1 /* SPDX-License-Identifier: GPL-2.0-only */
3 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
6 * Casey Schaufler <casey@schaufler-ca.com>
9 #ifndef _SECURITY_SMACK_H
10 #define _SECURITY_SMACK_H
12 #include <linux/capability.h>
13 #include <linux/spinlock.h>
14 #include <linux/lsm_hooks.h>
16 #if IS_ENABLED(CONFIG_IPV6)
17 #include <linux/in6.h>
18 #endif /* CONFIG_IPV6 */
19 #include <net/netlabel.h>
20 #include <linux/list.h>
21 #include <linux/rculist.h>
22 #include <linux/lsm_audit.h>
23 #include <linux/msg.h>
26 * Use IPv6 port labeling if IPv6 is enabled and secmarks
29 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
30 #define SMACK_IPV6_PORT_LABELING 1
33 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
34 #define SMACK_IPV6_SECMARK_LABELING 1
38 * Smack labels were limited to 23 characters for a long time.
40 #define SMK_LABELLEN 24
41 #define SMK_LONGLABEL 256
44 * This is the repository for labels seen so that it is
45 * not necessary to keep allocating tiny chuncks of memory
46 * and so that they can be shared.
48 * Labels are never modified in place. Anytime a label
49 * is imported (e.g. xattrset on a file) the list is checked
50 * for it and it is added if it doesn't exist. The address
51 * is passed out in either case. Entries are added, but
54 * Since labels are hanging around anyway it doesn't
55 * hurt to maintain a secid for those awkward situations
56 * where kernel components that ought to use LSM independent
57 * interfaces don't. The secid should go away when all of
58 * these components have been repaired.
60 * The cipso value associated with the label gets stored here, too.
62 * Keep the access rules for this subject label here so that
63 * the entire set of rules does not need to be examined every
67 struct list_head list;
68 struct hlist_node smk_hashed;
71 struct netlbl_lsm_secattr smk_netlabel; /* on wire labels */
72 struct list_head smk_rules; /* access rules */
73 struct mutex smk_rules_lock; /* lock for rules */
77 * Maximum number of bytes for the levels in a CIPSO IP option.
78 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
79 * bigger than can be used, and 24 is the next lower multiple
80 * of 8, and there are too many issues if there isn't space set
81 * aside for the terminating null byte.
83 #define SMK_CIPSOLEN 24
85 struct superblock_smack {
86 struct smack_known *smk_root;
87 struct smack_known *smk_floor;
88 struct smack_known *smk_hat;
89 struct smack_known *smk_default;
96 #define SMK_SB_INITIALIZED 0x01
97 #define SMK_SB_UNTRUSTED 0x02
100 struct smack_known *smk_out; /* outbound label */
101 struct smack_known *smk_in; /* inbound label */
102 struct smack_known *smk_packet; /* TCP peer label */
103 int smk_state; /* netlabel socket states */
105 #define SMK_NETLBL_UNSET 0
106 #define SMK_NETLBL_UNLABELED 1
107 #define SMK_NETLBL_LABELED 2
108 #define SMK_NETLBL_REQSKB 3
114 struct smack_known *smk_inode; /* label of the fso */
115 struct smack_known *smk_task; /* label of the task */
116 struct smack_known *smk_mmap; /* label of the mmap domain */
117 int smk_flags; /* smack inode flags */
121 struct smack_known *smk_task; /* label for access control */
122 struct smack_known *smk_forked; /* label when forked */
123 struct smack_known *smk_transmuted;/* label when transmuted */
124 struct list_head smk_rules; /* per task access rules */
125 struct mutex smk_rules_lock; /* lock for the rules */
126 struct list_head smk_relabel; /* transit allowed labels */
129 #define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
130 #define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
131 #define SMK_INODE_CHANGED 0x04 /* smack was transmuted */
132 #define SMK_INODE_IMPURE 0x08 /* involved in an impure transaction */
135 * A label access rule.
138 struct list_head list;
139 struct smack_known *smk_subject;
140 struct smack_known *smk_object;
145 * An entry in the table identifying IPv4 hosts.
147 struct smk_net4addr {
148 struct list_head list;
149 struct in_addr smk_host; /* network address */
150 struct in_addr smk_mask; /* network mask */
151 int smk_masks; /* mask size */
152 struct smack_known *smk_label; /* label */
156 * An entry in the table identifying IPv6 hosts.
158 struct smk_net6addr {
159 struct list_head list;
160 struct in6_addr smk_host; /* network address */
161 struct in6_addr smk_mask; /* network mask */
162 int smk_masks; /* mask size */
163 struct smack_known *smk_label; /* label */
167 * An entry in the table identifying ports.
169 struct smk_port_label {
170 struct list_head list;
171 struct sock *smk_sock; /* socket initialized on */
172 unsigned short smk_port; /* the port number */
173 struct smack_known *smk_in; /* inbound label */
174 struct smack_known *smk_out; /* outgoing label */
175 short smk_sock_type; /* Socket type */
179 struct smack_known_list_elem {
180 struct list_head list;
181 struct smack_known *smk_label;
184 /* Super block security struct flags for mount options */
185 #define FSDEFAULT_MNT 0x01
186 #define FSFLOOR_MNT 0x02
187 #define FSHAT_MNT 0x04
188 #define FSROOT_MNT 0x08
189 #define FSTRANS_MNT 0x10
191 #define NUM_SMK_MNT_OPTS 5
202 #define SMACK_DELETE_OPTION "-DELETE"
203 #define SMACK_CIPSO_OPTION "-CIPSO"
208 #define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
209 #define SMACK_CIPSO_DOI_INVALID -1 /* Not a DOI */
210 #define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
211 #define SMACK_CIPSO_MAPPED_DEFAULT 251 /* Also arbitrary */
212 #define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
214 * CIPSO 2.2 standard is 239, but Smack wants to use the
215 * categories in a structured way that limits the value to
216 * the bits in 23 bytes, hence the unusual number.
218 #define SMACK_CIPSO_MAXCATNUM 184 /* 23 * 8 */
223 #define SMACK_PTRACE_DEFAULT 0
224 #define SMACK_PTRACE_EXACT 1
225 #define SMACK_PTRACE_DRACONIAN 2
226 #define SMACK_PTRACE_MAX SMACK_PTRACE_DRACONIAN
229 * Flags for untraditional access modes.
230 * It shouldn't be necessary to avoid conflicts with definitions
231 * in fs.h, but do so anyway.
233 #define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */
234 #define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */
235 #define MAY_BRINGUP 0x00004000 /* Report use of this rule */
238 * The policy for delivering signals is configurable.
239 * It is usually "write", but can be "append".
241 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
242 #define MAY_DELIVER MAY_APPEND /* Signal delivery requires append */
244 #define MAY_DELIVER MAY_WRITE /* Signal delivery requires write */
247 #define SMACK_BRINGUP_ALLOW 1 /* Allow bringup mode */
248 #define SMACK_UNCONFINED_SUBJECT 2 /* Allow unconfined label */
249 #define SMACK_UNCONFINED_OBJECT 3 /* Allow unconfined label */
252 * Just to make the common cases easier to deal with
254 #define MAY_ANYREAD (MAY_READ | MAY_EXEC)
255 #define MAY_READWRITE (MAY_READ | MAY_WRITE)
259 * Number of access types used by Smack (rwxatlb)
261 #define SMK_NUM_ACCESS_TYPE 7
264 struct smack_audit_data {
265 const char *function;
273 * Smack audit data; is empty if CONFIG_AUDIT not set
276 struct smk_audit_info {
278 struct common_audit_data a;
279 struct smack_audit_data sad;
284 * These functions are in smack_access.c
286 int smk_access_entry(char *, char *, struct list_head *);
287 int smk_access(struct smack_known *, struct smack_known *,
288 int, struct smk_audit_info *);
289 int smk_tskacc(struct task_smack *, struct smack_known *,
290 u32, struct smk_audit_info *);
291 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
292 struct smack_known *smack_from_secid(const u32);
293 char *smk_parse_smack(const char *string, int len);
294 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
295 struct smack_known *smk_import_entry(const char *, int);
296 void smk_insert_entry(struct smack_known *skp);
297 struct smack_known *smk_find_entry(const char *);
298 bool smack_privileged(int cap);
299 bool smack_privileged_cred(int cap, const struct cred *cred);
300 void smk_destroy_label_list(struct list_head *list);
301 int smack_populate_secattr(struct smack_known *skp);
306 extern int smack_enabled __initdata;
307 extern int smack_cipso_direct;
308 extern int smack_cipso_mapped;
309 extern struct smack_known *smack_net_ambient;
310 extern struct smack_known *smack_syslog_label;
311 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
312 extern struct smack_known *smack_unconfined;
314 extern int smack_ptrace_rule;
315 extern struct lsm_blob_sizes smack_blob_sizes;
317 extern struct smack_known smack_known_floor;
318 extern struct smack_known smack_known_hat;
319 extern struct smack_known smack_known_huh;
320 extern struct smack_known smack_known_star;
321 extern struct smack_known smack_known_web;
323 extern struct mutex smack_known_lock;
324 extern struct list_head smack_known_list;
325 extern struct list_head smk_net4addr_list;
326 extern struct list_head smk_net6addr_list;
328 extern struct mutex smack_onlycap_lock;
329 extern struct list_head smack_onlycap_list;
331 #define SMACK_HASH_SLOTS 16
332 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
333 extern struct kmem_cache *smack_rule_cache;
335 static inline struct task_smack *smack_cred(const struct cred *cred)
337 return cred->security + smack_blob_sizes.lbs_cred;
340 static inline struct smack_known **smack_file(const struct file *file)
342 return (struct smack_known **)(file->f_security +
343 smack_blob_sizes.lbs_file);
346 static inline struct inode_smack *smack_inode(const struct inode *inode)
348 return inode->i_security + smack_blob_sizes.lbs_inode;
351 static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
353 return msg->security + smack_blob_sizes.lbs_msg_msg;
356 static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
358 return ipc->security + smack_blob_sizes.lbs_ipc;
361 static inline struct superblock_smack *smack_superblock(
362 const struct super_block *superblock)
364 return superblock->s_security + smack_blob_sizes.lbs_superblock;
368 * Is the directory transmuting?
370 static inline int smk_inode_transmutable(const struct inode *isp)
372 struct inode_smack *sip = smack_inode(isp);
373 return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
377 * Present a pointer to the smack label entry in an inode blob.
379 static inline struct smack_known *smk_of_inode(const struct inode *isp)
381 struct inode_smack *sip = smack_inode(isp);
382 return sip->smk_inode;
386 * Present a pointer to the smack label entry in an task blob.
388 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
390 return tsp->smk_task;
393 static inline struct smack_known *smk_of_task_struct_subj(
394 const struct task_struct *t)
396 struct smack_known *skp;
397 const struct cred *cred;
401 cred = rcu_dereference(t->cred);
402 skp = smk_of_task(smack_cred(cred));
409 static inline struct smack_known *smk_of_task_struct_obj(
410 const struct task_struct *t)
412 struct smack_known *skp;
413 const struct cred *cred;
417 cred = __task_cred(t);
418 skp = smk_of_task(smack_cred(cred));
426 * Present a pointer to the forked smack label entry in an task blob.
428 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
430 return tsp->smk_forked;
434 * Present a pointer to the smack label in the current task blob.
436 static inline struct smack_known *smk_of_current(void)
438 return smk_of_task(smack_cred(current_cred()));
444 #define SMACK_AUDIT_DENIED 0x1
445 #define SMACK_AUDIT_ACCEPT 0x2
446 extern int log_policy;
448 void smack_log(char *subject_label, char *object_label,
450 int result, struct smk_audit_info *auditdata);
455 * some inline functions to set up audit data
456 * they do nothing if CONFIG_AUDIT is not set
459 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
462 memset(&a->sad, 0, sizeof(a->sad));
464 a->a.smack_audit_data = &a->sad;
465 a->a.smack_audit_data->function = func;
468 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
469 char type, struct lsm_network_audit *net)
471 smk_ad_init(a, func, type);
472 memset(net, 0, sizeof(*net));
476 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
477 struct task_struct *t)
481 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
486 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
491 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
496 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
504 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
508 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
509 struct task_struct *t)
512 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
516 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
520 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
524 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
530 #endif /* _SECURITY_SMACK_H */