d3dc07cb smack: Add suppor... |
872 873 874 875 876 |
char *host = (char *)&newname.sin_addr.s_addr; int rc; struct netlbl_audit audit_info; struct in_addr mask; unsigned int m; |
7198e2eeb smack: convert sm... |
877 |
int found; |
113a0e459 smack: fixes for ... |
878 |
u32 mask_bits = (1<<31); |
6d3dc07cb smack: Add suppor... |
879 |
__be32 nsa; |
113a0e459 smack: fixes for ... |
880 |
u32 temp_mask; |
6d3dc07cb smack: Add suppor... |
881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 |
/* * Must have privilege. * No partial writes. * Enough data must be present. * "<addr/mask, as a.b.c.d/e><space><label>" * "<addr, as a.b.c.d><space><label>" */ if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (*ppos != 0) return -EINVAL; if (count < SMK_NETLBLADDRMIN || count > SMK_NETLBLADDRMAX) return -EINVAL; if (copy_from_user(data, buf, count) != 0) return -EFAULT; data[count] = '\0'; rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s", &host[0], &host[1], &host[2], &host[3], &m, smack); if (rc != 6) { rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s", &host[0], &host[1], &host[2], &host[3], smack); if (rc != 5) return -EINVAL; m = BEBITS; } if (m > BEBITS) return -EINVAL; |
4303154e8 smack: Add a new ... |
911 912 913 914 915 916 917 918 919 920 921 922 |
/* if smack begins with '-', its an option, don't import it */ if (smack[0] != '-') { sp = smk_import(smack, 0); if (sp == NULL) return -EINVAL; } else { /* check known options */ if (strcmp(smack, smack_cipso_option) == 0) sp = (char *)smack_cipso_option; else return -EINVAL; } |
6d3dc07cb smack: Add suppor... |
923 |
|
113a0e459 smack: fixes for ... |
924 925 926 |
for (temp_mask = 0; m > 0; m--) { temp_mask |= mask_bits; mask_bits >>= 1; |
6d3dc07cb smack: Add suppor... |
927 |
} |
113a0e459 smack: fixes for ... |
928 929 930 |
mask.s_addr = cpu_to_be32(temp_mask); newname.sin_addr.s_addr &= mask.s_addr; |
6d3dc07cb smack: Add suppor... |
931 932 933 934 935 936 937 |
/* * Only allow one writer at a time. Writes should be * quite rare and small in any case. */ mutex_lock(&smk_netlbladdr_lock); nsa = newname.sin_addr.s_addr; |
113a0e459 smack: fixes for ... |
938 |
/* try to find if the prefix is already in the list */ |
7198e2eeb smack: convert sm... |
939 940 |
found = 0; list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) { |
6d3dc07cb smack: Add suppor... |
941 |
if (skp->smk_host.sin_addr.s_addr == nsa && |
7198e2eeb smack: convert sm... |
942 943 |
skp->smk_mask.s_addr == mask.s_addr) { found = 1; |
6d3dc07cb smack: Add suppor... |
944 |
break; |
7198e2eeb smack: convert sm... |
945 946 |
} } |
6d3dc07cb smack: Add suppor... |
947 |
smk_netlabel_audit_set(&audit_info); |
7198e2eeb smack: convert sm... |
948 |
if (found == 0) { |
6d3dc07cb smack: Add suppor... |
949 950 951 952 953 954 955 |
skp = kzalloc(sizeof(*skp), GFP_KERNEL); if (skp == NULL) rc = -ENOMEM; else { rc = 0; skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr; skp->smk_mask.s_addr = mask.s_addr; |
6d3dc07cb smack: Add suppor... |
956 |
skp->smk_label = sp; |
113a0e459 smack: fixes for ... |
957 |
smk_netlbladdr_insert(skp); |
6d3dc07cb smack: Add suppor... |
958 959 |
} } else { |
4303154e8 smack: Add a new ... |
960 |
/* we delete the unlabeled entry, only if the previous label |
25985edce Fix common misspe... |
961 |
* wasn't the special CIPSO option */ |
4303154e8 smack: Add a new ... |
962 963 964 965 966 967 |
if (skp->smk_label != smack_cipso_option) rc = netlbl_cfg_unlbl_static_del(&init_net, NULL, &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET, &audit_info); else rc = 0; |
6d3dc07cb smack: Add suppor... |
968 969 970 971 972 973 |
skp->smk_label = sp; } /* * Now tell netlabel about the single label nature of * this host so that incoming packets get labeled. |
4303154e8 smack: Add a new ... |
974 |
* but only if we didn't get the special CIPSO option |
6d3dc07cb smack: Add suppor... |
975 |
*/ |
4303154e8 smack: Add a new ... |
976 |
if (rc == 0 && sp != smack_cipso_option) |
6d3dc07cb smack: Add suppor... |
977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 |
rc = netlbl_cfg_unlbl_static_add(&init_net, NULL, &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET, smack_to_secid(skp->smk_label), &audit_info); if (rc == 0) rc = count; mutex_unlock(&smk_netlbladdr_lock); return rc; } static const struct file_operations smk_netlbladdr_ops = { .open = smk_open_netlbladdr, .read = seq_read, .llseek = seq_lseek, .write = smk_write_netlbladdr, .release = seq_release, }; |
e114e4737 Smack: Simplified... |
996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 |
/** * smk_read_doi - read() for /smack/doi * @filp: file pointer, not actually used * @buf: where to put the result * @count: maximum to send along * @ppos: where to start * * Returns number of bytes read or error code, as appropriate */ static ssize_t smk_read_doi(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { char temp[80]; ssize_t rc; if (*ppos != 0) return 0; sprintf(temp, "%d", smk_cipso_doi_value); rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); return rc; } /** * smk_write_doi - write() for /smack/doi |
251a2a958 smack: fix lots o... |
1022 |
* @file: file pointer, not actually used |
e114e4737 Smack: Simplified... |
1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_doi(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { char temp[80]; int i; if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (count >= sizeof(temp) || count == 0) return -EINVAL; if (copy_from_user(temp, buf, count) != 0) return -EFAULT; temp[count] = '\0'; if (sscanf(temp, "%d", &i) != 1) return -EINVAL; smk_cipso_doi_value = i; smk_cipso_doi(); return count; } static const struct file_operations smk_doi_ops = { .read = smk_read_doi, .write = smk_write_doi, |
6038f373a llseek: automatic... |
1059 |
.llseek = default_llseek, |
e114e4737 Smack: Simplified... |
1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 |
}; /** * smk_read_direct - read() for /smack/direct * @filp: file pointer, not actually used * @buf: where to put the result * @count: maximum to send along * @ppos: where to start * * Returns number of bytes read or error code, as appropriate */ static ssize_t smk_read_direct(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { char temp[80]; ssize_t rc; if (*ppos != 0) return 0; sprintf(temp, "%d", smack_cipso_direct); rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); return rc; } /** * smk_write_direct - write() for /smack/direct |
251a2a958 smack: fix lots o... |
1088 |
* @file: file pointer, not actually used |
e114e4737 Smack: Simplified... |
1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_direct(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { char temp[80]; int i; if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (count >= sizeof(temp) || count == 0) return -EINVAL; if (copy_from_user(temp, buf, count) != 0) return -EFAULT; temp[count] = '\0'; if (sscanf(temp, "%d", &i) != 1) return -EINVAL; smack_cipso_direct = i; return count; } static const struct file_operations smk_direct_ops = { .read = smk_read_direct, .write = smk_write_direct, |
6038f373a llseek: automatic... |
1123 |
.llseek = default_llseek, |
e114e4737 Smack: Simplified... |
1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 |
}; /** * smk_read_ambient - read() for /smack/ambient * @filp: file pointer, not actually used * @buf: where to put the result * @cn: maximum to send along * @ppos: where to start * * Returns number of bytes read or error code, as appropriate */ static ssize_t smk_read_ambient(struct file *filp, char __user *buf, size_t cn, loff_t *ppos) { ssize_t rc; |
e114e4737 Smack: Simplified... |
1139 1140 1141 1142 1143 1144 1145 |
int asize; if (*ppos != 0) return 0; /* * Being careful to avoid a problem in the case where * smack_net_ambient gets changed in midstream. |
e114e4737 Smack: Simplified... |
1146 |
*/ |
4bc87e627 Smack: unlabeled ... |
1147 |
mutex_lock(&smack_ambient_lock); |
e114e4737 Smack: Simplified... |
1148 |
|
4bc87e627 Smack: unlabeled ... |
1149 1150 1151 1152 1153 1154 1155 |
asize = strlen(smack_net_ambient) + 1; if (cn >= asize) rc = simple_read_from_buffer(buf, cn, ppos, smack_net_ambient, asize); else rc = -EINVAL; |
e114e4737 Smack: Simplified... |
1156 |
|
4bc87e627 Smack: unlabeled ... |
1157 |
mutex_unlock(&smack_ambient_lock); |
e114e4737 Smack: Simplified... |
1158 1159 1160 1161 1162 1163 |
return rc; } /** * smk_write_ambient - write() for /smack/ambient |
251a2a958 smack: fix lots o... |
1164 |
* @file: file pointer, not actually used |
e114e4737 Smack: Simplified... |
1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_ambient(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { char in[SMK_LABELLEN]; |
4bc87e627 Smack: unlabeled ... |
1175 |
char *oldambient; |
e114e4737 Smack: Simplified... |
1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 |
char *smack; if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (count >= SMK_LABELLEN) return -EINVAL; if (copy_from_user(in, buf, count) != 0) return -EFAULT; smack = smk_import(in, count); if (smack == NULL) return -EINVAL; |
4bc87e627 Smack: unlabeled ... |
1190 1191 1192 |
mutex_lock(&smack_ambient_lock); oldambient = smack_net_ambient; |
e114e4737 Smack: Simplified... |
1193 |
smack_net_ambient = smack; |
4bc87e627 Smack: unlabeled ... |
1194 1195 1196 |
smk_unlbl_ambient(oldambient); mutex_unlock(&smack_ambient_lock); |
e114e4737 Smack: Simplified... |
1197 1198 1199 1200 1201 1202 1203 |
return count; } static const struct file_operations smk_ambient_ops = { .read = smk_read_ambient, .write = smk_write_ambient, |
6038f373a llseek: automatic... |
1204 |
.llseek = default_llseek, |
e114e4737 Smack: Simplified... |
1205 |
}; |
154462353 smack: limit priv... |
1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 |
/** * smk_read_onlycap - read() for /smack/onlycap * @filp: file pointer, not actually used * @buf: where to put the result * @cn: maximum to send along * @ppos: where to start * * Returns number of bytes read or error code, as appropriate */ static ssize_t smk_read_onlycap(struct file *filp, char __user *buf, size_t cn, loff_t *ppos) { char *smack = ""; ssize_t rc = -EINVAL; int asize; if (*ppos != 0) return 0; if (smack_onlycap != NULL) smack = smack_onlycap; asize = strlen(smack) + 1; if (cn >= asize) rc = simple_read_from_buffer(buf, cn, ppos, smack, asize); return rc; } /** * smk_write_onlycap - write() for /smack/onlycap |
251a2a958 smack: fix lots o... |
1238 |
* @file: file pointer, not actually used |
154462353 smack: limit priv... |
1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 |
* @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { char in[SMK_LABELLEN]; |
676dac4b1 This patch adds a... |
1249 |
char *sp = smk_of_task(current->cred->security); |
154462353 smack: limit priv... |
1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 |
if (!capable(CAP_MAC_ADMIN)) return -EPERM; /* * This can be done using smk_access() but is done * explicitly for clarity. The smk_access() implementation * would use smk_access(smack_onlycap, MAY_WRITE) */ if (smack_onlycap != NULL && smack_onlycap != sp) return -EPERM; if (count >= SMK_LABELLEN) return -EINVAL; if (copy_from_user(in, buf, count) != 0) return -EFAULT; /* * Should the null string be passed in unset the onlycap value. * This seems like something to be careful with as usually * smk_import only expects to return NULL for errors. It * is usually the case that a nullstring or " " would be * bad to pass to smk_import but in fact this is useful here. */ smack_onlycap = smk_import(in, count); return count; } static const struct file_operations smk_onlycap_ops = { .read = smk_read_onlycap, .write = smk_write_onlycap, |
6038f373a llseek: automatic... |
1284 |
.llseek = default_llseek, |
154462353 smack: limit priv... |
1285 |
}; |
e114e4737 Smack: Simplified... |
1286 |
/** |
ecfcc53fe smack: implement ... |
1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 |
* smk_read_logging - read() for /smack/logging * @filp: file pointer, not actually used * @buf: where to put the result * @cn: maximum to send along * @ppos: where to start * * Returns number of bytes read or error code, as appropriate */ static ssize_t smk_read_logging(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { char temp[32]; ssize_t rc; if (*ppos != 0) return 0; sprintf(temp, "%d ", log_policy); rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp)); return rc; } /** * smk_write_logging - write() for /smack/logging * @file: file pointer, not actually used * @buf: where to get the data from * @count: bytes sent * @ppos: where to start * * Returns number of bytes written or error code, as appropriate */ static ssize_t smk_write_logging(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { char temp[32]; int i; if (!capable(CAP_MAC_ADMIN)) return -EPERM; if (count >= sizeof(temp) || count == 0) return -EINVAL; if (copy_from_user(temp, buf, count) != 0) return -EFAULT; temp[count] = '\0'; if (sscanf(temp, "%d", &i) != 1) return -EINVAL; if (i < 0 || i > 3) return -EINVAL; log_policy = i; return count; } static const struct file_operations smk_logging_ops = { .read = smk_read_logging, .write = smk_write_logging, |
6038f373a llseek: automatic... |
1349 |
.llseek = default_llseek, |
ecfcc53fe smack: implement ... |
1350 |
}; |
7898e1f8e Subject: [PATCH] ... |
1351 1352 1353 1354 1355 1356 1357 1358 |
/* * Seq_file read operations for /smack/load-self */ static void *load_self_seq_start(struct seq_file *s, loff_t *pos) { struct task_smack *tsp = current_security(); |
40809565c Smack: smackfs ci... |
1359 |
return smk_seq_start(s, pos, &tsp->smk_rules); |
7898e1f8e Subject: [PATCH] ... |
1360 1361 1362 1363 1364 |
} static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos) { struct task_smack *tsp = current_security(); |
7898e1f8e Subject: [PATCH] ... |
1365 |
|
40809565c Smack: smackfs ci... |
1366 |
return smk_seq_next(s, v, pos, &tsp->smk_rules); |
7898e1f8e Subject: [PATCH] ... |
1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 |
} static int load_self_seq_show(struct seq_file *s, void *v) { struct list_head *list = v; struct smack_rule *srp = list_entry(list, struct smack_rule, list); seq_printf(s, "%s %s", (char *)srp->smk_subject, (char *)srp->smk_object); seq_putc(s, ' '); if (srp->smk_access & MAY_READ) seq_putc(s, 'r'); if (srp->smk_access & MAY_WRITE) seq_putc(s, 'w'); if (srp->smk_access & MAY_EXEC) seq_putc(s, 'x'); if (srp->smk_access & MAY_APPEND) seq_putc(s, 'a'); if (srp->smk_access & MAY_TRANSMUTE) seq_putc(s, 't'); if (srp->smk_access == 0) seq_putc(s, '-'); seq_putc(s, ' '); return 0; } |
7898e1f8e Subject: [PATCH] ... |
1398 1399 1400 1401 |
static const struct seq_operations load_self_seq_ops = { .start = load_self_seq_start, .next = load_self_seq_next, .show = load_self_seq_show, |
40809565c Smack: smackfs ci... |
1402 |
.stop = smk_seq_stop, |
7898e1f8e Subject: [PATCH] ... |
1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 |
}; /** * smk_open_load_self - open() for /smack/load-self * @inode: inode structure representing file * @file: "load" file pointer * * For reading, use load_seq_* seq_file reading operations. */ static int smk_open_load_self(struct inode *inode, struct file *file) { return seq_open(file, &load_self_seq_ops); } /** * smk_write_load_self - write() for /smack/load-self * @file: file pointer, not actually used * @buf: where to get the data from * @count: bytes sent * @ppos: where to start - must be 0 * */ static ssize_t smk_write_load_self(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct task_smack *tsp = current_security(); return smk_write_load_list(file, buf, count, ppos, &tsp->smk_rules, &tsp->smk_rules_lock); } static const struct file_operations smk_load_self_ops = { .open = smk_open_load_self, .read = seq_read, .llseek = seq_lseek, .write = smk_write_load_self, .release = seq_release, }; |
828716c28 Smack: check perm... |
1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 |
/** * smk_write_access - handle access check transaction * @file: file pointer * @buf: data from user space * @count: bytes sent * @ppos: where to start - must be 0 */ static ssize_t smk_write_access(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { struct smack_rule rule; char *data; |
f8859d98c Smack: fix for /s... |
1455 |
int res; |
828716c28 Smack: check perm... |
1456 |
|
828716c28 Smack: check perm... |
1457 1458 1459 |
data = simple_transaction_get(file, buf, count); if (IS_ERR(data)) return PTR_ERR(data); |
0e94ae17c Smack: allow to a... |
1460 |
if (count < SMK_LOADLEN || smk_parse_rule(data, &rule, 0)) |
828716c28 Smack: check perm... |
1461 |
return -EINVAL; |
f8859d98c Smack: fix for /s... |
1462 1463 1464 1465 |
res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access, NULL); data[0] = res == 0 ? '1' : '0'; data[1] = '\0'; |
828716c28 Smack: check perm... |
1466 |
|
d86b2b61d Smack: fix: inval... |
1467 |
simple_transaction_set(file, 2); |
828716c28 Smack: check perm... |
1468 1469 1470 1471 1472 1473 1474 1475 1476 |
return SMK_LOADLEN; } static const struct file_operations smk_access_ops = { .write = smk_write_access, .read = simple_transaction_read, .release = simple_transaction_release, .llseek = generic_file_llseek, }; |
ecfcc53fe smack: implement ... |
1477 |
/** |
e114e4737 Smack: Simplified... |
1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 |
* smk_fill_super - fill the /smackfs superblock * @sb: the empty superblock * @data: unused * @silent: unused * * Fill in the well known entries for /smack * * Returns 0 on success, an error code on failure */ static int smk_fill_super(struct super_block *sb, void *data, int silent) { int rc; struct inode *root_inode; static struct tree_descr smack_files[] = { |
7898e1f8e Subject: [PATCH] ... |
1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 |
[SMK_LOAD] = { "load", &smk_load_ops, S_IRUGO|S_IWUSR}, [SMK_CIPSO] = { "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR}, [SMK_DOI] = { "doi", &smk_doi_ops, S_IRUGO|S_IWUSR}, [SMK_DIRECT] = { "direct", &smk_direct_ops, S_IRUGO|S_IWUSR}, [SMK_AMBIENT] = { "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR}, [SMK_NETLBLADDR] = { "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR}, [SMK_ONLYCAP] = { "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR}, [SMK_LOGGING] = { "logging", &smk_logging_ops, S_IRUGO|S_IWUSR}, [SMK_LOAD_SELF] = { "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO}, |
828716c28 Smack: check perm... |
1511 |
[SMK_ACCESSES] = { |
0e94ae17c Smack: allow to a... |
1512 |
"access", &smk_access_ops, S_IRUGO|S_IWUGO}, |
7898e1f8e Subject: [PATCH] ... |
1513 1514 |
/* last one */ {""} |
e114e4737 Smack: Simplified... |
1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 |
}; rc = simple_fill_super(sb, SMACK_MAGIC, smack_files); if (rc != 0) { printk(KERN_ERR "%s failed %d while creating inodes ", __func__, rc); return rc; } root_inode = sb->s_root->d_inode; root_inode->i_security = new_inode_smack(smack_known_floor.smk_known); return 0; } /** |
fc14f2fef convert get_sb_si... |
1532 |
* smk_mount - get the smackfs superblock |
e114e4737 Smack: Simplified... |
1533 1534 1535 1536 |
* @fs_type: passed along without comment * @flags: passed along without comment * @dev_name: passed along without comment * @data: passed along without comment |
e114e4737 Smack: Simplified... |
1537 1538 1539 1540 1541 |
* * Just passes everything along. * * Returns what the lower level code does. */ |
fc14f2fef convert get_sb_si... |
1542 1543 |
static struct dentry *smk_mount(struct file_system_type *fs_type, int flags, const char *dev_name, void *data) |
e114e4737 Smack: Simplified... |
1544 |
{ |
fc14f2fef convert get_sb_si... |
1545 |
return mount_single(fs_type, flags, data, smk_fill_super); |
e114e4737 Smack: Simplified... |
1546 1547 1548 1549 |
} static struct file_system_type smk_fs_type = { .name = "smackfs", |
fc14f2fef convert get_sb_si... |
1550 |
.mount = smk_mount, |
e114e4737 Smack: Simplified... |
1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 |
.kill_sb = kill_litter_super, }; static struct vfsmount *smackfs_mount; /** * init_smk_fs - get the smackfs superblock * * register the smackfs * |
076c54c5b Security: Introdu... |
1561 1562 1563 1564 1565 1566 1567 |
* Do not register smackfs if Smack wasn't enabled * on boot. We can not put this method normally under the * smack_init() code path since the security subsystem get * initialized before the vfs caches. * * Returns true if we were not chosen on boot or if * we were chosen and filesystem registration succeeded. |
e114e4737 Smack: Simplified... |
1568 1569 1570 1571 |
*/ static int __init init_smk_fs(void) { int err; |
076c54c5b Security: Introdu... |
1572 1573 |
if (!security_module_enable(&smack_ops)) return 0; |
e114e4737 Smack: Simplified... |
1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 |
err = register_filesystem(&smk_fs_type); if (!err) { smackfs_mount = kern_mount(&smk_fs_type); if (IS_ERR(smackfs_mount)) { printk(KERN_ERR "smackfs: could not mount! "); err = PTR_ERR(smackfs_mount); smackfs_mount = NULL; } } |
e114e4737 Smack: Simplified... |
1584 |
smk_cipso_doi(); |
4bc87e627 Smack: unlabeled ... |
1585 |
smk_unlbl_ambient(NULL); |
e114e4737 Smack: Simplified... |
1586 |
|
272cd7a8c Smack: Rule list ... |
1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 |
mutex_init(&smack_known_floor.smk_rules_lock); mutex_init(&smack_known_hat.smk_rules_lock); mutex_init(&smack_known_huh.smk_rules_lock); mutex_init(&smack_known_invalid.smk_rules_lock); mutex_init(&smack_known_star.smk_rules_lock); mutex_init(&smack_known_web.smk_rules_lock); INIT_LIST_HEAD(&smack_known_floor.smk_rules); INIT_LIST_HEAD(&smack_known_hat.smk_rules); INIT_LIST_HEAD(&smack_known_huh.smk_rules); INIT_LIST_HEAD(&smack_known_invalid.smk_rules); INIT_LIST_HEAD(&smack_known_star.smk_rules); INIT_LIST_HEAD(&smack_known_web.smk_rules); |
e114e4737 Smack: Simplified... |
1600 1601 1602 1603 |
return err; } __initcall(init_smk_fs); |