2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
13 #include <linux/types.h>
14 #include <linux/slab.h>
16 #include <linux/sched.h>
19 struct smack_known smack_known_huh = {
24 struct smack_known smack_known_hat = {
29 struct smack_known smack_known_star = {
34 struct smack_known smack_known_floor = {
39 struct smack_known smack_known_web = {
44 LIST_HEAD(smack_known_list);
47 * The initial value needs to be bigger than any of the
50 static u32 smack_next_secid = 10;
53 * what events do we log
54 * can be overwritten at run-time by /smack/logging
56 int log_policy = SMACK_AUDIT_DENIED;
59 * smk_access_entry - look up matching access rule
60 * @subject_label: a pointer to the subject's Smack label
61 * @object_label: a pointer to the object's Smack label
62 * @rule_list: the list of rules to search
64 * This function looks up the subject/object pair in the
65 * access rule list and returns the access mode. If no
66 * entry is found returns -ENOENT.
70 * Earlier versions of this function allowed for labels that
71 * were not on the label list. This was done to allow for
72 * labels to come over the network that had never been seen
73 * before on this host. Unless the receiving socket has the
74 * star label this will always result in a failure check. The
75 * star labeled socket case is now handled in the networking
76 * hooks so there is no case where the label is not on the
77 * label list. Checking to see if the address of two labels
78 * is the same is now a reliable test.
80 * Do the object check first because that is more
83 * Allowing write access implies allowing locking.
85 int smk_access_entry(char *subject_label, char *object_label,
86 struct list_head *rule_list)
88 struct smack_rule *srp;
90 list_for_each_entry_rcu(srp, rule_list, list) {
91 if (srp->smk_object->smk_known == object_label &&
92 srp->smk_subject->smk_known == subject_label) {
93 int may = srp->smk_access;
95 * MAY_WRITE implies MAY_LOCK.
97 if ((may & MAY_WRITE) == MAY_WRITE)
107 * smk_access - determine if a subject has a specific access to an object
108 * @subject: a pointer to the subject's Smack label entry
109 * @object: a pointer to the object's Smack label entry
110 * @request: the access requested, in "MAY" format
111 * @a : a pointer to the audit data
113 * This function looks up the subject/object pair in the
114 * access rule list and returns 0 if the access is permitted,
115 * non zero otherwise.
117 * Smack labels are shared on smack_list
119 int smk_access(struct smack_known *subject, struct smack_known *object,
120 int request, struct smk_audit_info *a)
126 * Hardcoded comparisons.
129 * A star subject can't access any object.
131 if (subject == &smack_known_star) {
136 * An internet object can be accessed by any subject.
137 * Tasks cannot be assigned the internet label.
138 * An internet subject can access any object.
140 if (object == &smack_known_web || subject == &smack_known_web)
143 * A star object can be accessed by any subject.
145 if (object == &smack_known_star)
148 * An object can be accessed in any way by a subject
149 * with the same label.
151 if (subject->smk_known == object->smk_known)
154 * A hat subject can read or lock any object.
155 * A floor object can be read or locked by any subject.
157 if ((request & MAY_ANYREAD) == request ||
158 (request & MAY_LOCK) == request) {
159 if (object == &smack_known_floor)
161 if (subject == &smack_known_hat)
165 * Beyond here an explicit relationship is required.
166 * If the requested access is contained in the available
167 * access (e.g. read is included in readwrite) it's
168 * good. A negative response from smk_access_entry()
169 * indicates there is no entry for this pair.
172 may = smk_access_entry(subject->smk_known, object->smk_known,
173 &subject->smk_rules);
176 if (may <= 0 || (request & may) != request) {
180 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
182 * Return a positive value if using bringup mode.
183 * This allows the hooks to identify checks that
184 * succeed because of "b" rules.
186 if (may & MAY_BRINGUP)
187 rc = SMACK_BRINGUP_ALLOW;
192 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
194 if (object == smack_unconfined)
195 rc = SMACK_UNCONFINED_OBJECT;
196 if (subject == smack_unconfined)
197 rc = SMACK_UNCONFINED_SUBJECT;
203 smack_log(subject->smk_known, object->smk_known,
211 * smk_tskacc - determine if a task has a specific access to an object
212 * @tsp: a pointer to the subject's task
213 * @obj_known: a pointer to the object's label entry
214 * @mode: the access requested, in "MAY" format
215 * @a : common audit data
217 * This function checks the subject task's label/object label pair
218 * in the access rule list and returns 0 if the access is permitted,
219 * non zero otherwise. It allows that the task may have the capability
220 * to override the rules.
222 int smk_tskacc(struct task_smack *tsp, struct smack_known *obj_known,
223 u32 mode, struct smk_audit_info *a)
225 struct smack_known *sbj_known = smk_of_task(tsp);
230 * Check the global rule list
232 rc = smk_access(sbj_known, obj_known, mode, NULL);
235 * If there is an entry in the task's rule list
236 * it can further restrict access.
238 may = smk_access_entry(sbj_known->smk_known,
239 obj_known->smk_known,
243 if ((mode & may) == mode)
249 * Allow for priviliged to override policy.
251 if (rc != 0 && smack_privileged(CAP_MAC_OVERRIDE))
257 smack_log(sbj_known->smk_known, obj_known->smk_known,
264 * smk_curacc - determine if current has a specific access to an object
265 * @obj_known: a pointer to the object's Smack label entry
266 * @mode: the access requested, in "MAY" format
267 * @a : common audit data
269 * This function checks the current subject label/object label pair
270 * in the access rule list and returns 0 if the access is permitted,
271 * non zero otherwise. It allows that current may have the capability
272 * to override the rules.
274 int smk_curacc(struct smack_known *obj_known,
275 u32 mode, struct smk_audit_info *a)
277 struct task_smack *tsp = current_security();
279 return smk_tskacc(tsp, obj_known, mode, a);
284 * smack_str_from_perm : helper to transalate an int to a
286 * @string : the string to fill
290 static inline void smack_str_from_perm(char *string, int access)
294 if (access & MAY_READ)
296 if (access & MAY_WRITE)
298 if (access & MAY_EXEC)
300 if (access & MAY_APPEND)
302 if (access & MAY_TRANSMUTE)
304 if (access & MAY_LOCK)
309 * smack_log_callback - SMACK specific information
310 * will be called by generic audit code
311 * @ab : the audit_buffer
315 static void smack_log_callback(struct audit_buffer *ab, void *a)
317 struct common_audit_data *ad = a;
318 struct smack_audit_data *sad = ad->smack_audit_data;
319 audit_log_format(ab, "lsm=SMACK fn=%s action=%s",
320 ad->smack_audit_data->function,
321 sad->result ? "denied" : "granted");
322 audit_log_format(ab, " subject=");
323 audit_log_untrustedstring(ab, sad->subject);
324 audit_log_format(ab, " object=");
325 audit_log_untrustedstring(ab, sad->object);
326 if (sad->request[0] == '\0')
327 audit_log_format(ab, " labels_differ");
329 audit_log_format(ab, " requested=%s", sad->request);
333 * smack_log - Audit the granting or denial of permissions.
334 * @subject_label : smack label of the requester
335 * @object_label : smack label of the object being accessed
336 * @request: requested permissions
337 * @result: result from smk_access
338 * @a: auxiliary audit data
340 * Audit the granting or denial of permissions in accordance
343 void smack_log(char *subject_label, char *object_label, int request,
344 int result, struct smk_audit_info *ad)
346 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
347 char request_buffer[SMK_NUM_ACCESS_TYPE + 5];
349 char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
351 struct smack_audit_data *sad;
352 struct common_audit_data *a = &ad->a;
354 /* check if we have to log the current event */
355 if (result < 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
357 if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
360 sad = a->smack_audit_data;
362 if (sad->function == NULL)
363 sad->function = "unknown";
365 /* end preparing the audit data */
366 smack_str_from_perm(request_buffer, request);
367 sad->subject = subject_label;
368 sad->object = object_label;
369 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
371 * The result may be positive in bringup mode.
372 * A positive result is an allow, but not for normal reasons.
373 * Mark it as successful, but don't filter it out even if
374 * the logging policy says to do so.
376 if (result == SMACK_UNCONFINED_SUBJECT)
377 strcat(request_buffer, "(US)");
378 else if (result == SMACK_UNCONFINED_OBJECT)
379 strcat(request_buffer, "(UO)");
384 sad->request = request_buffer;
385 sad->result = result;
387 common_lsm_audit(a, smack_log_callback, NULL);
389 #else /* #ifdef CONFIG_AUDIT */
390 void smack_log(char *subject_label, char *object_label, int request,
391 int result, struct smk_audit_info *ad)
396 DEFINE_MUTEX(smack_known_lock);
398 struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
401 * smk_insert_entry - insert a smack label into a hash map,
403 * this function must be called under smack_known_lock
405 void smk_insert_entry(struct smack_known *skp)
408 struct hlist_head *head;
410 hash = full_name_hash(NULL, skp->smk_known, strlen(skp->smk_known));
411 head = &smack_known_hash[hash & (SMACK_HASH_SLOTS - 1)];
413 hlist_add_head_rcu(&skp->smk_hashed, head);
414 list_add_rcu(&skp->list, &smack_known_list);
418 * smk_find_entry - find a label on the list, return the list entry
419 * @string: a text string that might be a Smack label
421 * Returns a pointer to the entry in the label list that
422 * matches the passed string or NULL if not found.
424 struct smack_known *smk_find_entry(const char *string)
427 struct hlist_head *head;
428 struct smack_known *skp;
430 hash = full_name_hash(NULL, string, strlen(string));
431 head = &smack_known_hash[hash & (SMACK_HASH_SLOTS - 1)];
433 hlist_for_each_entry_rcu(skp, head, smk_hashed)
434 if (strcmp(skp->smk_known, string) == 0)
441 * smk_parse_smack - parse smack label from a text string
442 * @string: a text string that might contain a Smack label
443 * @len: the maximum size, or zero if it is NULL terminated.
445 * Returns a pointer to the clean label or an error code.
447 char *smk_parse_smack(const char *string, int len)
453 len = strlen(string) + 1;
456 * Reserve a leading '-' as an indicator that
457 * this isn't a label, but an option to interfaces
458 * including /smack/cipso and /smack/cipso2
460 if (string[0] == '-')
461 return ERR_PTR(-EINVAL);
463 for (i = 0; i < len; i++)
464 if (string[i] > '~' || string[i] <= ' ' || string[i] == '/' ||
465 string[i] == '"' || string[i] == '\\' || string[i] == '\'')
468 if (i == 0 || i >= SMK_LONGLABEL)
469 return ERR_PTR(-EINVAL);
471 smack = kzalloc(i + 1, GFP_NOFS);
473 return ERR_PTR(-ENOMEM);
475 strncpy(smack, string, i);
481 * smk_netlbl_mls - convert a catset to netlabel mls categories
482 * @catset: the Smack categories
483 * @sap: where to put the netlabel categories
485 * Allocates and fills attr.mls
486 * Returns 0 on success, error code on failure.
488 int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap,
497 sap->flags |= NETLBL_SECATTR_MLS_CAT;
498 sap->attr.mls.lvl = level;
499 sap->attr.mls.cat = NULL;
501 for (cat = 1, cp = catset, byte = 0; byte < len; cp++, byte++)
502 for (m = 0x80; m != 0; m >>= 1, cat++) {
505 rc = netlbl_catmap_setbit(&sap->attr.mls.cat,
508 netlbl_catmap_free(sap->attr.mls.cat);
517 * smk_import_entry - import a label, return the list entry
518 * @string: a text string that might be a Smack label
519 * @len: the maximum size, or zero if it is NULL terminated.
521 * Returns a pointer to the entry in the label list that
522 * matches the passed string, adding it if necessary,
525 struct smack_known *smk_import_entry(const char *string, int len)
527 struct smack_known *skp;
532 smack = smk_parse_smack(string, len);
534 return ERR_CAST(smack);
536 mutex_lock(&smack_known_lock);
538 skp = smk_find_entry(smack);
542 skp = kzalloc(sizeof(*skp), GFP_NOFS);
544 skp = ERR_PTR(-ENOMEM);
548 skp->smk_known = smack;
549 skp->smk_secid = smack_next_secid++;
550 skp->smk_netlabel.domain = skp->smk_known;
551 skp->smk_netlabel.flags =
552 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
554 * If direct labeling works use it.
555 * Otherwise use mapped labeling.
557 slen = strlen(smack);
558 if (slen < SMK_CIPSOLEN)
559 rc = smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
560 &skp->smk_netlabel, slen);
562 rc = smk_netlbl_mls(smack_cipso_mapped, (char *)&skp->smk_secid,
563 &skp->smk_netlabel, sizeof(skp->smk_secid));
566 INIT_LIST_HEAD(&skp->smk_rules);
567 mutex_init(&skp->smk_rules_lock);
569 * Make sure that the entry is actually
570 * filled before putting it on the list.
572 smk_insert_entry(skp);
576 * smk_netlbl_mls failed.
583 mutex_unlock(&smack_known_lock);
589 * smack_from_secid - find the Smack label associated with a secid
590 * @secid: an integer that might be associated with a Smack label
592 * Returns a pointer to the appropriate Smack label entry if there is one,
593 * otherwise a pointer to the invalid Smack label.
595 struct smack_known *smack_from_secid(const u32 secid)
597 struct smack_known *skp;
600 list_for_each_entry_rcu(skp, &smack_known_list, list) {
601 if (skp->smk_secid == secid) {
608 * If we got this far someone asked for the translation
609 * of a secid that is not on the list.
612 return &smack_known_huh;
616 * Unless a process is running with one of these labels
617 * even having CAP_MAC_OVERRIDE isn't enough to grant
618 * privilege to violate MAC policy. If no labels are
619 * designated (the empty list case) capabilities apply to
622 LIST_HEAD(smack_onlycap_list);
623 DEFINE_MUTEX(smack_onlycap_lock);
626 * smack_privileged_cred - are all privilege requirements met by cred
627 * @cap: The requested capability
628 * @cred: the credential to use
630 * Is the task privileged and allowed to be privileged
631 * by the onlycap rule.
633 * Returns true if the task is allowed to be privileged, false if it's not.
635 bool smack_privileged_cred(int cap, const struct cred *cred)
637 struct task_smack *tsp = cred->security;
638 struct smack_known *skp = tsp->smk_task;
639 struct smack_known_list_elem *sklep;
642 rc = cap_capable(cred, &init_user_ns, cap, CAP_OPT_NONE);
647 if (list_empty(&smack_onlycap_list)) {
652 list_for_each_entry_rcu(sklep, &smack_onlycap_list, list) {
653 if (sklep->smk_label == skp) {
664 * smack_privileged - are all privilege requirements met
665 * @cap: The requested capability
667 * Is the task privileged and allowed to be privileged
668 * by the onlycap rule.
670 * Returns true if the task is allowed to be privileged, false if it's not.
672 bool smack_privileged(int cap)
675 * All kernel tasks are privileged
677 if (unlikely(current->flags & PF_KTHREAD))
680 return smack_privileged_cred(cap, current_cred());