blob: ab167037b2ddcc99b9dc733b69f1243ee65843fb [file] [log] [blame]
Casey Schauflere114e472008-02-04 22:29:50 -08001/*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Authors:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
11 *
12 * Special thanks to the authors of selinuxfs.
13 *
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
16 *
17 */
18
19#include <linux/kernel.h>
20#include <linux/vmalloc.h>
21#include <linux/security.h>
22#include <linux/mutex.h>
Tejun Heo5a0e3ad2010-03-24 17:04:11 +090023#include <linux/slab.h>
Casey Schaufler6d3dc072008-12-31 12:54:12 -050024#include <net/net_namespace.h>
Casey Schauflere114e472008-02-04 22:29:50 -080025#include <net/cipso_ipv4.h>
26#include <linux/seq_file.h>
27#include <linux/ctype.h>
Casey Schaufler4bc87e62008-02-15 15:24:25 -080028#include <linux/audit.h>
Casey Schaufler958d2c22013-04-02 11:41:18 -070029#include <linux/magic.h>
Casey Schauflere114e472008-02-04 22:29:50 -080030#include "smack.h"
31
32/*
33 * smackfs pseudo filesystem.
34 */
35
36enum smk_inos {
37 SMK_ROOT_INO = 2,
38 SMK_LOAD = 3, /* load policy */
39 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
40 SMK_DOI = 5, /* CIPSO DOI */
41 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT = 7, /* internet ambient label */
Casey Schaufler6d3dc072008-12-31 12:54:12 -050043 SMK_NETLBLADDR = 8, /* single label hosts */
Casey Schaufler15446232008-07-30 15:37:11 -070044 SMK_ONLYCAP = 9, /* the only "capable" label */
Etienne Bassetecfcc532009-04-08 20:40:06 +020045 SMK_LOGGING = 10, /* logging */
Casey Schaufler7898e1f2011-01-17 08:05:27 -080046 SMK_LOAD_SELF = 11, /* task specific rules */
Jarkko Sakkinen828716c2011-09-08 10:12:01 +030047 SMK_ACCESSES = 12, /* access policy */
Casey Schauflerf7112e62012-05-06 15:22:02 -070048 SMK_MAPPED = 13, /* CIPSO level indicating mapped label */
49 SMK_LOAD2 = 14, /* load policy with long labels */
50 SMK_LOAD_SELF2 = 15, /* load task specific rules with long labels */
51 SMK_ACCESS2 = 16, /* make an access check with long labels */
52 SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
Rafal Krypa449543b2012-07-11 17:49:30 +020053 SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
Rafal Krypae05b6f92013-01-10 19:42:00 +010054 SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
Casey Schauflere114e472008-02-04 22:29:50 -080055};
56
57/*
58 * List locks
59 */
Casey Schauflere114e472008-02-04 22:29:50 -080060static DEFINE_MUTEX(smack_cipso_lock);
Casey Schaufler4bc87e62008-02-15 15:24:25 -080061static DEFINE_MUTEX(smack_ambient_lock);
Casey Schaufler6d3dc072008-12-31 12:54:12 -050062static DEFINE_MUTEX(smk_netlbladdr_lock);
Casey Schauflere114e472008-02-04 22:29:50 -080063
64/*
65 * This is the "ambient" label for network traffic.
66 * If it isn't somehow marked, use this.
67 * It can be reset via smackfs/ambient
68 */
Casey Schaufler2f823ff2013-05-22 18:43:03 -070069struct smack_known *smack_net_ambient;
Casey Schauflere114e472008-02-04 22:29:50 -080070
71/*
Casey Schauflere114e472008-02-04 22:29:50 -080072 * This is the level in a CIPSO header that indicates a
73 * smack label is contained directly in the category set.
74 * It can be reset via smackfs/direct
75 */
76int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
77
Casey Schaufler15446232008-07-30 15:37:11 -070078/*
Casey Schauflerf7112e62012-05-06 15:22:02 -070079 * This is the level in a CIPSO header that indicates a
80 * secid is contained directly in the category set.
81 * It can be reset via smackfs/mapped
82 */
83int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
84
85/*
Casey Schaufler15446232008-07-30 15:37:11 -070086 * Unless a process is running with this label even
87 * having CAP_MAC_OVERRIDE isn't enough to grant
88 * privilege to violate MAC policy. If no label is
89 * designated (the NULL case) capabilities apply to
90 * everyone. It is expected that the hat (^) label
91 * will be used if any label is used.
92 */
93char *smack_onlycap;
94
Casey Schaufler6d3dc072008-12-31 12:54:12 -050095/*
96 * Certain IP addresses may be designated as single label hosts.
97 * Packets are sent there unlabeled, but only from tasks that
98 * can write to the specified label.
99 */
Etienne Basset7198e2e2009-03-24 20:53:24 +0100100
101LIST_HEAD(smk_netlbladdr_list);
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700102
103/*
104 * Rule lists are maintained for each label.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700105 * This master list is just for reading /smack/load and /smack/load2.
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700106 */
107struct smack_master_list {
108 struct list_head list;
109 struct smack_rule *smk_rule;
110};
111
Etienne Basset7198e2e2009-03-24 20:53:24 +0100112LIST_HEAD(smack_rule_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500113
Rafal Krypae05b6f92013-01-10 19:42:00 +0100114struct smack_parsed_rule {
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700115 struct smack_known *smk_subject;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100116 char *smk_object;
117 int smk_access1;
118 int smk_access2;
119};
120
Casey Schauflere114e472008-02-04 22:29:50 -0800121static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
Casey Schauflere114e472008-02-04 22:29:50 -0800122
Etienne Basset43031542009-03-27 17:11:01 -0400123const char *smack_cipso_option = SMACK_CIPSO_OPTION;
124
Casey Schauflere114e472008-02-04 22:29:50 -0800125/*
Casey Schauflere114e472008-02-04 22:29:50 -0800126 * Values for parsing cipso rules
127 * SMK_DIGITLEN: Length of a digit field in a rule.
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700128 * SMK_CIPSOMIN: Minimum possible cipso rule length.
129 * SMK_CIPSOMAX: Maximum possible cipso rule length.
Casey Schauflere114e472008-02-04 22:29:50 -0800130 */
131#define SMK_DIGITLEN 4
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700132#define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
133#define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
134
135/*
136 * Values for parsing MAC rules
137 * SMK_ACCESS: Maximum possible combination of access permissions
138 * SMK_ACCESSLEN: Maximum length for a rule access field
139 * SMK_LOADLEN: Smack rule length
140 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200141#define SMK_OACCESS "rwxa"
142#define SMK_ACCESS "rwxat"
143#define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
144#define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
145#define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
146#define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
Ahmed S. Darwishb500ce82008-03-13 12:32:34 -0700147
Casey Schauflerf7112e62012-05-06 15:22:02 -0700148/*
149 * Stricly for CIPSO level manipulation.
150 * Set the category bit number in a smack label sized buffer.
151 */
152static inline void smack_catset_bit(unsigned int cat, char *catsetp)
153{
154 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
155 return;
156
157 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
158}
159
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500160/**
161 * smk_netlabel_audit_set - fill a netlbl_audit struct
162 * @nap: structure to fill
163 */
164static void smk_netlabel_audit_set(struct netlbl_audit *nap)
165{
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700166 struct smack_known *skp = smk_of_current();
167
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500168 nap->loginuid = audit_get_loginuid(current);
169 nap->sessionid = audit_get_sessionid(current);
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700170 nap->secid = skp->smk_secid;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500171}
172
173/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700174 * Value for parsing single label host rules
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500175 * "1.2.3.4 X"
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500176 */
177#define SMK_NETLBLADDRMIN 9
Casey Schauflere114e472008-02-04 22:29:50 -0800178
Casey Schauflere114e472008-02-04 22:29:50 -0800179/**
Rafal Krypae05b6f92013-01-10 19:42:00 +0100180 * smk_set_access - add a rule to the rule list or replace an old rule
181 * @srp: the rule to add or replace
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800182 * @rule_list: the list of rules
183 * @rule_lock: the rule list lock
Rafal Krypae05b6f92013-01-10 19:42:00 +0100184 * @global: if non-zero, indicates a global rule
Casey Schauflere114e472008-02-04 22:29:50 -0800185 *
186 * Looks through the current subject/object/access list for
187 * the subject/object pair and replaces the access that was
188 * there. If the pair isn't found add it with the specified
189 * access.
Sergio Luis81ea7142008-12-22 01:16:15 -0300190 *
191 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
192 * during the allocation of the new pair to add.
Casey Schauflere114e472008-02-04 22:29:50 -0800193 */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100194static int smk_set_access(struct smack_parsed_rule *srp,
195 struct list_head *rule_list,
196 struct mutex *rule_lock, int global)
Casey Schauflere114e472008-02-04 22:29:50 -0800197{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100198 struct smack_rule *sp;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100199 struct smack_master_list *smlp;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800200 int found = 0;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100201 int rc = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800202
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800203 mutex_lock(rule_lock);
204
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700205 /*
206 * Because the object label is less likely to match
207 * than the subject label check it first
208 */
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800209 list_for_each_entry_rcu(sp, rule_list, list) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700210 if (sp->smk_object == srp->smk_object &&
211 sp->smk_subject == srp->smk_subject) {
Etienne Basset7198e2e2009-03-24 20:53:24 +0100212 found = 1;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100213 sp->smk_access |= srp->smk_access1;
214 sp->smk_access &= ~srp->smk_access2;
Casey Schauflere114e472008-02-04 22:29:50 -0800215 break;
216 }
Casey Schauflere114e472008-02-04 22:29:50 -0800217 }
218
Rafal Krypae05b6f92013-01-10 19:42:00 +0100219 if (found == 0) {
220 sp = kzalloc(sizeof(*sp), GFP_KERNEL);
221 if (sp == NULL) {
222 rc = -ENOMEM;
223 goto out;
224 }
225
226 sp->smk_subject = srp->smk_subject;
227 sp->smk_object = srp->smk_object;
228 sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
229
230 list_add_rcu(&sp->list, rule_list);
231 /*
232 * If this is a global as opposed to self and a new rule
233 * it needs to get added for reporting.
234 */
235 if (global) {
236 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
237 if (smlp != NULL) {
238 smlp->smk_rule = sp;
239 list_add_rcu(&smlp->list, &smack_rule_list);
240 } else
241 rc = -ENOMEM;
242 }
243 }
244
245out:
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800246 mutex_unlock(rule_lock);
Rafal Krypae05b6f92013-01-10 19:42:00 +0100247 return rc;
248}
Casey Schauflere114e472008-02-04 22:29:50 -0800249
Rafal Krypae05b6f92013-01-10 19:42:00 +0100250/**
251 * smk_perm_from_str - parse smack accesses from a text string
252 * @string: a text string that contains a Smack accesses code
253 *
254 * Returns an integer with respective bits set for specified accesses.
255 */
256static int smk_perm_from_str(const char *string)
257{
258 int perm = 0;
259 const char *cp;
260
261 for (cp = string; ; cp++)
262 switch (*cp) {
263 case '-':
264 break;
265 case 'r':
266 case 'R':
267 perm |= MAY_READ;
268 break;
269 case 'w':
270 case 'W':
271 perm |= MAY_WRITE;
272 break;
273 case 'x':
274 case 'X':
275 perm |= MAY_EXEC;
276 break;
277 case 'a':
278 case 'A':
279 perm |= MAY_APPEND;
280 break;
281 case 't':
282 case 'T':
283 perm |= MAY_TRANSMUTE;
284 break;
285 default:
286 return perm;
287 }
Casey Schauflere114e472008-02-04 22:29:50 -0800288}
289
290/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700291 * smk_fill_rule - Fill Smack rule from strings
292 * @subject: subject label string
293 * @object: object label string
Rafal Krypae05b6f92013-01-10 19:42:00 +0100294 * @access1: access string
295 * @access2: string with permissions to be removed
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300296 * @rule: Smack rule
297 * @import: if non-zero, import labels
Casey Schaufler35187212012-06-18 19:01:36 -0700298 * @len: label length limit
Casey Schauflerf7112e62012-05-06 15:22:02 -0700299 *
300 * Returns 0 on success, -1 on failure
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300301 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700302static int smk_fill_rule(const char *subject, const char *object,
Rafal Krypae05b6f92013-01-10 19:42:00 +0100303 const char *access1, const char *access2,
304 struct smack_parsed_rule *rule, int import,
305 int len)
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300306{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700307 const char *cp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300308 struct smack_known *skp;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300309
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300310 if (import) {
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700311 rule->smk_subject = smk_import_entry(subject, len);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300312 if (rule->smk_subject == NULL)
313 return -1;
314
Casey Schaufler35187212012-06-18 19:01:36 -0700315 rule->smk_object = smk_import(object, len);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300316 if (rule->smk_object == NULL)
317 return -1;
318 } else {
Casey Schaufler35187212012-06-18 19:01:36 -0700319 cp = smk_parse_smack(subject, len);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700320 if (cp == NULL)
321 return -1;
322 skp = smk_find_entry(cp);
323 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300324 if (skp == NULL)
325 return -1;
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700326 rule->smk_subject = skp;
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300327
Casey Schaufler35187212012-06-18 19:01:36 -0700328 cp = smk_parse_smack(object, len);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700329 if (cp == NULL)
330 return -1;
331 skp = smk_find_entry(cp);
332 kfree(cp);
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +0300333 if (skp == NULL)
334 return -1;
335 rule->smk_object = skp->smk_known;
336 }
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300337
Rafal Krypae05b6f92013-01-10 19:42:00 +0100338 rule->smk_access1 = smk_perm_from_str(access1);
339 if (access2)
340 rule->smk_access2 = smk_perm_from_str(access2);
341 else
342 rule->smk_access2 = ~rule->smk_access1;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300343
Casey Schaufler35187212012-06-18 19:01:36 -0700344 return 0;
Jarkko Sakkinen828716c2011-09-08 10:12:01 +0300345}
346
347/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700348 * smk_parse_rule - parse Smack rule from load string
349 * @data: string to be parsed whose size is SMK_LOADLEN
350 * @rule: Smack rule
351 * @import: if non-zero, import labels
352 *
353 * Returns 0 on success, -1 on errors.
354 */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100355static int smk_parse_rule(const char *data, struct smack_parsed_rule *rule,
356 int import)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700357{
358 int rc;
359
360 rc = smk_fill_rule(data, data + SMK_LABELLEN,
Rafal Krypae05b6f92013-01-10 19:42:00 +0100361 data + SMK_LABELLEN + SMK_LABELLEN, NULL, rule,
362 import, SMK_LABELLEN);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700363 return rc;
364}
365
366/**
367 * smk_parse_long_rule - parse Smack rule from rule string
368 * @data: string to be parsed, null terminated
Rafal Krypae05b6f92013-01-10 19:42:00 +0100369 * @rule: Will be filled with Smack parsed rule
Casey Schauflerf7112e62012-05-06 15:22:02 -0700370 * @import: if non-zero, import labels
Rafal Krypae05b6f92013-01-10 19:42:00 +0100371 * @change: if non-zero, data is from /smack/change-rule
Casey Schauflerf7112e62012-05-06 15:22:02 -0700372 *
373 * Returns 0 on success, -1 on failure
374 */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100375static int smk_parse_long_rule(const char *data, struct smack_parsed_rule *rule,
376 int import, int change)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700377{
378 char *subject;
379 char *object;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100380 char *access1;
381 char *access2;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700382 int datalen;
383 int rc = -1;
384
Alan Cox3b9fc372012-07-26 14:47:11 -0700385 /* This is inefficient */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700386 datalen = strlen(data);
Alan Cox3b9fc372012-07-26 14:47:11 -0700387
388 /* Our first element can be 64 + \0 with no spaces */
389 subject = kzalloc(datalen + 1, GFP_KERNEL);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700390 if (subject == NULL)
391 return -1;
392 object = kzalloc(datalen, GFP_KERNEL);
393 if (object == NULL)
394 goto free_out_s;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100395 access1 = kzalloc(datalen, GFP_KERNEL);
396 if (access1 == NULL)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700397 goto free_out_o;
Rafal Krypae05b6f92013-01-10 19:42:00 +0100398 access2 = kzalloc(datalen, GFP_KERNEL);
399 if (access2 == NULL)
400 goto free_out_a;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700401
Rafal Krypae05b6f92013-01-10 19:42:00 +0100402 if (change) {
403 if (sscanf(data, "%s %s %s %s",
404 subject, object, access1, access2) == 4)
405 rc = smk_fill_rule(subject, object, access1, access2,
406 rule, import, 0);
407 } else {
408 if (sscanf(data, "%s %s %s", subject, object, access1) == 3)
409 rc = smk_fill_rule(subject, object, access1, NULL,
410 rule, import, 0);
411 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700412
Rafal Krypae05b6f92013-01-10 19:42:00 +0100413 kfree(access2);
414free_out_a:
415 kfree(access1);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700416free_out_o:
417 kfree(object);
418free_out_s:
419 kfree(subject);
420 return rc;
421}
422
423#define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
424#define SMK_LONG_FMT 1 /* Variable long label format */
Rafal Krypae05b6f92013-01-10 19:42:00 +0100425#define SMK_CHANGE_FMT 2 /* Rule modification format */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700426/**
427 * smk_write_rules_list - write() for any /smack rule file
Randy Dunlap251a2a92009-02-18 11:42:33 -0800428 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800429 * @buf: where to get the data from
430 * @count: bytes sent
431 * @ppos: where to start - must be 0
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800432 * @rule_list: the list of rules to write to
433 * @rule_lock: lock for the rule list
Rafal Krypae05b6f92013-01-10 19:42:00 +0100434 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
Casey Schauflere114e472008-02-04 22:29:50 -0800435 *
436 * Get one smack access rule from above.
Casey Schauflerf7112e62012-05-06 15:22:02 -0700437 * The format for SMK_LONG_FMT is:
438 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
439 * The format for SMK_FIXED24_FMT is exactly:
440 * "subject object rwxat"
Rafal Krypae05b6f92013-01-10 19:42:00 +0100441 * The format for SMK_CHANGE_FMT is:
442 * "subject<whitespace>object<whitespace>
443 * acc_enable<whitespace>acc_disable[<whitespace>...]"
Casey Schauflere114e472008-02-04 22:29:50 -0800444 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700445static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
446 size_t count, loff_t *ppos,
447 struct list_head *rule_list,
448 struct mutex *rule_lock, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800449{
Rafal Krypae05b6f92013-01-10 19:42:00 +0100450 struct smack_parsed_rule *rule;
Casey Schauflere114e472008-02-04 22:29:50 -0800451 char *data;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700452 int datalen;
Casey Schauflere114e472008-02-04 22:29:50 -0800453 int rc = -EINVAL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700454 int load = 0;
Casey Schauflere114e472008-02-04 22:29:50 -0800455
456 /*
Casey Schauflere114e472008-02-04 22:29:50 -0800457 * No partial writes.
458 * Enough data must be present.
459 */
Jarkko Sakkinen5c6d1122010-12-07 13:34:01 +0200460 if (*ppos != 0)
461 return -EINVAL;
Casey Schauflere114e472008-02-04 22:29:50 -0800462
Casey Schauflerf7112e62012-05-06 15:22:02 -0700463 if (format == SMK_FIXED24_FMT) {
464 /*
465 * Minor hack for backward compatibility
466 */
467 if (count != SMK_OLOADLEN && count != SMK_LOADLEN)
468 return -EINVAL;
469 datalen = SMK_LOADLEN;
470 } else
471 datalen = count + 1;
472
473 data = kzalloc(datalen, GFP_KERNEL);
Casey Schauflere114e472008-02-04 22:29:50 -0800474 if (data == NULL)
475 return -ENOMEM;
476
477 if (copy_from_user(data, buf, count) != 0) {
478 rc = -EFAULT;
479 goto out;
480 }
481
Etienne Basset7198e2e2009-03-24 20:53:24 +0100482 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
483 if (rule == NULL) {
484 rc = -ENOMEM;
Casey Schauflere114e472008-02-04 22:29:50 -0800485 goto out;
Etienne Basset7198e2e2009-03-24 20:53:24 +0100486 }
Casey Schauflere114e472008-02-04 22:29:50 -0800487
Casey Schauflerf7112e62012-05-06 15:22:02 -0700488 if (format == SMK_LONG_FMT) {
489 /*
490 * Be sure the data string is terminated.
491 */
492 data[count] = '\0';
Rafal Krypae05b6f92013-01-10 19:42:00 +0100493 if (smk_parse_long_rule(data, rule, 1, 0))
494 goto out_free_rule;
495 } else if (format == SMK_CHANGE_FMT) {
496 data[count] = '\0';
497 if (smk_parse_long_rule(data, rule, 1, 1))
Casey Schauflerf7112e62012-05-06 15:22:02 -0700498 goto out_free_rule;
499 } else {
500 /*
501 * More on the minor hack for backward compatibility
502 */
503 if (count == (SMK_OLOADLEN))
504 data[SMK_OLOADLEN] = '-';
505 if (smk_parse_rule(data, rule, 1))
506 goto out_free_rule;
507 }
508
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700509 if (rule_list == NULL) {
510 load = 1;
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700511 rule_list = &rule->smk_subject->smk_rules;
512 rule_lock = &rule->smk_subject->smk_rules_lock;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700513 }
514
Rafal Krypae05b6f92013-01-10 19:42:00 +0100515 rc = smk_set_access(rule, rule_list, rule_lock, load);
516 if (rc == 0) {
517 rc = count;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800518 goto out;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700519 }
Casey Schauflere114e472008-02-04 22:29:50 -0800520
Etienne Basset7198e2e2009-03-24 20:53:24 +0100521out_free_rule:
522 kfree(rule);
Casey Schauflere114e472008-02-04 22:29:50 -0800523out:
524 kfree(data);
525 return rc;
526}
527
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800528/*
Casey Schaufler40809562011-11-10 15:02:22 -0800529 * Core logic for smackfs seq list operations.
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800530 */
531
Casey Schaufler40809562011-11-10 15:02:22 -0800532static void *smk_seq_start(struct seq_file *s, loff_t *pos,
533 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800534{
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700535 struct list_head *list;
536
537 /*
538 * This is 0 the first time through.
539 */
540 if (s->index == 0)
Casey Schaufler40809562011-11-10 15:02:22 -0800541 s->private = head;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700542
543 if (s->private == NULL)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800544 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700545
546 list = s->private;
547 if (list_empty(list))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800548 return NULL;
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700549
550 if (s->index == 0)
551 return list->next;
552 return list;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800553}
554
Casey Schaufler40809562011-11-10 15:02:22 -0800555static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
556 struct list_head *head)
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800557{
558 struct list_head *list = v;
559
Casey Schaufler40809562011-11-10 15:02:22 -0800560 if (list_is_last(list, head)) {
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700561 s->private = NULL;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800562 return NULL;
563 }
Casey Schaufler272cd7a2011-09-20 12:24:36 -0700564 s->private = list->next;
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800565 return list->next;
566}
567
Casey Schaufler40809562011-11-10 15:02:22 -0800568static void smk_seq_stop(struct seq_file *s, void *v)
569{
570 /* No-op */
571}
572
Casey Schauflerf7112e62012-05-06 15:22:02 -0700573static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
Casey Schaufler40809562011-11-10 15:02:22 -0800574{
Casey Schauflerf7112e62012-05-06 15:22:02 -0700575 /*
576 * Don't show any rules with label names too long for
577 * interface file (/smack/load or /smack/load2)
578 * because you should expect to be able to write
579 * anything you read back.
580 */
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700581 if (strlen(srp->smk_subject->smk_known) >= max ||
582 strlen(srp->smk_object) >= max)
Casey Schauflerf7112e62012-05-06 15:22:02 -0700583 return;
Casey Schaufler40809562011-11-10 15:02:22 -0800584
Rafal Krypa65ee7f42012-07-09 19:36:34 +0200585 if (srp->smk_access == 0)
586 return;
587
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700588 seq_printf(s, "%s %s", srp->smk_subject->smk_known, srp->smk_object);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800589
590 seq_putc(s, ' ');
591
592 if (srp->smk_access & MAY_READ)
593 seq_putc(s, 'r');
594 if (srp->smk_access & MAY_WRITE)
595 seq_putc(s, 'w');
596 if (srp->smk_access & MAY_EXEC)
597 seq_putc(s, 'x');
598 if (srp->smk_access & MAY_APPEND)
599 seq_putc(s, 'a');
600 if (srp->smk_access & MAY_TRANSMUTE)
601 seq_putc(s, 't');
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800602
603 seq_putc(s, '\n');
Casey Schauflerf7112e62012-05-06 15:22:02 -0700604}
605
606/*
607 * Seq_file read operations for /smack/load
608 */
609
610static void *load2_seq_start(struct seq_file *s, loff_t *pos)
611{
612 return smk_seq_start(s, pos, &smack_rule_list);
613}
614
615static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
616{
617 return smk_seq_next(s, v, pos, &smack_rule_list);
618}
619
620static int load_seq_show(struct seq_file *s, void *v)
621{
622 struct list_head *list = v;
623 struct smack_master_list *smlp =
624 list_entry(list, struct smack_master_list, list);
625
626 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800627
628 return 0;
629}
630
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800631static const struct seq_operations load_seq_ops = {
Casey Schauflerf7112e62012-05-06 15:22:02 -0700632 .start = load2_seq_start,
633 .next = load2_seq_next,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800634 .show = load_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800635 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800636};
637
638/**
639 * smk_open_load - open() for /smack/load
640 * @inode: inode structure representing file
641 * @file: "load" file pointer
642 *
643 * For reading, use load_seq_* seq_file reading operations.
644 */
645static int smk_open_load(struct inode *inode, struct file *file)
646{
647 return seq_open(file, &load_seq_ops);
648}
649
650/**
651 * smk_write_load - write() for /smack/load
652 * @file: file pointer, not actually used
653 * @buf: where to get the data from
654 * @count: bytes sent
655 * @ppos: where to start - must be 0
656 *
657 */
658static ssize_t smk_write_load(struct file *file, const char __user *buf,
659 size_t count, loff_t *ppos)
660{
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800661 /*
662 * Must have privilege.
663 * No partial writes.
664 * Enough data must be present.
665 */
Casey Schaufler1880eff2012-06-05 15:28:30 -0700666 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800667 return -EPERM;
668
Casey Schauflerf7112e62012-05-06 15:22:02 -0700669 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
670 SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -0800671}
672
Casey Schauflere114e472008-02-04 22:29:50 -0800673static const struct file_operations smk_load_ops = {
674 .open = smk_open_load,
675 .read = seq_read,
676 .llseek = seq_lseek,
677 .write = smk_write_load,
Ahmed S. Darwishcb622bb2008-03-24 12:29:49 -0700678 .release = seq_release,
Casey Schauflere114e472008-02-04 22:29:50 -0800679};
680
681/**
682 * smk_cipso_doi - initialize the CIPSO domain
683 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700684static void smk_cipso_doi(void)
Casey Schauflere114e472008-02-04 22:29:50 -0800685{
686 int rc;
687 struct cipso_v4_doi *doip;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500688 struct netlbl_audit nai;
Casey Schauflere114e472008-02-04 22:29:50 -0800689
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500690 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800691
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500692 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
Casey Schauflere114e472008-02-04 22:29:50 -0800693 if (rc != 0)
694 printk(KERN_WARNING "%s:%d remove rc = %d\n",
695 __func__, __LINE__, rc);
696
697 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
698 if (doip == NULL)
699 panic("smack: Failed to initialize cipso DOI.\n");
700 doip->map.std = NULL;
701 doip->doi = smk_cipso_doi_value;
702 doip->type = CIPSO_V4_MAP_PASS;
703 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
704 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
705 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
706
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500707 rc = netlbl_cfg_cipsov4_add(doip, &nai);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400708 if (rc != 0) {
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500709 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
Casey Schauflere114e472008-02-04 22:29:50 -0800710 __func__, __LINE__, rc);
Paul Mooreb1edeb12008-10-10 10:16:31 -0400711 kfree(doip);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500712 return;
713 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500714 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
Paul Moore6c2e8ac2008-12-31 12:54:11 -0500715 if (rc != 0) {
716 printk(KERN_WARNING "%s:%d map add rc = %d\n",
717 __func__, __LINE__, rc);
718 kfree(doip);
719 return;
Paul Mooreb1edeb12008-10-10 10:16:31 -0400720 }
Casey Schauflere114e472008-02-04 22:29:50 -0800721}
722
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800723/**
724 * smk_unlbl_ambient - initialize the unlabeled domain
Randy Dunlap251a2a92009-02-18 11:42:33 -0800725 * @oldambient: previous domain string
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800726 */
Casey Schaufler30aa4fa2008-04-28 02:13:43 -0700727static void smk_unlbl_ambient(char *oldambient)
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800728{
729 int rc;
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500730 struct netlbl_audit nai;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800731
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500732 smk_netlabel_audit_set(&nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800733
734 if (oldambient != NULL) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500735 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800736 if (rc != 0)
737 printk(KERN_WARNING "%s:%d remove rc = %d\n",
738 __func__, __LINE__, rc);
739 }
Casey Schauflerf7112e62012-05-06 15:22:02 -0700740 if (smack_net_ambient == NULL)
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700741 smack_net_ambient = &smack_known_floor;
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800742
Casey Schaufler2f823ff2013-05-22 18:43:03 -0700743 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient->smk_known, PF_INET,
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500744 NULL, NULL, &nai);
Casey Schaufler4bc87e62008-02-15 15:24:25 -0800745 if (rc != 0)
746 printk(KERN_WARNING "%s:%d add rc = %d\n",
747 __func__, __LINE__, rc);
748}
749
Casey Schauflere114e472008-02-04 22:29:50 -0800750/*
751 * Seq_file read operations for /smack/cipso
752 */
753
754static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
755{
Casey Schaufler40809562011-11-10 15:02:22 -0800756 return smk_seq_start(s, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800757}
758
759static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
760{
Casey Schaufler40809562011-11-10 15:02:22 -0800761 return smk_seq_next(s, v, pos, &smack_known_list);
Casey Schauflere114e472008-02-04 22:29:50 -0800762}
763
764/*
765 * Print cipso labels in format:
766 * label level[/cat[,cat]]
767 */
768static int cipso_seq_show(struct seq_file *s, void *v)
769{
Etienne Basset7198e2e2009-03-24 20:53:24 +0100770 struct list_head *list = v;
771 struct smack_known *skp =
772 list_entry(list, struct smack_known, list);
Casey Schauflerf7112e62012-05-06 15:22:02 -0700773 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800774 char sep = '/';
Casey Schauflere114e472008-02-04 22:29:50 -0800775 int i;
Casey Schauflere114e472008-02-04 22:29:50 -0800776
Casey Schauflerf7112e62012-05-06 15:22:02 -0700777 /*
778 * Don't show a label that could not have been set using
779 * /smack/cipso. This is in support of the notion that
780 * anything read from /smack/cipso ought to be writeable
781 * to /smack/cipso.
782 *
783 * /smack/cipso2 should be used instead.
784 */
785 if (strlen(skp->smk_known) >= SMK_LABELLEN)
Casey Schauflere114e472008-02-04 22:29:50 -0800786 return 0;
787
Casey Schauflerf7112e62012-05-06 15:22:02 -0700788 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
Casey Schauflere114e472008-02-04 22:29:50 -0800789
Casey Schauflerf7112e62012-05-06 15:22:02 -0700790 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
791 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
792 seq_printf(s, "%c%d", sep, i);
793 sep = ',';
794 }
Casey Schauflere114e472008-02-04 22:29:50 -0800795
796 seq_putc(s, '\n');
797
798 return 0;
799}
800
James Morris88e9d342009-09-22 16:43:43 -0700801static const struct seq_operations cipso_seq_ops = {
Casey Schauflere114e472008-02-04 22:29:50 -0800802 .start = cipso_seq_start,
Casey Schauflere114e472008-02-04 22:29:50 -0800803 .next = cipso_seq_next,
804 .show = cipso_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -0800805 .stop = smk_seq_stop,
Casey Schauflere114e472008-02-04 22:29:50 -0800806};
807
808/**
809 * smk_open_cipso - open() for /smack/cipso
810 * @inode: inode structure representing file
811 * @file: "cipso" file pointer
812 *
813 * Connect our cipso_seq_* operations with /smack/cipso
814 * file_operations
815 */
816static int smk_open_cipso(struct inode *inode, struct file *file)
817{
818 return seq_open(file, &cipso_seq_ops);
819}
820
821/**
Casey Schauflerf7112e62012-05-06 15:22:02 -0700822 * smk_set_cipso - do the work for write() for cipso and cipso2
Randy Dunlap251a2a92009-02-18 11:42:33 -0800823 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -0800824 * @buf: where to get the data from
825 * @count: bytes sent
826 * @ppos: where to start
Casey Schauflerf7112e62012-05-06 15:22:02 -0700827 * @format: /smack/cipso or /smack/cipso2
Casey Schauflere114e472008-02-04 22:29:50 -0800828 *
829 * Accepts only one cipso rule per write call.
830 * Returns number of bytes written or error code, as appropriate
831 */
Casey Schauflerf7112e62012-05-06 15:22:02 -0700832static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
833 size_t count, loff_t *ppos, int format)
Casey Schauflere114e472008-02-04 22:29:50 -0800834{
835 struct smack_known *skp;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700836 struct netlbl_lsm_secattr ncats;
837 char mapcatset[SMK_CIPSOLEN];
Casey Schauflere114e472008-02-04 22:29:50 -0800838 int maplevel;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700839 unsigned int cat;
Casey Schauflere114e472008-02-04 22:29:50 -0800840 int catlen;
841 ssize_t rc = -EINVAL;
842 char *data = NULL;
843 char *rule;
844 int ret;
845 int i;
846
847 /*
848 * Must have privilege.
849 * No partial writes.
850 * Enough data must be present.
851 */
Casey Schaufler1880eff2012-06-05 15:28:30 -0700852 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -0800853 return -EPERM;
854 if (*ppos != 0)
855 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700856 if (format == SMK_FIXED24_FMT &&
857 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
Casey Schauflere114e472008-02-04 22:29:50 -0800858 return -EINVAL;
859
860 data = kzalloc(count + 1, GFP_KERNEL);
861 if (data == NULL)
862 return -ENOMEM;
863
864 if (copy_from_user(data, buf, count) != 0) {
865 rc = -EFAULT;
866 goto unlockedout;
867 }
868
869 data[count] = '\0';
870 rule = data;
871 /*
872 * Only allow one writer at a time. Writes should be
873 * quite rare and small in any case.
874 */
875 mutex_lock(&smack_cipso_lock);
876
877 skp = smk_import_entry(rule, 0);
878 if (skp == NULL)
879 goto out;
880
Casey Schauflerf7112e62012-05-06 15:22:02 -0700881 if (format == SMK_FIXED24_FMT)
882 rule += SMK_LABELLEN;
883 else
Passion,Zhao0fcfee62013-06-03 11:42:24 +0800884 rule += strlen(skp->smk_known) + 1;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700885
Casey Schauflere114e472008-02-04 22:29:50 -0800886 ret = sscanf(rule, "%d", &maplevel);
887 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
888 goto out;
889
890 rule += SMK_DIGITLEN;
891 ret = sscanf(rule, "%d", &catlen);
892 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
893 goto out;
894
Casey Schauflerf7112e62012-05-06 15:22:02 -0700895 if (format == SMK_FIXED24_FMT &&
896 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
Casey Schauflere114e472008-02-04 22:29:50 -0800897 goto out;
898
899 memset(mapcatset, 0, sizeof(mapcatset));
900
901 for (i = 0; i < catlen; i++) {
902 rule += SMK_DIGITLEN;
Casey Schauflerf7112e62012-05-06 15:22:02 -0700903 ret = sscanf(rule, "%u", &cat);
Casey Schauflere114e472008-02-04 22:29:50 -0800904 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
905 goto out;
906
907 smack_catset_bit(cat, mapcatset);
908 }
909
Casey Schauflerf7112e62012-05-06 15:22:02 -0700910 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
911 if (rc >= 0) {
912 netlbl_secattr_catmap_free(skp->smk_netlabel.attr.mls.cat);
913 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
914 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
915 rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -0800916 }
917
Casey Schauflere114e472008-02-04 22:29:50 -0800918out:
919 mutex_unlock(&smack_cipso_lock);
920unlockedout:
921 kfree(data);
922 return rc;
923}
924
Casey Schauflerf7112e62012-05-06 15:22:02 -0700925/**
926 * smk_write_cipso - write() for /smack/cipso
927 * @file: file pointer, not actually used
928 * @buf: where to get the data from
929 * @count: bytes sent
930 * @ppos: where to start
931 *
932 * Accepts only one cipso rule per write call.
933 * Returns number of bytes written or error code, as appropriate
934 */
935static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
936 size_t count, loff_t *ppos)
937{
938 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
939}
940
Casey Schauflere114e472008-02-04 22:29:50 -0800941static const struct file_operations smk_cipso_ops = {
942 .open = smk_open_cipso,
943 .read = seq_read,
944 .llseek = seq_lseek,
945 .write = smk_write_cipso,
946 .release = seq_release,
947};
948
Casey Schaufler6d3dc072008-12-31 12:54:12 -0500949/*
Casey Schauflerf7112e62012-05-06 15:22:02 -0700950 * Seq_file read operations for /smack/cipso2
951 */
952
953/*
954 * Print cipso labels in format:
955 * label level[/cat[,cat]]
956 */
957static int cipso2_seq_show(struct seq_file *s, void *v)
958{
959 struct list_head *list = v;
960 struct smack_known *skp =
961 list_entry(list, struct smack_known, list);
962 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
963 char sep = '/';
964 int i;
965
966 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
967
968 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
969 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
970 seq_printf(s, "%c%d", sep, i);
971 sep = ',';
972 }
973
974 seq_putc(s, '\n');
975
976 return 0;
977}
978
979static const struct seq_operations cipso2_seq_ops = {
980 .start = cipso_seq_start,
981 .next = cipso_seq_next,
982 .show = cipso2_seq_show,
983 .stop = smk_seq_stop,
984};
985
986/**
987 * smk_open_cipso2 - open() for /smack/cipso2
988 * @inode: inode structure representing file
989 * @file: "cipso2" file pointer
990 *
991 * Connect our cipso_seq_* operations with /smack/cipso2
992 * file_operations
993 */
994static int smk_open_cipso2(struct inode *inode, struct file *file)
995{
996 return seq_open(file, &cipso2_seq_ops);
997}
998
999/**
1000 * smk_write_cipso2 - write() for /smack/cipso2
1001 * @file: file pointer, not actually used
1002 * @buf: where to get the data from
1003 * @count: bytes sent
1004 * @ppos: where to start
1005 *
1006 * Accepts only one cipso rule per write call.
1007 * Returns number of bytes written or error code, as appropriate
1008 */
1009static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
1010 size_t count, loff_t *ppos)
1011{
1012 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
1013}
1014
1015static const struct file_operations smk_cipso2_ops = {
1016 .open = smk_open_cipso2,
1017 .read = seq_read,
1018 .llseek = seq_lseek,
1019 .write = smk_write_cipso2,
1020 .release = seq_release,
1021};
1022
1023/*
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001024 * Seq_file read operations for /smack/netlabel
1025 */
1026
1027static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
1028{
Casey Schaufler40809562011-11-10 15:02:22 -08001029 return smk_seq_start(s, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001030}
1031
1032static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
1033{
Casey Schaufler40809562011-11-10 15:02:22 -08001034 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001035}
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001036#define BEBITS (sizeof(__be32) * 8)
1037
1038/*
1039 * Print host/label pairs
1040 */
1041static int netlbladdr_seq_show(struct seq_file *s, void *v)
1042{
Etienne Basset7198e2e2009-03-24 20:53:24 +01001043 struct list_head *list = v;
1044 struct smk_netlbladdr *skp =
1045 list_entry(list, struct smk_netlbladdr, list);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001046 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +01001047 int maskn;
1048 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001049
etienne113a0e42009-03-04 07:33:51 +01001050 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001051
1052 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1053 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
1054
1055 return 0;
1056}
1057
James Morris88e9d342009-09-22 16:43:43 -07001058static const struct seq_operations netlbladdr_seq_ops = {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001059 .start = netlbladdr_seq_start,
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001060 .next = netlbladdr_seq_next,
1061 .show = netlbladdr_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001062 .stop = smk_seq_stop,
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001063};
1064
1065/**
1066 * smk_open_netlbladdr - open() for /smack/netlabel
1067 * @inode: inode structure representing file
1068 * @file: "netlabel" file pointer
1069 *
1070 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1071 * file_operations
1072 */
1073static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1074{
1075 return seq_open(file, &netlbladdr_seq_ops);
1076}
1077
1078/**
etienne113a0e42009-03-04 07:33:51 +01001079 * smk_netlbladdr_insert
1080 * @new : netlabel to insert
1081 *
1082 * This helper insert netlabel in the smack_netlbladdrs list
1083 * sorted by netmask length (longest to smallest)
Etienne Basset7198e2e2009-03-24 20:53:24 +01001084 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1085 *
etienne113a0e42009-03-04 07:33:51 +01001086 */
1087static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1088{
Etienne Basset7198e2e2009-03-24 20:53:24 +01001089 struct smk_netlbladdr *m, *m_next;
etienne113a0e42009-03-04 07:33:51 +01001090
Etienne Basset7198e2e2009-03-24 20:53:24 +01001091 if (list_empty(&smk_netlbladdr_list)) {
1092 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001093 return;
1094 }
1095
Jiri Pirko05725f72009-04-14 20:17:16 +02001096 m = list_entry_rcu(smk_netlbladdr_list.next,
1097 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001098
etienne113a0e42009-03-04 07:33:51 +01001099 /* the comparison '>' is a bit hacky, but works */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001100 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1101 list_add_rcu(&new->list, &smk_netlbladdr_list);
etienne113a0e42009-03-04 07:33:51 +01001102 return;
1103 }
Etienne Basset7198e2e2009-03-24 20:53:24 +01001104
1105 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1106 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1107 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001108 return;
1109 }
Jiri Pirko05725f72009-04-14 20:17:16 +02001110 m_next = list_entry_rcu(m->list.next,
1111 struct smk_netlbladdr, list);
Etienne Basset7198e2e2009-03-24 20:53:24 +01001112 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1113 list_add_rcu(&new->list, &m->list);
etienne113a0e42009-03-04 07:33:51 +01001114 return;
1115 }
1116 }
1117}
1118
1119
1120/**
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001121 * smk_write_netlbladdr - write() for /smack/netlabel
Randy Dunlap251a2a92009-02-18 11:42:33 -08001122 * @file: file pointer, not actually used
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001123 * @buf: where to get the data from
1124 * @count: bytes sent
1125 * @ppos: where to start
1126 *
1127 * Accepts only one netlbladdr per write call.
1128 * Returns number of bytes written or error code, as appropriate
1129 */
1130static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1131 size_t count, loff_t *ppos)
1132{
1133 struct smk_netlbladdr *skp;
1134 struct sockaddr_in newname;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001135 char *smack;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001136 char *sp;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001137 char *data;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001138 char *host = (char *)&newname.sin_addr.s_addr;
1139 int rc;
1140 struct netlbl_audit audit_info;
1141 struct in_addr mask;
1142 unsigned int m;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001143 int found;
etienne113a0e42009-03-04 07:33:51 +01001144 u32 mask_bits = (1<<31);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001145 __be32 nsa;
etienne113a0e42009-03-04 07:33:51 +01001146 u32 temp_mask;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001147
1148 /*
1149 * Must have privilege.
1150 * No partial writes.
1151 * Enough data must be present.
1152 * "<addr/mask, as a.b.c.d/e><space><label>"
1153 * "<addr, as a.b.c.d><space><label>"
1154 */
Casey Schaufler1880eff2012-06-05 15:28:30 -07001155 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001156 return -EPERM;
1157 if (*ppos != 0)
1158 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001159 if (count < SMK_NETLBLADDRMIN)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001160 return -EINVAL;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001161
1162 data = kzalloc(count + 1, GFP_KERNEL);
1163 if (data == NULL)
1164 return -ENOMEM;
1165
1166 if (copy_from_user(data, buf, count) != 0) {
1167 rc = -EFAULT;
1168 goto free_data_out;
1169 }
1170
1171 smack = kzalloc(count + 1, GFP_KERNEL);
1172 if (smack == NULL) {
1173 rc = -ENOMEM;
1174 goto free_data_out;
1175 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001176
1177 data[count] = '\0';
1178
1179 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
1180 &host[0], &host[1], &host[2], &host[3], &m, smack);
1181 if (rc != 6) {
1182 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1183 &host[0], &host[1], &host[2], &host[3], smack);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001184 if (rc != 5) {
1185 rc = -EINVAL;
1186 goto free_out;
1187 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001188 m = BEBITS;
1189 }
Casey Schauflerf7112e62012-05-06 15:22:02 -07001190 if (m > BEBITS) {
1191 rc = -EINVAL;
1192 goto free_out;
1193 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001194
Casey Schauflerf7112e62012-05-06 15:22:02 -07001195 /*
1196 * If smack begins with '-', it is an option, don't import it
1197 */
Etienne Basset43031542009-03-27 17:11:01 -04001198 if (smack[0] != '-') {
1199 sp = smk_import(smack, 0);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001200 if (sp == NULL) {
1201 rc = -EINVAL;
1202 goto free_out;
1203 }
Etienne Basset43031542009-03-27 17:11:01 -04001204 } else {
1205 /* check known options */
1206 if (strcmp(smack, smack_cipso_option) == 0)
1207 sp = (char *)smack_cipso_option;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001208 else {
1209 rc = -EINVAL;
1210 goto free_out;
1211 }
Etienne Basset43031542009-03-27 17:11:01 -04001212 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001213
etienne113a0e42009-03-04 07:33:51 +01001214 for (temp_mask = 0; m > 0; m--) {
1215 temp_mask |= mask_bits;
1216 mask_bits >>= 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001217 }
etienne113a0e42009-03-04 07:33:51 +01001218 mask.s_addr = cpu_to_be32(temp_mask);
1219
1220 newname.sin_addr.s_addr &= mask.s_addr;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001221 /*
1222 * Only allow one writer at a time. Writes should be
1223 * quite rare and small in any case.
1224 */
1225 mutex_lock(&smk_netlbladdr_lock);
1226
1227 nsa = newname.sin_addr.s_addr;
etienne113a0e42009-03-04 07:33:51 +01001228 /* try to find if the prefix is already in the list */
Etienne Basset7198e2e2009-03-24 20:53:24 +01001229 found = 0;
1230 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001231 if (skp->smk_host.sin_addr.s_addr == nsa &&
Etienne Basset7198e2e2009-03-24 20:53:24 +01001232 skp->smk_mask.s_addr == mask.s_addr) {
1233 found = 1;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001234 break;
Etienne Basset7198e2e2009-03-24 20:53:24 +01001235 }
1236 }
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001237 smk_netlabel_audit_set(&audit_info);
1238
Etienne Basset7198e2e2009-03-24 20:53:24 +01001239 if (found == 0) {
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001240 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
1241 if (skp == NULL)
1242 rc = -ENOMEM;
1243 else {
1244 rc = 0;
1245 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1246 skp->smk_mask.s_addr = mask.s_addr;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001247 skp->smk_label = sp;
etienne113a0e42009-03-04 07:33:51 +01001248 smk_netlbladdr_insert(skp);
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001249 }
1250 } else {
Etienne Basset43031542009-03-27 17:11:01 -04001251 /* we delete the unlabeled entry, only if the previous label
Lucas De Marchi25985ed2011-03-30 22:57:33 -03001252 * wasn't the special CIPSO option */
Etienne Basset43031542009-03-27 17:11:01 -04001253 if (skp->smk_label != smack_cipso_option)
1254 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1255 &skp->smk_host.sin_addr, &skp->smk_mask,
1256 PF_INET, &audit_info);
1257 else
1258 rc = 0;
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001259 skp->smk_label = sp;
1260 }
1261
1262 /*
1263 * Now tell netlabel about the single label nature of
1264 * this host so that incoming packets get labeled.
Etienne Basset43031542009-03-27 17:11:01 -04001265 * but only if we didn't get the special CIPSO option
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001266 */
Etienne Basset43031542009-03-27 17:11:01 -04001267 if (rc == 0 && sp != smack_cipso_option)
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001268 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1269 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
1270 smack_to_secid(skp->smk_label), &audit_info);
1271
1272 if (rc == 0)
1273 rc = count;
1274
1275 mutex_unlock(&smk_netlbladdr_lock);
1276
Casey Schauflerf7112e62012-05-06 15:22:02 -07001277free_out:
1278 kfree(smack);
1279free_data_out:
1280 kfree(data);
1281
Casey Schaufler6d3dc072008-12-31 12:54:12 -05001282 return rc;
1283}
1284
1285static const struct file_operations smk_netlbladdr_ops = {
1286 .open = smk_open_netlbladdr,
1287 .read = seq_read,
1288 .llseek = seq_lseek,
1289 .write = smk_write_netlbladdr,
1290 .release = seq_release,
1291};
1292
Casey Schauflere114e472008-02-04 22:29:50 -08001293/**
1294 * smk_read_doi - read() for /smack/doi
1295 * @filp: file pointer, not actually used
1296 * @buf: where to put the result
1297 * @count: maximum to send along
1298 * @ppos: where to start
1299 *
1300 * Returns number of bytes read or error code, as appropriate
1301 */
1302static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1303 size_t count, loff_t *ppos)
1304{
1305 char temp[80];
1306 ssize_t rc;
1307
1308 if (*ppos != 0)
1309 return 0;
1310
1311 sprintf(temp, "%d", smk_cipso_doi_value);
1312 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1313
1314 return rc;
1315}
1316
1317/**
1318 * smk_write_doi - write() for /smack/doi
Randy Dunlap251a2a92009-02-18 11:42:33 -08001319 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001320 * @buf: where to get the data from
1321 * @count: bytes sent
1322 * @ppos: where to start
1323 *
1324 * Returns number of bytes written or error code, as appropriate
1325 */
1326static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1327 size_t count, loff_t *ppos)
1328{
1329 char temp[80];
1330 int i;
1331
Casey Schaufler1880eff2012-06-05 15:28:30 -07001332 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001333 return -EPERM;
1334
1335 if (count >= sizeof(temp) || count == 0)
1336 return -EINVAL;
1337
1338 if (copy_from_user(temp, buf, count) != 0)
1339 return -EFAULT;
1340
1341 temp[count] = '\0';
1342
1343 if (sscanf(temp, "%d", &i) != 1)
1344 return -EINVAL;
1345
1346 smk_cipso_doi_value = i;
1347
1348 smk_cipso_doi();
1349
1350 return count;
1351}
1352
1353static const struct file_operations smk_doi_ops = {
1354 .read = smk_read_doi,
1355 .write = smk_write_doi,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001356 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001357};
1358
1359/**
1360 * smk_read_direct - read() for /smack/direct
1361 * @filp: file pointer, not actually used
1362 * @buf: where to put the result
1363 * @count: maximum to send along
1364 * @ppos: where to start
1365 *
1366 * Returns number of bytes read or error code, as appropriate
1367 */
1368static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1369 size_t count, loff_t *ppos)
1370{
1371 char temp[80];
1372 ssize_t rc;
1373
1374 if (*ppos != 0)
1375 return 0;
1376
1377 sprintf(temp, "%d", smack_cipso_direct);
1378 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1379
1380 return rc;
1381}
1382
1383/**
1384 * smk_write_direct - write() for /smack/direct
Randy Dunlap251a2a92009-02-18 11:42:33 -08001385 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001386 * @buf: where to get the data from
1387 * @count: bytes sent
1388 * @ppos: where to start
1389 *
1390 * Returns number of bytes written or error code, as appropriate
1391 */
1392static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1393 size_t count, loff_t *ppos)
1394{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001395 struct smack_known *skp;
Casey Schauflere114e472008-02-04 22:29:50 -08001396 char temp[80];
1397 int i;
1398
Casey Schaufler1880eff2012-06-05 15:28:30 -07001399 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001400 return -EPERM;
1401
1402 if (count >= sizeof(temp) || count == 0)
1403 return -EINVAL;
1404
1405 if (copy_from_user(temp, buf, count) != 0)
1406 return -EFAULT;
1407
1408 temp[count] = '\0';
1409
1410 if (sscanf(temp, "%d", &i) != 1)
1411 return -EINVAL;
1412
Casey Schauflerf7112e62012-05-06 15:22:02 -07001413 /*
1414 * Don't do anything if the value hasn't actually changed.
1415 * If it is changing reset the level on entries that were
1416 * set up to be direct when they were created.
1417 */
1418 if (smack_cipso_direct != i) {
1419 mutex_lock(&smack_known_lock);
1420 list_for_each_entry_rcu(skp, &smack_known_list, list)
1421 if (skp->smk_netlabel.attr.mls.lvl ==
1422 smack_cipso_direct)
1423 skp->smk_netlabel.attr.mls.lvl = i;
1424 smack_cipso_direct = i;
1425 mutex_unlock(&smack_known_lock);
1426 }
Casey Schauflere114e472008-02-04 22:29:50 -08001427
1428 return count;
1429}
1430
1431static const struct file_operations smk_direct_ops = {
1432 .read = smk_read_direct,
1433 .write = smk_write_direct,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001434 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001435};
1436
1437/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001438 * smk_read_mapped - read() for /smack/mapped
1439 * @filp: file pointer, not actually used
1440 * @buf: where to put the result
1441 * @count: maximum to send along
1442 * @ppos: where to start
1443 *
1444 * Returns number of bytes read or error code, as appropriate
1445 */
1446static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1447 size_t count, loff_t *ppos)
1448{
1449 char temp[80];
1450 ssize_t rc;
1451
1452 if (*ppos != 0)
1453 return 0;
1454
1455 sprintf(temp, "%d", smack_cipso_mapped);
1456 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1457
1458 return rc;
1459}
1460
1461/**
1462 * smk_write_mapped - write() for /smack/mapped
1463 * @file: file pointer, not actually used
1464 * @buf: where to get the data from
1465 * @count: bytes sent
1466 * @ppos: where to start
1467 *
1468 * Returns number of bytes written or error code, as appropriate
1469 */
1470static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1471 size_t count, loff_t *ppos)
1472{
1473 struct smack_known *skp;
1474 char temp[80];
1475 int i;
1476
Casey Schaufler1880eff2012-06-05 15:28:30 -07001477 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflerf7112e62012-05-06 15:22:02 -07001478 return -EPERM;
1479
1480 if (count >= sizeof(temp) || count == 0)
1481 return -EINVAL;
1482
1483 if (copy_from_user(temp, buf, count) != 0)
1484 return -EFAULT;
1485
1486 temp[count] = '\0';
1487
1488 if (sscanf(temp, "%d", &i) != 1)
1489 return -EINVAL;
1490
1491 /*
1492 * Don't do anything if the value hasn't actually changed.
1493 * If it is changing reset the level on entries that were
1494 * set up to be mapped when they were created.
1495 */
1496 if (smack_cipso_mapped != i) {
1497 mutex_lock(&smack_known_lock);
1498 list_for_each_entry_rcu(skp, &smack_known_list, list)
1499 if (skp->smk_netlabel.attr.mls.lvl ==
1500 smack_cipso_mapped)
1501 skp->smk_netlabel.attr.mls.lvl = i;
1502 smack_cipso_mapped = i;
1503 mutex_unlock(&smack_known_lock);
1504 }
1505
1506 return count;
1507}
1508
1509static const struct file_operations smk_mapped_ops = {
1510 .read = smk_read_mapped,
1511 .write = smk_write_mapped,
1512 .llseek = default_llseek,
1513};
1514
1515/**
Casey Schauflere114e472008-02-04 22:29:50 -08001516 * smk_read_ambient - read() for /smack/ambient
1517 * @filp: file pointer, not actually used
1518 * @buf: where to put the result
1519 * @cn: maximum to send along
1520 * @ppos: where to start
1521 *
1522 * Returns number of bytes read or error code, as appropriate
1523 */
1524static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1525 size_t cn, loff_t *ppos)
1526{
1527 ssize_t rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001528 int asize;
1529
1530 if (*ppos != 0)
1531 return 0;
1532 /*
1533 * Being careful to avoid a problem in the case where
1534 * smack_net_ambient gets changed in midstream.
Casey Schauflere114e472008-02-04 22:29:50 -08001535 */
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001536 mutex_lock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001537
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001538 asize = strlen(smack_net_ambient->smk_known) + 1;
Casey Schauflere114e472008-02-04 22:29:50 -08001539
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001540 if (cn >= asize)
1541 rc = simple_read_from_buffer(buf, cn, ppos,
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001542 smack_net_ambient->smk_known,
1543 asize);
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001544 else
1545 rc = -EINVAL;
1546
1547 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001548
1549 return rc;
1550}
1551
1552/**
1553 * smk_write_ambient - write() for /smack/ambient
Randy Dunlap251a2a92009-02-18 11:42:33 -08001554 * @file: file pointer, not actually used
Casey Schauflere114e472008-02-04 22:29:50 -08001555 * @buf: where to get the data from
1556 * @count: bytes sent
1557 * @ppos: where to start
1558 *
1559 * Returns number of bytes written or error code, as appropriate
1560 */
1561static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1562 size_t count, loff_t *ppos)
1563{
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001564 struct smack_known *skp;
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001565 char *oldambient;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001566 char *data;
1567 int rc = count;
Casey Schauflere114e472008-02-04 22:29:50 -08001568
Casey Schaufler1880eff2012-06-05 15:28:30 -07001569 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflere114e472008-02-04 22:29:50 -08001570 return -EPERM;
1571
Casey Schauflerf7112e62012-05-06 15:22:02 -07001572 data = kzalloc(count + 1, GFP_KERNEL);
1573 if (data == NULL)
1574 return -ENOMEM;
Casey Schauflere114e472008-02-04 22:29:50 -08001575
Casey Schauflerf7112e62012-05-06 15:22:02 -07001576 if (copy_from_user(data, buf, count) != 0) {
1577 rc = -EFAULT;
1578 goto out;
1579 }
Casey Schauflere114e472008-02-04 22:29:50 -08001580
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001581 skp = smk_import_entry(data, count);
1582 if (skp == NULL) {
Casey Schauflerf7112e62012-05-06 15:22:02 -07001583 rc = -EINVAL;
1584 goto out;
1585 }
Casey Schauflere114e472008-02-04 22:29:50 -08001586
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001587 mutex_lock(&smack_ambient_lock);
1588
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001589 oldambient = smack_net_ambient->smk_known;
1590 smack_net_ambient = skp;
Casey Schaufler4bc87e62008-02-15 15:24:25 -08001591 smk_unlbl_ambient(oldambient);
1592
1593 mutex_unlock(&smack_ambient_lock);
Casey Schauflere114e472008-02-04 22:29:50 -08001594
Casey Schauflerf7112e62012-05-06 15:22:02 -07001595out:
1596 kfree(data);
1597 return rc;
Casey Schauflere114e472008-02-04 22:29:50 -08001598}
1599
1600static const struct file_operations smk_ambient_ops = {
1601 .read = smk_read_ambient,
1602 .write = smk_write_ambient,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001603 .llseek = default_llseek,
Casey Schauflere114e472008-02-04 22:29:50 -08001604};
1605
Casey Schaufler15446232008-07-30 15:37:11 -07001606/**
1607 * smk_read_onlycap - read() for /smack/onlycap
1608 * @filp: file pointer, not actually used
1609 * @buf: where to put the result
1610 * @cn: maximum to send along
1611 * @ppos: where to start
1612 *
1613 * Returns number of bytes read or error code, as appropriate
1614 */
1615static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1616 size_t cn, loff_t *ppos)
1617{
1618 char *smack = "";
1619 ssize_t rc = -EINVAL;
1620 int asize;
1621
1622 if (*ppos != 0)
1623 return 0;
1624
1625 if (smack_onlycap != NULL)
1626 smack = smack_onlycap;
1627
1628 asize = strlen(smack) + 1;
1629
1630 if (cn >= asize)
1631 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1632
1633 return rc;
1634}
1635
1636/**
1637 * smk_write_onlycap - write() for /smack/onlycap
Randy Dunlap251a2a92009-02-18 11:42:33 -08001638 * @file: file pointer, not actually used
Casey Schaufler15446232008-07-30 15:37:11 -07001639 * @buf: where to get the data from
1640 * @count: bytes sent
1641 * @ppos: where to start
1642 *
1643 * Returns number of bytes written or error code, as appropriate
1644 */
1645static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1646 size_t count, loff_t *ppos)
1647{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001648 char *data;
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001649 struct smack_known *skp = smk_of_task(current->cred->security);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001650 int rc = count;
Casey Schaufler15446232008-07-30 15:37:11 -07001651
Casey Schaufler1880eff2012-06-05 15:28:30 -07001652 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schaufler15446232008-07-30 15:37:11 -07001653 return -EPERM;
1654
1655 /*
1656 * This can be done using smk_access() but is done
1657 * explicitly for clarity. The smk_access() implementation
1658 * would use smk_access(smack_onlycap, MAY_WRITE)
1659 */
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001660 if (smack_onlycap != NULL && smack_onlycap != skp->smk_known)
Casey Schaufler15446232008-07-30 15:37:11 -07001661 return -EPERM;
1662
Casey Schauflerf7112e62012-05-06 15:22:02 -07001663 data = kzalloc(count, GFP_KERNEL);
1664 if (data == NULL)
1665 return -ENOMEM;
Casey Schaufler15446232008-07-30 15:37:11 -07001666
1667 /*
1668 * Should the null string be passed in unset the onlycap value.
1669 * This seems like something to be careful with as usually
1670 * smk_import only expects to return NULL for errors. It
1671 * is usually the case that a nullstring or "\n" would be
1672 * bad to pass to smk_import but in fact this is useful here.
Casey Schauflerf7112e62012-05-06 15:22:02 -07001673 *
1674 * smk_import will also reject a label beginning with '-',
1675 * so "-usecapabilities" will also work.
Casey Schaufler15446232008-07-30 15:37:11 -07001676 */
Casey Schauflerf7112e62012-05-06 15:22:02 -07001677 if (copy_from_user(data, buf, count) != 0)
1678 rc = -EFAULT;
1679 else
1680 smack_onlycap = smk_import(data, count);
Casey Schaufler15446232008-07-30 15:37:11 -07001681
Casey Schauflerf7112e62012-05-06 15:22:02 -07001682 kfree(data);
1683 return rc;
Casey Schaufler15446232008-07-30 15:37:11 -07001684}
1685
1686static const struct file_operations smk_onlycap_ops = {
1687 .read = smk_read_onlycap,
1688 .write = smk_write_onlycap,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001689 .llseek = default_llseek,
Casey Schaufler15446232008-07-30 15:37:11 -07001690};
1691
Casey Schauflere114e472008-02-04 22:29:50 -08001692/**
Etienne Bassetecfcc532009-04-08 20:40:06 +02001693 * smk_read_logging - read() for /smack/logging
1694 * @filp: file pointer, not actually used
1695 * @buf: where to put the result
1696 * @cn: maximum to send along
1697 * @ppos: where to start
1698 *
1699 * Returns number of bytes read or error code, as appropriate
1700 */
1701static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1702 size_t count, loff_t *ppos)
1703{
1704 char temp[32];
1705 ssize_t rc;
1706
1707 if (*ppos != 0)
1708 return 0;
1709
1710 sprintf(temp, "%d\n", log_policy);
1711 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1712 return rc;
1713}
1714
1715/**
1716 * smk_write_logging - write() for /smack/logging
1717 * @file: file pointer, not actually used
1718 * @buf: where to get the data from
1719 * @count: bytes sent
1720 * @ppos: where to start
1721 *
1722 * Returns number of bytes written or error code, as appropriate
1723 */
1724static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1725 size_t count, loff_t *ppos)
1726{
1727 char temp[32];
1728 int i;
1729
Casey Schaufler1880eff2012-06-05 15:28:30 -07001730 if (!smack_privileged(CAP_MAC_ADMIN))
Etienne Bassetecfcc532009-04-08 20:40:06 +02001731 return -EPERM;
1732
1733 if (count >= sizeof(temp) || count == 0)
1734 return -EINVAL;
1735
1736 if (copy_from_user(temp, buf, count) != 0)
1737 return -EFAULT;
1738
1739 temp[count] = '\0';
1740
1741 if (sscanf(temp, "%d", &i) != 1)
1742 return -EINVAL;
1743 if (i < 0 || i > 3)
1744 return -EINVAL;
1745 log_policy = i;
1746 return count;
1747}
1748
1749
1750
1751static const struct file_operations smk_logging_ops = {
1752 .read = smk_read_logging,
1753 .write = smk_write_logging,
Arnd Bergmann6038f372010-08-15 18:52:59 +02001754 .llseek = default_llseek,
Etienne Bassetecfcc532009-04-08 20:40:06 +02001755};
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001756
1757/*
1758 * Seq_file read operations for /smack/load-self
1759 */
1760
1761static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1762{
1763 struct task_smack *tsp = current_security();
1764
Casey Schaufler40809562011-11-10 15:02:22 -08001765 return smk_seq_start(s, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001766}
1767
1768static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1769{
1770 struct task_smack *tsp = current_security();
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001771
Casey Schaufler40809562011-11-10 15:02:22 -08001772 return smk_seq_next(s, v, pos, &tsp->smk_rules);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001773}
1774
1775static int load_self_seq_show(struct seq_file *s, void *v)
1776{
1777 struct list_head *list = v;
1778 struct smack_rule *srp =
1779 list_entry(list, struct smack_rule, list);
1780
Casey Schauflerf7112e62012-05-06 15:22:02 -07001781 smk_rule_show(s, srp, SMK_LABELLEN);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001782
1783 return 0;
1784}
1785
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001786static const struct seq_operations load_self_seq_ops = {
1787 .start = load_self_seq_start,
1788 .next = load_self_seq_next,
1789 .show = load_self_seq_show,
Casey Schaufler40809562011-11-10 15:02:22 -08001790 .stop = smk_seq_stop,
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001791};
1792
1793
1794/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001795 * smk_open_load_self - open() for /smack/load-self2
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001796 * @inode: inode structure representing file
1797 * @file: "load" file pointer
1798 *
1799 * For reading, use load_seq_* seq_file reading operations.
1800 */
1801static int smk_open_load_self(struct inode *inode, struct file *file)
1802{
1803 return seq_open(file, &load_self_seq_ops);
1804}
1805
1806/**
1807 * smk_write_load_self - write() for /smack/load-self
1808 * @file: file pointer, not actually used
1809 * @buf: where to get the data from
1810 * @count: bytes sent
1811 * @ppos: where to start - must be 0
1812 *
1813 */
1814static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1815 size_t count, loff_t *ppos)
1816{
1817 struct task_smack *tsp = current_security();
1818
Casey Schauflerf7112e62012-05-06 15:22:02 -07001819 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1820 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
Casey Schaufler7898e1f2011-01-17 08:05:27 -08001821}
1822
1823static const struct file_operations smk_load_self_ops = {
1824 .open = smk_open_load_self,
1825 .read = seq_read,
1826 .llseek = seq_lseek,
1827 .write = smk_write_load_self,
1828 .release = seq_release,
1829};
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001830
1831/**
Casey Schauflerf7112e62012-05-06 15:22:02 -07001832 * smk_user_access - handle access check transaction
1833 * @file: file pointer
1834 * @buf: data from user space
1835 * @count: bytes sent
1836 * @ppos: where to start - must be 0
1837 */
1838static ssize_t smk_user_access(struct file *file, const char __user *buf,
1839 size_t count, loff_t *ppos, int format)
1840{
Rafal Krypae05b6f92013-01-10 19:42:00 +01001841 struct smack_parsed_rule rule;
Casey Schauflerf7112e62012-05-06 15:22:02 -07001842 char *data;
1843 char *cod;
1844 int res;
1845
1846 data = simple_transaction_get(file, buf, count);
1847 if (IS_ERR(data))
1848 return PTR_ERR(data);
1849
1850 if (format == SMK_FIXED24_FMT) {
1851 if (count < SMK_LOADLEN)
1852 return -EINVAL;
1853 res = smk_parse_rule(data, &rule, 0);
1854 } else {
1855 /*
1856 * Copy the data to make sure the string is terminated.
1857 */
1858 cod = kzalloc(count + 1, GFP_KERNEL);
1859 if (cod == NULL)
1860 return -ENOMEM;
1861 memcpy(cod, data, count);
1862 cod[count] = '\0';
Rafal Krypae05b6f92013-01-10 19:42:00 +01001863 res = smk_parse_long_rule(cod, &rule, 0, 0);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001864 kfree(cod);
1865 }
1866
1867 if (res)
1868 return -EINVAL;
1869
Casey Schaufler2f823ff2013-05-22 18:43:03 -07001870 res = smk_access(rule.smk_subject, rule.smk_object,
1871 rule.smk_access1, NULL);
Casey Schauflerf7112e62012-05-06 15:22:02 -07001872 data[0] = res == 0 ? '1' : '0';
1873 data[1] = '\0';
1874
1875 simple_transaction_set(file, 2);
1876
1877 if (format == SMK_FIXED24_FMT)
1878 return SMK_LOADLEN;
1879 return count;
1880}
1881
1882/**
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001883 * smk_write_access - handle access check transaction
1884 * @file: file pointer
1885 * @buf: data from user space
1886 * @count: bytes sent
1887 * @ppos: where to start - must be 0
1888 */
1889static ssize_t smk_write_access(struct file *file, const char __user *buf,
1890 size_t count, loff_t *ppos)
1891{
Casey Schauflerf7112e62012-05-06 15:22:02 -07001892 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03001893}
1894
1895static const struct file_operations smk_access_ops = {
1896 .write = smk_write_access,
1897 .read = simple_transaction_read,
1898 .release = simple_transaction_release,
1899 .llseek = generic_file_llseek,
1900};
1901
Casey Schauflerf7112e62012-05-06 15:22:02 -07001902
1903/*
1904 * Seq_file read operations for /smack/load2
1905 */
1906
1907static int load2_seq_show(struct seq_file *s, void *v)
1908{
1909 struct list_head *list = v;
1910 struct smack_master_list *smlp =
1911 list_entry(list, struct smack_master_list, list);
1912
1913 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1914
1915 return 0;
1916}
1917
1918static const struct seq_operations load2_seq_ops = {
1919 .start = load2_seq_start,
1920 .next = load2_seq_next,
1921 .show = load2_seq_show,
1922 .stop = smk_seq_stop,
1923};
1924
1925/**
1926 * smk_open_load2 - open() for /smack/load2
1927 * @inode: inode structure representing file
1928 * @file: "load2" file pointer
1929 *
1930 * For reading, use load2_seq_* seq_file reading operations.
1931 */
1932static int smk_open_load2(struct inode *inode, struct file *file)
1933{
1934 return seq_open(file, &load2_seq_ops);
1935}
1936
1937/**
1938 * smk_write_load2 - write() for /smack/load2
1939 * @file: file pointer, not actually used
1940 * @buf: where to get the data from
1941 * @count: bytes sent
1942 * @ppos: where to start - must be 0
1943 *
1944 */
1945static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1946 size_t count, loff_t *ppos)
1947{
1948 /*
1949 * Must have privilege.
1950 */
Casey Schaufler1880eff2012-06-05 15:28:30 -07001951 if (!smack_privileged(CAP_MAC_ADMIN))
Casey Schauflerf7112e62012-05-06 15:22:02 -07001952 return -EPERM;
1953
1954 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1955 SMK_LONG_FMT);
1956}
1957
1958static const struct file_operations smk_load2_ops = {
1959 .open = smk_open_load2,
1960 .read = seq_read,
1961 .llseek = seq_lseek,
1962 .write = smk_write_load2,
1963 .release = seq_release,
1964};
1965
1966/*
1967 * Seq_file read operations for /smack/load-self2
1968 */
1969
1970static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1971{
1972 struct task_smack *tsp = current_security();
1973
1974 return smk_seq_start(s, pos, &tsp->smk_rules);
1975}
1976
1977static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
1978{
1979 struct task_smack *tsp = current_security();
1980
1981 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1982}
1983
1984static int load_self2_seq_show(struct seq_file *s, void *v)
1985{
1986 struct list_head *list = v;
1987 struct smack_rule *srp =
1988 list_entry(list, struct smack_rule, list);
1989
1990 smk_rule_show(s, srp, SMK_LONGLABEL);
1991
1992 return 0;
1993}
1994
1995static const struct seq_operations load_self2_seq_ops = {
1996 .start = load_self2_seq_start,
1997 .next = load_self2_seq_next,
1998 .show = load_self2_seq_show,
1999 .stop = smk_seq_stop,
2000};
2001
2002/**
2003 * smk_open_load_self2 - open() for /smack/load-self2
2004 * @inode: inode structure representing file
2005 * @file: "load" file pointer
2006 *
2007 * For reading, use load_seq_* seq_file reading operations.
2008 */
2009static int smk_open_load_self2(struct inode *inode, struct file *file)
2010{
2011 return seq_open(file, &load_self2_seq_ops);
2012}
2013
2014/**
2015 * smk_write_load_self2 - write() for /smack/load-self2
2016 * @file: file pointer, not actually used
2017 * @buf: where to get the data from
2018 * @count: bytes sent
2019 * @ppos: where to start - must be 0
2020 *
2021 */
2022static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
2023 size_t count, loff_t *ppos)
2024{
2025 struct task_smack *tsp = current_security();
2026
2027 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
2028 &tsp->smk_rules_lock, SMK_LONG_FMT);
2029}
2030
2031static const struct file_operations smk_load_self2_ops = {
2032 .open = smk_open_load_self2,
2033 .read = seq_read,
2034 .llseek = seq_lseek,
2035 .write = smk_write_load_self2,
2036 .release = seq_release,
2037};
2038
2039/**
2040 * smk_write_access2 - handle access check transaction
2041 * @file: file pointer
2042 * @buf: data from user space
2043 * @count: bytes sent
2044 * @ppos: where to start - must be 0
2045 */
2046static ssize_t smk_write_access2(struct file *file, const char __user *buf,
2047 size_t count, loff_t *ppos)
2048{
2049 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
2050}
2051
2052static const struct file_operations smk_access2_ops = {
2053 .write = smk_write_access2,
2054 .read = simple_transaction_read,
2055 .release = simple_transaction_release,
2056 .llseek = generic_file_llseek,
2057};
2058
Etienne Bassetecfcc532009-04-08 20:40:06 +02002059/**
Rafal Krypa449543b2012-07-11 17:49:30 +02002060 * smk_write_revoke_subj - write() for /smack/revoke-subject
2061 * @file: file pointer
2062 * @buf: data from user space
2063 * @count: bytes sent
2064 * @ppos: where to start - must be 0
2065 */
2066static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
2067 size_t count, loff_t *ppos)
2068{
2069 char *data = NULL;
2070 const char *cp = NULL;
2071 struct smack_known *skp;
2072 struct smack_rule *sp;
2073 struct list_head *rule_list;
2074 struct mutex *rule_lock;
2075 int rc = count;
2076
2077 if (*ppos != 0)
2078 return -EINVAL;
2079
2080 if (!smack_privileged(CAP_MAC_ADMIN))
2081 return -EPERM;
2082
2083 if (count == 0 || count > SMK_LONGLABEL)
2084 return -EINVAL;
2085
2086 data = kzalloc(count, GFP_KERNEL);
2087 if (data == NULL)
2088 return -ENOMEM;
2089
2090 if (copy_from_user(data, buf, count) != 0) {
2091 rc = -EFAULT;
2092 goto free_out;
2093 }
2094
2095 cp = smk_parse_smack(data, count);
2096 if (cp == NULL) {
2097 rc = -EINVAL;
2098 goto free_out;
2099 }
2100
2101 skp = smk_find_entry(cp);
Rafal Krypad15d9fad2012-11-27 16:28:11 +01002102 if (skp == NULL)
Rafal Krypa449543b2012-07-11 17:49:30 +02002103 goto free_out;
Rafal Krypa449543b2012-07-11 17:49:30 +02002104
2105 rule_list = &skp->smk_rules;
2106 rule_lock = &skp->smk_rules_lock;
2107
2108 mutex_lock(rule_lock);
2109
2110 list_for_each_entry_rcu(sp, rule_list, list)
2111 sp->smk_access = 0;
2112
2113 mutex_unlock(rule_lock);
2114
2115free_out:
2116 kfree(data);
2117 kfree(cp);
2118 return rc;
2119}
2120
2121static const struct file_operations smk_revoke_subj_ops = {
2122 .write = smk_write_revoke_subj,
2123 .read = simple_transaction_read,
2124 .release = simple_transaction_release,
2125 .llseek = generic_file_llseek,
2126};
2127
Casey Schauflere9307232012-11-01 18:14:32 -07002128static struct kset *smackfs_kset;
2129/**
2130 * smk_init_sysfs - initialize /sys/fs/smackfs
2131 *
2132 */
2133static int smk_init_sysfs(void)
2134{
2135 smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
2136 if (!smackfs_kset)
2137 return -ENOMEM;
2138 return 0;
2139}
2140
Rafal Krypa449543b2012-07-11 17:49:30 +02002141/**
Rafal Krypae05b6f92013-01-10 19:42:00 +01002142 * smk_write_change_rule - write() for /smack/change-rule
2143 * @file: file pointer
2144 * @buf: data from user space
2145 * @count: bytes sent
2146 * @ppos: where to start - must be 0
2147 */
2148static ssize_t smk_write_change_rule(struct file *file, const char __user *buf,
2149 size_t count, loff_t *ppos)
2150{
2151 /*
2152 * Must have privilege.
2153 */
2154 if (!capable(CAP_MAC_ADMIN))
2155 return -EPERM;
2156
2157 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
2158 SMK_CHANGE_FMT);
2159}
2160
2161static const struct file_operations smk_change_rule_ops = {
2162 .write = smk_write_change_rule,
2163 .read = simple_transaction_read,
2164 .release = simple_transaction_release,
2165 .llseek = generic_file_llseek,
2166};
2167
2168/**
Casey Schauflere114e472008-02-04 22:29:50 -08002169 * smk_fill_super - fill the /smackfs superblock
2170 * @sb: the empty superblock
2171 * @data: unused
2172 * @silent: unused
2173 *
2174 * Fill in the well known entries for /smack
2175 *
2176 * Returns 0 on success, an error code on failure
2177 */
2178static int smk_fill_super(struct super_block *sb, void *data, int silent)
2179{
2180 int rc;
2181 struct inode *root_inode;
2182
2183 static struct tree_descr smack_files[] = {
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002184 [SMK_LOAD] = {
2185 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2186 [SMK_CIPSO] = {
2187 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2188 [SMK_DOI] = {
2189 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2190 [SMK_DIRECT] = {
2191 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2192 [SMK_AMBIENT] = {
2193 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2194 [SMK_NETLBLADDR] = {
2195 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2196 [SMK_ONLYCAP] = {
2197 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2198 [SMK_LOGGING] = {
2199 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2200 [SMK_LOAD_SELF] = {
2201 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
Jarkko Sakkinen828716c2011-09-08 10:12:01 +03002202 [SMK_ACCESSES] = {
Jarkko Sakkinen0e94ae12011-10-18 21:21:36 +03002203 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
Casey Schauflerf7112e62012-05-06 15:22:02 -07002204 [SMK_MAPPED] = {
2205 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2206 [SMK_LOAD2] = {
2207 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2208 [SMK_LOAD_SELF2] = {
2209 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2210 [SMK_ACCESS2] = {
2211 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2212 [SMK_CIPSO2] = {
2213 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
Rafal Krypa449543b2012-07-11 17:49:30 +02002214 [SMK_REVOKE_SUBJ] = {
2215 "revoke-subject", &smk_revoke_subj_ops,
2216 S_IRUGO|S_IWUSR},
Rafal Krypae05b6f92013-01-10 19:42:00 +01002217 [SMK_CHANGE_RULE] = {
2218 "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
Casey Schaufler7898e1f2011-01-17 08:05:27 -08002219 /* last one */
2220 {""}
Casey Schauflere114e472008-02-04 22:29:50 -08002221 };
2222
2223 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2224 if (rc != 0) {
2225 printk(KERN_ERR "%s failed %d while creating inodes\n",
2226 __func__, rc);
2227 return rc;
2228 }
2229
2230 root_inode = sb->s_root->d_inode;
Casey Schauflere114e472008-02-04 22:29:50 -08002231
2232 return 0;
2233}
2234
2235/**
Al Virofc14f2f2010-07-25 01:48:30 +04002236 * smk_mount - get the smackfs superblock
Casey Schauflere114e472008-02-04 22:29:50 -08002237 * @fs_type: passed along without comment
2238 * @flags: passed along without comment
2239 * @dev_name: passed along without comment
2240 * @data: passed along without comment
Casey Schauflere114e472008-02-04 22:29:50 -08002241 *
2242 * Just passes everything along.
2243 *
2244 * Returns what the lower level code does.
2245 */
Al Virofc14f2f2010-07-25 01:48:30 +04002246static struct dentry *smk_mount(struct file_system_type *fs_type,
2247 int flags, const char *dev_name, void *data)
Casey Schauflere114e472008-02-04 22:29:50 -08002248{
Al Virofc14f2f2010-07-25 01:48:30 +04002249 return mount_single(fs_type, flags, data, smk_fill_super);
Casey Schauflere114e472008-02-04 22:29:50 -08002250}
2251
2252static struct file_system_type smk_fs_type = {
2253 .name = "smackfs",
Al Virofc14f2f2010-07-25 01:48:30 +04002254 .mount = smk_mount,
Casey Schauflere114e472008-02-04 22:29:50 -08002255 .kill_sb = kill_litter_super,
2256};
2257
2258static struct vfsmount *smackfs_mount;
2259
Casey Schauflerf7112e62012-05-06 15:22:02 -07002260static int __init smk_preset_netlabel(struct smack_known *skp)
2261{
2262 skp->smk_netlabel.domain = skp->smk_known;
2263 skp->smk_netlabel.flags =
2264 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2265 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2266 &skp->smk_netlabel, strlen(skp->smk_known));
2267}
2268
Casey Schauflere114e472008-02-04 22:29:50 -08002269/**
2270 * init_smk_fs - get the smackfs superblock
2271 *
2272 * register the smackfs
2273 *
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002274 * Do not register smackfs if Smack wasn't enabled
2275 * on boot. We can not put this method normally under the
2276 * smack_init() code path since the security subsystem get
2277 * initialized before the vfs caches.
2278 *
2279 * Returns true if we were not chosen on boot or if
2280 * we were chosen and filesystem registration succeeded.
Casey Schauflere114e472008-02-04 22:29:50 -08002281 */
2282static int __init init_smk_fs(void)
2283{
2284 int err;
Casey Schauflerf7112e62012-05-06 15:22:02 -07002285 int rc;
Casey Schauflere114e472008-02-04 22:29:50 -08002286
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02002287 if (!security_module_enable(&smack_ops))
2288 return 0;
2289
Casey Schauflere9307232012-11-01 18:14:32 -07002290 err = smk_init_sysfs();
2291 if (err)
2292 printk(KERN_ERR "smackfs: sysfs mountpoint problem.\n");
2293
Casey Schauflere114e472008-02-04 22:29:50 -08002294 err = register_filesystem(&smk_fs_type);
2295 if (!err) {
2296 smackfs_mount = kern_mount(&smk_fs_type);
2297 if (IS_ERR(smackfs_mount)) {
2298 printk(KERN_ERR "smackfs: could not mount!\n");
2299 err = PTR_ERR(smackfs_mount);
2300 smackfs_mount = NULL;
2301 }
2302 }
2303
Casey Schauflere114e472008-02-04 22:29:50 -08002304 smk_cipso_doi();
Casey Schaufler4bc87e62008-02-15 15:24:25 -08002305 smk_unlbl_ambient(NULL);
Casey Schauflere114e472008-02-04 22:29:50 -08002306
Casey Schauflerf7112e62012-05-06 15:22:02 -07002307 rc = smk_preset_netlabel(&smack_known_floor);
2308 if (err == 0 && rc < 0)
2309 err = rc;
2310 rc = smk_preset_netlabel(&smack_known_hat);
2311 if (err == 0 && rc < 0)
2312 err = rc;
2313 rc = smk_preset_netlabel(&smack_known_huh);
2314 if (err == 0 && rc < 0)
2315 err = rc;
2316 rc = smk_preset_netlabel(&smack_known_invalid);
2317 if (err == 0 && rc < 0)
2318 err = rc;
2319 rc = smk_preset_netlabel(&smack_known_star);
2320 if (err == 0 && rc < 0)
2321 err = rc;
2322 rc = smk_preset_netlabel(&smack_known_web);
2323 if (err == 0 && rc < 0)
2324 err = rc;
2325
Casey Schauflere114e472008-02-04 22:29:50 -08002326 return err;
2327}
2328
2329__initcall(init_smk_fs);