Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> |
| 3 | * |
| 4 | * This program is free software; you can redistribute it and/or modify |
| 5 | * it under the terms of the GNU General Public License as published by |
| 6 | * the Free Software Foundation, version 2. |
| 7 | * |
| 8 | * Author: |
| 9 | * Casey Schaufler <casey@schaufler-ca.com> |
| 10 | * |
| 11 | */ |
| 12 | |
| 13 | #include <linux/types.h> |
Tejun Heo | 5a0e3ad | 2010-03-24 17:04:11 +0900 | [diff] [blame] | 14 | #include <linux/slab.h> |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 15 | #include <linux/fs.h> |
| 16 | #include <linux/sched.h> |
| 17 | #include "smack.h" |
| 18 | |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 19 | struct smack_known smack_known_huh = { |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 20 | .smk_known = "?", |
| 21 | .smk_secid = 2, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 22 | }; |
| 23 | |
| 24 | struct smack_known smack_known_hat = { |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 25 | .smk_known = "^", |
| 26 | .smk_secid = 3, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 27 | }; |
| 28 | |
| 29 | struct smack_known smack_known_star = { |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 30 | .smk_known = "*", |
| 31 | .smk_secid = 4, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 32 | }; |
| 33 | |
| 34 | struct smack_known smack_known_floor = { |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 35 | .smk_known = "_", |
| 36 | .smk_secid = 5, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 37 | }; |
| 38 | |
| 39 | struct smack_known smack_known_invalid = { |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 40 | .smk_known = "", |
| 41 | .smk_secid = 6, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 42 | }; |
| 43 | |
Casey Schaufler | 6d3dc07 | 2008-12-31 12:54:12 -0500 | [diff] [blame] | 44 | struct smack_known smack_known_web = { |
Casey Schaufler | 6d3dc07 | 2008-12-31 12:54:12 -0500 | [diff] [blame] | 45 | .smk_known = "@", |
| 46 | .smk_secid = 7, |
Casey Schaufler | 6d3dc07 | 2008-12-31 12:54:12 -0500 | [diff] [blame] | 47 | }; |
| 48 | |
Etienne Basset | 7198e2e | 2009-03-24 20:53:24 +0100 | [diff] [blame] | 49 | LIST_HEAD(smack_known_list); |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 50 | |
| 51 | /* |
| 52 | * The initial value needs to be bigger than any of the |
| 53 | * known values above. |
| 54 | */ |
| 55 | static u32 smack_next_secid = 10; |
| 56 | |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 57 | /* |
| 58 | * what events do we log |
| 59 | * can be overwritten at run-time by /smack/logging |
| 60 | */ |
| 61 | int log_policy = SMACK_AUDIT_DENIED; |
| 62 | |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 63 | /** |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 64 | * smk_access_entry - look up matching access rule |
| 65 | * @subject_label: a pointer to the subject's Smack label |
| 66 | * @object_label: a pointer to the object's Smack label |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 67 | * @rule_list: the list of rules to search |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 68 | * |
| 69 | * This function looks up the subject/object pair in the |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 70 | * access rule list and returns the access mode. If no |
| 71 | * entry is found returns -ENOENT. |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 72 | * |
| 73 | * NOTE: |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 74 | * |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 75 | * Earlier versions of this function allowed for labels that |
| 76 | * were not on the label list. This was done to allow for |
| 77 | * labels to come over the network that had never been seen |
| 78 | * before on this host. Unless the receiving socket has the |
| 79 | * star label this will always result in a failure check. The |
| 80 | * star labeled socket case is now handled in the networking |
| 81 | * hooks so there is no case where the label is not on the |
| 82 | * label list. Checking to see if the address of two labels |
| 83 | * is the same is now a reliable test. |
| 84 | * |
| 85 | * Do the object check first because that is more |
| 86 | * likely to differ. |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 87 | */ |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 88 | int smk_access_entry(char *subject_label, char *object_label, |
| 89 | struct list_head *rule_list) |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 90 | { |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 91 | int may = -ENOENT; |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 92 | struct smack_rule *srp; |
| 93 | |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 94 | list_for_each_entry_rcu(srp, rule_list, list) { |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 95 | if (srp->smk_object == object_label && |
| 96 | srp->smk_subject == subject_label) { |
| 97 | may = srp->smk_access; |
| 98 | break; |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 99 | } |
| 100 | } |
Jarkko Sakkinen | 5c6d112 | 2010-12-07 13:34:01 +0200 | [diff] [blame] | 101 | |
| 102 | return may; |
| 103 | } |
| 104 | |
| 105 | /** |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 106 | * smk_access - determine if a subject has a specific access to an object |
| 107 | * @subject_label: a pointer to the subject's Smack label |
| 108 | * @object_label: a pointer to the object's Smack label |
| 109 | * @request: the access requested, in "MAY" format |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 110 | * @a : a pointer to the audit data |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 111 | * |
| 112 | * This function looks up the subject/object pair in the |
| 113 | * access rule list and returns 0 if the access is permitted, |
| 114 | * non zero otherwise. |
| 115 | * |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 116 | * Smack labels are shared on smack_list |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 117 | */ |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 118 | int smk_access(char *subject_label, char *object_label, int request, |
| 119 | struct smk_audit_info *a) |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 120 | { |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 121 | struct smack_known *skp; |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 122 | int may = MAY_NOT; |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 123 | int rc = 0; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 124 | |
| 125 | /* |
| 126 | * Hardcoded comparisons. |
| 127 | * |
| 128 | * A star subject can't access any object. |
| 129 | */ |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 130 | if (subject_label == smack_known_star.smk_known) { |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 131 | rc = -EACCES; |
| 132 | goto out_audit; |
| 133 | } |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 134 | /* |
Casey Schaufler | 6d3dc07 | 2008-12-31 12:54:12 -0500 | [diff] [blame] | 135 | * An internet object can be accessed by any subject. |
| 136 | * Tasks cannot be assigned the internet label. |
| 137 | * An internet subject can access any object. |
| 138 | */ |
| 139 | if (object_label == smack_known_web.smk_known || |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 140 | subject_label == smack_known_web.smk_known) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 141 | goto out_audit; |
Casey Schaufler | 6d3dc07 | 2008-12-31 12:54:12 -0500 | [diff] [blame] | 142 | /* |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 143 | * A star object can be accessed by any subject. |
| 144 | */ |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 145 | if (object_label == smack_known_star.smk_known) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 146 | goto out_audit; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 147 | /* |
| 148 | * An object can be accessed in any way by a subject |
| 149 | * with the same label. |
| 150 | */ |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 151 | if (subject_label == object_label) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 152 | goto out_audit; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 153 | /* |
| 154 | * A hat subject can read any object. |
| 155 | * A floor object can be read by any subject. |
| 156 | */ |
| 157 | if ((request & MAY_ANYREAD) == request) { |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 158 | if (object_label == smack_known_floor.smk_known) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 159 | goto out_audit; |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 160 | if (subject_label == smack_known_hat.smk_known) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 161 | goto out_audit; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 162 | } |
| 163 | /* |
| 164 | * Beyond here an explicit relationship is required. |
| 165 | * If the requested access is contained in the available |
| 166 | * access (e.g. read is included in readwrite) it's |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 167 | * good. A negative response from smk_access_entry() |
| 168 | * indicates there is no entry for this pair. |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 169 | */ |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 170 | skp = smk_find_entry(subject_label); |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 171 | rcu_read_lock(); |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 172 | may = smk_access_entry(subject_label, object_label, &skp->smk_rules); |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 173 | rcu_read_unlock(); |
| 174 | |
| 175 | if (may > 0 && (request & may) == request) |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 176 | goto out_audit; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 177 | |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 178 | rc = -EACCES; |
| 179 | out_audit: |
| 180 | #ifdef CONFIG_AUDIT |
| 181 | if (a) |
| 182 | smack_log(subject_label, object_label, request, rc, a); |
| 183 | #endif |
| 184 | return rc; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 185 | } |
| 186 | |
| 187 | /** |
| 188 | * smk_curacc - determine if current has a specific access to an object |
Randy Dunlap | 251a2a9 | 2009-02-18 11:42:33 -0800 | [diff] [blame] | 189 | * @obj_label: a pointer to the object's Smack label |
| 190 | * @mode: the access requested, in "MAY" format |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 191 | * @a : common audit data |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 192 | * |
| 193 | * This function checks the current subject label/object label pair |
| 194 | * in the access rule list and returns 0 if the access is permitted, |
Casey Schaufler | 1544623 | 2008-07-30 15:37:11 -0700 | [diff] [blame] | 195 | * non zero otherwise. It allows that current may have the capability |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 196 | * to override the rules. |
| 197 | */ |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 198 | int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a) |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 199 | { |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 200 | struct task_smack *tsp = current_security(); |
| 201 | char *sp = smk_of_task(tsp); |
| 202 | int may; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 203 | int rc; |
| 204 | |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 205 | /* |
| 206 | * Check the global rule list |
| 207 | */ |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 208 | rc = smk_access(sp, obj_label, mode, NULL); |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 209 | if (rc == 0) { |
| 210 | /* |
| 211 | * If there is an entry in the task's rule list |
| 212 | * it can further restrict access. |
| 213 | */ |
| 214 | may = smk_access_entry(sp, obj_label, &tsp->smk_rules); |
| 215 | if (may < 0) |
| 216 | goto out_audit; |
| 217 | if ((mode & may) == mode) |
| 218 | goto out_audit; |
| 219 | rc = -EACCES; |
| 220 | } |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 221 | |
Casey Schaufler | 1544623 | 2008-07-30 15:37:11 -0700 | [diff] [blame] | 222 | /* |
Casey Schaufler | 1880eff | 2012-06-05 15:28:30 -0700 | [diff] [blame] | 223 | * Allow for priviliged to override policy. |
Casey Schaufler | 1544623 | 2008-07-30 15:37:11 -0700 | [diff] [blame] | 224 | */ |
Casey Schaufler | 1880eff | 2012-06-05 15:28:30 -0700 | [diff] [blame] | 225 | if (rc != 0 && smack_privileged(CAP_MAC_OVERRIDE)) |
Casey Schaufler | 7898e1f | 2011-01-17 08:05:27 -0800 | [diff] [blame] | 226 | rc = 0; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 227 | |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 228 | out_audit: |
| 229 | #ifdef CONFIG_AUDIT |
| 230 | if (a) |
| 231 | smack_log(sp, obj_label, mode, rc, a); |
| 232 | #endif |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 233 | return rc; |
| 234 | } |
| 235 | |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 236 | #ifdef CONFIG_AUDIT |
| 237 | /** |
| 238 | * smack_str_from_perm : helper to transalate an int to a |
| 239 | * readable string |
| 240 | * @string : the string to fill |
| 241 | * @access : the int |
| 242 | * |
| 243 | */ |
| 244 | static inline void smack_str_from_perm(char *string, int access) |
| 245 | { |
| 246 | int i = 0; |
| 247 | if (access & MAY_READ) |
| 248 | string[i++] = 'r'; |
| 249 | if (access & MAY_WRITE) |
| 250 | string[i++] = 'w'; |
| 251 | if (access & MAY_EXEC) |
| 252 | string[i++] = 'x'; |
| 253 | if (access & MAY_APPEND) |
| 254 | string[i++] = 'a'; |
Rafal Krypa | a87d79a | 2012-11-27 16:29:07 +0100 | [diff] [blame^] | 255 | if (access & MAY_TRANSMUTE) |
| 256 | string[i++] = 't'; |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 257 | string[i] = '\0'; |
| 258 | } |
| 259 | /** |
| 260 | * smack_log_callback - SMACK specific information |
| 261 | * will be called by generic audit code |
| 262 | * @ab : the audit_buffer |
| 263 | * @a : audit_data |
| 264 | * |
| 265 | */ |
| 266 | static void smack_log_callback(struct audit_buffer *ab, void *a) |
| 267 | { |
| 268 | struct common_audit_data *ad = a; |
Eric Paris | 3b3b0e4 | 2012-04-03 09:37:02 -0700 | [diff] [blame] | 269 | struct smack_audit_data *sad = ad->smack_audit_data; |
Thomas Liu | ed5215a | 2009-07-09 10:00:29 -0400 | [diff] [blame] | 270 | audit_log_format(ab, "lsm=SMACK fn=%s action=%s", |
Eric Paris | 3b3b0e4 | 2012-04-03 09:37:02 -0700 | [diff] [blame] | 271 | ad->smack_audit_data->function, |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 272 | sad->result ? "denied" : "granted"); |
| 273 | audit_log_format(ab, " subject="); |
| 274 | audit_log_untrustedstring(ab, sad->subject); |
| 275 | audit_log_format(ab, " object="); |
| 276 | audit_log_untrustedstring(ab, sad->object); |
| 277 | audit_log_format(ab, " requested=%s", sad->request); |
| 278 | } |
| 279 | |
| 280 | /** |
| 281 | * smack_log - Audit the granting or denial of permissions. |
| 282 | * @subject_label : smack label of the requester |
| 283 | * @object_label : smack label of the object being accessed |
| 284 | * @request: requested permissions |
| 285 | * @result: result from smk_access |
| 286 | * @a: auxiliary audit data |
| 287 | * |
| 288 | * Audit the granting or denial of permissions in accordance |
| 289 | * with the policy. |
| 290 | */ |
| 291 | void smack_log(char *subject_label, char *object_label, int request, |
| 292 | int result, struct smk_audit_info *ad) |
| 293 | { |
| 294 | char request_buffer[SMK_NUM_ACCESS_TYPE + 1]; |
| 295 | struct smack_audit_data *sad; |
| 296 | struct common_audit_data *a = &ad->a; |
| 297 | |
| 298 | /* check if we have to log the current event */ |
| 299 | if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0) |
| 300 | return; |
| 301 | if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0) |
| 302 | return; |
| 303 | |
Eric Paris | 3b3b0e4 | 2012-04-03 09:37:02 -0700 | [diff] [blame] | 304 | sad = a->smack_audit_data; |
| 305 | |
| 306 | if (sad->function == NULL) |
| 307 | sad->function = "unknown"; |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 308 | |
| 309 | /* end preparing the audit data */ |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 310 | smack_str_from_perm(request_buffer, request); |
| 311 | sad->subject = subject_label; |
| 312 | sad->object = object_label; |
| 313 | sad->request = request_buffer; |
| 314 | sad->result = result; |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 315 | |
Linus Torvalds | b61c37f | 2012-04-02 15:48:12 -0700 | [diff] [blame] | 316 | common_lsm_audit(a, smack_log_callback, NULL); |
Etienne Basset | ecfcc53 | 2009-04-08 20:40:06 +0200 | [diff] [blame] | 317 | } |
| 318 | #else /* #ifdef CONFIG_AUDIT */ |
| 319 | void smack_log(char *subject_label, char *object_label, int request, |
| 320 | int result, struct smk_audit_info *ad) |
| 321 | { |
| 322 | } |
| 323 | #endif |
| 324 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 325 | DEFINE_MUTEX(smack_known_lock); |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 326 | |
| 327 | /** |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 328 | * smk_find_entry - find a label on the list, return the list entry |
| 329 | * @string: a text string that might be a Smack label |
| 330 | * |
| 331 | * Returns a pointer to the entry in the label list that |
| 332 | * matches the passed string. |
| 333 | */ |
| 334 | struct smack_known *smk_find_entry(const char *string) |
| 335 | { |
| 336 | struct smack_known *skp; |
| 337 | |
| 338 | list_for_each_entry_rcu(skp, &smack_known_list, list) { |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 339 | if (strcmp(skp->smk_known, string) == 0) |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 340 | return skp; |
| 341 | } |
| 342 | |
| 343 | return NULL; |
| 344 | } |
| 345 | |
| 346 | /** |
Jarkko Sakkinen | 0e94ae1 | 2011-10-18 21:21:36 +0300 | [diff] [blame] | 347 | * smk_parse_smack - parse smack label from a text string |
| 348 | * @string: a text string that might contain a Smack label |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 349 | * @len: the maximum size, or zero if it is NULL terminated. |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 350 | * |
| 351 | * Returns a pointer to the clean label, or NULL |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 352 | */ |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 353 | char *smk_parse_smack(const char *string, int len) |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 354 | { |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 355 | char *smack; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 356 | int i; |
| 357 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 358 | if (len <= 0) |
| 359 | len = strlen(string) + 1; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 360 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 361 | /* |
| 362 | * Reserve a leading '-' as an indicator that |
| 363 | * this isn't a label, but an option to interfaces |
| 364 | * including /smack/cipso and /smack/cipso2 |
| 365 | */ |
| 366 | if (string[0] == '-') |
| 367 | return NULL; |
| 368 | |
| 369 | for (i = 0; i < len; i++) |
| 370 | if (string[i] > '~' || string[i] <= ' ' || string[i] == '/' || |
| 371 | string[i] == '"' || string[i] == '\\' || string[i] == '\'') |
| 372 | break; |
| 373 | |
| 374 | if (i == 0 || i >= SMK_LONGLABEL) |
| 375 | return NULL; |
| 376 | |
| 377 | smack = kzalloc(i + 1, GFP_KERNEL); |
| 378 | if (smack != NULL) { |
| 379 | strncpy(smack, string, i + 1); |
| 380 | smack[i] = '\0'; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 381 | } |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 382 | return smack; |
| 383 | } |
| 384 | |
| 385 | /** |
| 386 | * smk_netlbl_mls - convert a catset to netlabel mls categories |
| 387 | * @catset: the Smack categories |
| 388 | * @sap: where to put the netlabel categories |
| 389 | * |
| 390 | * Allocates and fills attr.mls |
| 391 | * Returns 0 on success, error code on failure. |
| 392 | */ |
| 393 | int smk_netlbl_mls(int level, char *catset, struct netlbl_lsm_secattr *sap, |
| 394 | int len) |
| 395 | { |
| 396 | unsigned char *cp; |
| 397 | unsigned char m; |
| 398 | int cat; |
| 399 | int rc; |
| 400 | int byte; |
| 401 | |
| 402 | sap->flags |= NETLBL_SECATTR_MLS_CAT; |
| 403 | sap->attr.mls.lvl = level; |
| 404 | sap->attr.mls.cat = netlbl_secattr_catmap_alloc(GFP_ATOMIC); |
| 405 | sap->attr.mls.cat->startbit = 0; |
| 406 | |
| 407 | for (cat = 1, cp = catset, byte = 0; byte < len; cp++, byte++) |
| 408 | for (m = 0x80; m != 0; m >>= 1, cat++) { |
| 409 | if ((m & *cp) == 0) |
| 410 | continue; |
| 411 | rc = netlbl_secattr_catmap_setbit(sap->attr.mls.cat, |
| 412 | cat, GFP_ATOMIC); |
| 413 | if (rc < 0) { |
| 414 | netlbl_secattr_catmap_free(sap->attr.mls.cat); |
| 415 | return rc; |
| 416 | } |
| 417 | } |
| 418 | |
| 419 | return 0; |
Jarkko Sakkinen | 0e94ae1 | 2011-10-18 21:21:36 +0300 | [diff] [blame] | 420 | } |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 421 | |
Jarkko Sakkinen | 0e94ae1 | 2011-10-18 21:21:36 +0300 | [diff] [blame] | 422 | /** |
| 423 | * smk_import_entry - import a label, return the list entry |
| 424 | * @string: a text string that might be a Smack label |
| 425 | * @len: the maximum size, or zero if it is NULL terminated. |
| 426 | * |
| 427 | * Returns a pointer to the entry in the label list that |
| 428 | * matches the passed string, adding it if necessary. |
| 429 | */ |
| 430 | struct smack_known *smk_import_entry(const char *string, int len) |
| 431 | { |
| 432 | struct smack_known *skp; |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 433 | char *smack; |
| 434 | int slen; |
| 435 | int rc; |
Jarkko Sakkinen | 0e94ae1 | 2011-10-18 21:21:36 +0300 | [diff] [blame] | 436 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 437 | smack = smk_parse_smack(string, len); |
| 438 | if (smack == NULL) |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 439 | return NULL; |
| 440 | |
| 441 | mutex_lock(&smack_known_lock); |
| 442 | |
Casey Schaufler | 272cd7a | 2011-09-20 12:24:36 -0700 | [diff] [blame] | 443 | skp = smk_find_entry(smack); |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 444 | if (skp != NULL) |
| 445 | goto freeout; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 446 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 447 | skp = kzalloc(sizeof(*skp), GFP_KERNEL); |
| 448 | if (skp == NULL) |
| 449 | goto freeout; |
| 450 | |
| 451 | skp->smk_known = smack; |
| 452 | skp->smk_secid = smack_next_secid++; |
| 453 | skp->smk_netlabel.domain = skp->smk_known; |
| 454 | skp->smk_netlabel.flags = |
| 455 | NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL; |
| 456 | /* |
| 457 | * If direct labeling works use it. |
| 458 | * Otherwise use mapped labeling. |
| 459 | */ |
| 460 | slen = strlen(smack); |
| 461 | if (slen < SMK_CIPSOLEN) |
| 462 | rc = smk_netlbl_mls(smack_cipso_direct, skp->smk_known, |
| 463 | &skp->smk_netlabel, slen); |
| 464 | else |
| 465 | rc = smk_netlbl_mls(smack_cipso_mapped, (char *)&skp->smk_secid, |
| 466 | &skp->smk_netlabel, sizeof(skp->smk_secid)); |
| 467 | |
| 468 | if (rc >= 0) { |
| 469 | INIT_LIST_HEAD(&skp->smk_rules); |
| 470 | mutex_init(&skp->smk_rules_lock); |
| 471 | /* |
| 472 | * Make sure that the entry is actually |
| 473 | * filled before putting it on the list. |
| 474 | */ |
| 475 | list_add_rcu(&skp->list, &smack_known_list); |
| 476 | goto unlockout; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 477 | } |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 478 | /* |
| 479 | * smk_netlbl_mls failed. |
| 480 | */ |
| 481 | kfree(skp); |
| 482 | skp = NULL; |
| 483 | freeout: |
| 484 | kfree(smack); |
| 485 | unlockout: |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 486 | mutex_unlock(&smack_known_lock); |
| 487 | |
| 488 | return skp; |
| 489 | } |
| 490 | |
| 491 | /** |
| 492 | * smk_import - import a smack label |
| 493 | * @string: a text string that might be a Smack label |
| 494 | * @len: the maximum size, or zero if it is NULL terminated. |
| 495 | * |
| 496 | * Returns a pointer to the label in the label list that |
| 497 | * matches the passed string, adding it if necessary. |
| 498 | */ |
| 499 | char *smk_import(const char *string, int len) |
| 500 | { |
| 501 | struct smack_known *skp; |
| 502 | |
Etienne Basset | 4303154 | 2009-03-27 17:11:01 -0400 | [diff] [blame] | 503 | /* labels cannot begin with a '-' */ |
| 504 | if (string[0] == '-') |
| 505 | return NULL; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 506 | skp = smk_import_entry(string, len); |
| 507 | if (skp == NULL) |
| 508 | return NULL; |
| 509 | return skp->smk_known; |
| 510 | } |
| 511 | |
| 512 | /** |
| 513 | * smack_from_secid - find the Smack label associated with a secid |
| 514 | * @secid: an integer that might be associated with a Smack label |
| 515 | * |
Lucas De Marchi | 25985ed | 2011-03-30 22:57:33 -0300 | [diff] [blame] | 516 | * Returns a pointer to the appropriate Smack label if there is one, |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 517 | * otherwise a pointer to the invalid Smack label. |
| 518 | */ |
| 519 | char *smack_from_secid(const u32 secid) |
| 520 | { |
| 521 | struct smack_known *skp; |
| 522 | |
Etienne Basset | 7198e2e | 2009-03-24 20:53:24 +0100 | [diff] [blame] | 523 | rcu_read_lock(); |
| 524 | list_for_each_entry_rcu(skp, &smack_known_list, list) { |
| 525 | if (skp->smk_secid == secid) { |
| 526 | rcu_read_unlock(); |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 527 | return skp->smk_known; |
Etienne Basset | 7198e2e | 2009-03-24 20:53:24 +0100 | [diff] [blame] | 528 | } |
| 529 | } |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 530 | |
| 531 | /* |
| 532 | * If we got this far someone asked for the translation |
| 533 | * of a secid that is not on the list. |
| 534 | */ |
Etienne Basset | 7198e2e | 2009-03-24 20:53:24 +0100 | [diff] [blame] | 535 | rcu_read_unlock(); |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 536 | return smack_known_invalid.smk_known; |
| 537 | } |
| 538 | |
| 539 | /** |
| 540 | * smack_to_secid - find the secid associated with a Smack label |
| 541 | * @smack: the Smack label |
| 542 | * |
| 543 | * Returns the appropriate secid if there is one, |
| 544 | * otherwise 0 |
| 545 | */ |
| 546 | u32 smack_to_secid(const char *smack) |
| 547 | { |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 548 | struct smack_known *skp = smk_find_entry(smack); |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 549 | |
Casey Schaufler | f7112e6 | 2012-05-06 15:22:02 -0700 | [diff] [blame] | 550 | if (skp == NULL) |
| 551 | return 0; |
| 552 | return skp->smk_secid; |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 553 | } |