blob: 86453db4333d2b4f5973f04ecc8563986871bac3 [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Author:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 *
11 */
12
13#include <linux/types.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090014#include <linux/slab.h>
Casey Schauflere114e472008-02-04 22:29:50 -080015#include <linux/fs.h>
16#include <linux/sched.h>
17#include "smack.h"
18
Casey Schauflere114e472008-02-04 22:29:50 -080019struct smack_known smack_known_huh = {
Casey Schauflere114e472008-02-04 22:29:50 -080020 .smk_known = "?",
21 .smk_secid = 2,
22 .smk_cipso = NULL,
23};
24
25struct smack_known smack_known_hat = {
Casey Schauflere114e472008-02-04 22:29:50 -080026 .smk_known = "^",
27 .smk_secid = 3,
28 .smk_cipso = NULL,
29};
30
31struct smack_known smack_known_star = {
Casey Schauflere114e472008-02-04 22:29:50 -080032 .smk_known = "*",
33 .smk_secid = 4,
34 .smk_cipso = NULL,
35};
36
37struct smack_known smack_known_floor = {
Casey Schauflere114e472008-02-04 22:29:50 -080038 .smk_known = "_",
39 .smk_secid = 5,
40 .smk_cipso = NULL,
41};
42
43struct smack_known smack_known_invalid = {
Casey Schauflere114e472008-02-04 22:29:50 -080044 .smk_known = "",
45 .smk_secid = 6,
46 .smk_cipso = NULL,
47};
48
Casey Schaufler6d3dc072008-12-31 12:54:12 -050049struct smack_known smack_known_web = {
Casey Schaufler6d3dc072008-12-31 12:54:12 -050050 .smk_known = "@",
51 .smk_secid = 7,
52 .smk_cipso = NULL,
53};
54
Etienne Basset7198e2e2009-03-24 20:53:24 +010055LIST_HEAD(smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -080056
57/*
58 * The initial value needs to be bigger than any of the
59 * known values above.
60 */
61static u32 smack_next_secid = 10;
62
Etienne Bassetecfcc532009-04-08 20:40:06 +020063/*
64 * what events do we log
65 * can be overwritten at run-time by /smack/logging
66 */
67int log_policy = SMACK_AUDIT_DENIED;
68
Casey Schauflere114e472008-02-04 22:29:50 -080069/**
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020070 * smk_access_entry - look up matching access rule
71 * @subject_label: a pointer to the subject's Smack label
72 * @object_label: a pointer to the object's Smack label
Casey Schaufler7898e1f2011-01-17 08:05:27 -080073 * @rule_list: the list of rules to search
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020074 *
75 * This function looks up the subject/object pair in the
Casey Schaufler7898e1f2011-01-17 08:05:27 -080076 * access rule list and returns the access mode. If no
77 * entry is found returns -ENOENT.
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020078 *
79 * NOTE:
80 * Even though Smack labels are usually shared on smack_list
81 * labels that come in off the network can't be imported
82 * and added to the list for locking reasons.
83 *
84 * Therefore, it is necessary to check the contents of the labels,
85 * not just the pointer values. Of course, in most cases the labels
86 * will be on the list, so checking the pointers may be a worthwhile
87 * optimization.
88 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -080089int smk_access_entry(char *subject_label, char *object_label,
90 struct list_head *rule_list)
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020091{
Casey Schaufler7898e1f2011-01-17 08:05:27 -080092 int may = -ENOENT;
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020093 struct smack_rule *srp;
94
Casey Schaufler7898e1f2011-01-17 08:05:27 -080095 list_for_each_entry_rcu(srp, rule_list, list) {
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +020096 if (srp->smk_subject == subject_label ||
97 strcmp(srp->smk_subject, subject_label) == 0) {
98 if (srp->smk_object == object_label ||
99 strcmp(srp->smk_object, object_label) == 0) {
100 may = srp->smk_access;
101 break;
102 }
103 }
104 }
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200105
106 return may;
107}
108
109/**
Casey Schauflere114e472008-02-04 22:29:50 -0800110 * smk_access - determine if a subject has a specific access to an object
111 * @subject_label: a pointer to the subject's Smack label
112 * @object_label: a pointer to the object's Smack label
113 * @request: the access requested, in "MAY" format
Etienne Bassetecfcc532009-04-08 20:40:06 +0200114 * @a : a pointer to the audit data
Casey Schauflere114e472008-02-04 22:29:50 -0800115 *
116 * This function looks up the subject/object pair in the
117 * access rule list and returns 0 if the access is permitted,
118 * non zero otherwise.
119 *
120 * Even though Smack labels are usually shared on smack_list
121 * labels that come in off the network can't be imported
122 * and added to the list for locking reasons.
123 *
124 * Therefore, it is necessary to check the contents of the labels,
125 * not just the pointer values. Of course, in most cases the labels
126 * will be on the list, so checking the pointers may be a worthwhile
127 * optimization.
128 */
Etienne Bassetecfcc532009-04-08 20:40:06 +0200129int smk_access(char *subject_label, char *object_label, int request,
130 struct smk_audit_info *a)
Casey Schauflere114e472008-02-04 22:29:50 -0800131{
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800132 int may = MAY_NOT;
Etienne Bassetecfcc532009-04-08 20:40:06 +0200133 int rc = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800134
135 /*
136 * Hardcoded comparisons.
137 *
138 * A star subject can't access any object.
139 */
140 if (subject_label == smack_known_star.smk_known ||
Etienne Bassetecfcc532009-04-08 20:40:06 +0200141 strcmp(subject_label, smack_known_star.smk_known) == 0) {
142 rc = -EACCES;
143 goto out_audit;
144 }
Casey Schauflere114e472008-02-04 22:29:50 -0800145 /*
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500146 * An internet object can be accessed by any subject.
147 * Tasks cannot be assigned the internet label.
148 * An internet subject can access any object.
149 */
150 if (object_label == smack_known_web.smk_known ||
151 subject_label == smack_known_web.smk_known ||
152 strcmp(object_label, smack_known_web.smk_known) == 0 ||
153 strcmp(subject_label, smack_known_web.smk_known) == 0)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200154 goto out_audit;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500155 /*
Casey Schauflere114e472008-02-04 22:29:50 -0800156 * A star object can be accessed by any subject.
157 */
158 if (object_label == smack_known_star.smk_known ||
159 strcmp(object_label, smack_known_star.smk_known) == 0)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200160 goto out_audit;
Casey Schauflere114e472008-02-04 22:29:50 -0800161 /*
162 * An object can be accessed in any way by a subject
163 * with the same label.
164 */
165 if (subject_label == object_label ||
166 strcmp(subject_label, object_label) == 0)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200167 goto out_audit;
Casey Schauflere114e472008-02-04 22:29:50 -0800168 /*
169 * A hat subject can read any object.
170 * A floor object can be read by any subject.
171 */
172 if ((request & MAY_ANYREAD) == request) {
173 if (object_label == smack_known_floor.smk_known ||
174 strcmp(object_label, smack_known_floor.smk_known) == 0)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200175 goto out_audit;
Casey Schauflere114e472008-02-04 22:29:50 -0800176 if (subject_label == smack_known_hat.smk_known ||
177 strcmp(subject_label, smack_known_hat.smk_known) == 0)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200178 goto out_audit;
Casey Schauflere114e472008-02-04 22:29:50 -0800179 }
180 /*
181 * Beyond here an explicit relationship is required.
182 * If the requested access is contained in the available
183 * access (e.g. read is included in readwrite) it's
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800184 * good. A negative response from smk_access_entry()
185 * indicates there is no entry for this pair.
Casey Schauflere114e472008-02-04 22:29:50 -0800186 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800187 rcu_read_lock();
188 may = smk_access_entry(subject_label, object_label, &smack_rule_list);
189 rcu_read_unlock();
190
191 if (may > 0 && (request & may) == request)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200192 goto out_audit;
Casey Schauflere114e472008-02-04 22:29:50 -0800193
Etienne Bassetecfcc532009-04-08 20:40:06 +0200194 rc = -EACCES;
195out_audit:
196#ifdef CONFIG_AUDIT
197 if (a)
198 smack_log(subject_label, object_label, request, rc, a);
199#endif
200 return rc;
Casey Schauflere114e472008-02-04 22:29:50 -0800201}
202
203/**
204 * smk_curacc - determine if current has a specific access to an object
Randy Dunlap251a2a92009-02-18 11:42:33 -0800205 * @obj_label: a pointer to the object's Smack label
206 * @mode: the access requested, in "MAY" format
Etienne Bassetecfcc532009-04-08 20:40:06 +0200207 * @a : common audit data
Casey Schauflere114e472008-02-04 22:29:50 -0800208 *
209 * This function checks the current subject label/object label pair
210 * in the access rule list and returns 0 if the access is permitted,
Casey Schaufler15446232008-07-30 15:37:11 -0700211 * non zero otherwise. It allows that current may have the capability
Casey Schauflere114e472008-02-04 22:29:50 -0800212 * to override the rules.
213 */
Etienne Bassetecfcc532009-04-08 20:40:06 +0200214int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
Casey Schauflere114e472008-02-04 22:29:50 -0800215{
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800216 struct task_smack *tsp = current_security();
217 char *sp = smk_of_task(tsp);
218 int may;
Casey Schauflere114e472008-02-04 22:29:50 -0800219 int rc;
220
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800221 /*
222 * Check the global rule list
223 */
Etienne Bassetecfcc532009-04-08 20:40:06 +0200224 rc = smk_access(sp, obj_label, mode, NULL);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800225 if (rc == 0) {
226 /*
227 * If there is an entry in the task's rule list
228 * it can further restrict access.
229 */
230 may = smk_access_entry(sp, obj_label, &tsp->smk_rules);
231 if (may < 0)
232 goto out_audit;
233 if ((mode & may) == mode)
234 goto out_audit;
235 rc = -EACCES;
236 }
Casey Schauflere114e472008-02-04 22:29:50 -0800237
Casey Schaufler15446232008-07-30 15:37:11 -0700238 /*
239 * Return if a specific label has been designated as the
240 * only one that gets privilege and current does not
241 * have that label.
242 */
Casey Schaufler676dac42010-12-02 06:43:39 -0800243 if (smack_onlycap != NULL && smack_onlycap != sp)
Etienne Bassetecfcc532009-04-08 20:40:06 +0200244 goto out_audit;
Casey Schaufler15446232008-07-30 15:37:11 -0700245
Casey Schauflere114e472008-02-04 22:29:50 -0800246 if (capable(CAP_MAC_OVERRIDE))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800247 rc = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800248
Etienne Bassetecfcc532009-04-08 20:40:06 +0200249out_audit:
250#ifdef CONFIG_AUDIT
251 if (a)
252 smack_log(sp, obj_label, mode, rc, a);
253#endif
Casey Schauflere114e472008-02-04 22:29:50 -0800254 return rc;
255}
256
Etienne Bassetecfcc532009-04-08 20:40:06 +0200257#ifdef CONFIG_AUDIT
258/**
259 * smack_str_from_perm : helper to transalate an int to a
260 * readable string
261 * @string : the string to fill
262 * @access : the int
263 *
264 */
265static inline void smack_str_from_perm(char *string, int access)
266{
267 int i = 0;
268 if (access & MAY_READ)
269 string[i++] = 'r';
270 if (access & MAY_WRITE)
271 string[i++] = 'w';
272 if (access & MAY_EXEC)
273 string[i++] = 'x';
274 if (access & MAY_APPEND)
275 string[i++] = 'a';
276 string[i] = '\0';
277}
278/**
279 * smack_log_callback - SMACK specific information
280 * will be called by generic audit code
281 * @ab : the audit_buffer
282 * @a : audit_data
283 *
284 */
285static void smack_log_callback(struct audit_buffer *ab, void *a)
286{
287 struct common_audit_data *ad = a;
Thomas Liud4131de2009-07-09 10:00:30 -0400288 struct smack_audit_data *sad = &ad->smack_audit_data;
Thomas Liued5215a2009-07-09 10:00:29 -0400289 audit_log_format(ab, "lsm=SMACK fn=%s action=%s",
Thomas Liud4131de2009-07-09 10:00:30 -0400290 ad->smack_audit_data.function,
Etienne Bassetecfcc532009-04-08 20:40:06 +0200291 sad->result ? "denied" : "granted");
292 audit_log_format(ab, " subject=");
293 audit_log_untrustedstring(ab, sad->subject);
294 audit_log_format(ab, " object=");
295 audit_log_untrustedstring(ab, sad->object);
296 audit_log_format(ab, " requested=%s", sad->request);
297}
298
299/**
300 * smack_log - Audit the granting or denial of permissions.
301 * @subject_label : smack label of the requester
302 * @object_label : smack label of the object being accessed
303 * @request: requested permissions
304 * @result: result from smk_access
305 * @a: auxiliary audit data
306 *
307 * Audit the granting or denial of permissions in accordance
308 * with the policy.
309 */
310void smack_log(char *subject_label, char *object_label, int request,
311 int result, struct smk_audit_info *ad)
312{
313 char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
314 struct smack_audit_data *sad;
315 struct common_audit_data *a = &ad->a;
316
317 /* check if we have to log the current event */
318 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
319 return;
320 if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
321 return;
322
Thomas Liud4131de2009-07-09 10:00:30 -0400323 if (a->smack_audit_data.function == NULL)
324 a->smack_audit_data.function = "unknown";
Etienne Bassetecfcc532009-04-08 20:40:06 +0200325
326 /* end preparing the audit data */
Thomas Liud4131de2009-07-09 10:00:30 -0400327 sad = &a->smack_audit_data;
Etienne Bassetecfcc532009-04-08 20:40:06 +0200328 smack_str_from_perm(request_buffer, request);
329 sad->subject = subject_label;
330 sad->object = object_label;
331 sad->request = request_buffer;
332 sad->result = result;
333 a->lsm_pre_audit = smack_log_callback;
334
335 common_lsm_audit(a);
336}
337#else /* #ifdef CONFIG_AUDIT */
338void smack_log(char *subject_label, char *object_label, int request,
339 int result, struct smk_audit_info *ad)
340{
341}
342#endif
343
Casey Schauflere114e472008-02-04 22:29:50 -0800344static DEFINE_MUTEX(smack_known_lock);
345
346/**
347 * smk_import_entry - import a label, return the list entry
348 * @string: a text string that might be a Smack label
349 * @len: the maximum size, or zero if it is NULL terminated.
350 *
351 * Returns a pointer to the entry in the label list that
352 * matches the passed string, adding it if necessary.
353 */
354struct smack_known *smk_import_entry(const char *string, int len)
355{
356 struct smack_known *skp;
357 char smack[SMK_LABELLEN];
358 int found;
359 int i;
360
361 if (len <= 0 || len > SMK_MAXLEN)
362 len = SMK_MAXLEN;
363
364 for (i = 0, found = 0; i < SMK_LABELLEN; i++) {
365 if (found)
366 smack[i] = '\0';
367 else if (i >= len || string[i] > '~' || string[i] <= ' ' ||
Etienne Bassetecfcc532009-04-08 20:40:06 +0200368 string[i] == '/' || string[i] == '"' ||
369 string[i] == '\\' || string[i] == '\'') {
Casey Schauflere114e472008-02-04 22:29:50 -0800370 smack[i] = '\0';
371 found = 1;
372 } else
373 smack[i] = string[i];
374 }
375
376 if (smack[0] == '\0')
377 return NULL;
378
379 mutex_lock(&smack_known_lock);
380
Etienne Basset7198e2e2009-03-24 20:53:24 +0100381 found = 0;
382 list_for_each_entry_rcu(skp, &smack_known_list, list) {
383 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) {
384 found = 1;
Casey Schauflere114e472008-02-04 22:29:50 -0800385 break;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100386 }
387 }
Casey Schauflere114e472008-02-04 22:29:50 -0800388
Etienne Basset7198e2e2009-03-24 20:53:24 +0100389 if (found == 0) {
Casey Schauflere114e472008-02-04 22:29:50 -0800390 skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL);
391 if (skp != NULL) {
Casey Schauflere114e472008-02-04 22:29:50 -0800392 strncpy(skp->smk_known, smack, SMK_MAXLEN);
393 skp->smk_secid = smack_next_secid++;
394 skp->smk_cipso = NULL;
395 spin_lock_init(&skp->smk_cipsolock);
396 /*
397 * Make sure that the entry is actually
398 * filled before putting it on the list.
399 */
Etienne Basset7198e2e2009-03-24 20:53:24 +0100400 list_add_rcu(&skp->list, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800401 }
402 }
403
404 mutex_unlock(&smack_known_lock);
405
406 return skp;
407}
408
409/**
410 * smk_import - import a smack label
411 * @string: a text string that might be a Smack label
412 * @len: the maximum size, or zero if it is NULL terminated.
413 *
414 * Returns a pointer to the label in the label list that
415 * matches the passed string, adding it if necessary.
416 */
417char *smk_import(const char *string, int len)
418{
419 struct smack_known *skp;
420
Etienne Basset43031542009-03-27 17:11:01 -0400421 /* labels cannot begin with a '-' */
422 if (string[0] == '-')
423 return NULL;
Casey Schauflere114e472008-02-04 22:29:50 -0800424 skp = smk_import_entry(string, len);
425 if (skp == NULL)
426 return NULL;
427 return skp->smk_known;
428}
429
430/**
431 * smack_from_secid - find the Smack label associated with a secid
432 * @secid: an integer that might be associated with a Smack label
433 *
434 * Returns a pointer to the appropraite Smack label if there is one,
435 * otherwise a pointer to the invalid Smack label.
436 */
437char *smack_from_secid(const u32 secid)
438{
439 struct smack_known *skp;
440
Etienne Basset7198e2e2009-03-24 20:53:24 +0100441 rcu_read_lock();
442 list_for_each_entry_rcu(skp, &smack_known_list, list) {
443 if (skp->smk_secid == secid) {
444 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800445 return skp->smk_known;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100446 }
447 }
Casey Schauflere114e472008-02-04 22:29:50 -0800448
449 /*
450 * If we got this far someone asked for the translation
451 * of a secid that is not on the list.
452 */
Etienne Basset7198e2e2009-03-24 20:53:24 +0100453 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800454 return smack_known_invalid.smk_known;
455}
456
457/**
458 * smack_to_secid - find the secid associated with a Smack label
459 * @smack: the Smack label
460 *
461 * Returns the appropriate secid if there is one,
462 * otherwise 0
463 */
464u32 smack_to_secid(const char *smack)
465{
466 struct smack_known *skp;
467
Etienne Basset7198e2e2009-03-24 20:53:24 +0100468 rcu_read_lock();
469 list_for_each_entry_rcu(skp, &smack_known_list, list) {
470 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) {
471 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800472 return skp->smk_secid;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100473 }
474 }
475 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800476 return 0;
477}
478
479/**
480 * smack_from_cipso - find the Smack label associated with a CIPSO option
481 * @level: Bell & LaPadula level from the network
482 * @cp: Bell & LaPadula categories from the network
483 * @result: where to put the Smack value
484 *
485 * This is a simple lookup in the label table.
486 *
487 * This is an odd duck as far as smack handling goes in that
488 * it sends back a copy of the smack label rather than a pointer
489 * to the master list. This is done because it is possible for
490 * a foreign host to send a smack label that is new to this
491 * machine and hence not on the list. That would not be an
492 * issue except that adding an entry to the master list can't
493 * be done at that point.
494 */
495void smack_from_cipso(u32 level, char *cp, char *result)
496{
497 struct smack_known *kp;
498 char *final = NULL;
499
Etienne Basset7198e2e2009-03-24 20:53:24 +0100500 rcu_read_lock();
501 list_for_each_entry(kp, &smack_known_list, list) {
Casey Schauflere114e472008-02-04 22:29:50 -0800502 if (kp->smk_cipso == NULL)
503 continue;
504
505 spin_lock_bh(&kp->smk_cipsolock);
506
507 if (kp->smk_cipso->smk_level == level &&
508 memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0)
509 final = kp->smk_known;
510
511 spin_unlock_bh(&kp->smk_cipsolock);
512 }
Etienne Basset7198e2e2009-03-24 20:53:24 +0100513 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800514 if (final == NULL)
515 final = smack_known_huh.smk_known;
516 strncpy(result, final, SMK_MAXLEN);
517 return;
518}
519
520/**
521 * smack_to_cipso - find the CIPSO option to go with a Smack label
522 * @smack: a pointer to the smack label in question
523 * @cp: where to put the result
524 *
525 * Returns zero if a value is available, non-zero otherwise.
526 */
527int smack_to_cipso(const char *smack, struct smack_cipso *cp)
528{
529 struct smack_known *kp;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100530 int found = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800531
Etienne Basset7198e2e2009-03-24 20:53:24 +0100532 rcu_read_lock();
533 list_for_each_entry_rcu(kp, &smack_known_list, list) {
Casey Schauflere114e472008-02-04 22:29:50 -0800534 if (kp->smk_known == smack ||
Etienne Basset7198e2e2009-03-24 20:53:24 +0100535 strcmp(kp->smk_known, smack) == 0) {
536 found = 1;
Casey Schauflere114e472008-02-04 22:29:50 -0800537 break;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100538 }
539 }
540 rcu_read_unlock();
Casey Schauflere114e472008-02-04 22:29:50 -0800541
Etienne Basset7198e2e2009-03-24 20:53:24 +0100542 if (found == 0 || kp->smk_cipso == NULL)
Casey Schauflere114e472008-02-04 22:29:50 -0800543 return -ENOENT;
544
545 memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso));
546 return 0;
547}