blob: 1810c9a4ed48b84e2c317a5940e799546379d1f8 [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Authors:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
11 *
12 * Special thanks to the authors of selinuxfs.
13 *
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
16 *
17 */
18
19#include <linux/kernel.h>
20#include <linux/vmalloc.h>
21#include <linux/security.h>
22#include <linux/mutex.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090023#include <linux/slab.h>
Casey Schaufler6d3dc072008-12-31 12:54:12 -050024#include <net/net_namespace.h>
Casey Schauflere114e472008-02-04 22:29:50 -080025#include <net/cipso_ipv4.h>
26#include <linux/seq_file.h>
27#include <linux/ctype.h>
Casey Schaufler4bc87e62008-02-15 15:24:25 -080028#include <linux/audit.h>
Casey Schauflere114e472008-02-04 22:29:50 -080029#include "smack.h"
30
31/*
32 * smackfs pseudo filesystem.
33 */
34
35enum smk_inos {
36 SMK_ROOT_INO = 2,
37 SMK_LOAD = 3, /* load policy */
38 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
39 SMK_DOI = 5, /* CIPSO DOI */
40 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
41 SMK_AMBIENT = 7, /* internet ambient label */
Casey Schaufler6d3dc072008-12-31 12:54:12 -050042 SMK_NETLBLADDR = 8, /* single label hosts */
Casey Schaufler15446232008-07-30 15:37:11 -070043 SMK_ONLYCAP = 9, /* the only "capable" label */
Etienne Bassetecfcc532009-04-08 20:40:06 +020044 SMK_LOGGING = 10, /* logging */
Casey Schaufler7898e1f2011-01-17 08:05:27 -080045 SMK_LOAD_SELF = 11, /* task specific rules */
Jarkko Sakkinen828716c2011-09-08 10:12:01 +030046 SMK_ACCESSES = 12, /* access policy */
Casey Schauflerf7112e62012-05-06 15:22:02 -070047 SMK_MAPPED = 13, /* CIPSO level indicating mapped label */
48 SMK_LOAD2 = 14, /* load policy with long labels */
49 SMK_LOAD_SELF2 = 15, /* load task specific rules with long labels */
50 SMK_ACCESS2 = 16, /* make an access check with long labels */
51 SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
Casey Schauflere114e472008-02-04 22:29:50 -080052};
53
54/*
55 * List locks
56 */
57static DEFINE_MUTEX(smack_list_lock);
58static DEFINE_MUTEX(smack_cipso_lock);
Casey Schaufler4bc87e62008-02-15 15:24:25 -080059static DEFINE_MUTEX(smack_ambient_lock);
Casey Schaufler6d3dc072008-12-31 12:54:12 -050060static DEFINE_MUTEX(smk_netlbladdr_lock);
Casey Schauflere114e472008-02-04 22:29:50 -080061
62/*
63 * This is the "ambient" label for network traffic.
64 * If it isn't somehow marked, use this.
65 * It can be reset via smackfs/ambient
66 */
Casey Schauflerf7112e62012-05-06 15:22:02 -070067char *smack_net_ambient;
Casey Schauflere114e472008-02-04 22:29:50 -080068
69/*
Casey Schauflere114e472008-02-04 22:29:50 -080070 * This is the level in a CIPSO header that indicates a
71 * smack label is contained directly in the category set.
72 * It can be reset via smackfs/direct
73 */
74int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
75
Casey Schaufler15446232008-07-30 15:37:11 -070076/*
Casey Schauflerf7112e62012-05-06 15:22:02 -070077 * This is the level in a CIPSO header that indicates a
78 * secid is contained directly in the category set.
79 * It can be reset via smackfs/mapped
80 */
81int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
82
83/*
Casey Schaufler15446232008-07-30 15:37:11 -070084 * Unless a process is running with this label even
85 * having CAP_MAC_OVERRIDE isn't enough to grant
86 * privilege to violate MAC policy. If no label is
87 * designated (the NULL case) capabilities apply to
88 * everyone. It is expected that the hat (^) label
89 * will be used if any label is used.
90 */
91char *smack_onlycap;
92
Casey Schaufler6d3dc072008-12-31 12:54:12 -050093/*
94 * Certain IP addresses may be designated as single label hosts.
95 * Packets are sent there unlabeled, but only from tasks that
96 * can write to the specified label.
97 */
Etienne Basset7198e2e2009-03-24 20:53:24 +010098
99LIST_HEAD(smk_netlbladdr_list);
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700100
101/*
102 * Rule lists are maintained for each label.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700103 * This master list is just for reading /smack/load and /smack/load2.
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700104 */
105struct smack_master_list {
106 struct list_head list;
107 struct smack_rule *smk_rule;
108};
109
Etienne Basset7198e2e2009-03-24 20:53:24 +0100110LIST_HEAD(smack_rule_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500111
Casey Schauflere114e472008-02-04 22:29:50 -0800112static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
Casey Schauflere114e472008-02-04 22:29:50 -0800113
Etienne Basset43031542009-03-27 17:11:01 -0400114const char *smack_cipso_option = SMACK_CIPSO_OPTION;
115
Casey Schauflere114e472008-02-04 22:29:50 -0800116/*
Casey Schauflere114e472008-02-04 22:29:50 -0800117 * Values for parsing cipso rules
118 * SMK_DIGITLEN: Length of a digit field in a rule.
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700119 * SMK_CIPSOMIN: Minimum possible cipso rule length.
120 * SMK_CIPSOMAX: Maximum possible cipso rule length.
Casey Schauflere114e472008-02-04 22:29:50 -0800121 */
122#define SMK_DIGITLEN 4
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700123#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
124#define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
125
126/*
127 * Values for parsing MAC rules
128 * SMK_ACCESS: Maximum possible combination of access permissions
129 * SMK_ACCESSLEN: Maximum length for a rule access field
130 * SMK_LOADLEN: Smack rule length
131 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200132#define SMK_OACCESS "rwxa"
133#define SMK_ACCESS "rwxat"
134#define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
135#define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
136#define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
137#define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700138
Casey Schauflerf7112e62012-05-06 15:22:02 -0700139/*
140 * Stricly for CIPSO level manipulation.
141 * Set the category bit number in a smack label sized buffer.
142 */
143static inline void smack_catset_bit(unsigned int cat, char *catsetp)
144{
145 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
146 return;
147
148 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
149}
150
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500151/**
152 * smk_netlabel_audit_set - fill a netlbl_audit struct
153 * @nap: structure to fill
154 */
155static void smk_netlabel_audit_set(struct netlbl_audit *nap)
156{
157 nap->loginuid = audit_get_loginuid(current);
158 nap->sessionid = audit_get_sessionid(current);
Casey Schaufler676dac42010-12-02 06:43:39 -0800159 nap->secid = smack_to_secid(smk_of_current());
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500160}
161
162/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700163 * Value for parsing single label host rules
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500164 * "1.2.3.4 X"
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500165 */
166#define SMK_NETLBLADDRMIN 9
Casey Schauflere114e472008-02-04 22:29:50 -0800167
Casey Schauflere114e472008-02-04 22:29:50 -0800168/**
169 * smk_set_access - add a rule to the rule list
170 * @srp: the new rule to add
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800171 * @rule_list: the list of rules
172 * @rule_lock: the rule list lock
Casey Schauflere114e472008-02-04 22:29:50 -0800173 *
174 * Looks through the current subject/object/access list for
175 * the subject/object pair and replaces the access that was
176 * there. If the pair isn't found add it with the specified
177 * access.
Sergio Luis81ea7142008-12-22 01:16:15 -0300178 *
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800179 * Returns 1 if a rule was found to exist already, 0 if it is new
Sergio Luis81ea7142008-12-22 01:16:15 -0300180 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
181 * during the allocation of the new pair to add.
Casey Schauflere114e472008-02-04 22:29:50 -0800182 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800183static int smk_set_access(struct smack_rule *srp, struct list_head *rule_list,
184 struct mutex *rule_lock)
Casey Schauflere114e472008-02-04 22:29:50 -0800185{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100186 struct smack_rule *sp;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800187 int found = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800188
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800189 mutex_lock(rule_lock);
190
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700191 /*
192 * Because the object label is less likely to match
193 * than the subject label check it first
194 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800195 list_for_each_entry_rcu(sp, rule_list, list) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700196 if (sp->smk_object == srp->smk_object &&
197 sp->smk_subject == srp->smk_subject) {
Etienne Basset7198e2e2009-03-24 20:53:24 +0100198 found = 1;
199 sp->smk_access = srp->smk_access;
Casey Schauflere114e472008-02-04 22:29:50 -0800200 break;
201 }
Casey Schauflere114e472008-02-04 22:29:50 -0800202 }
Etienne Basset7198e2e2009-03-24 20:53:24 +0100203 if (found == 0)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800204 list_add_rcu(&srp->list, rule_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800205
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800206 mutex_unlock(rule_lock);
Casey Schauflere114e472008-02-04 22:29:50 -0800207
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800208 return found;
Casey Schauflere114e472008-02-04 22:29:50 -0800209}
210
211/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700212 * smk_fill_rule - Fill Smack rule from strings
213 * @subject: subject label string
214 * @object: object label string
215 * @access: access string
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300216 * @rule: Smack rule
217 * @import: if non-zero, import labels
Casey Schauflerf7112e62012-05-06 15:22:02 -0700218 *
219 * Returns 0 on success, -1 on failure
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300220 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700221static int smk_fill_rule(const char *subject, const char *object,
222 const char *access, struct smack_rule *rule,
223 int import)
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300224{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700225 int rc = -1;
226 int done;
227 const char *cp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300228 struct smack_known *skp;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300229
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300230 if (import) {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700231 rule->smk_subject = smk_import(subject, 0);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300232 if (rule->smk_subject == NULL)
233 return -1;
234
Casey Schauflerf7112e62012-05-06 15:22:02 -0700235 rule->smk_object = smk_import(object, 0);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300236 if (rule->smk_object == NULL)
237 return -1;
238 } else {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700239 cp = smk_parse_smack(subject, 0);
240 if (cp == NULL)
241 return -1;
242 skp = smk_find_entry(cp);
243 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300244 if (skp == NULL)
245 return -1;
246 rule->smk_subject = skp->smk_known;
247
Casey Schauflerf7112e62012-05-06 15:22:02 -0700248 cp = smk_parse_smack(object, 0);
249 if (cp == NULL)
250 return -1;
251 skp = smk_find_entry(cp);
252 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300253 if (skp == NULL)
254 return -1;
255 rule->smk_object = skp->smk_known;
256 }
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300257
258 rule->smk_access = 0;
259
Casey Schauflerf7112e62012-05-06 15:22:02 -0700260 for (cp = access, done = 0; *cp && !done; cp++) {
261 switch (*cp) {
262 case '-':
263 break;
264 case 'r':
265 case 'R':
266 rule->smk_access |= MAY_READ;
267 break;
268 case 'w':
269 case 'W':
270 rule->smk_access |= MAY_WRITE;
271 break;
272 case 'x':
273 case 'X':
274 rule->smk_access |= MAY_EXEC;
275 break;
276 case 'a':
277 case 'A':
278 rule->smk_access |= MAY_APPEND;
279 break;
280 case 't':
281 case 'T':
282 rule->smk_access |= MAY_TRANSMUTE;
283 break;
284 default:
285 done = 1;
286 break;
287 }
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300288 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700289 rc = 0;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300290
Casey Schauflerf7112e62012-05-06 15:22:02 -0700291 return rc;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300292}
293
294/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700295 * smk_parse_rule - parse Smack rule from load string
296 * @data: string to be parsed whose size is SMK_LOADLEN
297 * @rule: Smack rule
298 * @import: if non-zero, import labels
299 *
300 * Returns 0 on success, -1 on errors.
301 */
302static int smk_parse_rule(const char *data, struct smack_rule *rule, int import)
303{
304 int rc;
305
306 rc = smk_fill_rule(data, data + SMK_LABELLEN,
307 data + SMK_LABELLEN + SMK_LABELLEN, rule, import);
308 return rc;
309}
310
311/**
312 * smk_parse_long_rule - parse Smack rule from rule string
313 * @data: string to be parsed, null terminated
314 * @rule: Smack rule
315 * @import: if non-zero, import labels
316 *
317 * Returns 0 on success, -1 on failure
318 */
319static int smk_parse_long_rule(const char *data, struct smack_rule *rule,
320 int import)
321{
322 char *subject;
323 char *object;
324 char *access;
325 int datalen;
326 int rc = -1;
327
328 /*
329 * This is probably inefficient, but safe.
330 */
331 datalen = strlen(data);
332 subject = kzalloc(datalen, GFP_KERNEL);
333 if (subject == NULL)
334 return -1;
335 object = kzalloc(datalen, GFP_KERNEL);
336 if (object == NULL)
337 goto free_out_s;
338 access = kzalloc(datalen, GFP_KERNEL);
339 if (access == NULL)
340 goto free_out_o;
341
342 if (sscanf(data, "%s %s %s", subject, object, access) == 3)
343 rc = smk_fill_rule(subject, object, access, rule, import);
344
345 kfree(access);
346free_out_o:
347 kfree(object);
348free_out_s:
349 kfree(subject);
350 return rc;
351}
352
353#define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
354#define SMK_LONG_FMT 1 /* Variable long label format */
355/**
356 * smk_write_rules_list - write() for any /smack rule file
Randy Dunlap251a2a92009-02-18 11:42:33 -0800357 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800358 * @buf: where to get the data from
359 * @count: bytes sent
360 * @ppos: where to start - must be 0
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800361 * @rule_list: the list of rules to write to
362 * @rule_lock: lock for the rule list
Casey Schauflerf7112e62012-05-06 15:22:02 -0700363 * @format: /smack/load or /smack/load2 format.
Casey Schauflere114e472008-02-04 22:29:50 -0800364 *
365 * Get one smack access rule from above.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700366 * The format for SMK_LONG_FMT is:
367 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
368 * The format for SMK_FIXED24_FMT is exactly:
369 * "subject object rwxat"
Casey Schauflere114e472008-02-04 22:29:50 -0800370 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700371static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
372 size_t count, loff_t *ppos,
373 struct list_head *rule_list,
374 struct mutex *rule_lock, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800375{
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700376 struct smack_master_list *smlp;
377 struct smack_known *skp;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100378 struct smack_rule *rule;
Casey Schauflere114e472008-02-04 22:29:50 -0800379 char *data;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700380 int datalen;
Casey Schauflere114e472008-02-04 22:29:50 -0800381 int rc = -EINVAL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700382 int load = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800383
384 /*
Casey Schauflere114e472008-02-04 22:29:50 -0800385 * No partial writes.
386 * Enough data must be present.
387 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200388 if (*ppos != 0)
389 return -EINVAL;
Casey Schauflere114e472008-02-04 22:29:50 -0800390
Casey Schauflerf7112e62012-05-06 15:22:02 -0700391 if (format == SMK_FIXED24_FMT) {
392 /*
393 * Minor hack for backward compatibility
394 */
395 if (count != SMK_OLOADLEN && count != SMK_LOADLEN)
396 return -EINVAL;
397 datalen = SMK_LOADLEN;
398 } else
399 datalen = count + 1;
400
401 data = kzalloc(datalen, GFP_KERNEL);
Casey Schauflere114e472008-02-04 22:29:50 -0800402 if (data == NULL)
403 return -ENOMEM;
404
405 if (copy_from_user(data, buf, count) != 0) {
406 rc = -EFAULT;
407 goto out;
408 }
409
Etienne Basset7198e2e2009-03-24 20:53:24 +0100410 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
411 if (rule == NULL) {
412 rc = -ENOMEM;
Casey Schauflere114e472008-02-04 22:29:50 -0800413 goto out;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100414 }
Casey Schauflere114e472008-02-04 22:29:50 -0800415
Casey Schauflerf7112e62012-05-06 15:22:02 -0700416 if (format == SMK_LONG_FMT) {
417 /*
418 * Be sure the data string is terminated.
419 */
420 data[count] = '\0';
421 if (smk_parse_long_rule(data, rule, 1))
422 goto out_free_rule;
423 } else {
424 /*
425 * More on the minor hack for backward compatibility
426 */
427 if (count == (SMK_OLOADLEN))
428 data[SMK_OLOADLEN] = '-';
429 if (smk_parse_rule(data, rule, 1))
430 goto out_free_rule;
431 }
432
Casey Schauflere114e472008-02-04 22:29:50 -0800433
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700434 if (rule_list == NULL) {
435 load = 1;
436 skp = smk_find_entry(rule->smk_subject);
437 rule_list = &skp->smk_rules;
438 rule_lock = &skp->smk_rules_lock;
439 }
440
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800441 rc = count;
442 /*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700443 * If this is a global as opposed to self and a new rule
Casey Schaufler40809562011-11-10 15:02:22 -0800444 * it needs to get added for reporting.
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800445 * smk_set_access returns true if there was already a rule
446 * for the subject/object pair, and false if it was new.
447 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700448 if (!smk_set_access(rule, rule_list, rule_lock)) {
449 if (load) {
450 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
451 if (smlp != NULL) {
452 smlp->smk_rule = rule;
453 list_add_rcu(&smlp->list, &smack_rule_list);
454 } else
455 rc = -ENOMEM;
456 }
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800457 goto out;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700458 }
Casey Schauflere114e472008-02-04 22:29:50 -0800459
Etienne Basset7198e2e2009-03-24 20:53:24 +0100460out_free_rule:
461 kfree(rule);
Casey Schauflere114e472008-02-04 22:29:50 -0800462out:
463 kfree(data);
464 return rc;
465}
466
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800467/*
Casey Schaufler40809562011-11-10 15:02:22 -0800468 * Core logic for smackfs seq list operations.
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800469 */
470
Casey Schaufler40809562011-11-10 15:02:22 -0800471static void *smk_seq_start(struct seq_file *s, loff_t *pos,
472 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800473{
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700474 struct list_head *list;
475
476 /*
477 * This is 0 the first time through.
478 */
479 if (s->index == 0)
Casey Schaufler40809562011-11-10 15:02:22 -0800480 s->private = head;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700481
482 if (s->private == NULL)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800483 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700484
485 list = s->private;
486 if (list_empty(list))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800487 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700488
489 if (s->index == 0)
490 return list->next;
491 return list;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800492}
493
Casey Schaufler40809562011-11-10 15:02:22 -0800494static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
495 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800496{
497 struct list_head *list = v;
498
Casey Schaufler40809562011-11-10 15:02:22 -0800499 if (list_is_last(list, head)) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700500 s->private = NULL;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800501 return NULL;
502 }
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700503 s->private = list->next;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800504 return list->next;
505}
506
Casey Schaufler40809562011-11-10 15:02:22 -0800507static void smk_seq_stop(struct seq_file *s, void *v)
508{
509 /* No-op */
510}
511
Casey Schauflerf7112e62012-05-06 15:22:02 -0700512static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
Casey Schaufler40809562011-11-10 15:02:22 -0800513{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700514 /*
515 * Don't show any rules with label names too long for
516 * interface file (/smack/load or /smack/load2)
517 * because you should expect to be able to write
518 * anything you read back.
519 */
520 if (strlen(srp->smk_subject) >= max || strlen(srp->smk_object) >= max)
521 return;
Casey Schaufler40809562011-11-10 15:02:22 -0800522
Casey Schauflerf7112e62012-05-06 15:22:02 -0700523 seq_printf(s, "%s %s", srp->smk_subject, srp->smk_object);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800524
525 seq_putc(s, ' ');
526
527 if (srp->smk_access & MAY_READ)
528 seq_putc(s, 'r');
529 if (srp->smk_access & MAY_WRITE)
530 seq_putc(s, 'w');
531 if (srp->smk_access & MAY_EXEC)
532 seq_putc(s, 'x');
533 if (srp->smk_access & MAY_APPEND)
534 seq_putc(s, 'a');
535 if (srp->smk_access & MAY_TRANSMUTE)
536 seq_putc(s, 't');
537 if (srp->smk_access == 0)
538 seq_putc(s, '-');
539
540 seq_putc(s, '\n');
Casey Schauflerf7112e62012-05-06 15:22:02 -0700541}
542
543/*
544 * Seq_file read operations for /smack/load
545 */
546
547static void *load2_seq_start(struct seq_file *s, loff_t *pos)
548{
549 return smk_seq_start(s, pos, &smack_rule_list);
550}
551
552static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
553{
554 return smk_seq_next(s, v, pos, &smack_rule_list);
555}
556
557static int load_seq_show(struct seq_file *s, void *v)
558{
559 struct list_head *list = v;
560 struct smack_master_list *smlp =
561 list_entry(list, struct smack_master_list, list);
562
563 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800564
565 return 0;
566}
567
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800568static const struct seq_operations load_seq_ops = {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700569 .start = load2_seq_start,
570 .next = load2_seq_next,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800571 .show = load_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800572 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800573};
574
575/**
576 * smk_open_load - open() for /smack/load
577 * @inode: inode structure representing file
578 * @file: "load" file pointer
579 *
580 * For reading, use load_seq_* seq_file reading operations.
581 */
582static int smk_open_load(struct inode *inode, struct file *file)
583{
584 return seq_open(file, &load_seq_ops);
585}
586
587/**
588 * smk_write_load - write() for /smack/load
589 * @file: file pointer, not actually used
590 * @buf: where to get the data from
591 * @count: bytes sent
592 * @ppos: where to start - must be 0
593 *
594 */
595static ssize_t smk_write_load(struct file *file, const char __user *buf,
596 size_t count, loff_t *ppos)
597{
598
599 /*
600 * Must have privilege.
601 * No partial writes.
602 * Enough data must be present.
603 */
604 if (!capable(CAP_MAC_ADMIN))
605 return -EPERM;
606
Casey Schauflerf7112e62012-05-06 15:22:02 -0700607 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
608 SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800609}
610
Casey Schauflere114e472008-02-04 22:29:50 -0800611static const struct file_operations smk_load_ops = {
612 .open = smk_open_load,
613 .read = seq_read,
614 .llseek = seq_lseek,
615 .write = smk_write_load,
Ahmed S. Darwishcb622bb2008-03-24 12:29:49 -0700616 .release = seq_release,
Casey Schauflere114e472008-02-04 22:29:50 -0800617};
618
619/**
620 * smk_cipso_doi - initialize the CIPSO domain
621 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700622static void smk_cipso_doi(void)
Casey Schauflere114e472008-02-04 22:29:50 -0800623{
624 int rc;
625 struct cipso_v4_doi *doip;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500626 struct netlbl_audit nai;
Casey Schauflere114e472008-02-04 22:29:50 -0800627
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500628 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800629
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500630 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
Casey Schauflere114e472008-02-04 22:29:50 -0800631 if (rc != 0)
632 printk(KERN_WARNING "%s:%d remove rc = %d\n",
633 __func__, __LINE__, rc);
634
635 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
636 if (doip == NULL)
637 panic("smack: Failed to initialize cipso DOI.\n");
638 doip->map.std = NULL;
639 doip->doi = smk_cipso_doi_value;
640 doip->type = CIPSO_V4_MAP_PASS;
641 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
642 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
643 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
644
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500645 rc = netlbl_cfg_cipsov4_add(doip, &nai);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400646 if (rc != 0) {
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500647 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
Casey Schauflere114e472008-02-04 22:29:50 -0800648 __func__, __LINE__, rc);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400649 kfree(doip);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500650 return;
651 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500652 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500653 if (rc != 0) {
654 printk(KERN_WARNING "%s:%d map add rc = %d\n",
655 __func__, __LINE__, rc);
656 kfree(doip);
657 return;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400658 }
Casey Schauflere114e472008-02-04 22:29:50 -0800659}
660
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800661/**
662 * smk_unlbl_ambient - initialize the unlabeled domain
Randy Dunlap251a2a92009-02-18 11:42:33 -0800663 * @oldambient: previous domain string
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800664 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700665static void smk_unlbl_ambient(char *oldambient)
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800666{
667 int rc;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500668 struct netlbl_audit nai;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800669
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500670 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800671
672 if (oldambient != NULL) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500673 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800674 if (rc != 0)
675 printk(KERN_WARNING "%s:%d remove rc = %d\n",
676 __func__, __LINE__, rc);
677 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700678 if (smack_net_ambient == NULL)
679 smack_net_ambient = smack_known_floor.smk_known;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800680
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500681 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET,
682 NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800683 if (rc != 0)
684 printk(KERN_WARNING "%s:%d add rc = %d\n",
685 __func__, __LINE__, rc);
686}
687
Casey Schauflere114e472008-02-04 22:29:50 -0800688/*
689 * Seq_file read operations for /smack/cipso
690 */
691
692static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
693{
Casey Schaufler40809562011-11-10 15:02:22 -0800694 return smk_seq_start(s, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800695}
696
697static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
698{
Casey Schaufler40809562011-11-10 15:02:22 -0800699 return smk_seq_next(s, v, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800700}
701
702/*
703 * Print cipso labels in format:
704 * label level[/cat[,cat]]
705 */
706static int cipso_seq_show(struct seq_file *s, void *v)
707{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100708 struct list_head *list = v;
709 struct smack_known *skp =
710 list_entry(list, struct smack_known, list);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700711 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800712 char sep = '/';
Casey Schauflere114e472008-02-04 22:29:50 -0800713 int i;
Casey Schauflere114e472008-02-04 22:29:50 -0800714
Casey Schauflerf7112e62012-05-06 15:22:02 -0700715 /*
716 * Don't show a label that could not have been set using
717 * /smack/cipso. This is in support of the notion that
718 * anything read from /smack/cipso ought to be writeable
719 * to /smack/cipso.
720 *
721 * /smack/cipso2 should be used instead.
722 */
723 if (strlen(skp->smk_known) >= SMK_LABELLEN)
Casey Schauflere114e472008-02-04 22:29:50 -0800724 return 0;
725
Casey Schauflerf7112e62012-05-06 15:22:02 -0700726 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
Casey Schauflere114e472008-02-04 22:29:50 -0800727
Casey Schauflerf7112e62012-05-06 15:22:02 -0700728 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
729 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
730 seq_printf(s, "%c%d", sep, i);
731 sep = ',';
732 }
Casey Schauflere114e472008-02-04 22:29:50 -0800733
734 seq_putc(s, '\n');
735
736 return 0;
737}
738
James Morris88e9d342009-09-22 16:43:43 -0700739static const struct seq_operations cipso_seq_ops = {
Casey Schauflere114e472008-02-04 22:29:50 -0800740 .start = cipso_seq_start,
Casey Schauflere114e472008-02-04 22:29:50 -0800741 .next = cipso_seq_next,
742 .show = cipso_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800743 .stop = smk_seq_stop,
Casey Schauflere114e472008-02-04 22:29:50 -0800744};
745
746/**
747 * smk_open_cipso - open() for /smack/cipso
748 * @inode: inode structure representing file
749 * @file: "cipso" file pointer
750 *
751 * Connect our cipso_seq_* operations with /smack/cipso
752 * file_operations
753 */
754static int smk_open_cipso(struct inode *inode, struct file *file)
755{
756 return seq_open(file, &cipso_seq_ops);
757}
758
759/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700760 * smk_set_cipso - do the work for write() for cipso and cipso2
Randy Dunlap251a2a92009-02-18 11:42:33 -0800761 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800762 * @buf: where to get the data from
763 * @count: bytes sent
764 * @ppos: where to start
Casey Schauflerf7112e62012-05-06 15:22:02 -0700765 * @format: /smack/cipso or /smack/cipso2
Casey Schauflere114e472008-02-04 22:29:50 -0800766 *
767 * Accepts only one cipso rule per write call.
768 * Returns number of bytes written or error code, as appropriate
769 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700770static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
771 size_t count, loff_t *ppos, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800772{
773 struct smack_known *skp;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700774 struct netlbl_lsm_secattr ncats;
775 char mapcatset[SMK_CIPSOLEN];
Casey Schauflere114e472008-02-04 22:29:50 -0800776 int maplevel;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700777 unsigned int cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800778 int catlen;
779 ssize_t rc = -EINVAL;
780 char *data = NULL;
781 char *rule;
782 int ret;
783 int i;
784
785 /*
786 * Must have privilege.
787 * No partial writes.
788 * Enough data must be present.
789 */
790 if (!capable(CAP_MAC_ADMIN))
791 return -EPERM;
792 if (*ppos != 0)
793 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700794 if (format == SMK_FIXED24_FMT &&
795 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
Casey Schauflere114e472008-02-04 22:29:50 -0800796 return -EINVAL;
797
798 data = kzalloc(count + 1, GFP_KERNEL);
799 if (data == NULL)
800 return -ENOMEM;
801
802 if (copy_from_user(data, buf, count) != 0) {
803 rc = -EFAULT;
804 goto unlockedout;
805 }
806
807 data[count] = '\0';
808 rule = data;
809 /*
810 * Only allow one writer at a time. Writes should be
811 * quite rare and small in any case.
812 */
813 mutex_lock(&smack_cipso_lock);
814
815 skp = smk_import_entry(rule, 0);
816 if (skp == NULL)
817 goto out;
818
Casey Schauflerf7112e62012-05-06 15:22:02 -0700819 if (format == SMK_FIXED24_FMT)
820 rule += SMK_LABELLEN;
821 else
822 rule += strlen(skp->smk_known);
823
Casey Schauflere114e472008-02-04 22:29:50 -0800824 ret = sscanf(rule, "%d", &maplevel);
825 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
826 goto out;
827
828 rule += SMK_DIGITLEN;
829 ret = sscanf(rule, "%d", &catlen);
830 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
831 goto out;
832
Casey Schauflerf7112e62012-05-06 15:22:02 -0700833 if (format == SMK_FIXED24_FMT &&
834 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
Casey Schauflere114e472008-02-04 22:29:50 -0800835 goto out;
836
837 memset(mapcatset, 0, sizeof(mapcatset));
838
839 for (i = 0; i < catlen; i++) {
840 rule += SMK_DIGITLEN;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700841 ret = sscanf(rule, "%u", &cat);
Casey Schauflere114e472008-02-04 22:29:50 -0800842 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
843 goto out;
844
845 smack_catset_bit(cat, mapcatset);
846 }
847
Casey Schauflerf7112e62012-05-06 15:22:02 -0700848 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
849 if (rc >= 0) {
850 netlbl_secattr_catmap_free(skp->smk_netlabel.attr.mls.cat);
851 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
852 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
853 rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -0800854 }
855
Casey Schauflere114e472008-02-04 22:29:50 -0800856out:
857 mutex_unlock(&smack_cipso_lock);
858unlockedout:
859 kfree(data);
860 return rc;
861}
862
Casey Schauflerf7112e62012-05-06 15:22:02 -0700863/**
864 * smk_write_cipso - write() for /smack/cipso
865 * @file: file pointer, not actually used
866 * @buf: where to get the data from
867 * @count: bytes sent
868 * @ppos: where to start
869 *
870 * Accepts only one cipso rule per write call.
871 * Returns number of bytes written or error code, as appropriate
872 */
873static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
874 size_t count, loff_t *ppos)
875{
876 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
877}
878
Casey Schauflere114e472008-02-04 22:29:50 -0800879static const struct file_operations smk_cipso_ops = {
880 .open = smk_open_cipso,
881 .read = seq_read,
882 .llseek = seq_lseek,
883 .write = smk_write_cipso,
884 .release = seq_release,
885};
886
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500887/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700888 * Seq_file read operations for /smack/cipso2
889 */
890
891/*
892 * Print cipso labels in format:
893 * label level[/cat[,cat]]
894 */
895static int cipso2_seq_show(struct seq_file *s, void *v)
896{
897 struct list_head *list = v;
898 struct smack_known *skp =
899 list_entry(list, struct smack_known, list);
900 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
901 char sep = '/';
902 int i;
903
904 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
905
906 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
907 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
908 seq_printf(s, "%c%d", sep, i);
909 sep = ',';
910 }
911
912 seq_putc(s, '\n');
913
914 return 0;
915}
916
917static const struct seq_operations cipso2_seq_ops = {
918 .start = cipso_seq_start,
919 .next = cipso_seq_next,
920 .show = cipso2_seq_show,
921 .stop = smk_seq_stop,
922};
923
924/**
925 * smk_open_cipso2 - open() for /smack/cipso2
926 * @inode: inode structure representing file
927 * @file: "cipso2" file pointer
928 *
929 * Connect our cipso_seq_* operations with /smack/cipso2
930 * file_operations
931 */
932static int smk_open_cipso2(struct inode *inode, struct file *file)
933{
934 return seq_open(file, &cipso2_seq_ops);
935}
936
937/**
938 * smk_write_cipso2 - write() for /smack/cipso2
939 * @file: file pointer, not actually used
940 * @buf: where to get the data from
941 * @count: bytes sent
942 * @ppos: where to start
943 *
944 * Accepts only one cipso rule per write call.
945 * Returns number of bytes written or error code, as appropriate
946 */
947static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
948 size_t count, loff_t *ppos)
949{
950 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
951}
952
953static const struct file_operations smk_cipso2_ops = {
954 .open = smk_open_cipso2,
955 .read = seq_read,
956 .llseek = seq_lseek,
957 .write = smk_write_cipso2,
958 .release = seq_release,
959};
960
961/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500962 * Seq_file read operations for /smack/netlabel
963 */
964
965static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
966{
Casey Schaufler40809562011-11-10 15:02:22 -0800967 return smk_seq_start(s, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500968}
969
970static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
971{
Casey Schaufler40809562011-11-10 15:02:22 -0800972 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500973}
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500974#define BEBITS (sizeof(__be32) * 8)
975
976/*
977 * Print host/label pairs
978 */
979static int netlbladdr_seq_show(struct seq_file *s, void *v)
980{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100981 struct list_head *list = v;
982 struct smk_netlbladdr *skp =
983 list_entry(list, struct smk_netlbladdr, list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500984 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +0100985 int maskn;
986 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500987
etienne113a0e42009-03-04 07:33:51 +0100988 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500989
990 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
991 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
992
993 return 0;
994}
995
James Morris88e9d342009-09-22 16:43:43 -0700996static const struct seq_operations netlbladdr_seq_ops = {
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500997 .start = netlbladdr_seq_start,
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500998 .next = netlbladdr_seq_next,
999 .show = netlbladdr_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001000 .stop = smk_seq_stop,
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001001};
1002
1003/**
1004 * smk_open_netlbladdr - open() for /smack/netlabel
1005 * @inode: inode structure representing file
1006 * @file: "netlabel" file pointer
1007 *
1008 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1009 * file_operations
1010 */
1011static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1012{
1013 return seq_open(file, &netlbladdr_seq_ops);
1014}
1015
1016/**
etienne113a0e42009-03-04 07:33:51 +01001017 * smk_netlbladdr_insert
1018 * @new : netlabel to insert
1019 *
1020 * This helper insert netlabel in the smack_netlbladdrs list
1021 * sorted by netmask length (longest to smallest)
Etienne Basset7198e2e2009-03-24 20:53:24 +01001022 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1023 *
etienne113a0e42009-03-04 07:33:51 +01001024 */
1025static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1026{
Etienne Basset7198e2e2009-03-24 20:53:24 +01001027 struct smk_netlbladdr *m, *m_next;
etienne113a0e42009-03-04 07:33:51 +01001028
Etienne Basset7198e2e2009-03-24 20:53:24 +01001029 if (list_empty(&smk_netlbladdr_list)) {
1030 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001031 return;
1032 }
1033
Jiri Pirko05725f72009-04-14 20:17:16 +02001034 m = list_entry_rcu(smk_netlbladdr_list.next,
1035 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001036
etienne113a0e42009-03-04 07:33:51 +01001037 /* the comparison '>' is a bit hacky, but works */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001038 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1039 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001040 return;
1041 }
Etienne Basset7198e2e2009-03-24 20:53:24 +01001042
1043 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1044 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1045 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001046 return;
1047 }
Jiri Pirko05725f72009-04-14 20:17:16 +02001048 m_next = list_entry_rcu(m->list.next,
1049 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001050 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1051 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001052 return;
1053 }
1054 }
1055}
1056
1057
1058/**
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001059 * smk_write_netlbladdr - write() for /smack/netlabel
Randy Dunlap251a2a92009-02-18 11:42:33 -08001060 * @file: file pointer, not actually used
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001061 * @buf: where to get the data from
1062 * @count: bytes sent
1063 * @ppos: where to start
1064 *
1065 * Accepts only one netlbladdr per write call.
1066 * Returns number of bytes written or error code, as appropriate
1067 */
1068static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1069 size_t count, loff_t *ppos)
1070{
1071 struct smk_netlbladdr *skp;
1072 struct sockaddr_in newname;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001073 char *smack;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001074 char *sp;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001075 char *data;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001076 char *host = (char *)&newname.sin_addr.s_addr;
1077 int rc;
1078 struct netlbl_audit audit_info;
1079 struct in_addr mask;
1080 unsigned int m;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001081 int found;
etienne113a0e42009-03-04 07:33:51 +01001082 u32 mask_bits = (1<<31);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001083 __be32 nsa;
etienne113a0e42009-03-04 07:33:51 +01001084 u32 temp_mask;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001085
1086 /*
1087 * Must have privilege.
1088 * No partial writes.
1089 * Enough data must be present.
1090 * "<addr/mask, as a.b.c.d/e><space><label>"
1091 * "<addr, as a.b.c.d><space><label>"
1092 */
1093 if (!capable(CAP_MAC_ADMIN))
1094 return -EPERM;
1095 if (*ppos != 0)
1096 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001097 if (count < SMK_NETLBLADDRMIN)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001098 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001099
1100 data = kzalloc(count + 1, GFP_KERNEL);
1101 if (data == NULL)
1102 return -ENOMEM;
1103
1104 if (copy_from_user(data, buf, count) != 0) {
1105 rc = -EFAULT;
1106 goto free_data_out;
1107 }
1108
1109 smack = kzalloc(count + 1, GFP_KERNEL);
1110 if (smack == NULL) {
1111 rc = -ENOMEM;
1112 goto free_data_out;
1113 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001114
1115 data[count] = '\0';
1116
1117 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
1118 &host[0], &host[1], &host[2], &host[3], &m, smack);
1119 if (rc != 6) {
1120 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1121 &host[0], &host[1], &host[2], &host[3], smack);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001122 if (rc != 5) {
1123 rc = -EINVAL;
1124 goto free_out;
1125 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001126 m = BEBITS;
1127 }
Casey Schauflerf7112e62012-05-06 15:22:02 -07001128 if (m > BEBITS) {
1129 rc = -EINVAL;
1130 goto free_out;
1131 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001132
Casey Schauflerf7112e62012-05-06 15:22:02 -07001133 /*
1134 * If smack begins with '-', it is an option, don't import it
1135 */
Etienne Basset43031542009-03-27 17:11:01 -04001136 if (smack[0] != '-') {
1137 sp = smk_import(smack, 0);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001138 if (sp == NULL) {
1139 rc = -EINVAL;
1140 goto free_out;
1141 }
Etienne Basset43031542009-03-27 17:11:01 -04001142 } else {
1143 /* check known options */
1144 if (strcmp(smack, smack_cipso_option) == 0)
1145 sp = (char *)smack_cipso_option;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001146 else {
1147 rc = -EINVAL;
1148 goto free_out;
1149 }
Etienne Basset43031542009-03-27 17:11:01 -04001150 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001151
etienne113a0e42009-03-04 07:33:51 +01001152 for (temp_mask = 0; m > 0; m--) {
1153 temp_mask |= mask_bits;
1154 mask_bits >>= 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001155 }
etienne113a0e42009-03-04 07:33:51 +01001156 mask.s_addr = cpu_to_be32(temp_mask);
1157
1158 newname.sin_addr.s_addr &= mask.s_addr;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001159 /*
1160 * Only allow one writer at a time. Writes should be
1161 * quite rare and small in any case.
1162 */
1163 mutex_lock(&smk_netlbladdr_lock);
1164
1165 nsa = newname.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +01001166 /* try to find if the prefix is already in the list */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001167 found = 0;
1168 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001169 if (skp->smk_host.sin_addr.s_addr == nsa &&
Etienne Basset7198e2e2009-03-24 20:53:24 +01001170 skp->smk_mask.s_addr == mask.s_addr) {
1171 found = 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001172 break;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001173 }
1174 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001175 smk_netlabel_audit_set(&audit_info);
1176
Etienne Basset7198e2e2009-03-24 20:53:24 +01001177 if (found == 0) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001178 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
1179 if (skp == NULL)
1180 rc = -ENOMEM;
1181 else {
1182 rc = 0;
1183 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1184 skp->smk_mask.s_addr = mask.s_addr;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001185 skp->smk_label = sp;
etienne113a0e42009-03-04 07:33:51 +01001186 smk_netlbladdr_insert(skp);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001187 }
1188 } else {
Etienne Basset43031542009-03-27 17:11:01 -04001189 /* we delete the unlabeled entry, only if the previous label
Lucas De Marchi25985ed2011-03-30 22:57:33 -03001190 * wasn't the special CIPSO option */
Etienne Basset43031542009-03-27 17:11:01 -04001191 if (skp->smk_label != smack_cipso_option)
1192 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1193 &skp->smk_host.sin_addr, &skp->smk_mask,
1194 PF_INET, &audit_info);
1195 else
1196 rc = 0;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001197 skp->smk_label = sp;
1198 }
1199
1200 /*
1201 * Now tell netlabel about the single label nature of
1202 * this host so that incoming packets get labeled.
Etienne Basset43031542009-03-27 17:11:01 -04001203 * but only if we didn't get the special CIPSO option
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001204 */
Etienne Basset43031542009-03-27 17:11:01 -04001205 if (rc == 0 && sp != smack_cipso_option)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001206 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1207 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
1208 smack_to_secid(skp->smk_label), &audit_info);
1209
1210 if (rc == 0)
1211 rc = count;
1212
1213 mutex_unlock(&smk_netlbladdr_lock);
1214
Casey Schauflerf7112e62012-05-06 15:22:02 -07001215free_out:
1216 kfree(smack);
1217free_data_out:
1218 kfree(data);
1219
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001220 return rc;
1221}
1222
1223static const struct file_operations smk_netlbladdr_ops = {
1224 .open = smk_open_netlbladdr,
1225 .read = seq_read,
1226 .llseek = seq_lseek,
1227 .write = smk_write_netlbladdr,
1228 .release = seq_release,
1229};
1230
Casey Schauflere114e472008-02-04 22:29:50 -08001231/**
1232 * smk_read_doi - read() for /smack/doi
1233 * @filp: file pointer, not actually used
1234 * @buf: where to put the result
1235 * @count: maximum to send along
1236 * @ppos: where to start
1237 *
1238 * Returns number of bytes read or error code, as appropriate
1239 */
1240static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1241 size_t count, loff_t *ppos)
1242{
1243 char temp[80];
1244 ssize_t rc;
1245
1246 if (*ppos != 0)
1247 return 0;
1248
1249 sprintf(temp, "%d", smk_cipso_doi_value);
1250 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1251
1252 return rc;
1253}
1254
1255/**
1256 * smk_write_doi - write() for /smack/doi
Randy Dunlap251a2a92009-02-18 11:42:33 -08001257 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001258 * @buf: where to get the data from
1259 * @count: bytes sent
1260 * @ppos: where to start
1261 *
1262 * Returns number of bytes written or error code, as appropriate
1263 */
1264static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1265 size_t count, loff_t *ppos)
1266{
1267 char temp[80];
1268 int i;
1269
1270 if (!capable(CAP_MAC_ADMIN))
1271 return -EPERM;
1272
1273 if (count >= sizeof(temp) || count == 0)
1274 return -EINVAL;
1275
1276 if (copy_from_user(temp, buf, count) != 0)
1277 return -EFAULT;
1278
1279 temp[count] = '\0';
1280
1281 if (sscanf(temp, "%d", &i) != 1)
1282 return -EINVAL;
1283
1284 smk_cipso_doi_value = i;
1285
1286 smk_cipso_doi();
1287
1288 return count;
1289}
1290
1291static const struct file_operations smk_doi_ops = {
1292 .read = smk_read_doi,
1293 .write = smk_write_doi,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001294 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001295};
1296
1297/**
1298 * smk_read_direct - read() for /smack/direct
1299 * @filp: file pointer, not actually used
1300 * @buf: where to put the result
1301 * @count: maximum to send along
1302 * @ppos: where to start
1303 *
1304 * Returns number of bytes read or error code, as appropriate
1305 */
1306static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1307 size_t count, loff_t *ppos)
1308{
1309 char temp[80];
1310 ssize_t rc;
1311
1312 if (*ppos != 0)
1313 return 0;
1314
1315 sprintf(temp, "%d", smack_cipso_direct);
1316 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1317
1318 return rc;
1319}
1320
1321/**
1322 * smk_write_direct - write() for /smack/direct
Randy Dunlap251a2a92009-02-18 11:42:33 -08001323 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001324 * @buf: where to get the data from
1325 * @count: bytes sent
1326 * @ppos: where to start
1327 *
1328 * Returns number of bytes written or error code, as appropriate
1329 */
1330static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1331 size_t count, loff_t *ppos)
1332{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001333 struct smack_known *skp;
Casey Schauflere114e472008-02-04 22:29:50 -08001334 char temp[80];
1335 int i;
1336
1337 if (!capable(CAP_MAC_ADMIN))
1338 return -EPERM;
1339
1340 if (count >= sizeof(temp) || count == 0)
1341 return -EINVAL;
1342
1343 if (copy_from_user(temp, buf, count) != 0)
1344 return -EFAULT;
1345
1346 temp[count] = '\0';
1347
1348 if (sscanf(temp, "%d", &i) != 1)
1349 return -EINVAL;
1350
Casey Schauflerf7112e62012-05-06 15:22:02 -07001351 /*
1352 * Don't do anything if the value hasn't actually changed.
1353 * If it is changing reset the level on entries that were
1354 * set up to be direct when they were created.
1355 */
1356 if (smack_cipso_direct != i) {
1357 mutex_lock(&smack_known_lock);
1358 list_for_each_entry_rcu(skp, &smack_known_list, list)
1359 if (skp->smk_netlabel.attr.mls.lvl ==
1360 smack_cipso_direct)
1361 skp->smk_netlabel.attr.mls.lvl = i;
1362 smack_cipso_direct = i;
1363 mutex_unlock(&smack_known_lock);
1364 }
Casey Schauflere114e472008-02-04 22:29:50 -08001365
1366 return count;
1367}
1368
1369static const struct file_operations smk_direct_ops = {
1370 .read = smk_read_direct,
1371 .write = smk_write_direct,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001372 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001373};
1374
1375/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001376 * smk_read_mapped - read() for /smack/mapped
1377 * @filp: file pointer, not actually used
1378 * @buf: where to put the result
1379 * @count: maximum to send along
1380 * @ppos: where to start
1381 *
1382 * Returns number of bytes read or error code, as appropriate
1383 */
1384static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1385 size_t count, loff_t *ppos)
1386{
1387 char temp[80];
1388 ssize_t rc;
1389
1390 if (*ppos != 0)
1391 return 0;
1392
1393 sprintf(temp, "%d", smack_cipso_mapped);
1394 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1395
1396 return rc;
1397}
1398
1399/**
1400 * smk_write_mapped - write() for /smack/mapped
1401 * @file: file pointer, not actually used
1402 * @buf: where to get the data from
1403 * @count: bytes sent
1404 * @ppos: where to start
1405 *
1406 * Returns number of bytes written or error code, as appropriate
1407 */
1408static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1409 size_t count, loff_t *ppos)
1410{
1411 struct smack_known *skp;
1412 char temp[80];
1413 int i;
1414
1415 if (!capable(CAP_MAC_ADMIN))
1416 return -EPERM;
1417
1418 if (count >= sizeof(temp) || count == 0)
1419 return -EINVAL;
1420
1421 if (copy_from_user(temp, buf, count) != 0)
1422 return -EFAULT;
1423
1424 temp[count] = '\0';
1425
1426 if (sscanf(temp, "%d", &i) != 1)
1427 return -EINVAL;
1428
1429 /*
1430 * Don't do anything if the value hasn't actually changed.
1431 * If it is changing reset the level on entries that were
1432 * set up to be mapped when they were created.
1433 */
1434 if (smack_cipso_mapped != i) {
1435 mutex_lock(&smack_known_lock);
1436 list_for_each_entry_rcu(skp, &smack_known_list, list)
1437 if (skp->smk_netlabel.attr.mls.lvl ==
1438 smack_cipso_mapped)
1439 skp->smk_netlabel.attr.mls.lvl = i;
1440 smack_cipso_mapped = i;
1441 mutex_unlock(&smack_known_lock);
1442 }
1443
1444 return count;
1445}
1446
1447static const struct file_operations smk_mapped_ops = {
1448 .read = smk_read_mapped,
1449 .write = smk_write_mapped,
1450 .llseek = default_llseek,
1451};
1452
1453/**
Casey Schauflere114e472008-02-04 22:29:50 -08001454 * smk_read_ambient - read() for /smack/ambient
1455 * @filp: file pointer, not actually used
1456 * @buf: where to put the result
1457 * @cn: maximum to send along
1458 * @ppos: where to start
1459 *
1460 * Returns number of bytes read or error code, as appropriate
1461 */
1462static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1463 size_t cn, loff_t *ppos)
1464{
1465 ssize_t rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001466 int asize;
1467
1468 if (*ppos != 0)
1469 return 0;
1470 /*
1471 * Being careful to avoid a problem in the case where
1472 * smack_net_ambient gets changed in midstream.
Casey Schauflere114e472008-02-04 22:29:50 -08001473 */
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001474 mutex_lock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001475
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001476 asize = strlen(smack_net_ambient) + 1;
Casey Schauflere114e472008-02-04 22:29:50 -08001477
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001478 if (cn >= asize)
1479 rc = simple_read_from_buffer(buf, cn, ppos,
1480 smack_net_ambient, asize);
1481 else
1482 rc = -EINVAL;
1483
1484 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001485
1486 return rc;
1487}
1488
1489/**
1490 * smk_write_ambient - write() for /smack/ambient
Randy Dunlap251a2a92009-02-18 11:42:33 -08001491 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001492 * @buf: where to get the data from
1493 * @count: bytes sent
1494 * @ppos: where to start
1495 *
1496 * Returns number of bytes written or error code, as appropriate
1497 */
1498static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1499 size_t count, loff_t *ppos)
1500{
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001501 char *oldambient;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001502 char *smack = NULL;
1503 char *data;
1504 int rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -08001505
1506 if (!capable(CAP_MAC_ADMIN))
1507 return -EPERM;
1508
Casey Schauflerf7112e62012-05-06 15:22:02 -07001509 data = kzalloc(count + 1, GFP_KERNEL);
1510 if (data == NULL)
1511 return -ENOMEM;
Casey Schauflere114e472008-02-04 22:29:50 -08001512
Casey Schauflerf7112e62012-05-06 15:22:02 -07001513 if (copy_from_user(data, buf, count) != 0) {
1514 rc = -EFAULT;
1515 goto out;
1516 }
Casey Schauflere114e472008-02-04 22:29:50 -08001517
Casey Schauflerf7112e62012-05-06 15:22:02 -07001518 smack = smk_import(data, count);
1519 if (smack == NULL) {
1520 rc = -EINVAL;
1521 goto out;
1522 }
Casey Schauflere114e472008-02-04 22:29:50 -08001523
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001524 mutex_lock(&smack_ambient_lock);
1525
1526 oldambient = smack_net_ambient;
Casey Schauflere114e472008-02-04 22:29:50 -08001527 smack_net_ambient = smack;
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001528 smk_unlbl_ambient(oldambient);
1529
1530 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001531
Casey Schauflerf7112e62012-05-06 15:22:02 -07001532out:
1533 kfree(data);
1534 return rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001535}
1536
1537static const struct file_operations smk_ambient_ops = {
1538 .read = smk_read_ambient,
1539 .write = smk_write_ambient,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001540 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001541};
1542
Casey Schaufler15446232008-07-30 15:37:11 -07001543/**
1544 * smk_read_onlycap - read() for /smack/onlycap
1545 * @filp: file pointer, not actually used
1546 * @buf: where to put the result
1547 * @cn: maximum to send along
1548 * @ppos: where to start
1549 *
1550 * Returns number of bytes read or error code, as appropriate
1551 */
1552static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1553 size_t cn, loff_t *ppos)
1554{
1555 char *smack = "";
1556 ssize_t rc = -EINVAL;
1557 int asize;
1558
1559 if (*ppos != 0)
1560 return 0;
1561
1562 if (smack_onlycap != NULL)
1563 smack = smack_onlycap;
1564
1565 asize = strlen(smack) + 1;
1566
1567 if (cn >= asize)
1568 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1569
1570 return rc;
1571}
1572
1573/**
1574 * smk_write_onlycap - write() for /smack/onlycap
Randy Dunlap251a2a92009-02-18 11:42:33 -08001575 * @file: file pointer, not actually used
Casey Schaufler15446232008-07-30 15:37:11 -07001576 * @buf: where to get the data from
1577 * @count: bytes sent
1578 * @ppos: where to start
1579 *
1580 * Returns number of bytes written or error code, as appropriate
1581 */
1582static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1583 size_t count, loff_t *ppos)
1584{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001585 char *data;
Casey Schaufler676dac42010-12-02 06:43:39 -08001586 char *sp = smk_of_task(current->cred->security);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001587 int rc = count;
Casey Schaufler15446232008-07-30 15:37:11 -07001588
1589 if (!capable(CAP_MAC_ADMIN))
1590 return -EPERM;
1591
1592 /*
1593 * This can be done using smk_access() but is done
1594 * explicitly for clarity. The smk_access() implementation
1595 * would use smk_access(smack_onlycap, MAY_WRITE)
1596 */
1597 if (smack_onlycap != NULL && smack_onlycap != sp)
1598 return -EPERM;
1599
Casey Schauflerf7112e62012-05-06 15:22:02 -07001600 data = kzalloc(count, GFP_KERNEL);
1601 if (data == NULL)
1602 return -ENOMEM;
Casey Schaufler15446232008-07-30 15:37:11 -07001603
1604 /*
1605 * Should the null string be passed in unset the onlycap value.
1606 * This seems like something to be careful with as usually
1607 * smk_import only expects to return NULL for errors. It
1608 * is usually the case that a nullstring or "\n" would be
1609 * bad to pass to smk_import but in fact this is useful here.
Casey Schauflerf7112e62012-05-06 15:22:02 -07001610 *
1611 * smk_import will also reject a label beginning with '-',
1612 * so "-usecapabilities" will also work.
Casey Schaufler15446232008-07-30 15:37:11 -07001613 */
Casey Schauflerf7112e62012-05-06 15:22:02 -07001614 if (copy_from_user(data, buf, count) != 0)
1615 rc = -EFAULT;
1616 else
1617 smack_onlycap = smk_import(data, count);
Casey Schaufler15446232008-07-30 15:37:11 -07001618
Casey Schauflerf7112e62012-05-06 15:22:02 -07001619 kfree(data);
1620 return rc;
Casey Schaufler15446232008-07-30 15:37:11 -07001621}
1622
1623static const struct file_operations smk_onlycap_ops = {
1624 .read = smk_read_onlycap,
1625 .write = smk_write_onlycap,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001626 .llseek = default_llseek,
Casey Schaufler15446232008-07-30 15:37:11 -07001627};
1628
Casey Schauflere114e472008-02-04 22:29:50 -08001629/**
Etienne Bassetecfcc532009-04-08 20:40:06 +02001630 * smk_read_logging - read() for /smack/logging
1631 * @filp: file pointer, not actually used
1632 * @buf: where to put the result
1633 * @cn: maximum to send along
1634 * @ppos: where to start
1635 *
1636 * Returns number of bytes read or error code, as appropriate
1637 */
1638static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1639 size_t count, loff_t *ppos)
1640{
1641 char temp[32];
1642 ssize_t rc;
1643
1644 if (*ppos != 0)
1645 return 0;
1646
1647 sprintf(temp, "%d\n", log_policy);
1648 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1649 return rc;
1650}
1651
1652/**
1653 * smk_write_logging - write() for /smack/logging
1654 * @file: file pointer, not actually used
1655 * @buf: where to get the data from
1656 * @count: bytes sent
1657 * @ppos: where to start
1658 *
1659 * Returns number of bytes written or error code, as appropriate
1660 */
1661static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1662 size_t count, loff_t *ppos)
1663{
1664 char temp[32];
1665 int i;
1666
1667 if (!capable(CAP_MAC_ADMIN))
1668 return -EPERM;
1669
1670 if (count >= sizeof(temp) || count == 0)
1671 return -EINVAL;
1672
1673 if (copy_from_user(temp, buf, count) != 0)
1674 return -EFAULT;
1675
1676 temp[count] = '\0';
1677
1678 if (sscanf(temp, "%d", &i) != 1)
1679 return -EINVAL;
1680 if (i < 0 || i > 3)
1681 return -EINVAL;
1682 log_policy = i;
1683 return count;
1684}
1685
1686
1687
1688static const struct file_operations smk_logging_ops = {
1689 .read = smk_read_logging,
1690 .write = smk_write_logging,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001691 .llseek = default_llseek,
Etienne Bassetecfcc532009-04-08 20:40:06 +02001692};
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001693
1694/*
1695 * Seq_file read operations for /smack/load-self
1696 */
1697
1698static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1699{
1700 struct task_smack *tsp = current_security();
1701
Casey Schaufler40809562011-11-10 15:02:22 -08001702 return smk_seq_start(s, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001703}
1704
1705static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1706{
1707 struct task_smack *tsp = current_security();
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001708
Casey Schaufler40809562011-11-10 15:02:22 -08001709 return smk_seq_next(s, v, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001710}
1711
1712static int load_self_seq_show(struct seq_file *s, void *v)
1713{
1714 struct list_head *list = v;
1715 struct smack_rule *srp =
1716 list_entry(list, struct smack_rule, list);
1717
Casey Schauflerf7112e62012-05-06 15:22:02 -07001718 smk_rule_show(s, srp, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001719
1720 return 0;
1721}
1722
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001723static const struct seq_operations load_self_seq_ops = {
1724 .start = load_self_seq_start,
1725 .next = load_self_seq_next,
1726 .show = load_self_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001727 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001728};
1729
1730
1731/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001732 * smk_open_load_self - open() for /smack/load-self2
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001733 * @inode: inode structure representing file
1734 * @file: "load" file pointer
1735 *
1736 * For reading, use load_seq_* seq_file reading operations.
1737 */
1738static int smk_open_load_self(struct inode *inode, struct file *file)
1739{
1740 return seq_open(file, &load_self_seq_ops);
1741}
1742
1743/**
1744 * smk_write_load_self - write() for /smack/load-self
1745 * @file: file pointer, not actually used
1746 * @buf: where to get the data from
1747 * @count: bytes sent
1748 * @ppos: where to start - must be 0
1749 *
1750 */
1751static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1752 size_t count, loff_t *ppos)
1753{
1754 struct task_smack *tsp = current_security();
1755
Casey Schauflerf7112e62012-05-06 15:22:02 -07001756 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1757 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001758}
1759
1760static const struct file_operations smk_load_self_ops = {
1761 .open = smk_open_load_self,
1762 .read = seq_read,
1763 .llseek = seq_lseek,
1764 .write = smk_write_load_self,
1765 .release = seq_release,
1766};
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001767
1768/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001769 * smk_user_access - handle access check transaction
1770 * @file: file pointer
1771 * @buf: data from user space
1772 * @count: bytes sent
1773 * @ppos: where to start - must be 0
1774 */
1775static ssize_t smk_user_access(struct file *file, const char __user *buf,
1776 size_t count, loff_t *ppos, int format)
1777{
1778 struct smack_rule rule;
1779 char *data;
1780 char *cod;
1781 int res;
1782
1783 data = simple_transaction_get(file, buf, count);
1784 if (IS_ERR(data))
1785 return PTR_ERR(data);
1786
1787 if (format == SMK_FIXED24_FMT) {
1788 if (count < SMK_LOADLEN)
1789 return -EINVAL;
1790 res = smk_parse_rule(data, &rule, 0);
1791 } else {
1792 /*
1793 * Copy the data to make sure the string is terminated.
1794 */
1795 cod = kzalloc(count + 1, GFP_KERNEL);
1796 if (cod == NULL)
1797 return -ENOMEM;
1798 memcpy(cod, data, count);
1799 cod[count] = '\0';
1800 res = smk_parse_long_rule(cod, &rule, 0);
1801 kfree(cod);
1802 }
1803
1804 if (res)
1805 return -EINVAL;
1806
1807 res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access,
1808 NULL);
1809 data[0] = res == 0 ? '1' : '0';
1810 data[1] = '\0';
1811
1812 simple_transaction_set(file, 2);
1813
1814 if (format == SMK_FIXED24_FMT)
1815 return SMK_LOADLEN;
1816 return count;
1817}
1818
1819/**
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001820 * smk_write_access - handle access check transaction
1821 * @file: file pointer
1822 * @buf: data from user space
1823 * @count: bytes sent
1824 * @ppos: where to start - must be 0
1825 */
1826static ssize_t smk_write_access(struct file *file, const char __user *buf,
1827 size_t count, loff_t *ppos)
1828{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001829 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001830}
1831
1832static const struct file_operations smk_access_ops = {
1833 .write = smk_write_access,
1834 .read = simple_transaction_read,
1835 .release = simple_transaction_release,
1836 .llseek = generic_file_llseek,
1837};
1838
Casey Schauflerf7112e62012-05-06 15:22:02 -07001839
1840/*
1841 * Seq_file read operations for /smack/load2
1842 */
1843
1844static int load2_seq_show(struct seq_file *s, void *v)
1845{
1846 struct list_head *list = v;
1847 struct smack_master_list *smlp =
1848 list_entry(list, struct smack_master_list, list);
1849
1850 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1851
1852 return 0;
1853}
1854
1855static const struct seq_operations load2_seq_ops = {
1856 .start = load2_seq_start,
1857 .next = load2_seq_next,
1858 .show = load2_seq_show,
1859 .stop = smk_seq_stop,
1860};
1861
1862/**
1863 * smk_open_load2 - open() for /smack/load2
1864 * @inode: inode structure representing file
1865 * @file: "load2" file pointer
1866 *
1867 * For reading, use load2_seq_* seq_file reading operations.
1868 */
1869static int smk_open_load2(struct inode *inode, struct file *file)
1870{
1871 return seq_open(file, &load2_seq_ops);
1872}
1873
1874/**
1875 * smk_write_load2 - write() for /smack/load2
1876 * @file: file pointer, not actually used
1877 * @buf: where to get the data from
1878 * @count: bytes sent
1879 * @ppos: where to start - must be 0
1880 *
1881 */
1882static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1883 size_t count, loff_t *ppos)
1884{
1885 /*
1886 * Must have privilege.
1887 */
1888 if (!capable(CAP_MAC_ADMIN))
1889 return -EPERM;
1890
1891 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1892 SMK_LONG_FMT);
1893}
1894
1895static const struct file_operations smk_load2_ops = {
1896 .open = smk_open_load2,
1897 .read = seq_read,
1898 .llseek = seq_lseek,
1899 .write = smk_write_load2,
1900 .release = seq_release,
1901};
1902
1903/*
1904 * Seq_file read operations for /smack/load-self2
1905 */
1906
1907static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1908{
1909 struct task_smack *tsp = current_security();
1910
1911 return smk_seq_start(s, pos, &tsp->smk_rules);
1912}
1913
1914static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
1915{
1916 struct task_smack *tsp = current_security();
1917
1918 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1919}
1920
1921static int load_self2_seq_show(struct seq_file *s, void *v)
1922{
1923 struct list_head *list = v;
1924 struct smack_rule *srp =
1925 list_entry(list, struct smack_rule, list);
1926
1927 smk_rule_show(s, srp, SMK_LONGLABEL);
1928
1929 return 0;
1930}
1931
1932static const struct seq_operations load_self2_seq_ops = {
1933 .start = load_self2_seq_start,
1934 .next = load_self2_seq_next,
1935 .show = load_self2_seq_show,
1936 .stop = smk_seq_stop,
1937};
1938
1939/**
1940 * smk_open_load_self2 - open() for /smack/load-self2
1941 * @inode: inode structure representing file
1942 * @file: "load" file pointer
1943 *
1944 * For reading, use load_seq_* seq_file reading operations.
1945 */
1946static int smk_open_load_self2(struct inode *inode, struct file *file)
1947{
1948 return seq_open(file, &load_self2_seq_ops);
1949}
1950
1951/**
1952 * smk_write_load_self2 - write() for /smack/load-self2
1953 * @file: file pointer, not actually used
1954 * @buf: where to get the data from
1955 * @count: bytes sent
1956 * @ppos: where to start - must be 0
1957 *
1958 */
1959static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
1960 size_t count, loff_t *ppos)
1961{
1962 struct task_smack *tsp = current_security();
1963
1964 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1965 &tsp->smk_rules_lock, SMK_LONG_FMT);
1966}
1967
1968static const struct file_operations smk_load_self2_ops = {
1969 .open = smk_open_load_self2,
1970 .read = seq_read,
1971 .llseek = seq_lseek,
1972 .write = smk_write_load_self2,
1973 .release = seq_release,
1974};
1975
1976/**
1977 * smk_write_access2 - handle access check transaction
1978 * @file: file pointer
1979 * @buf: data from user space
1980 * @count: bytes sent
1981 * @ppos: where to start - must be 0
1982 */
1983static ssize_t smk_write_access2(struct file *file, const char __user *buf,
1984 size_t count, loff_t *ppos)
1985{
1986 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
1987}
1988
1989static const struct file_operations smk_access2_ops = {
1990 .write = smk_write_access2,
1991 .read = simple_transaction_read,
1992 .release = simple_transaction_release,
1993 .llseek = generic_file_llseek,
1994};
1995
Etienne Bassetecfcc532009-04-08 20:40:06 +02001996/**
Casey Schauflere114e472008-02-04 22:29:50 -08001997 * smk_fill_super - fill the /smackfs superblock
1998 * @sb: the empty superblock
1999 * @data: unused
2000 * @silent: unused
2001 *
2002 * Fill in the well known entries for /smack
2003 *
2004 * Returns 0 on success, an error code on failure
2005 */
2006static int smk_fill_super(struct super_block *sb, void *data, int silent)
2007{
2008 int rc;
2009 struct inode *root_inode;
2010
2011 static struct tree_descr smack_files[] = {
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002012 [SMK_LOAD] = {
2013 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2014 [SMK_CIPSO] = {
2015 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2016 [SMK_DOI] = {
2017 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2018 [SMK_DIRECT] = {
2019 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2020 [SMK_AMBIENT] = {
2021 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2022 [SMK_NETLBLADDR] = {
2023 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2024 [SMK_ONLYCAP] = {
2025 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2026 [SMK_LOGGING] = {
2027 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2028 [SMK_LOAD_SELF] = {
2029 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03002030 [SMK_ACCESSES] = {
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +03002031 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
Casey Schauflerf7112e62012-05-06 15:22:02 -07002032 [SMK_MAPPED] = {
2033 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2034 [SMK_LOAD2] = {
2035 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2036 [SMK_LOAD_SELF2] = {
2037 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2038 [SMK_ACCESS2] = {
2039 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2040 [SMK_CIPSO2] = {
2041 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002042 /* last one */
2043 {""}
Casey Schauflere114e472008-02-04 22:29:50 -08002044 };
2045
2046 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2047 if (rc != 0) {
2048 printk(KERN_ERR "%s failed %d while creating inodes\n",
2049 __func__, rc);
2050 return rc;
2051 }
2052
2053 root_inode = sb->s_root->d_inode;
2054 root_inode->i_security = new_inode_smack(smack_known_floor.smk_known);
2055
2056 return 0;
2057}
2058
2059/**
Al Virofc14f2f2010-07-25 01:48:30 +04002060 * smk_mount - get the smackfs superblock
Casey Schauflere114e472008-02-04 22:29:50 -08002061 * @fs_type: passed along without comment
2062 * @flags: passed along without comment
2063 * @dev_name: passed along without comment
2064 * @data: passed along without comment
Casey Schauflere114e472008-02-04 22:29:50 -08002065 *
2066 * Just passes everything along.
2067 *
2068 * Returns what the lower level code does.
2069 */
Al Virofc14f2f2010-07-25 01:48:30 +04002070static struct dentry *smk_mount(struct file_system_type *fs_type,
2071 int flags, const char *dev_name, void *data)
Casey Schauflere114e472008-02-04 22:29:50 -08002072{
Al Virofc14f2f2010-07-25 01:48:30 +04002073 return mount_single(fs_type, flags, data, smk_fill_super);
Casey Schauflere114e472008-02-04 22:29:50 -08002074}
2075
2076static struct file_system_type smk_fs_type = {
2077 .name = "smackfs",
Al Virofc14f2f2010-07-25 01:48:30 +04002078 .mount = smk_mount,
Casey Schauflere114e472008-02-04 22:29:50 -08002079 .kill_sb = kill_litter_super,
2080};
2081
2082static struct vfsmount *smackfs_mount;
2083
Casey Schauflerf7112e62012-05-06 15:22:02 -07002084static int __init smk_preset_netlabel(struct smack_known *skp)
2085{
2086 skp->smk_netlabel.domain = skp->smk_known;
2087 skp->smk_netlabel.flags =
2088 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2089 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2090 &skp->smk_netlabel, strlen(skp->smk_known));
2091}
2092
Casey Schauflere114e472008-02-04 22:29:50 -08002093/**
2094 * init_smk_fs - get the smackfs superblock
2095 *
2096 * register the smackfs
2097 *
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002098 * Do not register smackfs if Smack wasn't enabled
2099 * on boot. We can not put this method normally under the
2100 * smack_init() code path since the security subsystem get
2101 * initialized before the vfs caches.
2102 *
2103 * Returns true if we were not chosen on boot or if
2104 * we were chosen and filesystem registration succeeded.
Casey Schauflere114e472008-02-04 22:29:50 -08002105 */
2106static int __init init_smk_fs(void)
2107{
2108 int err;
Casey Schauflerf7112e62012-05-06 15:22:02 -07002109 int rc;
Casey Schauflere114e472008-02-04 22:29:50 -08002110
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002111 if (!security_module_enable(&smack_ops))
2112 return 0;
2113
Casey Schauflere114e472008-02-04 22:29:50 -08002114 err = register_filesystem(&smk_fs_type);
2115 if (!err) {
2116 smackfs_mount = kern_mount(&smk_fs_type);
2117 if (IS_ERR(smackfs_mount)) {
2118 printk(KERN_ERR "smackfs: could not mount!\n");
2119 err = PTR_ERR(smackfs_mount);
2120 smackfs_mount = NULL;
2121 }
2122 }
2123
Casey Schauflere114e472008-02-04 22:29:50 -08002124 smk_cipso_doi();
Casey Schaufler4bc87e62008-02-15 15:24:25 -08002125 smk_unlbl_ambient(NULL);
Casey Schauflere114e472008-02-04 22:29:50 -08002126
Casey Schauflerf7112e62012-05-06 15:22:02 -07002127 rc = smk_preset_netlabel(&smack_known_floor);
2128 if (err == 0 && rc < 0)
2129 err = rc;
2130 rc = smk_preset_netlabel(&smack_known_hat);
2131 if (err == 0 && rc < 0)
2132 err = rc;
2133 rc = smk_preset_netlabel(&smack_known_huh);
2134 if (err == 0 && rc < 0)
2135 err = rc;
2136 rc = smk_preset_netlabel(&smack_known_invalid);
2137 if (err == 0 && rc < 0)
2138 err = rc;
2139 rc = smk_preset_netlabel(&smack_known_star);
2140 if (err == 0 && rc < 0)
2141 err = rc;
2142 rc = smk_preset_netlabel(&smack_known_web);
2143 if (err == 0 && rc < 0)
2144 err = rc;
2145
Casey Schauflere114e472008-02-04 22:29:50 -08002146 return err;
2147}
2148
2149__initcall(init_smk_fs);