2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
29 #include <linux/magic.h>
33 * smackfs pseudo filesystem.
38 SMK_LOAD = 3, /* load policy */
39 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
40 SMK_DOI = 5, /* CIPSO DOI */
41 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
42 SMK_AMBIENT = 7, /* internet ambient label */
43 SMK_NETLBLADDR = 8, /* single label hosts */
44 SMK_ONLYCAP = 9, /* the only "capable" label */
45 SMK_LOGGING = 10, /* logging */
46 SMK_LOAD_SELF = 11, /* task specific rules */
47 SMK_ACCESSES = 12, /* access policy */
48 SMK_MAPPED = 13, /* CIPSO level indicating mapped label */
49 SMK_LOAD2 = 14, /* load policy with long labels */
50 SMK_LOAD_SELF2 = 15, /* load task specific rules with long labels */
51 SMK_ACCESS2 = 16, /* make an access check with long labels */
52 SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
53 SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
54 SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
55 SMK_SYSLOG = 20, /* change syslog label) */
56 SMK_PTRACE = 21, /* set ptrace rule */
62 static DEFINE_MUTEX(smack_cipso_lock);
63 static DEFINE_MUTEX(smack_ambient_lock);
64 static DEFINE_MUTEX(smack_syslog_lock);
65 static DEFINE_MUTEX(smk_netlbladdr_lock);
68 * This is the "ambient" label for network traffic.
69 * If it isn't somehow marked, use this.
70 * It can be reset via smackfs/ambient
72 struct smack_known *smack_net_ambient;
75 * This is the level in a CIPSO header that indicates a
76 * smack label is contained directly in the category set.
77 * It can be reset via smackfs/direct
79 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
82 * This is the level in a CIPSO header that indicates a
83 * secid is contained directly in the category set.
84 * It can be reset via smackfs/mapped
86 int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
89 * Unless a process is running with this label even
90 * having CAP_MAC_OVERRIDE isn't enough to grant
91 * privilege to violate MAC policy. If no label is
92 * designated (the NULL case) capabilities apply to
93 * everyone. It is expected that the hat (^) label
94 * will be used if any label is used.
96 struct smack_known *smack_onlycap;
99 * If this value is set restrict syslog use to the label specified.
100 * It can be reset via smackfs/syslog
102 struct smack_known *smack_syslog_label;
105 * Ptrace current rule
106 * SMACK_PTRACE_DEFAULT regular smack ptrace rules (/proc based)
107 * SMACK_PTRACE_EXACT labels must match, but can be overriden with
109 * SMACK_PTRACE_DRACONIAN lables must match, CAP_SYS_PTRACE has no effect
111 int smack_ptrace_rule = SMACK_PTRACE_DEFAULT;
114 * Certain IP addresses may be designated as single label hosts.
115 * Packets are sent there unlabeled, but only from tasks that
116 * can write to the specified label.
119 LIST_HEAD(smk_netlbladdr_list);
122 * Rule lists are maintained for each label.
123 * This master list is just for reading /smack/load and /smack/load2.
125 struct smack_master_list {
126 struct list_head list;
127 struct smack_rule *smk_rule;
130 LIST_HEAD(smack_rule_list);
132 struct smack_parsed_rule {
133 struct smack_known *smk_subject;
139 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
141 const char *smack_cipso_option = SMACK_CIPSO_OPTION;
144 * Values for parsing cipso rules
145 * SMK_DIGITLEN: Length of a digit field in a rule.
146 * SMK_CIPSOMIN: Minimum possible cipso rule length.
147 * SMK_CIPSOMAX: Maximum possible cipso rule length.
149 #define SMK_DIGITLEN 4
150 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
151 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
154 * Values for parsing MAC rules
155 * SMK_ACCESS: Maximum possible combination of access permissions
156 * SMK_ACCESSLEN: Maximum length for a rule access field
157 * SMK_LOADLEN: Smack rule length
159 #define SMK_OACCESS "rwxa"
160 #define SMK_ACCESS "rwxatl"
161 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
162 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
163 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
164 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
167 * Stricly for CIPSO level manipulation.
168 * Set the category bit number in a smack label sized buffer.
170 static inline void smack_catset_bit(unsigned int cat, char *catsetp)
172 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
175 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
179 * smk_netlabel_audit_set - fill a netlbl_audit struct
180 * @nap: structure to fill
182 static void smk_netlabel_audit_set(struct netlbl_audit *nap)
184 struct smack_known *skp = smk_of_current();
186 nap->loginuid = audit_get_loginuid(current);
187 nap->sessionid = audit_get_sessionid(current);
188 nap->secid = skp->smk_secid;
192 * Value for parsing single label host rules
195 #define SMK_NETLBLADDRMIN 9
198 * smk_set_access - add a rule to the rule list or replace an old rule
199 * @srp: the rule to add or replace
200 * @rule_list: the list of rules
201 * @rule_lock: the rule list lock
202 * @global: if non-zero, indicates a global rule
204 * Looks through the current subject/object/access list for
205 * the subject/object pair and replaces the access that was
206 * there. If the pair isn't found add it with the specified
209 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
210 * during the allocation of the new pair to add.
212 static int smk_set_access(struct smack_parsed_rule *srp,
213 struct list_head *rule_list,
214 struct mutex *rule_lock, int global)
216 struct smack_rule *sp;
217 struct smack_master_list *smlp;
221 mutex_lock(rule_lock);
224 * Because the object label is less likely to match
225 * than the subject label check it first
227 list_for_each_entry_rcu(sp, rule_list, list) {
228 if (sp->smk_object == srp->smk_object &&
229 sp->smk_subject == srp->smk_subject) {
231 sp->smk_access |= srp->smk_access1;
232 sp->smk_access &= ~srp->smk_access2;
238 sp = kzalloc(sizeof(*sp), GFP_KERNEL);
244 sp->smk_subject = srp->smk_subject;
245 sp->smk_object = srp->smk_object;
246 sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
248 list_add_rcu(&sp->list, rule_list);
250 * If this is a global as opposed to self and a new rule
251 * it needs to get added for reporting.
254 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
257 list_add_rcu(&smlp->list, &smack_rule_list);
264 mutex_unlock(rule_lock);
269 * smk_perm_from_str - parse smack accesses from a text string
270 * @string: a text string that contains a Smack accesses code
272 * Returns an integer with respective bits set for specified accesses.
274 static int smk_perm_from_str(const char *string)
279 for (cp = string; ; cp++)
301 perm |= MAY_TRANSMUTE;
313 * smk_fill_rule - Fill Smack rule from strings
314 * @subject: subject label string
315 * @object: object label string
316 * @access1: access string
317 * @access2: string with permissions to be removed
319 * @import: if non-zero, import labels
320 * @len: label length limit
322 * Returns 0 on success, -EINVAL on failure and -ENOENT when either subject
323 * or object is missing.
325 static int smk_fill_rule(const char *subject, const char *object,
326 const char *access1, const char *access2,
327 struct smack_parsed_rule *rule, int import,
331 struct smack_known *skp;
334 rule->smk_subject = smk_import_entry(subject, len);
335 if (rule->smk_subject == NULL)
338 rule->smk_object = smk_import(object, len);
339 if (rule->smk_object == NULL)
342 cp = smk_parse_smack(subject, len);
345 skp = smk_find_entry(cp);
349 rule->smk_subject = skp;
351 cp = smk_parse_smack(object, len);
354 skp = smk_find_entry(cp);
358 rule->smk_object = skp->smk_known;
361 rule->smk_access1 = smk_perm_from_str(access1);
363 rule->smk_access2 = smk_perm_from_str(access2);
365 rule->smk_access2 = ~rule->smk_access1;
371 * smk_parse_rule - parse Smack rule from load string
372 * @data: string to be parsed whose size is SMK_LOADLEN
374 * @import: if non-zero, import labels
376 * Returns 0 on success, -1 on errors.
378 static int smk_parse_rule(const char *data, struct smack_parsed_rule *rule,
383 rc = smk_fill_rule(data, data + SMK_LABELLEN,
384 data + SMK_LABELLEN + SMK_LABELLEN, NULL, rule,
385 import, SMK_LABELLEN);
390 * smk_parse_long_rule - parse Smack rule from rule string
391 * @data: string to be parsed, null terminated
392 * @rule: Will be filled with Smack parsed rule
393 * @import: if non-zero, import labels
394 * @tokens: numer of substrings expected in data
396 * Returns number of processed bytes on success, -1 on failure.
398 static ssize_t smk_parse_long_rule(char *data, struct smack_parsed_rule *rule,
399 int import, int tokens)
407 * Parsing the rule in-place, filling all white-spaces with '\0'
409 for (i = 0; i < tokens; ++i) {
410 while (isspace(data[cnt]))
413 if (data[cnt] == '\0')
414 /* Unexpected end of data */
419 while (data[cnt] && !isspace(data[cnt]))
422 while (isspace(data[cnt]))
428 rc = smk_fill_rule(tok[0], tok[1], tok[2], tok[3], rule, import, 0);
429 return rc == 0 ? cnt : rc;
432 #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
433 #define SMK_LONG_FMT 1 /* Variable long label format */
434 #define SMK_CHANGE_FMT 2 /* Rule modification format */
436 * smk_write_rules_list - write() for any /smack rule file
437 * @file: file pointer, not actually used
438 * @buf: where to get the data from
440 * @ppos: where to start - must be 0
441 * @rule_list: the list of rules to write to
442 * @rule_lock: lock for the rule list
443 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
445 * Get one smack access rule from above.
446 * The format for SMK_LONG_FMT is:
447 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
448 * The format for SMK_FIXED24_FMT is exactly:
449 * "subject object rwxat"
450 * The format for SMK_CHANGE_FMT is:
451 * "subject<whitespace>object<whitespace>
452 * acc_enable<whitespace>acc_disable[<whitespace>...]"
454 static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
455 size_t count, loff_t *ppos,
456 struct list_head *rule_list,
457 struct mutex *rule_lock, int format)
459 struct smack_parsed_rule rule;
468 * Enough data must be present.
473 if (format == SMK_FIXED24_FMT) {
475 * Minor hack for backward compatibility
477 if (count < SMK_OLOADLEN || count > SMK_LOADLEN)
480 if (count >= PAGE_SIZE) {
481 count = PAGE_SIZE - 1;
486 data = kmalloc(count + 1, GFP_KERNEL);
490 if (copy_from_user(data, buf, count) != 0) {
496 * In case of parsing only part of user buf,
497 * avoid having partial rule at the data buffer
500 while (count > 0 && (data[count - 1] != '\n'))
509 tokens = (format == SMK_CHANGE_FMT ? 4 : 3);
510 while (cnt < count) {
511 if (format == SMK_FIXED24_FMT) {
512 rc = smk_parse_rule(data, &rule, 1);
519 rc = smk_parse_long_rule(data + cnt, &rule, 1, tokens);
527 if (rule_list == NULL)
528 rc = smk_set_access(&rule, &rule.smk_subject->smk_rules,
529 &rule.smk_subject->smk_rules_lock, 1);
531 rc = smk_set_access(&rule, rule_list, rule_lock, 0);
544 * Core logic for smackfs seq list operations.
547 static void *smk_seq_start(struct seq_file *s, loff_t *pos,
548 struct list_head *head)
550 struct list_head *list;
553 * This is 0 the first time through.
558 if (s->private == NULL)
562 if (list_empty(list))
570 static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
571 struct list_head *head)
573 struct list_head *list = v;
575 if (list_is_last(list, head)) {
579 s->private = list->next;
583 static void smk_seq_stop(struct seq_file *s, void *v)
588 static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
591 * Don't show any rules with label names too long for
592 * interface file (/smack/load or /smack/load2)
593 * because you should expect to be able to write
594 * anything you read back.
596 if (strlen(srp->smk_subject->smk_known) >= max ||
597 strlen(srp->smk_object) >= max)
600 if (srp->smk_access == 0)
603 seq_printf(s, "%s %s", srp->smk_subject->smk_known, srp->smk_object);
607 if (srp->smk_access & MAY_READ)
609 if (srp->smk_access & MAY_WRITE)
611 if (srp->smk_access & MAY_EXEC)
613 if (srp->smk_access & MAY_APPEND)
615 if (srp->smk_access & MAY_TRANSMUTE)
617 if (srp->smk_access & MAY_LOCK)
624 * Seq_file read operations for /smack/load
627 static void *load2_seq_start(struct seq_file *s, loff_t *pos)
629 return smk_seq_start(s, pos, &smack_rule_list);
632 static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
634 return smk_seq_next(s, v, pos, &smack_rule_list);
637 static int load_seq_show(struct seq_file *s, void *v)
639 struct list_head *list = v;
640 struct smack_master_list *smlp =
641 list_entry(list, struct smack_master_list, list);
643 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
648 static const struct seq_operations load_seq_ops = {
649 .start = load2_seq_start,
650 .next = load2_seq_next,
651 .show = load_seq_show,
652 .stop = smk_seq_stop,
656 * smk_open_load - open() for /smack/load
657 * @inode: inode structure representing file
658 * @file: "load" file pointer
660 * For reading, use load_seq_* seq_file reading operations.
662 static int smk_open_load(struct inode *inode, struct file *file)
664 return seq_open(file, &load_seq_ops);
668 * smk_write_load - write() for /smack/load
669 * @file: file pointer, not actually used
670 * @buf: where to get the data from
672 * @ppos: where to start - must be 0
675 static ssize_t smk_write_load(struct file *file, const char __user *buf,
676 size_t count, loff_t *ppos)
679 * Must have privilege.
681 * Enough data must be present.
683 if (!smack_privileged(CAP_MAC_ADMIN))
686 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
690 static const struct file_operations smk_load_ops = {
691 .open = smk_open_load,
694 .write = smk_write_load,
695 .release = seq_release,
699 * smk_cipso_doi - initialize the CIPSO domain
701 static void smk_cipso_doi(void)
704 struct cipso_v4_doi *doip;
705 struct netlbl_audit nai;
707 smk_netlabel_audit_set(&nai);
709 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
711 printk(KERN_WARNING "%s:%d remove rc = %d\n",
712 __func__, __LINE__, rc);
714 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
716 panic("smack: Failed to initialize cipso DOI.\n");
717 doip->map.std = NULL;
718 doip->doi = smk_cipso_doi_value;
719 doip->type = CIPSO_V4_MAP_PASS;
720 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
721 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
722 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
724 rc = netlbl_cfg_cipsov4_add(doip, &nai);
726 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
727 __func__, __LINE__, rc);
731 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
733 printk(KERN_WARNING "%s:%d map add rc = %d\n",
734 __func__, __LINE__, rc);
741 * smk_unlbl_ambient - initialize the unlabeled domain
742 * @oldambient: previous domain string
744 static void smk_unlbl_ambient(char *oldambient)
747 struct netlbl_audit nai;
749 smk_netlabel_audit_set(&nai);
751 if (oldambient != NULL) {
752 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
754 printk(KERN_WARNING "%s:%d remove rc = %d\n",
755 __func__, __LINE__, rc);
757 if (smack_net_ambient == NULL)
758 smack_net_ambient = &smack_known_floor;
760 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient->smk_known, PF_INET,
763 printk(KERN_WARNING "%s:%d add rc = %d\n",
764 __func__, __LINE__, rc);
768 * Seq_file read operations for /smack/cipso
771 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
773 return smk_seq_start(s, pos, &smack_known_list);
776 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
778 return smk_seq_next(s, v, pos, &smack_known_list);
782 * Print cipso labels in format:
783 * label level[/cat[,cat]]
785 static int cipso_seq_show(struct seq_file *s, void *v)
787 struct list_head *list = v;
788 struct smack_known *skp =
789 list_entry(list, struct smack_known, list);
790 struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
795 * Don't show a label that could not have been set using
796 * /smack/cipso. This is in support of the notion that
797 * anything read from /smack/cipso ought to be writeable
800 * /smack/cipso2 should be used instead.
802 if (strlen(skp->smk_known) >= SMK_LABELLEN)
805 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
807 for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
808 i = netlbl_catmap_walk(cmp, i + 1)) {
809 seq_printf(s, "%c%d", sep, i);
818 static const struct seq_operations cipso_seq_ops = {
819 .start = cipso_seq_start,
820 .next = cipso_seq_next,
821 .show = cipso_seq_show,
822 .stop = smk_seq_stop,
826 * smk_open_cipso - open() for /smack/cipso
827 * @inode: inode structure representing file
828 * @file: "cipso" file pointer
830 * Connect our cipso_seq_* operations with /smack/cipso
833 static int smk_open_cipso(struct inode *inode, struct file *file)
835 return seq_open(file, &cipso_seq_ops);
839 * smk_set_cipso - do the work for write() for cipso and cipso2
840 * @file: file pointer, not actually used
841 * @buf: where to get the data from
843 * @ppos: where to start
844 * @format: /smack/cipso or /smack/cipso2
846 * Accepts only one cipso rule per write call.
847 * Returns number of bytes written or error code, as appropriate
849 static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
850 size_t count, loff_t *ppos, int format)
852 struct smack_known *skp;
853 struct netlbl_lsm_secattr ncats;
854 char mapcatset[SMK_CIPSOLEN];
858 ssize_t rc = -EINVAL;
865 * Must have privilege.
867 * Enough data must be present.
869 if (!smack_privileged(CAP_MAC_ADMIN))
873 if (format == SMK_FIXED24_FMT &&
874 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
877 data = kzalloc(count + 1, GFP_KERNEL);
881 if (copy_from_user(data, buf, count) != 0) {
889 * Only allow one writer at a time. Writes should be
890 * quite rare and small in any case.
892 mutex_lock(&smack_cipso_lock);
894 skp = smk_import_entry(rule, 0);
898 if (format == SMK_FIXED24_FMT)
899 rule += SMK_LABELLEN;
901 rule += strlen(skp->smk_known) + 1;
903 ret = sscanf(rule, "%d", &maplevel);
904 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
907 rule += SMK_DIGITLEN;
908 ret = sscanf(rule, "%d", &catlen);
909 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
912 if (format == SMK_FIXED24_FMT &&
913 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
916 memset(mapcatset, 0, sizeof(mapcatset));
918 for (i = 0; i < catlen; i++) {
919 rule += SMK_DIGITLEN;
920 ret = sscanf(rule, "%u", &cat);
921 if (ret != 1 || cat > SMACK_CIPSO_MAXCATNUM)
924 smack_catset_bit(cat, mapcatset);
927 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
929 netlbl_catmap_free(skp->smk_netlabel.attr.mls.cat);
930 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
931 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
936 mutex_unlock(&smack_cipso_lock);
943 * smk_write_cipso - write() for /smack/cipso
944 * @file: file pointer, not actually used
945 * @buf: where to get the data from
947 * @ppos: where to start
949 * Accepts only one cipso rule per write call.
950 * Returns number of bytes written or error code, as appropriate
952 static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
953 size_t count, loff_t *ppos)
955 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
958 static const struct file_operations smk_cipso_ops = {
959 .open = smk_open_cipso,
962 .write = smk_write_cipso,
963 .release = seq_release,
967 * Seq_file read operations for /smack/cipso2
971 * Print cipso labels in format:
972 * label level[/cat[,cat]]
974 static int cipso2_seq_show(struct seq_file *s, void *v)
976 struct list_head *list = v;
977 struct smack_known *skp =
978 list_entry(list, struct smack_known, list);
979 struct netlbl_lsm_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
983 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
985 for (i = netlbl_catmap_walk(cmp, 0); i >= 0;
986 i = netlbl_catmap_walk(cmp, i + 1)) {
987 seq_printf(s, "%c%d", sep, i);
996 static const struct seq_operations cipso2_seq_ops = {
997 .start = cipso_seq_start,
998 .next = cipso_seq_next,
999 .show = cipso2_seq_show,
1000 .stop = smk_seq_stop,
1004 * smk_open_cipso2 - open() for /smack/cipso2
1005 * @inode: inode structure representing file
1006 * @file: "cipso2" file pointer
1008 * Connect our cipso_seq_* operations with /smack/cipso2
1011 static int smk_open_cipso2(struct inode *inode, struct file *file)
1013 return seq_open(file, &cipso2_seq_ops);
1017 * smk_write_cipso2 - write() for /smack/cipso2
1018 * @file: file pointer, not actually used
1019 * @buf: where to get the data from
1020 * @count: bytes sent
1021 * @ppos: where to start
1023 * Accepts only one cipso rule per write call.
1024 * Returns number of bytes written or error code, as appropriate
1026 static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
1027 size_t count, loff_t *ppos)
1029 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
1032 static const struct file_operations smk_cipso2_ops = {
1033 .open = smk_open_cipso2,
1035 .llseek = seq_lseek,
1036 .write = smk_write_cipso2,
1037 .release = seq_release,
1041 * Seq_file read operations for /smack/netlabel
1044 static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
1046 return smk_seq_start(s, pos, &smk_netlbladdr_list);
1049 static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
1051 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
1053 #define BEBITS (sizeof(__be32) * 8)
1056 * Print host/label pairs
1058 static int netlbladdr_seq_show(struct seq_file *s, void *v)
1060 struct list_head *list = v;
1061 struct smk_netlbladdr *skp =
1062 list_entry(list, struct smk_netlbladdr, list);
1063 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
1065 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
1067 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
1069 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1070 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
1075 static const struct seq_operations netlbladdr_seq_ops = {
1076 .start = netlbladdr_seq_start,
1077 .next = netlbladdr_seq_next,
1078 .show = netlbladdr_seq_show,
1079 .stop = smk_seq_stop,
1083 * smk_open_netlbladdr - open() for /smack/netlabel
1084 * @inode: inode structure representing file
1085 * @file: "netlabel" file pointer
1087 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1090 static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1092 return seq_open(file, &netlbladdr_seq_ops);
1096 * smk_netlbladdr_insert
1097 * @new : netlabel to insert
1099 * This helper insert netlabel in the smack_netlbladdrs list
1100 * sorted by netmask length (longest to smallest)
1101 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1104 static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1106 struct smk_netlbladdr *m, *m_next;
1108 if (list_empty(&smk_netlbladdr_list)) {
1109 list_add_rcu(&new->list, &smk_netlbladdr_list);
1113 m = list_entry_rcu(smk_netlbladdr_list.next,
1114 struct smk_netlbladdr, list);
1116 /* the comparison '>' is a bit hacky, but works */
1117 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1118 list_add_rcu(&new->list, &smk_netlbladdr_list);
1122 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1123 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1124 list_add_rcu(&new->list, &m->list);
1127 m_next = list_entry_rcu(m->list.next,
1128 struct smk_netlbladdr, list);
1129 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1130 list_add_rcu(&new->list, &m->list);
1138 * smk_write_netlbladdr - write() for /smack/netlabel
1139 * @file: file pointer, not actually used
1140 * @buf: where to get the data from
1141 * @count: bytes sent
1142 * @ppos: where to start
1144 * Accepts only one netlbladdr per write call.
1145 * Returns number of bytes written or error code, as appropriate
1147 static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1148 size_t count, loff_t *ppos)
1150 struct smk_netlbladdr *skp;
1151 struct sockaddr_in newname;
1155 char *host = (char *)&newname.sin_addr.s_addr;
1157 struct netlbl_audit audit_info;
1158 struct in_addr mask;
1161 u32 mask_bits = (1<<31);
1166 * Must have privilege.
1167 * No partial writes.
1168 * Enough data must be present.
1169 * "<addr/mask, as a.b.c.d/e><space><label>"
1170 * "<addr, as a.b.c.d><space><label>"
1172 if (!smack_privileged(CAP_MAC_ADMIN))
1176 if (count < SMK_NETLBLADDRMIN)
1179 data = kzalloc(count + 1, GFP_KERNEL);
1183 if (copy_from_user(data, buf, count) != 0) {
1188 smack = kzalloc(count + 1, GFP_KERNEL);
1189 if (smack == NULL) {
1196 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%u %s",
1197 &host[0], &host[1], &host[2], &host[3], &m, smack);
1199 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1200 &host[0], &host[1], &host[2], &host[3], smack);
1213 * If smack begins with '-', it is an option, don't import it
1215 if (smack[0] != '-') {
1216 sp = smk_import(smack, 0);
1222 /* check known options */
1223 if (strcmp(smack, smack_cipso_option) == 0)
1224 sp = (char *)smack_cipso_option;
1231 for (temp_mask = 0; m > 0; m--) {
1232 temp_mask |= mask_bits;
1235 mask.s_addr = cpu_to_be32(temp_mask);
1237 newname.sin_addr.s_addr &= mask.s_addr;
1239 * Only allow one writer at a time. Writes should be
1240 * quite rare and small in any case.
1242 mutex_lock(&smk_netlbladdr_lock);
1244 nsa = newname.sin_addr.s_addr;
1245 /* try to find if the prefix is already in the list */
1247 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
1248 if (skp->smk_host.sin_addr.s_addr == nsa &&
1249 skp->smk_mask.s_addr == mask.s_addr) {
1254 smk_netlabel_audit_set(&audit_info);
1257 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
1262 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1263 skp->smk_mask.s_addr = mask.s_addr;
1264 skp->smk_label = sp;
1265 smk_netlbladdr_insert(skp);
1268 /* we delete the unlabeled entry, only if the previous label
1269 * wasn't the special CIPSO option */
1270 if (skp->smk_label != smack_cipso_option)
1271 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1272 &skp->smk_host.sin_addr, &skp->smk_mask,
1273 PF_INET, &audit_info);
1276 skp->smk_label = sp;
1280 * Now tell netlabel about the single label nature of
1281 * this host so that incoming packets get labeled.
1282 * but only if we didn't get the special CIPSO option
1284 if (rc == 0 && sp != smack_cipso_option)
1285 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1286 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
1287 smack_to_secid(skp->smk_label), &audit_info);
1292 mutex_unlock(&smk_netlbladdr_lock);
1302 static const struct file_operations smk_netlbladdr_ops = {
1303 .open = smk_open_netlbladdr,
1305 .llseek = seq_lseek,
1306 .write = smk_write_netlbladdr,
1307 .release = seq_release,
1311 * smk_read_doi - read() for /smack/doi
1312 * @filp: file pointer, not actually used
1313 * @buf: where to put the result
1314 * @count: maximum to send along
1315 * @ppos: where to start
1317 * Returns number of bytes read or error code, as appropriate
1319 static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1320 size_t count, loff_t *ppos)
1328 sprintf(temp, "%d", smk_cipso_doi_value);
1329 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1335 * smk_write_doi - write() for /smack/doi
1336 * @file: file pointer, not actually used
1337 * @buf: where to get the data from
1338 * @count: bytes sent
1339 * @ppos: where to start
1341 * Returns number of bytes written or error code, as appropriate
1343 static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1344 size_t count, loff_t *ppos)
1349 if (!smack_privileged(CAP_MAC_ADMIN))
1352 if (count >= sizeof(temp) || count == 0)
1355 if (copy_from_user(temp, buf, count) != 0)
1360 if (sscanf(temp, "%d", &i) != 1)
1363 smk_cipso_doi_value = i;
1370 static const struct file_operations smk_doi_ops = {
1371 .read = smk_read_doi,
1372 .write = smk_write_doi,
1373 .llseek = default_llseek,
1377 * smk_read_direct - read() for /smack/direct
1378 * @filp: file pointer, not actually used
1379 * @buf: where to put the result
1380 * @count: maximum to send along
1381 * @ppos: where to start
1383 * Returns number of bytes read or error code, as appropriate
1385 static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1386 size_t count, loff_t *ppos)
1394 sprintf(temp, "%d", smack_cipso_direct);
1395 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1401 * smk_write_direct - write() for /smack/direct
1402 * @file: file pointer, not actually used
1403 * @buf: where to get the data from
1404 * @count: bytes sent
1405 * @ppos: where to start
1407 * Returns number of bytes written or error code, as appropriate
1409 static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1410 size_t count, loff_t *ppos)
1412 struct smack_known *skp;
1416 if (!smack_privileged(CAP_MAC_ADMIN))
1419 if (count >= sizeof(temp) || count == 0)
1422 if (copy_from_user(temp, buf, count) != 0)
1427 if (sscanf(temp, "%d", &i) != 1)
1431 * Don't do anything if the value hasn't actually changed.
1432 * If it is changing reset the level on entries that were
1433 * set up to be direct when they were created.
1435 if (smack_cipso_direct != i) {
1436 mutex_lock(&smack_known_lock);
1437 list_for_each_entry_rcu(skp, &smack_known_list, list)
1438 if (skp->smk_netlabel.attr.mls.lvl ==
1440 skp->smk_netlabel.attr.mls.lvl = i;
1441 smack_cipso_direct = i;
1442 mutex_unlock(&smack_known_lock);
1448 static const struct file_operations smk_direct_ops = {
1449 .read = smk_read_direct,
1450 .write = smk_write_direct,
1451 .llseek = default_llseek,
1455 * smk_read_mapped - read() for /smack/mapped
1456 * @filp: file pointer, not actually used
1457 * @buf: where to put the result
1458 * @count: maximum to send along
1459 * @ppos: where to start
1461 * Returns number of bytes read or error code, as appropriate
1463 static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1464 size_t count, loff_t *ppos)
1472 sprintf(temp, "%d", smack_cipso_mapped);
1473 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1479 * smk_write_mapped - write() for /smack/mapped
1480 * @file: file pointer, not actually used
1481 * @buf: where to get the data from
1482 * @count: bytes sent
1483 * @ppos: where to start
1485 * Returns number of bytes written or error code, as appropriate
1487 static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1488 size_t count, loff_t *ppos)
1490 struct smack_known *skp;
1494 if (!smack_privileged(CAP_MAC_ADMIN))
1497 if (count >= sizeof(temp) || count == 0)
1500 if (copy_from_user(temp, buf, count) != 0)
1505 if (sscanf(temp, "%d", &i) != 1)
1509 * Don't do anything if the value hasn't actually changed.
1510 * If it is changing reset the level on entries that were
1511 * set up to be mapped when they were created.
1513 if (smack_cipso_mapped != i) {
1514 mutex_lock(&smack_known_lock);
1515 list_for_each_entry_rcu(skp, &smack_known_list, list)
1516 if (skp->smk_netlabel.attr.mls.lvl ==
1518 skp->smk_netlabel.attr.mls.lvl = i;
1519 smack_cipso_mapped = i;
1520 mutex_unlock(&smack_known_lock);
1526 static const struct file_operations smk_mapped_ops = {
1527 .read = smk_read_mapped,
1528 .write = smk_write_mapped,
1529 .llseek = default_llseek,
1533 * smk_read_ambient - read() for /smack/ambient
1534 * @filp: file pointer, not actually used
1535 * @buf: where to put the result
1536 * @cn: maximum to send along
1537 * @ppos: where to start
1539 * Returns number of bytes read or error code, as appropriate
1541 static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1542 size_t cn, loff_t *ppos)
1550 * Being careful to avoid a problem in the case where
1551 * smack_net_ambient gets changed in midstream.
1553 mutex_lock(&smack_ambient_lock);
1555 asize = strlen(smack_net_ambient->smk_known) + 1;
1558 rc = simple_read_from_buffer(buf, cn, ppos,
1559 smack_net_ambient->smk_known,
1564 mutex_unlock(&smack_ambient_lock);
1570 * smk_write_ambient - write() for /smack/ambient
1571 * @file: file pointer, not actually used
1572 * @buf: where to get the data from
1573 * @count: bytes sent
1574 * @ppos: where to start
1576 * Returns number of bytes written or error code, as appropriate
1578 static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1579 size_t count, loff_t *ppos)
1581 struct smack_known *skp;
1586 if (!smack_privileged(CAP_MAC_ADMIN))
1589 data = kzalloc(count + 1, GFP_KERNEL);
1593 if (copy_from_user(data, buf, count) != 0) {
1598 skp = smk_import_entry(data, count);
1604 mutex_lock(&smack_ambient_lock);
1606 oldambient = smack_net_ambient->smk_known;
1607 smack_net_ambient = skp;
1608 smk_unlbl_ambient(oldambient);
1610 mutex_unlock(&smack_ambient_lock);
1617 static const struct file_operations smk_ambient_ops = {
1618 .read = smk_read_ambient,
1619 .write = smk_write_ambient,
1620 .llseek = default_llseek,
1624 * smk_read_onlycap - read() for smackfs/onlycap
1625 * @filp: file pointer, not actually used
1626 * @buf: where to put the result
1627 * @cn: maximum to send along
1628 * @ppos: where to start
1630 * Returns number of bytes read or error code, as appropriate
1632 static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1633 size_t cn, loff_t *ppos)
1636 ssize_t rc = -EINVAL;
1642 if (smack_onlycap != NULL)
1643 smack = smack_onlycap->smk_known;
1645 asize = strlen(smack) + 1;
1648 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1654 * smk_write_onlycap - write() for smackfs/onlycap
1655 * @file: file pointer, not actually used
1656 * @buf: where to get the data from
1657 * @count: bytes sent
1658 * @ppos: where to start
1660 * Returns number of bytes written or error code, as appropriate
1662 static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1663 size_t count, loff_t *ppos)
1666 struct smack_known *skp = smk_of_task(current->cred->security);
1669 if (!smack_privileged(CAP_MAC_ADMIN))
1673 * This can be done using smk_access() but is done
1674 * explicitly for clarity. The smk_access() implementation
1675 * would use smk_access(smack_onlycap, MAY_WRITE)
1677 if (smack_onlycap != NULL && smack_onlycap != skp)
1680 data = kzalloc(count, GFP_KERNEL);
1685 * Should the null string be passed in unset the onlycap value.
1686 * This seems like something to be careful with as usually
1687 * smk_import only expects to return NULL for errors. It
1688 * is usually the case that a nullstring or "\n" would be
1689 * bad to pass to smk_import but in fact this is useful here.
1691 * smk_import will also reject a label beginning with '-',
1692 * so "-usecapabilities" will also work.
1694 if (copy_from_user(data, buf, count) != 0)
1697 smack_onlycap = smk_import_entry(data, count);
1703 static const struct file_operations smk_onlycap_ops = {
1704 .read = smk_read_onlycap,
1705 .write = smk_write_onlycap,
1706 .llseek = default_llseek,
1710 * smk_read_logging - read() for /smack/logging
1711 * @filp: file pointer, not actually used
1712 * @buf: where to put the result
1713 * @cn: maximum to send along
1714 * @ppos: where to start
1716 * Returns number of bytes read or error code, as appropriate
1718 static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1719 size_t count, loff_t *ppos)
1727 sprintf(temp, "%d\n", log_policy);
1728 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1733 * smk_write_logging - write() for /smack/logging
1734 * @file: file pointer, not actually used
1735 * @buf: where to get the data from
1736 * @count: bytes sent
1737 * @ppos: where to start
1739 * Returns number of bytes written or error code, as appropriate
1741 static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1742 size_t count, loff_t *ppos)
1747 if (!smack_privileged(CAP_MAC_ADMIN))
1750 if (count >= sizeof(temp) || count == 0)
1753 if (copy_from_user(temp, buf, count) != 0)
1758 if (sscanf(temp, "%d", &i) != 1)
1768 static const struct file_operations smk_logging_ops = {
1769 .read = smk_read_logging,
1770 .write = smk_write_logging,
1771 .llseek = default_llseek,
1775 * Seq_file read operations for /smack/load-self
1778 static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1780 struct task_smack *tsp = current_security();
1782 return smk_seq_start(s, pos, &tsp->smk_rules);
1785 static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1787 struct task_smack *tsp = current_security();
1789 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1792 static int load_self_seq_show(struct seq_file *s, void *v)
1794 struct list_head *list = v;
1795 struct smack_rule *srp =
1796 list_entry(list, struct smack_rule, list);
1798 smk_rule_show(s, srp, SMK_LABELLEN);
1803 static const struct seq_operations load_self_seq_ops = {
1804 .start = load_self_seq_start,
1805 .next = load_self_seq_next,
1806 .show = load_self_seq_show,
1807 .stop = smk_seq_stop,
1812 * smk_open_load_self - open() for /smack/load-self2
1813 * @inode: inode structure representing file
1814 * @file: "load" file pointer
1816 * For reading, use load_seq_* seq_file reading operations.
1818 static int smk_open_load_self(struct inode *inode, struct file *file)
1820 return seq_open(file, &load_self_seq_ops);
1824 * smk_write_load_self - write() for /smack/load-self
1825 * @file: file pointer, not actually used
1826 * @buf: where to get the data from
1827 * @count: bytes sent
1828 * @ppos: where to start - must be 0
1831 static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1832 size_t count, loff_t *ppos)
1834 struct task_smack *tsp = current_security();
1836 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1837 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
1840 static const struct file_operations smk_load_self_ops = {
1841 .open = smk_open_load_self,
1843 .llseek = seq_lseek,
1844 .write = smk_write_load_self,
1845 .release = seq_release,
1849 * smk_user_access - handle access check transaction
1850 * @file: file pointer
1851 * @buf: data from user space
1852 * @count: bytes sent
1853 * @ppos: where to start - must be 0
1855 static ssize_t smk_user_access(struct file *file, const char __user *buf,
1856 size_t count, loff_t *ppos, int format)
1858 struct smack_parsed_rule rule;
1862 data = simple_transaction_get(file, buf, count);
1864 return PTR_ERR(data);
1866 if (format == SMK_FIXED24_FMT) {
1867 if (count < SMK_LOADLEN)
1869 res = smk_parse_rule(data, &rule, 0);
1872 * simple_transaction_get() returns null-terminated data
1874 res = smk_parse_long_rule(data, &rule, 0, 3);
1878 res = smk_access(rule.smk_subject, rule.smk_object,
1879 rule.smk_access1, NULL);
1880 else if (res != -ENOENT)
1883 data[0] = res == 0 ? '1' : '0';
1886 simple_transaction_set(file, 2);
1888 if (format == SMK_FIXED24_FMT)
1894 * smk_write_access - handle access check transaction
1895 * @file: file pointer
1896 * @buf: data from user space
1897 * @count: bytes sent
1898 * @ppos: where to start - must be 0
1900 static ssize_t smk_write_access(struct file *file, const char __user *buf,
1901 size_t count, loff_t *ppos)
1903 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
1906 static const struct file_operations smk_access_ops = {
1907 .write = smk_write_access,
1908 .read = simple_transaction_read,
1909 .release = simple_transaction_release,
1910 .llseek = generic_file_llseek,
1915 * Seq_file read operations for /smack/load2
1918 static int load2_seq_show(struct seq_file *s, void *v)
1920 struct list_head *list = v;
1921 struct smack_master_list *smlp =
1922 list_entry(list, struct smack_master_list, list);
1924 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1929 static const struct seq_operations load2_seq_ops = {
1930 .start = load2_seq_start,
1931 .next = load2_seq_next,
1932 .show = load2_seq_show,
1933 .stop = smk_seq_stop,
1937 * smk_open_load2 - open() for /smack/load2
1938 * @inode: inode structure representing file
1939 * @file: "load2" file pointer
1941 * For reading, use load2_seq_* seq_file reading operations.
1943 static int smk_open_load2(struct inode *inode, struct file *file)
1945 return seq_open(file, &load2_seq_ops);
1949 * smk_write_load2 - write() for /smack/load2
1950 * @file: file pointer, not actually used
1951 * @buf: where to get the data from
1952 * @count: bytes sent
1953 * @ppos: where to start - must be 0
1956 static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1957 size_t count, loff_t *ppos)
1960 * Must have privilege.
1962 if (!smack_privileged(CAP_MAC_ADMIN))
1965 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1969 static const struct file_operations smk_load2_ops = {
1970 .open = smk_open_load2,
1972 .llseek = seq_lseek,
1973 .write = smk_write_load2,
1974 .release = seq_release,
1978 * Seq_file read operations for /smack/load-self2
1981 static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1983 struct task_smack *tsp = current_security();
1985 return smk_seq_start(s, pos, &tsp->smk_rules);
1988 static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
1990 struct task_smack *tsp = current_security();
1992 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1995 static int load_self2_seq_show(struct seq_file *s, void *v)
1997 struct list_head *list = v;
1998 struct smack_rule *srp =
1999 list_entry(list, struct smack_rule, list);
2001 smk_rule_show(s, srp, SMK_LONGLABEL);
2006 static const struct seq_operations load_self2_seq_ops = {
2007 .start = load_self2_seq_start,
2008 .next = load_self2_seq_next,
2009 .show = load_self2_seq_show,
2010 .stop = smk_seq_stop,
2014 * smk_open_load_self2 - open() for /smack/load-self2
2015 * @inode: inode structure representing file
2016 * @file: "load" file pointer
2018 * For reading, use load_seq_* seq_file reading operations.
2020 static int smk_open_load_self2(struct inode *inode, struct file *file)
2022 return seq_open(file, &load_self2_seq_ops);
2026 * smk_write_load_self2 - write() for /smack/load-self2
2027 * @file: file pointer, not actually used
2028 * @buf: where to get the data from
2029 * @count: bytes sent
2030 * @ppos: where to start - must be 0
2033 static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
2034 size_t count, loff_t *ppos)
2036 struct task_smack *tsp = current_security();
2038 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
2039 &tsp->smk_rules_lock, SMK_LONG_FMT);
2042 static const struct file_operations smk_load_self2_ops = {
2043 .open = smk_open_load_self2,
2045 .llseek = seq_lseek,
2046 .write = smk_write_load_self2,
2047 .release = seq_release,
2051 * smk_write_access2 - handle access check transaction
2052 * @file: file pointer
2053 * @buf: data from user space
2054 * @count: bytes sent
2055 * @ppos: where to start - must be 0
2057 static ssize_t smk_write_access2(struct file *file, const char __user *buf,
2058 size_t count, loff_t *ppos)
2060 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
2063 static const struct file_operations smk_access2_ops = {
2064 .write = smk_write_access2,
2065 .read = simple_transaction_read,
2066 .release = simple_transaction_release,
2067 .llseek = generic_file_llseek,
2071 * smk_write_revoke_subj - write() for /smack/revoke-subject
2072 * @file: file pointer
2073 * @buf: data from user space
2074 * @count: bytes sent
2075 * @ppos: where to start - must be 0
2077 static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
2078 size_t count, loff_t *ppos)
2081 const char *cp = NULL;
2082 struct smack_known *skp;
2083 struct smack_rule *sp;
2084 struct list_head *rule_list;
2085 struct mutex *rule_lock;
2091 if (!smack_privileged(CAP_MAC_ADMIN))
2094 if (count == 0 || count > SMK_LONGLABEL)
2097 data = kzalloc(count, GFP_KERNEL);
2101 if (copy_from_user(data, buf, count) != 0) {
2106 cp = smk_parse_smack(data, count);
2112 skp = smk_find_entry(cp);
2116 rule_list = &skp->smk_rules;
2117 rule_lock = &skp->smk_rules_lock;
2119 mutex_lock(rule_lock);
2121 list_for_each_entry_rcu(sp, rule_list, list)
2124 mutex_unlock(rule_lock);
2132 static const struct file_operations smk_revoke_subj_ops = {
2133 .write = smk_write_revoke_subj,
2134 .read = simple_transaction_read,
2135 .release = simple_transaction_release,
2136 .llseek = generic_file_llseek,
2139 static struct kset *smackfs_kset;
2141 * smk_init_sysfs - initialize /sys/fs/smackfs
2144 static int smk_init_sysfs(void)
2146 smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
2153 * smk_write_change_rule - write() for /smack/change-rule
2154 * @file: file pointer
2155 * @buf: data from user space
2156 * @count: bytes sent
2157 * @ppos: where to start - must be 0
2159 static ssize_t smk_write_change_rule(struct file *file, const char __user *buf,
2160 size_t count, loff_t *ppos)
2163 * Must have privilege.
2165 if (!smack_privileged(CAP_MAC_ADMIN))
2168 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
2172 static const struct file_operations smk_change_rule_ops = {
2173 .write = smk_write_change_rule,
2174 .read = simple_transaction_read,
2175 .release = simple_transaction_release,
2176 .llseek = generic_file_llseek,
2180 * smk_read_syslog - read() for smackfs/syslog
2181 * @filp: file pointer, not actually used
2182 * @buf: where to put the result
2183 * @cn: maximum to send along
2184 * @ppos: where to start
2186 * Returns number of bytes read or error code, as appropriate
2188 static ssize_t smk_read_syslog(struct file *filp, char __user *buf,
2189 size_t cn, loff_t *ppos)
2191 struct smack_known *skp;
2192 ssize_t rc = -EINVAL;
2198 if (smack_syslog_label == NULL)
2199 skp = &smack_known_star;
2201 skp = smack_syslog_label;
2203 asize = strlen(skp->smk_known) + 1;
2206 rc = simple_read_from_buffer(buf, cn, ppos, skp->smk_known,
2213 * smk_write_syslog - write() for smackfs/syslog
2214 * @file: file pointer, not actually used
2215 * @buf: where to get the data from
2216 * @count: bytes sent
2217 * @ppos: where to start
2219 * Returns number of bytes written or error code, as appropriate
2221 static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
2222 size_t count, loff_t *ppos)
2225 struct smack_known *skp;
2228 if (!smack_privileged(CAP_MAC_ADMIN))
2231 data = kzalloc(count, GFP_KERNEL);
2235 if (copy_from_user(data, buf, count) != 0)
2238 skp = smk_import_entry(data, count);
2242 smack_syslog_label = smk_import_entry(data, count);
2249 static const struct file_operations smk_syslog_ops = {
2250 .read = smk_read_syslog,
2251 .write = smk_write_syslog,
2252 .llseek = default_llseek,
2257 * smk_read_ptrace - read() for /smack/ptrace
2258 * @filp: file pointer, not actually used
2259 * @buf: where to put the result
2260 * @count: maximum to send along
2261 * @ppos: where to start
2263 * Returns number of bytes read or error code, as appropriate
2265 static ssize_t smk_read_ptrace(struct file *filp, char __user *buf,
2266 size_t count, loff_t *ppos)
2274 sprintf(temp, "%d\n", smack_ptrace_rule);
2275 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
2280 * smk_write_ptrace - write() for /smack/ptrace
2281 * @file: file pointer
2282 * @buf: data from user space
2283 * @count: bytes sent
2284 * @ppos: where to start - must be 0
2286 static ssize_t smk_write_ptrace(struct file *file, const char __user *buf,
2287 size_t count, loff_t *ppos)
2292 if (!smack_privileged(CAP_MAC_ADMIN))
2295 if (*ppos != 0 || count >= sizeof(temp) || count == 0)
2298 if (copy_from_user(temp, buf, count) != 0)
2303 if (sscanf(temp, "%d", &i) != 1)
2305 if (i < SMACK_PTRACE_DEFAULT || i > SMACK_PTRACE_MAX)
2307 smack_ptrace_rule = i;
2312 static const struct file_operations smk_ptrace_ops = {
2313 .write = smk_write_ptrace,
2314 .read = smk_read_ptrace,
2315 .llseek = default_llseek,
2319 * smk_fill_super - fill the smackfs superblock
2320 * @sb: the empty superblock
2324 * Fill in the well known entries for the smack filesystem
2326 * Returns 0 on success, an error code on failure
2328 static int smk_fill_super(struct super_block *sb, void *data, int silent)
2331 struct inode *root_inode;
2333 static struct tree_descr smack_files[] = {
2335 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2337 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2339 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2341 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2343 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2344 [SMK_NETLBLADDR] = {
2345 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2347 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2349 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2351 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
2353 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
2355 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2357 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2358 [SMK_LOAD_SELF2] = {
2359 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2361 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2363 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
2364 [SMK_REVOKE_SUBJ] = {
2365 "revoke-subject", &smk_revoke_subj_ops,
2367 [SMK_CHANGE_RULE] = {
2368 "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
2370 "syslog", &smk_syslog_ops, S_IRUGO|S_IWUSR},
2372 "ptrace", &smk_ptrace_ops, S_IRUGO|S_IWUSR},
2377 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2379 printk(KERN_ERR "%s failed %d while creating inodes\n",
2384 root_inode = sb->s_root->d_inode;
2390 * smk_mount - get the smackfs superblock
2391 * @fs_type: passed along without comment
2392 * @flags: passed along without comment
2393 * @dev_name: passed along without comment
2394 * @data: passed along without comment
2396 * Just passes everything along.
2398 * Returns what the lower level code does.
2400 static struct dentry *smk_mount(struct file_system_type *fs_type,
2401 int flags, const char *dev_name, void *data)
2403 return mount_single(fs_type, flags, data, smk_fill_super);
2406 static struct file_system_type smk_fs_type = {
2409 .kill_sb = kill_litter_super,
2412 static struct vfsmount *smackfs_mount;
2414 static int __init smk_preset_netlabel(struct smack_known *skp)
2416 skp->smk_netlabel.domain = skp->smk_known;
2417 skp->smk_netlabel.flags =
2418 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2419 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2420 &skp->smk_netlabel, strlen(skp->smk_known));
2424 * init_smk_fs - get the smackfs superblock
2426 * register the smackfs
2428 * Do not register smackfs if Smack wasn't enabled
2429 * on boot. We can not put this method normally under the
2430 * smack_init() code path since the security subsystem get
2431 * initialized before the vfs caches.
2433 * Returns true if we were not chosen on boot or if
2434 * we were chosen and filesystem registration succeeded.
2436 static int __init init_smk_fs(void)
2441 if (!security_module_enable(&smack_ops))
2444 err = smk_init_sysfs();
2446 printk(KERN_ERR "smackfs: sysfs mountpoint problem.\n");
2448 err = register_filesystem(&smk_fs_type);
2450 smackfs_mount = kern_mount(&smk_fs_type);
2451 if (IS_ERR(smackfs_mount)) {
2452 printk(KERN_ERR "smackfs: could not mount!\n");
2453 err = PTR_ERR(smackfs_mount);
2454 smackfs_mount = NULL;
2459 smk_unlbl_ambient(NULL);
2461 rc = smk_preset_netlabel(&smack_known_floor);
2462 if (err == 0 && rc < 0)
2464 rc = smk_preset_netlabel(&smack_known_hat);
2465 if (err == 0 && rc < 0)
2467 rc = smk_preset_netlabel(&smack_known_huh);
2468 if (err == 0 && rc < 0)
2470 rc = smk_preset_netlabel(&smack_known_invalid);
2471 if (err == 0 && rc < 0)
2473 rc = smk_preset_netlabel(&smack_known_star);
2474 if (err == 0 && rc < 0)
2476 rc = smk_preset_netlabel(&smack_known_web);
2477 if (err == 0 && rc < 0)
2483 __initcall(init_smk_fs);