blob: bce4e8f1b267cef89501cd5538bdff86940cd81c [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Authors:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
11 *
12 * Special thanks to the authors of selinuxfs.
13 *
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
16 *
17 */
18
19#include <linux/kernel.h>
20#include <linux/vmalloc.h>
21#include <linux/security.h>
22#include <linux/mutex.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090023#include <linux/slab.h>
Casey Schaufler6d3dc072008-12-31 12:54:12 -050024#include <net/net_namespace.h>
Casey Schauflere114e472008-02-04 22:29:50 -080025#include <net/cipso_ipv4.h>
26#include <linux/seq_file.h>
27#include <linux/ctype.h>
Casey Schaufler4bc87e62008-02-15 15:24:25 -080028#include <linux/audit.h>
Casey Schaufler958d2c22013-04-02 11:41:18 -070029#include <linux/magic.h>
Casey Schauflere114e472008-02-04 22:29:50 -080030#include "smack.h"
31
32/*
33 * smackfs pseudo filesystem.
34 */
35
36enum smk_inos {
37 SMK_ROOT_INO = 2,
38 SMK_LOAD = 3, /* load policy */
39 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
40 SMK_DOI = 5, /* CIPSO DOI */
41 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT = 7, /* internet ambient label */
Casey Schaufler6d3dc072008-12-31 12:54:12 -050043 SMK_NETLBLADDR = 8, /* single label hosts */
Casey Schaufler15446232008-07-30 15:37:11 -070044 SMK_ONLYCAP = 9, /* the only "capable" label */
Etienne Bassetecfcc532009-04-08 20:40:06 +020045 SMK_LOGGING = 10, /* logging */
Casey Schaufler7898e1f2011-01-17 08:05:27 -080046 SMK_LOAD_SELF = 11, /* task specific rules */
Jarkko Sakkinen828716c2011-09-08 10:12:01 +030047 SMK_ACCESSES = 12, /* access policy */
Casey Schauflerf7112e62012-05-06 15:22:02 -070048 SMK_MAPPED = 13, /* CIPSO level indicating mapped label */
49 SMK_LOAD2 = 14, /* load policy with long labels */
50 SMK_LOAD_SELF2 = 15, /* load task specific rules with long labels */
51 SMK_ACCESS2 = 16, /* make an access check with long labels */
52 SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
Rafal Krypa449543b2012-07-11 17:49:30 +020053 SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
Rafal Krypae05b6f92013-01-10 19:42:00 +010054 SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
Casey Schaufler00f84f32013-12-23 11:07:10 -080055 SMK_SYSLOG = 20, /* change syslog label) */
Lukasz Pawelczyk66867812014-03-11 17:07:06 +010056 SMK_PTRACE = 21, /* set ptrace rule */
Casey Schauflere114e472008-02-04 22:29:50 -080057};
58
59/*
60 * List locks
61 */
Casey Schauflere114e472008-02-04 22:29:50 -080062static DEFINE_MUTEX(smack_cipso_lock);
Casey Schaufler4bc87e62008-02-15 15:24:25 -080063static DEFINE_MUTEX(smack_ambient_lock);
Casey Schaufler00f84f32013-12-23 11:07:10 -080064static DEFINE_MUTEX(smack_syslog_lock);
Casey Schaufler6d3dc072008-12-31 12:54:12 -050065static DEFINE_MUTEX(smk_netlbladdr_lock);
Casey Schauflere114e472008-02-04 22:29:50 -080066
67/*
68 * This is the "ambient" label for network traffic.
69 * If it isn't somehow marked, use this.
70 * It can be reset via smackfs/ambient
71 */
Casey Schaufler2f823ff2013-05-22 18:43:03 -070072struct smack_known *smack_net_ambient;
Casey Schauflere114e472008-02-04 22:29:50 -080073
74/*
Casey Schauflere114e472008-02-04 22:29:50 -080075 * This is the level in a CIPSO header that indicates a
76 * smack label is contained directly in the category set.
77 * It can be reset via smackfs/direct
78 */
79int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
80
Casey Schaufler15446232008-07-30 15:37:11 -070081/*
Casey Schauflerf7112e62012-05-06 15:22:02 -070082 * This is the level in a CIPSO header that indicates a
83 * secid is contained directly in the category set.
84 * It can be reset via smackfs/mapped
85 */
86int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
87
88/*
Casey Schaufler15446232008-07-30 15:37:11 -070089 * Unless a process is running with this label even
90 * having CAP_MAC_OVERRIDE isn't enough to grant
91 * privilege to violate MAC policy. If no label is
92 * designated (the NULL case) capabilities apply to
93 * everyone. It is expected that the hat (^) label
94 * will be used if any label is used.
95 */
Casey Schaufler00f84f32013-12-23 11:07:10 -080096struct smack_known *smack_onlycap;
97
98/*
99 * If this value is set restrict syslog use to the label specified.
100 * It can be reset via smackfs/syslog
101 */
102struct smack_known *smack_syslog_label;
Casey Schaufler15446232008-07-30 15:37:11 -0700103
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500104/*
Lukasz Pawelczyk66867812014-03-11 17:07:06 +0100105 * Ptrace current rule
106 * SMACK_PTRACE_DEFAULT regular smack ptrace rules (/proc based)
107 * SMACK_PTRACE_EXACT labels must match, but can be overriden with
108 * CAP_SYS_PTRACE
109 * SMACK_PTRACE_DRACONIAN lables must match, CAP_SYS_PTRACE has no effect
110 */
111int smack_ptrace_rule = SMACK_PTRACE_DEFAULT;
112
113/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500114 * Certain IP addresses may be designated as single label hosts.
115 * Packets are sent there unlabeled, but only from tasks that
116 * can write to the specified label.
117 */
Etienne Basset7198e2e2009-03-24 20:53:24 +0100118
119LIST_HEAD(smk_netlbladdr_list);
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700120
121/*
122 * Rule lists are maintained for each label.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700123 * This master list is just for reading /smack/load and /smack/load2.
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700124 */
125struct smack_master_list {
126 struct list_head list;
127 struct smack_rule *smk_rule;
128};
129
Etienne Basset7198e2e2009-03-24 20:53:24 +0100130LIST_HEAD(smack_rule_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500131
Rafal Krypae05b6f92013-01-10 19:42:00 +0100132struct smack_parsed_rule {
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700133 struct smack_known *smk_subject;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200134 struct smack_known *smk_object;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100135 int smk_access1;
136 int smk_access2;
137};
138
Casey Schauflere114e472008-02-04 22:29:50 -0800139static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
Casey Schauflere114e472008-02-04 22:29:50 -0800140
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200141struct smack_known smack_cipso_option = {
142 .smk_known = SMACK_CIPSO_OPTION,
143 .smk_secid = 0,
144};
Etienne Basset43031542009-03-27 17:11:01 -0400145
Casey Schauflere114e472008-02-04 22:29:50 -0800146/*
Casey Schauflere114e472008-02-04 22:29:50 -0800147 * Values for parsing cipso rules
148 * SMK_DIGITLEN: Length of a digit field in a rule.
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700149 * SMK_CIPSOMIN: Minimum possible cipso rule length.
150 * SMK_CIPSOMAX: Maximum possible cipso rule length.
Casey Schauflere114e472008-02-04 22:29:50 -0800151 */
152#define SMK_DIGITLEN 4
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700153#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
154#define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
155
156/*
157 * Values for parsing MAC rules
158 * SMK_ACCESS: Maximum possible combination of access permissions
159 * SMK_ACCESSLEN: Maximum length for a rule access field
160 * SMK_LOADLEN: Smack rule length
161 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200162#define SMK_OACCESS "rwxa"
Casey Schauflerc0ab6e52013-10-11 18:06:39 -0700163#define SMK_ACCESS "rwxatl"
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200164#define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
165#define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
166#define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
167#define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700168
Casey Schauflerf7112e62012-05-06 15:22:02 -0700169/*
170 * Stricly for CIPSO level manipulation.
171 * Set the category bit number in a smack label sized buffer.
172 */
173static inline void smack_catset_bit(unsigned int cat, char *catsetp)
174{
175 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
176 return;
177
178 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
179}
180
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500181/**
182 * smk_netlabel_audit_set - fill a netlbl_audit struct
183 * @nap: structure to fill
184 */
185static void smk_netlabel_audit_set(struct netlbl_audit *nap)
186{
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700187 struct smack_known *skp = smk_of_current();
188
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500189 nap->loginuid = audit_get_loginuid(current);
190 nap->sessionid = audit_get_sessionid(current);
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700191 nap->secid = skp->smk_secid;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500192}
193
194/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700195 * Value for parsing single label host rules
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500196 * "1.2.3.4 X"
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500197 */
198#define SMK_NETLBLADDRMIN 9
Casey Schauflere114e472008-02-04 22:29:50 -0800199
Casey Schauflere114e472008-02-04 22:29:50 -0800200/**
Rafal Krypae05b6f92013-01-10 19:42:00 +0100201 * smk_set_access - add a rule to the rule list or replace an old rule
202 * @srp: the rule to add or replace
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800203 * @rule_list: the list of rules
204 * @rule_lock: the rule list lock
Rafal Krypae05b6f92013-01-10 19:42:00 +0100205 * @global: if non-zero, indicates a global rule
Casey Schauflere114e472008-02-04 22:29:50 -0800206 *
207 * Looks through the current subject/object/access list for
208 * the subject/object pair and replaces the access that was
209 * there. If the pair isn't found add it with the specified
210 * access.
Sergio Luis81ea7142008-12-22 01:16:15 -0300211 *
212 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
213 * during the allocation of the new pair to add.
Casey Schauflere114e472008-02-04 22:29:50 -0800214 */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100215static int smk_set_access(struct smack_parsed_rule *srp,
216 struct list_head *rule_list,
217 struct mutex *rule_lock, int global)
Casey Schauflere114e472008-02-04 22:29:50 -0800218{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100219 struct smack_rule *sp;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100220 struct smack_master_list *smlp;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800221 int found = 0;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100222 int rc = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800223
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800224 mutex_lock(rule_lock);
225
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700226 /*
227 * Because the object label is less likely to match
228 * than the subject label check it first
229 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800230 list_for_each_entry_rcu(sp, rule_list, list) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700231 if (sp->smk_object == srp->smk_object &&
232 sp->smk_subject == srp->smk_subject) {
Etienne Basset7198e2e2009-03-24 20:53:24 +0100233 found = 1;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100234 sp->smk_access |= srp->smk_access1;
235 sp->smk_access &= ~srp->smk_access2;
Casey Schauflere114e472008-02-04 22:29:50 -0800236 break;
237 }
Casey Schauflere114e472008-02-04 22:29:50 -0800238 }
239
Rafal Krypae05b6f92013-01-10 19:42:00 +0100240 if (found == 0) {
241 sp = kzalloc(sizeof(*sp), GFP_KERNEL);
242 if (sp == NULL) {
243 rc = -ENOMEM;
244 goto out;
245 }
246
247 sp->smk_subject = srp->smk_subject;
248 sp->smk_object = srp->smk_object;
249 sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
250
251 list_add_rcu(&sp->list, rule_list);
252 /*
253 * If this is a global as opposed to self and a new rule
254 * it needs to get added for reporting.
255 */
256 if (global) {
257 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
258 if (smlp != NULL) {
259 smlp->smk_rule = sp;
260 list_add_rcu(&smlp->list, &smack_rule_list);
261 } else
262 rc = -ENOMEM;
263 }
264 }
265
266out:
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800267 mutex_unlock(rule_lock);
Rafal Krypae05b6f92013-01-10 19:42:00 +0100268 return rc;
269}
Casey Schauflere114e472008-02-04 22:29:50 -0800270
Rafal Krypae05b6f92013-01-10 19:42:00 +0100271/**
272 * smk_perm_from_str - parse smack accesses from a text string
273 * @string: a text string that contains a Smack accesses code
274 *
275 * Returns an integer with respective bits set for specified accesses.
276 */
277static int smk_perm_from_str(const char *string)
278{
279 int perm = 0;
280 const char *cp;
281
282 for (cp = string; ; cp++)
283 switch (*cp) {
284 case '-':
285 break;
286 case 'r':
287 case 'R':
288 perm |= MAY_READ;
289 break;
290 case 'w':
291 case 'W':
292 perm |= MAY_WRITE;
293 break;
294 case 'x':
295 case 'X':
296 perm |= MAY_EXEC;
297 break;
298 case 'a':
299 case 'A':
300 perm |= MAY_APPEND;
301 break;
302 case 't':
303 case 'T':
304 perm |= MAY_TRANSMUTE;
305 break;
Casey Schauflerc0ab6e52013-10-11 18:06:39 -0700306 case 'l':
307 case 'L':
308 perm |= MAY_LOCK;
309 break;
Casey Schauflerd166c802014-08-27 14:51:27 -0700310 case 'b':
311 case 'B':
312 perm |= MAY_BRINGUP;
313 break;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100314 default:
315 return perm;
316 }
Casey Schauflere114e472008-02-04 22:29:50 -0800317}
318
319/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700320 * smk_fill_rule - Fill Smack rule from strings
321 * @subject: subject label string
322 * @object: object label string
Rafal Krypae05b6f92013-01-10 19:42:00 +0100323 * @access1: access string
324 * @access2: string with permissions to be removed
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300325 * @rule: Smack rule
326 * @import: if non-zero, import labels
Casey Schaufler35187212012-06-18 19:01:36 -0700327 * @len: label length limit
Casey Schauflerf7112e62012-05-06 15:22:02 -0700328 *
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200329 * Returns 0 on success, -EINVAL on failure and -ENOENT when either subject
330 * or object is missing.
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300331 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700332static int smk_fill_rule(const char *subject, const char *object,
Rafal Krypae05b6f92013-01-10 19:42:00 +0100333 const char *access1, const char *access2,
334 struct smack_parsed_rule *rule, int import,
335 int len)
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300336{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700337 const char *cp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300338 struct smack_known *skp;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300339
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300340 if (import) {
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700341 rule->smk_subject = smk_import_entry(subject, len);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300342 if (rule->smk_subject == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200343 return -EINVAL;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300344
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200345 rule->smk_object = smk_import_entry(object, len);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300346 if (rule->smk_object == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200347 return -EINVAL;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300348 } else {
Casey Schaufler35187212012-06-18 19:01:36 -0700349 cp = smk_parse_smack(subject, len);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700350 if (cp == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200351 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700352 skp = smk_find_entry(cp);
353 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300354 if (skp == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200355 return -ENOENT;
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700356 rule->smk_subject = skp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300357
Casey Schaufler35187212012-06-18 19:01:36 -0700358 cp = smk_parse_smack(object, len);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700359 if (cp == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200360 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700361 skp = smk_find_entry(cp);
362 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300363 if (skp == NULL)
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200364 return -ENOENT;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200365 rule->smk_object = skp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300366 }
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300367
Rafal Krypae05b6f92013-01-10 19:42:00 +0100368 rule->smk_access1 = smk_perm_from_str(access1);
369 if (access2)
370 rule->smk_access2 = smk_perm_from_str(access2);
371 else
372 rule->smk_access2 = ~rule->smk_access1;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300373
Casey Schaufler35187212012-06-18 19:01:36 -0700374 return 0;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300375}
376
377/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700378 * smk_parse_rule - parse Smack rule from load string
379 * @data: string to be parsed whose size is SMK_LOADLEN
380 * @rule: Smack rule
381 * @import: if non-zero, import labels
382 *
383 * Returns 0 on success, -1 on errors.
384 */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100385static int smk_parse_rule(const char *data, struct smack_parsed_rule *rule,
386 int import)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700387{
388 int rc;
389
390 rc = smk_fill_rule(data, data + SMK_LABELLEN,
Rafal Krypae05b6f92013-01-10 19:42:00 +0100391 data + SMK_LABELLEN + SMK_LABELLEN, NULL, rule,
392 import, SMK_LABELLEN);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700393 return rc;
394}
395
396/**
397 * smk_parse_long_rule - parse Smack rule from rule string
398 * @data: string to be parsed, null terminated
Rafal Krypae05b6f92013-01-10 19:42:00 +0100399 * @rule: Will be filled with Smack parsed rule
Casey Schauflerf7112e62012-05-06 15:22:02 -0700400 * @import: if non-zero, import labels
Rafal Krypa10289b02013-08-09 11:47:07 +0200401 * @tokens: numer of substrings expected in data
Casey Schauflerf7112e62012-05-06 15:22:02 -0700402 *
Rafal Krypa10289b02013-08-09 11:47:07 +0200403 * Returns number of processed bytes on success, -1 on failure.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700404 */
Rafal Krypa10289b02013-08-09 11:47:07 +0200405static ssize_t smk_parse_long_rule(char *data, struct smack_parsed_rule *rule,
406 int import, int tokens)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700407{
Rafal Krypa10289b02013-08-09 11:47:07 +0200408 ssize_t cnt = 0;
409 char *tok[4];
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200410 int rc;
Rafal Krypa10289b02013-08-09 11:47:07 +0200411 int i;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700412
Rafal Krypa10289b02013-08-09 11:47:07 +0200413 /*
414 * Parsing the rule in-place, filling all white-spaces with '\0'
415 */
416 for (i = 0; i < tokens; ++i) {
417 while (isspace(data[cnt]))
418 data[cnt++] = '\0';
Alan Cox3b9fc372012-07-26 14:47:11 -0700419
Rafal Krypa10289b02013-08-09 11:47:07 +0200420 if (data[cnt] == '\0')
421 /* Unexpected end of data */
422 return -1;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700423
Rafal Krypa10289b02013-08-09 11:47:07 +0200424 tok[i] = data + cnt;
425
426 while (data[cnt] && !isspace(data[cnt]))
427 ++cnt;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100428 }
Rafal Krypa10289b02013-08-09 11:47:07 +0200429 while (isspace(data[cnt]))
430 data[cnt++] = '\0';
Casey Schauflerf7112e62012-05-06 15:22:02 -0700431
Rafal Krypa10289b02013-08-09 11:47:07 +0200432 while (i < 4)
433 tok[i++] = NULL;
434
Jarkko Sakkinen398ce072013-11-28 19:16:46 +0200435 rc = smk_fill_rule(tok[0], tok[1], tok[2], tok[3], rule, import, 0);
436 return rc == 0 ? cnt : rc;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700437}
438
439#define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
440#define SMK_LONG_FMT 1 /* Variable long label format */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100441#define SMK_CHANGE_FMT 2 /* Rule modification format */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700442/**
443 * smk_write_rules_list - write() for any /smack rule file
Randy Dunlap251a2a92009-02-18 11:42:33 -0800444 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800445 * @buf: where to get the data from
446 * @count: bytes sent
447 * @ppos: where to start - must be 0
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800448 * @rule_list: the list of rules to write to
449 * @rule_lock: lock for the rule list
Rafal Krypae05b6f92013-01-10 19:42:00 +0100450 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
Casey Schauflere114e472008-02-04 22:29:50 -0800451 *
452 * Get one smack access rule from above.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700453 * The format for SMK_LONG_FMT is:
454 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
455 * The format for SMK_FIXED24_FMT is exactly:
456 * "subject object rwxat"
Rafal Krypae05b6f92013-01-10 19:42:00 +0100457 * The format for SMK_CHANGE_FMT is:
458 * "subject<whitespace>object<whitespace>
459 * acc_enable<whitespace>acc_disable[<whitespace>...]"
Casey Schauflere114e472008-02-04 22:29:50 -0800460 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700461static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
462 size_t count, loff_t *ppos,
463 struct list_head *rule_list,
464 struct mutex *rule_lock, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800465{
Tomasz Stanislawski470043b2013-06-06 09:30:50 +0200466 struct smack_parsed_rule rule;
Casey Schauflere114e472008-02-04 22:29:50 -0800467 char *data;
Rafal Krypa10289b02013-08-09 11:47:07 +0200468 int rc;
469 int trunc = 0;
470 int tokens;
471 ssize_t cnt = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800472
473 /*
Casey Schauflere114e472008-02-04 22:29:50 -0800474 * No partial writes.
475 * Enough data must be present.
476 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200477 if (*ppos != 0)
478 return -EINVAL;
Casey Schauflere114e472008-02-04 22:29:50 -0800479
Casey Schauflerf7112e62012-05-06 15:22:02 -0700480 if (format == SMK_FIXED24_FMT) {
481 /*
482 * Minor hack for backward compatibility
483 */
Casey Schauflerc0ab6e52013-10-11 18:06:39 -0700484 if (count < SMK_OLOADLEN || count > SMK_LOADLEN)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700485 return -EINVAL;
Rafal Krypa10289b02013-08-09 11:47:07 +0200486 } else {
487 if (count >= PAGE_SIZE) {
488 count = PAGE_SIZE - 1;
489 trunc = 1;
490 }
491 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700492
Rafal Krypa10289b02013-08-09 11:47:07 +0200493 data = kmalloc(count + 1, GFP_KERNEL);
Casey Schauflere114e472008-02-04 22:29:50 -0800494 if (data == NULL)
495 return -ENOMEM;
496
497 if (copy_from_user(data, buf, count) != 0) {
498 rc = -EFAULT;
499 goto out;
500 }
501
Rafal Krypa10289b02013-08-09 11:47:07 +0200502 /*
503 * In case of parsing only part of user buf,
504 * avoid having partial rule at the data buffer
505 */
506 if (trunc) {
507 while (count > 0 && (data[count - 1] != '\n'))
508 --count;
509 if (count == 0) {
510 rc = -EINVAL;
Tomasz Stanislawski470043b2013-06-06 09:30:50 +0200511 goto out;
Rafal Krypa10289b02013-08-09 11:47:07 +0200512 }
513 }
514
515 data[count] = '\0';
516 tokens = (format == SMK_CHANGE_FMT ? 4 : 3);
517 while (cnt < count) {
518 if (format == SMK_FIXED24_FMT) {
519 rc = smk_parse_rule(data, &rule, 1);
520 if (rc != 0) {
521 rc = -EINVAL;
522 goto out;
523 }
524 cnt = count;
525 } else {
526 rc = smk_parse_long_rule(data + cnt, &rule, 1, tokens);
527 if (rc <= 0) {
528 rc = -EINVAL;
529 goto out;
530 }
531 cnt += rc;
532 }
533
534 if (rule_list == NULL)
535 rc = smk_set_access(&rule, &rule.smk_subject->smk_rules,
536 &rule.smk_subject->smk_rules_lock, 1);
537 else
538 rc = smk_set_access(&rule, rule_list, rule_lock, 0);
539
540 if (rc)
Tomasz Stanislawski470043b2013-06-06 09:30:50 +0200541 goto out;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700542 }
543
Rafal Krypa10289b02013-08-09 11:47:07 +0200544 rc = cnt;
Casey Schauflere114e472008-02-04 22:29:50 -0800545out:
546 kfree(data);
547 return rc;
548}
549
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800550/*
Casey Schaufler40809562011-11-10 15:02:22 -0800551 * Core logic for smackfs seq list operations.
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800552 */
553
Casey Schaufler40809562011-11-10 15:02:22 -0800554static void *smk_seq_start(struct seq_file *s, loff_t *pos,
555 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800556{
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700557 struct list_head *list;
558
559 /*
560 * This is 0 the first time through.
561 */
562 if (s->index == 0)
Casey Schaufler40809562011-11-10 15:02:22 -0800563 s->private = head;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700564
565 if (s->private == NULL)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800566 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700567
568 list = s->private;
569 if (list_empty(list))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800570 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700571
572 if (s->index == 0)
573 return list->next;
574 return list;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800575}
576
Casey Schaufler40809562011-11-10 15:02:22 -0800577static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
578 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800579{
580 struct list_head *list = v;
581
Casey Schaufler40809562011-11-10 15:02:22 -0800582 if (list_is_last(list, head)) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700583 s->private = NULL;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800584 return NULL;
585 }
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700586 s->private = list->next;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800587 return list->next;
588}
589
Casey Schaufler40809562011-11-10 15:02:22 -0800590static void smk_seq_stop(struct seq_file *s, void *v)
591{
592 /* No-op */
593}
594
Casey Schauflerf7112e62012-05-06 15:22:02 -0700595static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
Casey Schaufler40809562011-11-10 15:02:22 -0800596{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700597 /*
598 * Don't show any rules with label names too long for
599 * interface file (/smack/load or /smack/load2)
600 * because you should expect to be able to write
601 * anything you read back.
602 */
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700603 if (strlen(srp->smk_subject->smk_known) >= max ||
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200604 strlen(srp->smk_object->smk_known) >= max)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700605 return;
Casey Schaufler40809562011-11-10 15:02:22 -0800606
Rafal Krypa65ee7f42012-07-09 19:36:34 +0200607 if (srp->smk_access == 0)
608 return;
609
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +0200610 seq_printf(s, "%s %s",
611 srp->smk_subject->smk_known,
612 srp->smk_object->smk_known);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800613
614 seq_putc(s, ' ');
615
616 if (srp->smk_access & MAY_READ)
617 seq_putc(s, 'r');
618 if (srp->smk_access & MAY_WRITE)
619 seq_putc(s, 'w');
620 if (srp->smk_access & MAY_EXEC)
621 seq_putc(s, 'x');
622 if (srp->smk_access & MAY_APPEND)
623 seq_putc(s, 'a');
624 if (srp->smk_access & MAY_TRANSMUTE)
625 seq_putc(s, 't');
Casey Schauflerc0ab6e52013-10-11 18:06:39 -0700626 if (srp->smk_access & MAY_LOCK)
627 seq_putc(s, 'l');
Casey Schauflerd166c802014-08-27 14:51:27 -0700628 if (srp->smk_access & MAY_BRINGUP)
629 seq_putc(s, 'b');
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800630
631 seq_putc(s, '\n');
Casey Schauflerf7112e62012-05-06 15:22:02 -0700632}
633
634/*
635 * Seq_file read operations for /smack/load
636 */
637
638static void *load2_seq_start(struct seq_file *s, loff_t *pos)
639{
640 return smk_seq_start(s, pos, &smack_rule_list);
641}
642
643static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
644{
645 return smk_seq_next(s, v, pos, &smack_rule_list);
646}
647
648static int load_seq_show(struct seq_file *s, void *v)
649{
650 struct list_head *list = v;
651 struct smack_master_list *smlp =
652 list_entry(list, struct smack_master_list, list);
653
654 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800655
656 return 0;
657}
658
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800659static const struct seq_operations load_seq_ops = {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700660 .start = load2_seq_start,
661 .next = load2_seq_next,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800662 .show = load_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800663 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800664};
665
666/**
667 * smk_open_load - open() for /smack/load
668 * @inode: inode structure representing file
669 * @file: "load" file pointer
670 *
671 * For reading, use load_seq_* seq_file reading operations.
672 */
673static int smk_open_load(struct inode *inode, struct file *file)
674{
675 return seq_open(file, &load_seq_ops);
676}
677
678/**
679 * smk_write_load - write() for /smack/load
680 * @file: file pointer, not actually used
681 * @buf: where to get the data from
682 * @count: bytes sent
683 * @ppos: where to start - must be 0
684 *
685 */
686static ssize_t smk_write_load(struct file *file, const char __user *buf,
687 size_t count, loff_t *ppos)
688{
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800689 /*
690 * Must have privilege.
691 * No partial writes.
692 * Enough data must be present.
693 */
Casey Schaufler1880eff2012-06-05 15:28:30 -0700694 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800695 return -EPERM;
696
Casey Schauflerf7112e62012-05-06 15:22:02 -0700697 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
698 SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800699}
700
Casey Schauflere114e472008-02-04 22:29:50 -0800701static const struct file_operations smk_load_ops = {
702 .open = smk_open_load,
703 .read = seq_read,
704 .llseek = seq_lseek,
705 .write = smk_write_load,
Ahmed S. Darwishcb622bb2008-03-24 12:29:49 -0700706 .release = seq_release,
Casey Schauflere114e472008-02-04 22:29:50 -0800707};
708
709/**
710 * smk_cipso_doi - initialize the CIPSO domain
711 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700712static void smk_cipso_doi(void)
Casey Schauflere114e472008-02-04 22:29:50 -0800713{
714 int rc;
715 struct cipso_v4_doi *doip;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500716 struct netlbl_audit nai;
Casey Schauflere114e472008-02-04 22:29:50 -0800717
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500718 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800719
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500720 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
Casey Schauflere114e472008-02-04 22:29:50 -0800721 if (rc != 0)
722 printk(KERN_WARNING "%s:%d remove rc = %d\n",
723 __func__, __LINE__, rc);
724
725 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
726 if (doip == NULL)
727 panic("smack: Failed to initialize cipso DOI.\n");
728 doip->map.std = NULL;
729 doip->doi = smk_cipso_doi_value;
730 doip->type = CIPSO_V4_MAP_PASS;
731 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
732 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
733 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
734
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500735 rc = netlbl_cfg_cipsov4_add(doip, &nai);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400736 if (rc != 0) {
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500737 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
Casey Schauflere114e472008-02-04 22:29:50 -0800738 __func__, __LINE__, rc);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400739 kfree(doip);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500740 return;
741 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500742 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500743 if (rc != 0) {
744 printk(KERN_WARNING "%s:%d map add rc = %d\n",
745 __func__, __LINE__, rc);
746 kfree(doip);
747 return;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400748 }
Casey Schauflere114e472008-02-04 22:29:50 -0800749}
750
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800751/**
752 * smk_unlbl_ambient - initialize the unlabeled domain
Randy Dunlap251a2a92009-02-18 11:42:33 -0800753 * @oldambient: previous domain string
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800754 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700755static void smk_unlbl_ambient(char *oldambient)
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800756{
757 int rc;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500758 struct netlbl_audit nai;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800759
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500760 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800761
762 if (oldambient != NULL) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500763 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800764 if (rc != 0)
765 printk(KERN_WARNING "%s:%d remove rc = %d\n",
766 __func__, __LINE__, rc);
767 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700768 if (smack_net_ambient == NULL)
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700769 smack_net_ambient = &smack_known_floor;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800770
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700771 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient->smk_known, PF_INET,
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500772 NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800773 if (rc != 0)
774 printk(KERN_WARNING "%s:%d add rc = %d\n",
775 __func__, __LINE__, rc);
776}
777
Casey Schauflere114e472008-02-04 22:29:50 -0800778/*
779 * Seq_file read operations for /smack/cipso
780 */
781
782static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
783{
Casey Schaufler40809562011-11-10 15:02:22 -0800784 return smk_seq_start(s, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800785}
786
787static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
788{
Casey Schaufler40809562011-11-10 15:02:22 -0800789 return smk_seq_next(s, v, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800790}
791
792/*
793 * Print cipso labels in format:
794 * label level[/cat[,cat]]
795 */
796static int cipso_seq_show(struct seq_file *s, void *v)
797{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100798 struct list_head *list = v;
799 struct smack_known *skp =
800 list_entry(list, struct smack_known, list);
Paul Moore4fbe63d2014-08-01 11:17:37 -0400801 struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800802 char sep = '/';
Casey Schauflere114e472008-02-04 22:29:50 -0800803 int i;
Casey Schauflere114e472008-02-04 22:29:50 -0800804
Casey Schauflerf7112e62012-05-06 15:22:02 -0700805 /*
806 * Don't show a label that could not have been set using
807 * /smack/cipso. This is in support of the notion that
808 * anything read from /smack/cipso ought to be writeable
809 * to /smack/cipso.
810 *
811 * /smack/cipso2 should be used instead.
812 */
813 if (strlen(skp->smk_known) >= SMK_LABELLEN)
Casey Schauflere114e472008-02-04 22:29:50 -0800814 return 0;
815
Casey Schauflerf7112e62012-05-06 15:22:02 -0700816 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
Casey Schauflere114e472008-02-04 22:29:50 -0800817
Paul Moore4fbe63d2014-08-01 11:17:37 -0400818 for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
819 i = netlbl_catmap_walk(cmp, i + 1)) {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700820 seq_printf(s, "%c%d", sep, i);
821 sep = ',';
822 }
Casey Schauflere114e472008-02-04 22:29:50 -0800823
824 seq_putc(s, '\n');
825
826 return 0;
827}
828
James Morris88e9d342009-09-22 16:43:43 -0700829static const struct seq_operations cipso_seq_ops = {
Casey Schauflere114e472008-02-04 22:29:50 -0800830 .start = cipso_seq_start,
Casey Schauflere114e472008-02-04 22:29:50 -0800831 .next = cipso_seq_next,
832 .show = cipso_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800833 .stop = smk_seq_stop,
Casey Schauflere114e472008-02-04 22:29:50 -0800834};
835
836/**
837 * smk_open_cipso - open() for /smack/cipso
838 * @inode: inode structure representing file
839 * @file: "cipso" file pointer
840 *
841 * Connect our cipso_seq_* operations with /smack/cipso
842 * file_operations
843 */
844static int smk_open_cipso(struct inode *inode, struct file *file)
845{
846 return seq_open(file, &cipso_seq_ops);
847}
848
849/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700850 * smk_set_cipso - do the work for write() for cipso and cipso2
Randy Dunlap251a2a92009-02-18 11:42:33 -0800851 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800852 * @buf: where to get the data from
853 * @count: bytes sent
854 * @ppos: where to start
Casey Schauflerf7112e62012-05-06 15:22:02 -0700855 * @format: /smack/cipso or /smack/cipso2
Casey Schauflere114e472008-02-04 22:29:50 -0800856 *
857 * Accepts only one cipso rule per write call.
858 * Returns number of bytes written or error code, as appropriate
859 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700860static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
861 size_t count, loff_t *ppos, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800862{
863 struct smack_known *skp;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700864 struct netlbl_lsm_secattr ncats;
865 char mapcatset[SMK_CIPSOLEN];
Casey Schauflere114e472008-02-04 22:29:50 -0800866 int maplevel;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700867 unsigned int cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800868 int catlen;
869 ssize_t rc = -EINVAL;
870 char *data = NULL;
871 char *rule;
872 int ret;
873 int i;
874
875 /*
876 * Must have privilege.
877 * No partial writes.
878 * Enough data must be present.
879 */
Casey Schaufler1880eff2012-06-05 15:28:30 -0700880 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -0800881 return -EPERM;
882 if (*ppos != 0)
883 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700884 if (format == SMK_FIXED24_FMT &&
885 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
Casey Schauflere114e472008-02-04 22:29:50 -0800886 return -EINVAL;
887
888 data = kzalloc(count + 1, GFP_KERNEL);
889 if (data == NULL)
890 return -ENOMEM;
891
892 if (copy_from_user(data, buf, count) != 0) {
893 rc = -EFAULT;
894 goto unlockedout;
895 }
896
897 data[count] = '\0';
898 rule = data;
899 /*
900 * Only allow one writer at a time. Writes should be
901 * quite rare and small in any case.
902 */
903 mutex_lock(&smack_cipso_lock);
904
905 skp = smk_import_entry(rule, 0);
906 if (skp == NULL)
907 goto out;
908
Casey Schauflerf7112e62012-05-06 15:22:02 -0700909 if (format == SMK_FIXED24_FMT)
910 rule += SMK_LABELLEN;
911 else
Passion,Zhao0fcfee62013-06-03 11:42:24 +0800912 rule += strlen(skp->smk_known) + 1;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700913
Casey Schauflere114e472008-02-04 22:29:50 -0800914 ret = sscanf(rule, "%d", &maplevel);
915 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
916 goto out;
917
918 rule += SMK_DIGITLEN;
919 ret = sscanf(rule, "%d", &catlen);
920 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
921 goto out;
922
Casey Schauflerf7112e62012-05-06 15:22:02 -0700923 if (format == SMK_FIXED24_FMT &&
924 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
Casey Schauflere114e472008-02-04 22:29:50 -0800925 goto out;
926
927 memset(mapcatset, 0, sizeof(mapcatset));
928
929 for (i = 0; i < catlen; i++) {
930 rule += SMK_DIGITLEN;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700931 ret = sscanf(rule, "%u", &cat);
Casey Schaufler677264e2013-06-28 13:47:07 -0700932 if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
Casey Schauflere114e472008-02-04 22:29:50 -0800933 goto out;
934
935 smack_catset_bit(cat, mapcatset);
936 }
937
Casey Schauflerf7112e62012-05-06 15:22:02 -0700938 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
939 if (rc >= 0) {
Paul Moore4fbe63d2014-08-01 11:17:37 -0400940 netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700941 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
942 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
943 rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -0800944 }
945
Casey Schauflere114e472008-02-04 22:29:50 -0800946out:
947 mutex_unlock(&smack_cipso_lock);
948unlockedout:
949 kfree(data);
950 return rc;
951}
952
Casey Schauflerf7112e62012-05-06 15:22:02 -0700953/**
954 * smk_write_cipso - write() for /smack/cipso
955 * @file: file pointer, not actually used
956 * @buf: where to get the data from
957 * @count: bytes sent
958 * @ppos: where to start
959 *
960 * Accepts only one cipso rule per write call.
961 * Returns number of bytes written or error code, as appropriate
962 */
963static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
964 size_t count, loff_t *ppos)
965{
966 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
967}
968
Casey Schauflere114e472008-02-04 22:29:50 -0800969static const struct file_operations smk_cipso_ops = {
970 .open = smk_open_cipso,
971 .read = seq_read,
972 .llseek = seq_lseek,
973 .write = smk_write_cipso,
974 .release = seq_release,
975};
976
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500977/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700978 * Seq_file read operations for /smack/cipso2
979 */
980
981/*
982 * Print cipso labels in format:
983 * label level[/cat[,cat]]
984 */
985static int cipso2_seq_show(struct seq_file *s, void *v)
986{
987 struct list_head *list = v;
988 struct smack_known *skp =
989 list_entry(list, struct smack_known, list);
Paul Moore4fbe63d2014-08-01 11:17:37 -0400990 struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700991 char sep = '/';
992 int i;
993
994 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
995
Paul Moore4fbe63d2014-08-01 11:17:37 -0400996 for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
997 i = netlbl_catmap_walk(cmp, i + 1)) {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700998 seq_printf(s, "%c%d", sep, i);
999 sep = ',';
1000 }
1001
1002 seq_putc(s, '\n');
1003
1004 return 0;
1005}
1006
1007static const struct seq_operations cipso2_seq_ops = {
1008 .start = cipso_seq_start,
1009 .next = cipso_seq_next,
1010 .show = cipso2_seq_show,
1011 .stop = smk_seq_stop,
1012};
1013
1014/**
1015 * smk_open_cipso2 - open() for /smack/cipso2
1016 * @inode: inode structure representing file
1017 * @file: "cipso2" file pointer
1018 *
1019 * Connect our cipso_seq_* operations with /smack/cipso2
1020 * file_operations
1021 */
1022static int smk_open_cipso2(struct inode *inode, struct file *file)
1023{
1024 return seq_open(file, &cipso2_seq_ops);
1025}
1026
1027/**
1028 * smk_write_cipso2 - write() for /smack/cipso2
1029 * @file: file pointer, not actually used
1030 * @buf: where to get the data from
1031 * @count: bytes sent
1032 * @ppos: where to start
1033 *
1034 * Accepts only one cipso rule per write call.
1035 * Returns number of bytes written or error code, as appropriate
1036 */
1037static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
1038 size_t count, loff_t *ppos)
1039{
1040 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
1041}
1042
1043static const struct file_operations smk_cipso2_ops = {
1044 .open = smk_open_cipso2,
1045 .read = seq_read,
1046 .llseek = seq_lseek,
1047 .write = smk_write_cipso2,
1048 .release = seq_release,
1049};
1050
1051/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001052 * Seq_file read operations for /smack/netlabel
1053 */
1054
1055static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
1056{
Casey Schaufler40809562011-11-10 15:02:22 -08001057 return smk_seq_start(s, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001058}
1059
1060static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
1061{
Casey Schaufler40809562011-11-10 15:02:22 -08001062 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001063}
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001064#define BEBITS (sizeof(__be32) * 8)
1065
1066/*
1067 * Print host/label pairs
1068 */
1069static int netlbladdr_seq_show(struct seq_file *s, void *v)
1070{
Etienne Basset7198e2e2009-03-24 20:53:24 +01001071 struct list_head *list = v;
1072 struct smk_netlbladdr *skp =
1073 list_entry(list, struct smk_netlbladdr, list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001074 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +01001075 int maskn;
1076 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001077
etienne113a0e42009-03-04 07:33:51 +01001078 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001079
1080 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001081 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label->smk_known);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001082
1083 return 0;
1084}
1085
James Morris88e9d342009-09-22 16:43:43 -07001086static const struct seq_operations netlbladdr_seq_ops = {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001087 .start = netlbladdr_seq_start,
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001088 .next = netlbladdr_seq_next,
1089 .show = netlbladdr_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001090 .stop = smk_seq_stop,
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001091};
1092
1093/**
1094 * smk_open_netlbladdr - open() for /smack/netlabel
1095 * @inode: inode structure representing file
1096 * @file: "netlabel" file pointer
1097 *
1098 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1099 * file_operations
1100 */
1101static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1102{
1103 return seq_open(file, &netlbladdr_seq_ops);
1104}
1105
1106/**
etienne113a0e42009-03-04 07:33:51 +01001107 * smk_netlbladdr_insert
1108 * @new : netlabel to insert
1109 *
1110 * This helper insert netlabel in the smack_netlbladdrs list
1111 * sorted by netmask length (longest to smallest)
Etienne Basset7198e2e2009-03-24 20:53:24 +01001112 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1113 *
etienne113a0e42009-03-04 07:33:51 +01001114 */
1115static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1116{
Etienne Basset7198e2e2009-03-24 20:53:24 +01001117 struct smk_netlbladdr *m, *m_next;
etienne113a0e42009-03-04 07:33:51 +01001118
Etienne Basset7198e2e2009-03-24 20:53:24 +01001119 if (list_empty(&smk_netlbladdr_list)) {
1120 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001121 return;
1122 }
1123
Jiri Pirko05725f72009-04-14 20:17:16 +02001124 m = list_entry_rcu(smk_netlbladdr_list.next,
1125 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001126
etienne113a0e42009-03-04 07:33:51 +01001127 /* the comparison '>' is a bit hacky, but works */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001128 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1129 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001130 return;
1131 }
Etienne Basset7198e2e2009-03-24 20:53:24 +01001132
1133 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1134 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1135 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001136 return;
1137 }
Jiri Pirko05725f72009-04-14 20:17:16 +02001138 m_next = list_entry_rcu(m->list.next,
1139 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001140 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1141 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001142 return;
1143 }
1144 }
1145}
1146
1147
1148/**
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001149 * smk_write_netlbladdr - write() for /smack/netlabel
Randy Dunlap251a2a92009-02-18 11:42:33 -08001150 * @file: file pointer, not actually used
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001151 * @buf: where to get the data from
1152 * @count: bytes sent
1153 * @ppos: where to start
1154 *
1155 * Accepts only one netlbladdr per write call.
1156 * Returns number of bytes written or error code, as appropriate
1157 */
1158static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1159 size_t count, loff_t *ppos)
1160{
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001161 struct smk_netlbladdr *snp;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001162 struct sockaddr_in newname;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001163 char *smack;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001164 struct smack_known *skp;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001165 char *data;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001166 char *host = (char *)&newname.sin_addr.s_addr;
1167 int rc;
1168 struct netlbl_audit audit_info;
1169 struct in_addr mask;
1170 unsigned int m;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001171 int found;
etienne113a0e42009-03-04 07:33:51 +01001172 u32 mask_bits = (1<<31);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001173 __be32 nsa;
etienne113a0e42009-03-04 07:33:51 +01001174 u32 temp_mask;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001175
1176 /*
1177 * Must have privilege.
1178 * No partial writes.
1179 * Enough data must be present.
1180 * "<addr/mask, as a.b.c.d/e><space><label>"
1181 * "<addr, as a.b.c.d><space><label>"
1182 */
Casey Schaufler1880eff2012-06-05 15:28:30 -07001183 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001184 return -EPERM;
1185 if (*ppos != 0)
1186 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001187 if (count < SMK_NETLBLADDRMIN)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001188 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001189
1190 data = kzalloc(count + 1, GFP_KERNEL);
1191 if (data == NULL)
1192 return -ENOMEM;
1193
1194 if (copy_from_user(data, buf, count) != 0) {
1195 rc = -EFAULT;
1196 goto free_data_out;
1197 }
1198
1199 smack = kzalloc(count + 1, GFP_KERNEL);
1200 if (smack == NULL) {
1201 rc = -ENOMEM;
1202 goto free_data_out;
1203 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001204
1205 data[count] = '\0';
1206
Toralf Försterec554fa2014-04-27 19:33:34 +02001207 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%u %s",
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001208 &host[0], &host[1], &host[2], &host[3], &m, smack);
1209 if (rc != 6) {
1210 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1211 &host[0], &host[1], &host[2], &host[3], smack);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001212 if (rc != 5) {
1213 rc = -EINVAL;
1214 goto free_out;
1215 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001216 m = BEBITS;
1217 }
Casey Schauflerf7112e62012-05-06 15:22:02 -07001218 if (m > BEBITS) {
1219 rc = -EINVAL;
1220 goto free_out;
1221 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001222
Casey Schauflerf7112e62012-05-06 15:22:02 -07001223 /*
1224 * If smack begins with '-', it is an option, don't import it
1225 */
Etienne Basset43031542009-03-27 17:11:01 -04001226 if (smack[0] != '-') {
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001227 skp = smk_import_entry(smack, 0);
1228 if (skp == NULL) {
Casey Schauflerf7112e62012-05-06 15:22:02 -07001229 rc = -EINVAL;
1230 goto free_out;
1231 }
Etienne Basset43031542009-03-27 17:11:01 -04001232 } else {
1233 /* check known options */
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001234 if (strcmp(smack, smack_cipso_option.smk_known) == 0)
1235 skp = &smack_cipso_option;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001236 else {
1237 rc = -EINVAL;
1238 goto free_out;
1239 }
Etienne Basset43031542009-03-27 17:11:01 -04001240 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001241
etienne113a0e42009-03-04 07:33:51 +01001242 for (temp_mask = 0; m > 0; m--) {
1243 temp_mask |= mask_bits;
1244 mask_bits >>= 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001245 }
etienne113a0e42009-03-04 07:33:51 +01001246 mask.s_addr = cpu_to_be32(temp_mask);
1247
1248 newname.sin_addr.s_addr &= mask.s_addr;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001249 /*
1250 * Only allow one writer at a time. Writes should be
1251 * quite rare and small in any case.
1252 */
1253 mutex_lock(&smk_netlbladdr_lock);
1254
1255 nsa = newname.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +01001256 /* try to find if the prefix is already in the list */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001257 found = 0;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001258 list_for_each_entry_rcu(snp, &smk_netlbladdr_list, list) {
1259 if (snp->smk_host.sin_addr.s_addr == nsa &&
1260 snp->smk_mask.s_addr == mask.s_addr) {
Etienne Basset7198e2e2009-03-24 20:53:24 +01001261 found = 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001262 break;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001263 }
1264 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001265 smk_netlabel_audit_set(&audit_info);
1266
Etienne Basset7198e2e2009-03-24 20:53:24 +01001267 if (found == 0) {
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001268 snp = kzalloc(sizeof(*snp), GFP_KERNEL);
1269 if (snp == NULL)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001270 rc = -ENOMEM;
1271 else {
1272 rc = 0;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001273 snp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1274 snp->smk_mask.s_addr = mask.s_addr;
1275 snp->smk_label = skp;
1276 smk_netlbladdr_insert(snp);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001277 }
1278 } else {
Etienne Basset43031542009-03-27 17:11:01 -04001279 /* we delete the unlabeled entry, only if the previous label
Lucas De Marchi25985ed2011-03-30 22:57:33 -03001280 * wasn't the special CIPSO option */
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001281 if (snp->smk_label != &smack_cipso_option)
Etienne Basset43031542009-03-27 17:11:01 -04001282 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001283 &snp->smk_host.sin_addr, &snp->smk_mask,
Etienne Basset43031542009-03-27 17:11:01 -04001284 PF_INET, &audit_info);
1285 else
1286 rc = 0;
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001287 snp->smk_label = skp;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001288 }
1289
1290 /*
1291 * Now tell netlabel about the single label nature of
1292 * this host so that incoming packets get labeled.
Etienne Basset43031542009-03-27 17:11:01 -04001293 * but only if we didn't get the special CIPSO option
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001294 */
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001295 if (rc == 0 && skp != &smack_cipso_option)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001296 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
Lukasz Pawelczyk21c7eae2014-08-29 17:02:55 +02001297 &snp->smk_host.sin_addr, &snp->smk_mask, PF_INET,
1298 snp->smk_label->smk_secid, &audit_info);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001299
1300 if (rc == 0)
1301 rc = count;
1302
1303 mutex_unlock(&smk_netlbladdr_lock);
1304
Casey Schauflerf7112e62012-05-06 15:22:02 -07001305free_out:
1306 kfree(smack);
1307free_data_out:
1308 kfree(data);
1309
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001310 return rc;
1311}
1312
1313static const struct file_operations smk_netlbladdr_ops = {
1314 .open = smk_open_netlbladdr,
1315 .read = seq_read,
1316 .llseek = seq_lseek,
1317 .write = smk_write_netlbladdr,
1318 .release = seq_release,
1319};
1320
Casey Schauflere114e472008-02-04 22:29:50 -08001321/**
1322 * smk_read_doi - read() for /smack/doi
1323 * @filp: file pointer, not actually used
1324 * @buf: where to put the result
1325 * @count: maximum to send along
1326 * @ppos: where to start
1327 *
1328 * Returns number of bytes read or error code, as appropriate
1329 */
1330static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1331 size_t count, loff_t *ppos)
1332{
1333 char temp[80];
1334 ssize_t rc;
1335
1336 if (*ppos != 0)
1337 return 0;
1338
1339 sprintf(temp, "%d", smk_cipso_doi_value);
1340 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1341
1342 return rc;
1343}
1344
1345/**
1346 * smk_write_doi - write() for /smack/doi
Randy Dunlap251a2a92009-02-18 11:42:33 -08001347 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001348 * @buf: where to get the data from
1349 * @count: bytes sent
1350 * @ppos: where to start
1351 *
1352 * Returns number of bytes written or error code, as appropriate
1353 */
1354static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1355 size_t count, loff_t *ppos)
1356{
1357 char temp[80];
1358 int i;
1359
Casey Schaufler1880eff2012-06-05 15:28:30 -07001360 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001361 return -EPERM;
1362
1363 if (count >= sizeof(temp) || count == 0)
1364 return -EINVAL;
1365
1366 if (copy_from_user(temp, buf, count) != 0)
1367 return -EFAULT;
1368
1369 temp[count] = '\0';
1370
1371 if (sscanf(temp, "%d", &i) != 1)
1372 return -EINVAL;
1373
1374 smk_cipso_doi_value = i;
1375
1376 smk_cipso_doi();
1377
1378 return count;
1379}
1380
1381static const struct file_operations smk_doi_ops = {
1382 .read = smk_read_doi,
1383 .write = smk_write_doi,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001384 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001385};
1386
1387/**
1388 * smk_read_direct - read() for /smack/direct
1389 * @filp: file pointer, not actually used
1390 * @buf: where to put the result
1391 * @count: maximum to send along
1392 * @ppos: where to start
1393 *
1394 * Returns number of bytes read or error code, as appropriate
1395 */
1396static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1397 size_t count, loff_t *ppos)
1398{
1399 char temp[80];
1400 ssize_t rc;
1401
1402 if (*ppos != 0)
1403 return 0;
1404
1405 sprintf(temp, "%d", smack_cipso_direct);
1406 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1407
1408 return rc;
1409}
1410
1411/**
1412 * smk_write_direct - write() for /smack/direct
Randy Dunlap251a2a92009-02-18 11:42:33 -08001413 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001414 * @buf: where to get the data from
1415 * @count: bytes sent
1416 * @ppos: where to start
1417 *
1418 * Returns number of bytes written or error code, as appropriate
1419 */
1420static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1421 size_t count, loff_t *ppos)
1422{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001423 struct smack_known *skp;
Casey Schauflere114e472008-02-04 22:29:50 -08001424 char temp[80];
1425 int i;
1426
Casey Schaufler1880eff2012-06-05 15:28:30 -07001427 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001428 return -EPERM;
1429
1430 if (count >= sizeof(temp) || count == 0)
1431 return -EINVAL;
1432
1433 if (copy_from_user(temp, buf, count) != 0)
1434 return -EFAULT;
1435
1436 temp[count] = '\0';
1437
1438 if (sscanf(temp, "%d", &i) != 1)
1439 return -EINVAL;
1440
Casey Schauflerf7112e62012-05-06 15:22:02 -07001441 /*
1442 * Don't do anything if the value hasn't actually changed.
1443 * If it is changing reset the level on entries that were
1444 * set up to be direct when they were created.
1445 */
1446 if (smack_cipso_direct != i) {
1447 mutex_lock(&smack_known_lock);
1448 list_for_each_entry_rcu(skp, &smack_known_list, list)
1449 if (skp->smk_netlabel.attr.mls.lvl ==
1450 smack_cipso_direct)
1451 skp->smk_netlabel.attr.mls.lvl = i;
1452 smack_cipso_direct = i;
1453 mutex_unlock(&smack_known_lock);
1454 }
Casey Schauflere114e472008-02-04 22:29:50 -08001455
1456 return count;
1457}
1458
1459static const struct file_operations smk_direct_ops = {
1460 .read = smk_read_direct,
1461 .write = smk_write_direct,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001462 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001463};
1464
1465/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001466 * smk_read_mapped - read() for /smack/mapped
1467 * @filp: file pointer, not actually used
1468 * @buf: where to put the result
1469 * @count: maximum to send along
1470 * @ppos: where to start
1471 *
1472 * Returns number of bytes read or error code, as appropriate
1473 */
1474static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1475 size_t count, loff_t *ppos)
1476{
1477 char temp[80];
1478 ssize_t rc;
1479
1480 if (*ppos != 0)
1481 return 0;
1482
1483 sprintf(temp, "%d", smack_cipso_mapped);
1484 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1485
1486 return rc;
1487}
1488
1489/**
1490 * smk_write_mapped - write() for /smack/mapped
1491 * @file: file pointer, not actually used
1492 * @buf: where to get the data from
1493 * @count: bytes sent
1494 * @ppos: where to start
1495 *
1496 * Returns number of bytes written or error code, as appropriate
1497 */
1498static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1499 size_t count, loff_t *ppos)
1500{
1501 struct smack_known *skp;
1502 char temp[80];
1503 int i;
1504
Casey Schaufler1880eff2012-06-05 15:28:30 -07001505 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflerf7112e62012-05-06 15:22:02 -07001506 return -EPERM;
1507
1508 if (count >= sizeof(temp) || count == 0)
1509 return -EINVAL;
1510
1511 if (copy_from_user(temp, buf, count) != 0)
1512 return -EFAULT;
1513
1514 temp[count] = '\0';
1515
1516 if (sscanf(temp, "%d", &i) != 1)
1517 return -EINVAL;
1518
1519 /*
1520 * Don't do anything if the value hasn't actually changed.
1521 * If it is changing reset the level on entries that were
1522 * set up to be mapped when they were created.
1523 */
1524 if (smack_cipso_mapped != i) {
1525 mutex_lock(&smack_known_lock);
1526 list_for_each_entry_rcu(skp, &smack_known_list, list)
1527 if (skp->smk_netlabel.attr.mls.lvl ==
1528 smack_cipso_mapped)
1529 skp->smk_netlabel.attr.mls.lvl = i;
1530 smack_cipso_mapped = i;
1531 mutex_unlock(&smack_known_lock);
1532 }
1533
1534 return count;
1535}
1536
1537static const struct file_operations smk_mapped_ops = {
1538 .read = smk_read_mapped,
1539 .write = smk_write_mapped,
1540 .llseek = default_llseek,
1541};
1542
1543/**
Casey Schauflere114e472008-02-04 22:29:50 -08001544 * smk_read_ambient - read() for /smack/ambient
1545 * @filp: file pointer, not actually used
1546 * @buf: where to put the result
1547 * @cn: maximum to send along
1548 * @ppos: where to start
1549 *
1550 * Returns number of bytes read or error code, as appropriate
1551 */
1552static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1553 size_t cn, loff_t *ppos)
1554{
1555 ssize_t rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001556 int asize;
1557
1558 if (*ppos != 0)
1559 return 0;
1560 /*
1561 * Being careful to avoid a problem in the case where
1562 * smack_net_ambient gets changed in midstream.
Casey Schauflere114e472008-02-04 22:29:50 -08001563 */
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001564 mutex_lock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001565
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001566 asize = strlen(smack_net_ambient->smk_known) + 1;
Casey Schauflere114e472008-02-04 22:29:50 -08001567
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001568 if (cn >= asize)
1569 rc = simple_read_from_buffer(buf, cn, ppos,
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001570 smack_net_ambient->smk_known,
1571 asize);
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001572 else
1573 rc = -EINVAL;
1574
1575 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001576
1577 return rc;
1578}
1579
1580/**
1581 * smk_write_ambient - write() for /smack/ambient
Randy Dunlap251a2a92009-02-18 11:42:33 -08001582 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001583 * @buf: where to get the data from
1584 * @count: bytes sent
1585 * @ppos: where to start
1586 *
1587 * Returns number of bytes written or error code, as appropriate
1588 */
1589static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1590 size_t count, loff_t *ppos)
1591{
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001592 struct smack_known *skp;
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001593 char *oldambient;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001594 char *data;
1595 int rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -08001596
Casey Schaufler1880eff2012-06-05 15:28:30 -07001597 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001598 return -EPERM;
1599
Casey Schauflerf7112e62012-05-06 15:22:02 -07001600 data = kzalloc(count + 1, GFP_KERNEL);
1601 if (data == NULL)
1602 return -ENOMEM;
Casey Schauflere114e472008-02-04 22:29:50 -08001603
Casey Schauflerf7112e62012-05-06 15:22:02 -07001604 if (copy_from_user(data, buf, count) != 0) {
1605 rc = -EFAULT;
1606 goto out;
1607 }
Casey Schauflere114e472008-02-04 22:29:50 -08001608
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001609 skp = smk_import_entry(data, count);
1610 if (skp == NULL) {
Casey Schauflerf7112e62012-05-06 15:22:02 -07001611 rc = -EINVAL;
1612 goto out;
1613 }
Casey Schauflere114e472008-02-04 22:29:50 -08001614
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001615 mutex_lock(&smack_ambient_lock);
1616
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001617 oldambient = smack_net_ambient->smk_known;
1618 smack_net_ambient = skp;
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001619 smk_unlbl_ambient(oldambient);
1620
1621 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001622
Casey Schauflerf7112e62012-05-06 15:22:02 -07001623out:
1624 kfree(data);
1625 return rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001626}
1627
1628static const struct file_operations smk_ambient_ops = {
1629 .read = smk_read_ambient,
1630 .write = smk_write_ambient,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001631 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001632};
1633
Casey Schaufler15446232008-07-30 15:37:11 -07001634/**
Casey Schaufler00f84f32013-12-23 11:07:10 -08001635 * smk_read_onlycap - read() for smackfs/onlycap
Casey Schaufler15446232008-07-30 15:37:11 -07001636 * @filp: file pointer, not actually used
1637 * @buf: where to put the result
1638 * @cn: maximum to send along
1639 * @ppos: where to start
1640 *
1641 * Returns number of bytes read or error code, as appropriate
1642 */
1643static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1644 size_t cn, loff_t *ppos)
1645{
1646 char *smack = "";
1647 ssize_t rc = -EINVAL;
1648 int asize;
1649
1650 if (*ppos != 0)
1651 return 0;
1652
1653 if (smack_onlycap != NULL)
Casey Schaufler00f84f32013-12-23 11:07:10 -08001654 smack = smack_onlycap->smk_known;
Casey Schaufler15446232008-07-30 15:37:11 -07001655
1656 asize = strlen(smack) + 1;
1657
1658 if (cn >= asize)
1659 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1660
1661 return rc;
1662}
1663
1664/**
Casey Schaufler00f84f32013-12-23 11:07:10 -08001665 * smk_write_onlycap - write() for smackfs/onlycap
Randy Dunlap251a2a92009-02-18 11:42:33 -08001666 * @file: file pointer, not actually used
Casey Schaufler15446232008-07-30 15:37:11 -07001667 * @buf: where to get the data from
1668 * @count: bytes sent
1669 * @ppos: where to start
1670 *
1671 * Returns number of bytes written or error code, as appropriate
1672 */
1673static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1674 size_t count, loff_t *ppos)
1675{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001676 char *data;
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001677 struct smack_known *skp = smk_of_task(current->cred->security);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001678 int rc = count;
Casey Schaufler15446232008-07-30 15:37:11 -07001679
Casey Schaufler1880eff2012-06-05 15:28:30 -07001680 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler15446232008-07-30 15:37:11 -07001681 return -EPERM;
1682
1683 /*
1684 * This can be done using smk_access() but is done
1685 * explicitly for clarity. The smk_access() implementation
1686 * would use smk_access(smack_onlycap, MAY_WRITE)
1687 */
Casey Schaufler00f84f32013-12-23 11:07:10 -08001688 if (smack_onlycap != NULL && smack_onlycap != skp)
Casey Schaufler15446232008-07-30 15:37:11 -07001689 return -EPERM;
1690
Konstantin Khlebnikovb862e562014-08-07 20:52:43 +04001691 data = kzalloc(count + 1, GFP_KERNEL);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001692 if (data == NULL)
1693 return -ENOMEM;
Casey Schaufler15446232008-07-30 15:37:11 -07001694
1695 /*
1696 * Should the null string be passed in unset the onlycap value.
1697 * This seems like something to be careful with as usually
1698 * smk_import only expects to return NULL for errors. It
1699 * is usually the case that a nullstring or "\n" would be
1700 * bad to pass to smk_import but in fact this is useful here.
Casey Schauflerf7112e62012-05-06 15:22:02 -07001701 *
1702 * smk_import will also reject a label beginning with '-',
1703 * so "-usecapabilities" will also work.
Casey Schaufler15446232008-07-30 15:37:11 -07001704 */
Casey Schauflerf7112e62012-05-06 15:22:02 -07001705 if (copy_from_user(data, buf, count) != 0)
1706 rc = -EFAULT;
1707 else
Casey Schaufler00f84f32013-12-23 11:07:10 -08001708 smack_onlycap = smk_import_entry(data, count);
Casey Schaufler15446232008-07-30 15:37:11 -07001709
Casey Schauflerf7112e62012-05-06 15:22:02 -07001710 kfree(data);
1711 return rc;
Casey Schaufler15446232008-07-30 15:37:11 -07001712}
1713
1714static const struct file_operations smk_onlycap_ops = {
1715 .read = smk_read_onlycap,
1716 .write = smk_write_onlycap,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001717 .llseek = default_llseek,
Casey Schaufler15446232008-07-30 15:37:11 -07001718};
1719
Casey Schauflere114e472008-02-04 22:29:50 -08001720/**
Etienne Bassetecfcc532009-04-08 20:40:06 +02001721 * smk_read_logging - read() for /smack/logging
1722 * @filp: file pointer, not actually used
1723 * @buf: where to put the result
1724 * @cn: maximum to send along
1725 * @ppos: where to start
1726 *
1727 * Returns number of bytes read or error code, as appropriate
1728 */
1729static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1730 size_t count, loff_t *ppos)
1731{
1732 char temp[32];
1733 ssize_t rc;
1734
1735 if (*ppos != 0)
1736 return 0;
1737
1738 sprintf(temp, "%d\n", log_policy);
1739 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1740 return rc;
1741}
1742
1743/**
1744 * smk_write_logging - write() for /smack/logging
1745 * @file: file pointer, not actually used
1746 * @buf: where to get the data from
1747 * @count: bytes sent
1748 * @ppos: where to start
1749 *
1750 * Returns number of bytes written or error code, as appropriate
1751 */
1752static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1753 size_t count, loff_t *ppos)
1754{
1755 char temp[32];
1756 int i;
1757
Casey Schaufler1880eff2012-06-05 15:28:30 -07001758 if (!smack_privileged(CAP_MAC_ADMIN))
Etienne Bassetecfcc532009-04-08 20:40:06 +02001759 return -EPERM;
1760
1761 if (count >= sizeof(temp) || count == 0)
1762 return -EINVAL;
1763
1764 if (copy_from_user(temp, buf, count) != 0)
1765 return -EFAULT;
1766
1767 temp[count] = '\0';
1768
1769 if (sscanf(temp, "%d", &i) != 1)
1770 return -EINVAL;
1771 if (i < 0 || i > 3)
1772 return -EINVAL;
1773 log_policy = i;
1774 return count;
1775}
1776
1777
1778
1779static const struct file_operations smk_logging_ops = {
1780 .read = smk_read_logging,
1781 .write = smk_write_logging,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001782 .llseek = default_llseek,
Etienne Bassetecfcc532009-04-08 20:40:06 +02001783};
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001784
1785/*
1786 * Seq_file read operations for /smack/load-self
1787 */
1788
1789static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1790{
1791 struct task_smack *tsp = current_security();
1792
Casey Schaufler40809562011-11-10 15:02:22 -08001793 return smk_seq_start(s, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001794}
1795
1796static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1797{
1798 struct task_smack *tsp = current_security();
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001799
Casey Schaufler40809562011-11-10 15:02:22 -08001800 return smk_seq_next(s, v, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001801}
1802
1803static int load_self_seq_show(struct seq_file *s, void *v)
1804{
1805 struct list_head *list = v;
1806 struct smack_rule *srp =
1807 list_entry(list, struct smack_rule, list);
1808
Casey Schauflerf7112e62012-05-06 15:22:02 -07001809 smk_rule_show(s, srp, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001810
1811 return 0;
1812}
1813
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001814static const struct seq_operations load_self_seq_ops = {
1815 .start = load_self_seq_start,
1816 .next = load_self_seq_next,
1817 .show = load_self_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001818 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001819};
1820
1821
1822/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001823 * smk_open_load_self - open() for /smack/load-self2
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001824 * @inode: inode structure representing file
1825 * @file: "load" file pointer
1826 *
1827 * For reading, use load_seq_* seq_file reading operations.
1828 */
1829static int smk_open_load_self(struct inode *inode, struct file *file)
1830{
1831 return seq_open(file, &load_self_seq_ops);
1832}
1833
1834/**
1835 * smk_write_load_self - write() for /smack/load-self
1836 * @file: file pointer, not actually used
1837 * @buf: where to get the data from
1838 * @count: bytes sent
1839 * @ppos: where to start - must be 0
1840 *
1841 */
1842static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1843 size_t count, loff_t *ppos)
1844{
1845 struct task_smack *tsp = current_security();
1846
Casey Schauflerf7112e62012-05-06 15:22:02 -07001847 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1848 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001849}
1850
1851static const struct file_operations smk_load_self_ops = {
1852 .open = smk_open_load_self,
1853 .read = seq_read,
1854 .llseek = seq_lseek,
1855 .write = smk_write_load_self,
1856 .release = seq_release,
1857};
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001858
1859/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001860 * smk_user_access - handle access check transaction
1861 * @file: file pointer
1862 * @buf: data from user space
1863 * @count: bytes sent
1864 * @ppos: where to start - must be 0
1865 */
1866static ssize_t smk_user_access(struct file *file, const char __user *buf,
1867 size_t count, loff_t *ppos, int format)
1868{
Rafal Krypae05b6f92013-01-10 19:42:00 +01001869 struct smack_parsed_rule rule;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001870 char *data;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001871 int res;
1872
1873 data = simple_transaction_get(file, buf, count);
1874 if (IS_ERR(data))
1875 return PTR_ERR(data);
1876
1877 if (format == SMK_FIXED24_FMT) {
1878 if (count < SMK_LOADLEN)
1879 return -EINVAL;
1880 res = smk_parse_rule(data, &rule, 0);
1881 } else {
1882 /*
Rafal Krypa10289b02013-08-09 11:47:07 +02001883 * simple_transaction_get() returns null-terminated data
Casey Schauflerf7112e62012-05-06 15:22:02 -07001884 */
Rafal Krypa10289b02013-08-09 11:47:07 +02001885 res = smk_parse_long_rule(data, &rule, 0, 3);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001886 }
1887
Jarkko Sakkinen398ce072013-11-28 19:16:46 +02001888 if (res >= 0)
1889 res = smk_access(rule.smk_subject, rule.smk_object,
1890 rule.smk_access1, NULL);
1891 else if (res != -ENOENT)
Casey Schauflerf7112e62012-05-06 15:22:02 -07001892 return -EINVAL;
1893
Casey Schauflerd166c802014-08-27 14:51:27 -07001894 /*
1895 * smk_access() can return a value > 0 in the "bringup" case.
1896 */
1897 data[0] = res >= 0 ? '1' : '0';
Casey Schauflerf7112e62012-05-06 15:22:02 -07001898 data[1] = '\0';
1899
1900 simple_transaction_set(file, 2);
1901
1902 if (format == SMK_FIXED24_FMT)
1903 return SMK_LOADLEN;
1904 return count;
1905}
1906
1907/**
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001908 * smk_write_access - handle access check transaction
1909 * @file: file pointer
1910 * @buf: data from user space
1911 * @count: bytes sent
1912 * @ppos: where to start - must be 0
1913 */
1914static ssize_t smk_write_access(struct file *file, const char __user *buf,
1915 size_t count, loff_t *ppos)
1916{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001917 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001918}
1919
1920static const struct file_operations smk_access_ops = {
1921 .write = smk_write_access,
1922 .read = simple_transaction_read,
1923 .release = simple_transaction_release,
1924 .llseek = generic_file_llseek,
1925};
1926
Casey Schauflerf7112e62012-05-06 15:22:02 -07001927
1928/*
1929 * Seq_file read operations for /smack/load2
1930 */
1931
1932static int load2_seq_show(struct seq_file *s, void *v)
1933{
1934 struct list_head *list = v;
1935 struct smack_master_list *smlp =
1936 list_entry(list, struct smack_master_list, list);
1937
1938 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1939
1940 return 0;
1941}
1942
1943static const struct seq_operations load2_seq_ops = {
1944 .start = load2_seq_start,
1945 .next = load2_seq_next,
1946 .show = load2_seq_show,
1947 .stop = smk_seq_stop,
1948};
1949
1950/**
1951 * smk_open_load2 - open() for /smack/load2
1952 * @inode: inode structure representing file
1953 * @file: "load2" file pointer
1954 *
1955 * For reading, use load2_seq_* seq_file reading operations.
1956 */
1957static int smk_open_load2(struct inode *inode, struct file *file)
1958{
1959 return seq_open(file, &load2_seq_ops);
1960}
1961
1962/**
1963 * smk_write_load2 - write() for /smack/load2
1964 * @file: file pointer, not actually used
1965 * @buf: where to get the data from
1966 * @count: bytes sent
1967 * @ppos: where to start - must be 0
1968 *
1969 */
1970static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1971 size_t count, loff_t *ppos)
1972{
1973 /*
1974 * Must have privilege.
1975 */
Casey Schaufler1880eff2012-06-05 15:28:30 -07001976 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflerf7112e62012-05-06 15:22:02 -07001977 return -EPERM;
1978
1979 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1980 SMK_LONG_FMT);
1981}
1982
1983static const struct file_operations smk_load2_ops = {
1984 .open = smk_open_load2,
1985 .read = seq_read,
1986 .llseek = seq_lseek,
1987 .write = smk_write_load2,
1988 .release = seq_release,
1989};
1990
1991/*
1992 * Seq_file read operations for /smack/load-self2
1993 */
1994
1995static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1996{
1997 struct task_smack *tsp = current_security();
1998
1999 return smk_seq_start(s, pos, &tsp->smk_rules);
2000}
2001
2002static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
2003{
2004 struct task_smack *tsp = current_security();
2005
2006 return smk_seq_next(s, v, pos, &tsp->smk_rules);
2007}
2008
2009static int load_self2_seq_show(struct seq_file *s, void *v)
2010{
2011 struct list_head *list = v;
2012 struct smack_rule *srp =
2013 list_entry(list, struct smack_rule, list);
2014
2015 smk_rule_show(s, srp, SMK_LONGLABEL);
2016
2017 return 0;
2018}
2019
2020static const struct seq_operations load_self2_seq_ops = {
2021 .start = load_self2_seq_start,
2022 .next = load_self2_seq_next,
2023 .show = load_self2_seq_show,
2024 .stop = smk_seq_stop,
2025};
2026
2027/**
2028 * smk_open_load_self2 - open() for /smack/load-self2
2029 * @inode: inode structure representing file
2030 * @file: "load" file pointer
2031 *
2032 * For reading, use load_seq_* seq_file reading operations.
2033 */
2034static int smk_open_load_self2(struct inode *inode, struct file *file)
2035{
2036 return seq_open(file, &load_self2_seq_ops);
2037}
2038
2039/**
2040 * smk_write_load_self2 - write() for /smack/load-self2
2041 * @file: file pointer, not actually used
2042 * @buf: where to get the data from
2043 * @count: bytes sent
2044 * @ppos: where to start - must be 0
2045 *
2046 */
2047static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
2048 size_t count, loff_t *ppos)
2049{
2050 struct task_smack *tsp = current_security();
2051
2052 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
2053 &tsp->smk_rules_lock, SMK_LONG_FMT);
2054}
2055
2056static const struct file_operations smk_load_self2_ops = {
2057 .open = smk_open_load_self2,
2058 .read = seq_read,
2059 .llseek = seq_lseek,
2060 .write = smk_write_load_self2,
2061 .release = seq_release,
2062};
2063
2064/**
2065 * smk_write_access2 - handle access check transaction
2066 * @file: file pointer
2067 * @buf: data from user space
2068 * @count: bytes sent
2069 * @ppos: where to start - must be 0
2070 */
2071static ssize_t smk_write_access2(struct file *file, const char __user *buf,
2072 size_t count, loff_t *ppos)
2073{
2074 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
2075}
2076
2077static const struct file_operations smk_access2_ops = {
2078 .write = smk_write_access2,
2079 .read = simple_transaction_read,
2080 .release = simple_transaction_release,
2081 .llseek = generic_file_llseek,
2082};
2083
Etienne Bassetecfcc532009-04-08 20:40:06 +02002084/**
Rafal Krypa449543b2012-07-11 17:49:30 +02002085 * smk_write_revoke_subj - write() for /smack/revoke-subject
2086 * @file: file pointer
2087 * @buf: data from user space
2088 * @count: bytes sent
2089 * @ppos: where to start - must be 0
2090 */
2091static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
2092 size_t count, loff_t *ppos)
2093{
2094 char *data = NULL;
2095 const char *cp = NULL;
2096 struct smack_known *skp;
2097 struct smack_rule *sp;
2098 struct list_head *rule_list;
2099 struct mutex *rule_lock;
2100 int rc = count;
2101
2102 if (*ppos != 0)
2103 return -EINVAL;
2104
2105 if (!smack_privileged(CAP_MAC_ADMIN))
2106 return -EPERM;
2107
2108 if (count == 0 || count > SMK_LONGLABEL)
2109 return -EINVAL;
2110
2111 data = kzalloc(count, GFP_KERNEL);
2112 if (data == NULL)
2113 return -ENOMEM;
2114
2115 if (copy_from_user(data, buf, count) != 0) {
2116 rc = -EFAULT;
2117 goto free_out;
2118 }
2119
2120 cp = smk_parse_smack(data, count);
2121 if (cp == NULL) {
2122 rc = -EINVAL;
2123 goto free_out;
2124 }
2125
2126 skp = smk_find_entry(cp);
Rafal Krypad15d9fa2012-11-27 16:28:11 +01002127 if (skp == NULL)
Rafal Krypa449543b2012-07-11 17:49:30 +02002128 goto free_out;
Rafal Krypa449543b2012-07-11 17:49:30 +02002129
2130 rule_list = &skp->smk_rules;
2131 rule_lock = &skp->smk_rules_lock;
2132
2133 mutex_lock(rule_lock);
2134
2135 list_for_each_entry_rcu(sp, rule_list, list)
2136 sp->smk_access = 0;
2137
2138 mutex_unlock(rule_lock);
2139
2140free_out:
2141 kfree(data);
2142 kfree(cp);
2143 return rc;
2144}
2145
2146static const struct file_operations smk_revoke_subj_ops = {
2147 .write = smk_write_revoke_subj,
2148 .read = simple_transaction_read,
2149 .release = simple_transaction_release,
2150 .llseek = generic_file_llseek,
2151};
2152
Casey Schauflere9307232012-11-01 18:14:32 -07002153static struct kset *smackfs_kset;
2154/**
2155 * smk_init_sysfs - initialize /sys/fs/smackfs
2156 *
2157 */
2158static int smk_init_sysfs(void)
2159{
2160 smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
2161 if (!smackfs_kset)
2162 return -ENOMEM;
2163 return 0;
2164}
2165
Rafal Krypa449543b2012-07-11 17:49:30 +02002166/**
Rafal Krypae05b6f92013-01-10 19:42:00 +01002167 * smk_write_change_rule - write() for /smack/change-rule
2168 * @file: file pointer
2169 * @buf: data from user space
2170 * @count: bytes sent
2171 * @ppos: where to start - must be 0
2172 */
2173static ssize_t smk_write_change_rule(struct file *file, const char __user *buf,
2174 size_t count, loff_t *ppos)
2175{
2176 /*
2177 * Must have privilege.
2178 */
Casey Schaufler4afde482013-12-19 13:23:26 -08002179 if (!smack_privileged(CAP_MAC_ADMIN))
Rafal Krypae05b6f92013-01-10 19:42:00 +01002180 return -EPERM;
2181
2182 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
2183 SMK_CHANGE_FMT);
2184}
2185
2186static const struct file_operations smk_change_rule_ops = {
2187 .write = smk_write_change_rule,
2188 .read = simple_transaction_read,
2189 .release = simple_transaction_release,
2190 .llseek = generic_file_llseek,
2191};
2192
2193/**
Casey Schaufler00f84f32013-12-23 11:07:10 -08002194 * smk_read_syslog - read() for smackfs/syslog
2195 * @filp: file pointer, not actually used
2196 * @buf: where to put the result
2197 * @cn: maximum to send along
2198 * @ppos: where to start
2199 *
2200 * Returns number of bytes read or error code, as appropriate
2201 */
2202static ssize_t smk_read_syslog(struct file *filp, char __user *buf,
2203 size_t cn, loff_t *ppos)
2204{
2205 struct smack_known *skp;
2206 ssize_t rc = -EINVAL;
2207 int asize;
2208
2209 if (*ppos != 0)
2210 return 0;
2211
2212 if (smack_syslog_label == NULL)
2213 skp = &smack_known_star;
2214 else
2215 skp = smack_syslog_label;
2216
2217 asize = strlen(skp->smk_known) + 1;
2218
2219 if (cn >= asize)
2220 rc = simple_read_from_buffer(buf, cn, ppos, skp->smk_known,
2221 asize);
2222
2223 return rc;
2224}
2225
2226/**
2227 * smk_write_syslog - write() for smackfs/syslog
2228 * @file: file pointer, not actually used
2229 * @buf: where to get the data from
2230 * @count: bytes sent
2231 * @ppos: where to start
2232 *
2233 * Returns number of bytes written or error code, as appropriate
2234 */
2235static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
2236 size_t count, loff_t *ppos)
2237{
2238 char *data;
2239 struct smack_known *skp;
2240 int rc = count;
2241
2242 if (!smack_privileged(CAP_MAC_ADMIN))
2243 return -EPERM;
2244
Konstantin Khlebnikovb862e562014-08-07 20:52:43 +04002245 data = kzalloc(count + 1, GFP_KERNEL);
Casey Schaufler00f84f32013-12-23 11:07:10 -08002246 if (data == NULL)
2247 return -ENOMEM;
2248
2249 if (copy_from_user(data, buf, count) != 0)
2250 rc = -EFAULT;
2251 else {
2252 skp = smk_import_entry(data, count);
2253 if (skp == NULL)
2254 rc = -EINVAL;
2255 else
2256 smack_syslog_label = smk_import_entry(data, count);
2257 }
2258
2259 kfree(data);
2260 return rc;
2261}
2262
2263static const struct file_operations smk_syslog_ops = {
2264 .read = smk_read_syslog,
2265 .write = smk_write_syslog,
2266 .llseek = default_llseek,
2267};
2268
2269
2270/**
Lukasz Pawelczyk66867812014-03-11 17:07:06 +01002271 * smk_read_ptrace - read() for /smack/ptrace
2272 * @filp: file pointer, not actually used
2273 * @buf: where to put the result
2274 * @count: maximum to send along
2275 * @ppos: where to start
2276 *
2277 * Returns number of bytes read or error code, as appropriate
2278 */
2279static ssize_t smk_read_ptrace(struct file *filp, char __user *buf,
2280 size_t count, loff_t *ppos)
2281{
2282 char temp[32];
2283 ssize_t rc;
2284
2285 if (*ppos != 0)
2286 return 0;
2287
2288 sprintf(temp, "%d\n", smack_ptrace_rule);
2289 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
2290 return rc;
2291}
2292
2293/**
2294 * smk_write_ptrace - write() for /smack/ptrace
2295 * @file: file pointer
2296 * @buf: data from user space
2297 * @count: bytes sent
2298 * @ppos: where to start - must be 0
2299 */
2300static ssize_t smk_write_ptrace(struct file *file, const char __user *buf,
2301 size_t count, loff_t *ppos)
2302{
2303 char temp[32];
2304 int i;
2305
2306 if (!smack_privileged(CAP_MAC_ADMIN))
2307 return -EPERM;
2308
2309 if (*ppos != 0 || count >= sizeof(temp) || count == 0)
2310 return -EINVAL;
2311
2312 if (copy_from_user(temp, buf, count) != 0)
2313 return -EFAULT;
2314
2315 temp[count] = '\0';
2316
2317 if (sscanf(temp, "%d", &i) != 1)
2318 return -EINVAL;
2319 if (i < SMACK_PTRACE_DEFAULT || i > SMACK_PTRACE_MAX)
2320 return -EINVAL;
2321 smack_ptrace_rule = i;
2322
2323 return count;
2324}
2325
2326static const struct file_operations smk_ptrace_ops = {
2327 .write = smk_write_ptrace,
2328 .read = smk_read_ptrace,
2329 .llseek = default_llseek,
2330};
2331
2332/**
Casey Schaufler00f84f32013-12-23 11:07:10 -08002333 * smk_fill_super - fill the smackfs superblock
Casey Schauflere114e472008-02-04 22:29:50 -08002334 * @sb: the empty superblock
2335 * @data: unused
2336 * @silent: unused
2337 *
Casey Schaufler00f84f32013-12-23 11:07:10 -08002338 * Fill in the well known entries for the smack filesystem
Casey Schauflere114e472008-02-04 22:29:50 -08002339 *
2340 * Returns 0 on success, an error code on failure
2341 */
2342static int smk_fill_super(struct super_block *sb, void *data, int silent)
2343{
2344 int rc;
2345 struct inode *root_inode;
2346
2347 static struct tree_descr smack_files[] = {
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002348 [SMK_LOAD] = {
2349 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2350 [SMK_CIPSO] = {
2351 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2352 [SMK_DOI] = {
2353 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2354 [SMK_DIRECT] = {
2355 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2356 [SMK_AMBIENT] = {
2357 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2358 [SMK_NETLBLADDR] = {
2359 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2360 [SMK_ONLYCAP] = {
2361 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2362 [SMK_LOGGING] = {
2363 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2364 [SMK_LOAD_SELF] = {
2365 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03002366 [SMK_ACCESSES] = {
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +03002367 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
Casey Schauflerf7112e62012-05-06 15:22:02 -07002368 [SMK_MAPPED] = {
2369 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2370 [SMK_LOAD2] = {
2371 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2372 [SMK_LOAD_SELF2] = {
2373 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2374 [SMK_ACCESS2] = {
2375 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2376 [SMK_CIPSO2] = {
2377 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
Rafal Krypa449543b2012-07-11 17:49:30 +02002378 [SMK_REVOKE_SUBJ] = {
2379 "revoke-subject", &smk_revoke_subj_ops,
2380 S_IRUGO|S_IWUSR},
Rafal Krypae05b6f92013-01-10 19:42:00 +01002381 [SMK_CHANGE_RULE] = {
2382 "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
Casey Schaufler00f84f32013-12-23 11:07:10 -08002383 [SMK_SYSLOG] = {
2384 "syslog", &smk_syslog_ops, S_IRUGO|S_IWUSR},
Lukasz Pawelczyk66867812014-03-11 17:07:06 +01002385 [SMK_PTRACE] = {
2386 "ptrace", &smk_ptrace_ops, S_IRUGO|S_IWUSR},
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002387 /* last one */
2388 {""}
Casey Schauflere114e472008-02-04 22:29:50 -08002389 };
2390
2391 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2392 if (rc != 0) {
2393 printk(KERN_ERR "%s failed %d while creating inodes\n",
2394 __func__, rc);
2395 return rc;
2396 }
2397
2398 root_inode = sb->s_root->d_inode;
Casey Schauflere114e472008-02-04 22:29:50 -08002399
2400 return 0;
2401}
2402
2403/**
Al Virofc14f2f2010-07-25 01:48:30 +04002404 * smk_mount - get the smackfs superblock
Casey Schauflere114e472008-02-04 22:29:50 -08002405 * @fs_type: passed along without comment
2406 * @flags: passed along without comment
2407 * @dev_name: passed along without comment
2408 * @data: passed along without comment
Casey Schauflere114e472008-02-04 22:29:50 -08002409 *
2410 * Just passes everything along.
2411 *
2412 * Returns what the lower level code does.
2413 */
Al Virofc14f2f2010-07-25 01:48:30 +04002414static struct dentry *smk_mount(struct file_system_type *fs_type,
2415 int flags, const char *dev_name, void *data)
Casey Schauflere114e472008-02-04 22:29:50 -08002416{
Al Virofc14f2f2010-07-25 01:48:30 +04002417 return mount_single(fs_type, flags, data, smk_fill_super);
Casey Schauflere114e472008-02-04 22:29:50 -08002418}
2419
2420static struct file_system_type smk_fs_type = {
2421 .name = "smackfs",
Al Virofc14f2f2010-07-25 01:48:30 +04002422 .mount = smk_mount,
Casey Schauflere114e472008-02-04 22:29:50 -08002423 .kill_sb = kill_litter_super,
2424};
2425
2426static struct vfsmount *smackfs_mount;
2427
Casey Schauflerf7112e62012-05-06 15:22:02 -07002428static int __init smk_preset_netlabel(struct smack_known *skp)
2429{
2430 skp->smk_netlabel.domain = skp->smk_known;
2431 skp->smk_netlabel.flags =
2432 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2433 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2434 &skp->smk_netlabel, strlen(skp->smk_known));
2435}
2436
Casey Schauflere114e472008-02-04 22:29:50 -08002437/**
2438 * init_smk_fs - get the smackfs superblock
2439 *
2440 * register the smackfs
2441 *
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002442 * Do not register smackfs if Smack wasn't enabled
2443 * on boot. We can not put this method normally under the
2444 * smack_init() code path since the security subsystem get
2445 * initialized before the vfs caches.
2446 *
2447 * Returns true if we were not chosen on boot or if
2448 * we were chosen and filesystem registration succeeded.
Casey Schauflere114e472008-02-04 22:29:50 -08002449 */
2450static int __init init_smk_fs(void)
2451{
2452 int err;
Casey Schauflerf7112e62012-05-06 15:22:02 -07002453 int rc;
Casey Schauflere114e472008-02-04 22:29:50 -08002454
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002455 if (!security_module_enable(&smack_ops))
2456 return 0;
2457
Casey Schauflere9307232012-11-01 18:14:32 -07002458 err = smk_init_sysfs();
2459 if (err)
2460 printk(KERN_ERR "smackfs: sysfs mountpoint problem.\n");
2461
Casey Schauflere114e472008-02-04 22:29:50 -08002462 err = register_filesystem(&smk_fs_type);
2463 if (!err) {
2464 smackfs_mount = kern_mount(&smk_fs_type);
2465 if (IS_ERR(smackfs_mount)) {
2466 printk(KERN_ERR "smackfs: could not mount!\n");
2467 err = PTR_ERR(smackfs_mount);
2468 smackfs_mount = NULL;
2469 }
2470 }
2471
Casey Schauflere114e472008-02-04 22:29:50 -08002472 smk_cipso_doi();
Casey Schaufler4bc87e62008-02-15 15:24:25 -08002473 smk_unlbl_ambient(NULL);
Casey Schauflere114e472008-02-04 22:29:50 -08002474
Casey Schauflerf7112e62012-05-06 15:22:02 -07002475 rc = smk_preset_netlabel(&smack_known_floor);
2476 if (err == 0 && rc < 0)
2477 err = rc;
2478 rc = smk_preset_netlabel(&smack_known_hat);
2479 if (err == 0 && rc < 0)
2480 err = rc;
2481 rc = smk_preset_netlabel(&smack_known_huh);
2482 if (err == 0 && rc < 0)
2483 err = rc;
2484 rc = smk_preset_netlabel(&smack_known_invalid);
2485 if (err == 0 && rc < 0)
2486 err = rc;
2487 rc = smk_preset_netlabel(&smack_known_star);
2488 if (err == 0 && rc < 0)
2489 err = rc;
2490 rc = smk_preset_netlabel(&smack_known_web);
2491 if (err == 0 && rc < 0)
2492 err = rc;
2493
Casey Schauflere114e472008-02-04 22:29:50 -08002494 return err;
2495}
2496
2497__initcall(init_smk_fs);