xref: /openbmc/linux/security/smack/smack.h (revision baed456a)
1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4  *
5  * Author:
6  *      Casey Schaufler <casey@schaufler-ca.com>
7  */
8 
9 #ifndef _SECURITY_SMACK_H
10 #define _SECURITY_SMACK_H
11 
12 #include <linux/capability.h>
13 #include <linux/spinlock.h>
14 #include <linux/lsm_hooks.h>
15 #include <linux/in.h>
16 #if IS_ENABLED(CONFIG_IPV6)
17 #include <linux/in6.h>
18 #endif /* CONFIG_IPV6 */
19 #include <net/netlabel.h>
20 #include <linux/list.h>
21 #include <linux/rculist.h>
22 #include <linux/lsm_audit.h>
23 #include <linux/msg.h>
24 
25 /*
26  * Use IPv6 port labeling if IPv6 is enabled and secmarks
27  * are not being used.
28  */
29 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
30 #define SMACK_IPV6_PORT_LABELING 1
31 #endif
32 
33 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
34 #define SMACK_IPV6_SECMARK_LABELING 1
35 #endif
36 
37 /*
38  * Smack labels were limited to 23 characters for a long time.
39  */
40 #define SMK_LABELLEN	24
41 #define SMK_LONGLABEL	256
42 
43 /*
44  * This is the repository for labels seen so that it is
45  * not necessary to keep allocating tiny chuncks of memory
46  * and so that they can be shared.
47  *
48  * Labels are never modified in place. Anytime a label
49  * is imported (e.g. xattrset on a file) the list is checked
50  * for it and it is added if it doesn't exist. The address
51  * is passed out in either case. Entries are added, but
52  * never deleted.
53  *
54  * Since labels are hanging around anyway it doesn't
55  * hurt to maintain a secid for those awkward situations
56  * where kernel components that ought to use LSM independent
57  * interfaces don't. The secid should go away when all of
58  * these components have been repaired.
59  *
60  * The cipso value associated with the label gets stored here, too.
61  *
62  * Keep the access rules for this subject label here so that
63  * the entire set of rules does not need to be examined every
64  * time.
65  */
66 struct smack_known {
67 	struct list_head		list;
68 	struct hlist_node		smk_hashed;
69 	char				*smk_known;
70 	u32				smk_secid;
71 	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
72 	struct list_head		smk_rules;	/* access rules */
73 	struct mutex			smk_rules_lock;	/* lock for rules */
74 };
75 
76 /*
77  * Maximum number of bytes for the levels in a CIPSO IP option.
78  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
79  * bigger than can be used, and 24 is the next lower multiple
80  * of 8, and there are too many issues if there isn't space set
81  * aside for the terminating null byte.
82  */
83 #define SMK_CIPSOLEN	24
84 
85 struct superblock_smack {
86 	struct smack_known	*smk_root;
87 	struct smack_known	*smk_floor;
88 	struct smack_known	*smk_hat;
89 	struct smack_known	*smk_default;
90 	int			smk_flags;
91 };
92 
93 /*
94  * Superblock flags
95  */
96 #define SMK_SB_INITIALIZED	0x01
97 #define SMK_SB_UNTRUSTED	0x02
98 
99 struct socket_smack {
100 	struct smack_known	*smk_out;	/* outbound label */
101 	struct smack_known	*smk_in;	/* inbound label */
102 	struct smack_known	*smk_packet;	/* TCP peer label */
103 	int			smk_state;	/* netlabel socket states */
104 };
105 #define	SMK_NETLBL_UNSET	0
106 #define	SMK_NETLBL_UNLABELED	1
107 #define	SMK_NETLBL_LABELED	2
108 #define	SMK_NETLBL_REQSKB	3
109 
110 /*
111  * Inode smack data
112  */
113 struct inode_smack {
114 	struct smack_known	*smk_inode;	/* label of the fso */
115 	struct smack_known	*smk_task;	/* label of the task */
116 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
117 	int			smk_flags;	/* smack inode flags */
118 };
119 
120 struct task_smack {
121 	struct smack_known	*smk_task;	/* label for access control */
122 	struct smack_known	*smk_forked;	/* label when forked */
123 	struct smack_known	*smk_transmuted;/* label when transmuted */
124 	struct list_head	smk_rules;	/* per task access rules */
125 	struct mutex		smk_rules_lock;	/* lock for the rules */
126 	struct list_head	smk_relabel;	/* transit allowed labels */
127 };
128 
129 #define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
130 #define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
131 #define	SMK_INODE_CHANGED	0x04	/* smack was transmuted (unused) */
132 #define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
133 
134 /*
135  * A label access rule.
136  */
137 struct smack_rule {
138 	struct list_head	list;
139 	struct smack_known	*smk_subject;
140 	struct smack_known	*smk_object;
141 	int			smk_access;
142 };
143 
144 /*
145  * An entry in the table identifying IPv4 hosts.
146  */
147 struct smk_net4addr {
148 	struct list_head	list;
149 	struct in_addr		smk_host;	/* network address */
150 	struct in_addr		smk_mask;	/* network mask */
151 	int			smk_masks;	/* mask size */
152 	struct smack_known	*smk_label;	/* label */
153 };
154 
155 /*
156  * An entry in the table identifying IPv6 hosts.
157  */
158 struct smk_net6addr {
159 	struct list_head	list;
160 	struct in6_addr		smk_host;	/* network address */
161 	struct in6_addr		smk_mask;	/* network mask */
162 	int			smk_masks;	/* mask size */
163 	struct smack_known	*smk_label;	/* label */
164 };
165 
166 /*
167  * An entry in the table identifying ports.
168  */
169 struct smk_port_label {
170 	struct list_head	list;
171 	struct sock		*smk_sock;	/* socket initialized on */
172 	unsigned short		smk_port;	/* the port number */
173 	struct smack_known	*smk_in;	/* inbound label */
174 	struct smack_known	*smk_out;	/* outgoing label */
175 	short			smk_sock_type;	/* Socket type */
176 	short			smk_can_reuse;
177 };
178 
179 struct smack_known_list_elem {
180 	struct list_head	list;
181 	struct smack_known	*smk_label;
182 };
183 
184 enum {
185 	Opt_error = -1,
186 	Opt_fsdefault = 0,
187 	Opt_fsfloor = 1,
188 	Opt_fshat = 2,
189 	Opt_fsroot = 3,
190 	Opt_fstransmute = 4,
191 };
192 
193 #define SMACK_DELETE_OPTION	"-DELETE"
194 #define SMACK_CIPSO_OPTION 	"-CIPSO"
195 
196 /*
197  * CIPSO defaults.
198  */
199 #define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
200 #define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
201 #define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
202 #define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
203 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
204 /*
205  * CIPSO 2.2 standard is 239, but Smack wants to use the
206  * categories in a structured way that limits the value to
207  * the bits in 23 bytes, hence the unusual number.
208  */
209 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
210 
211 /*
212  * Ptrace rules
213  */
214 #define SMACK_PTRACE_DEFAULT	0
215 #define SMACK_PTRACE_EXACT	1
216 #define SMACK_PTRACE_DRACONIAN	2
217 #define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
218 
219 /*
220  * Flags for untraditional access modes.
221  * It shouldn't be necessary to avoid conflicts with definitions
222  * in fs.h, but do so anyway.
223  */
224 #define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
225 #define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
226 #define MAY_BRINGUP	0x00004000	/* Report use of this rule */
227 
228 /*
229  * The policy for delivering signals is configurable.
230  * It is usually "write", but can be "append".
231  */
232 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
233 #define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
234 #else
235 #define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
236 #endif
237 
238 #define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
239 #define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
240 #define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
241 
242 /*
243  * Just to make the common cases easier to deal with
244  */
245 #define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
246 #define MAY_READWRITE	(MAY_READ | MAY_WRITE)
247 #define MAY_NOT		0
248 
249 /*
250  * Number of access types used by Smack (rwxatlb)
251  */
252 #define SMK_NUM_ACCESS_TYPE 7
253 
254 /* SMACK data */
255 struct smack_audit_data {
256 	const char *function;
257 	char *subject;
258 	char *object;
259 	char *request;
260 	int result;
261 };
262 
263 /*
264  * Smack audit data; is empty if CONFIG_AUDIT not set
265  * to save some stack
266  */
267 struct smk_audit_info {
268 #ifdef CONFIG_AUDIT
269 	struct common_audit_data a;
270 	struct smack_audit_data sad;
271 #endif
272 };
273 
274 /*
275  * These functions are in smack_access.c
276  */
277 int smk_access_entry(char *, char *, struct list_head *);
278 int smk_access(struct smack_known *, struct smack_known *,
279 	       int, struct smk_audit_info *);
280 int smk_tskacc(struct task_smack *, struct smack_known *,
281 	       u32, struct smk_audit_info *);
282 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
283 struct smack_known *smack_from_secid(const u32);
284 char *smk_parse_smack(const char *string, int len);
285 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
286 struct smack_known *smk_import_entry(const char *, int);
287 void smk_insert_entry(struct smack_known *skp);
288 struct smack_known *smk_find_entry(const char *);
289 bool smack_privileged(int cap);
290 bool smack_privileged_cred(int cap, const struct cred *cred);
291 void smk_destroy_label_list(struct list_head *list);
292 int smack_populate_secattr(struct smack_known *skp);
293 
294 /*
295  * Shared data.
296  */
297 extern int smack_enabled __initdata;
298 extern int smack_cipso_direct;
299 extern int smack_cipso_mapped;
300 extern struct smack_known *smack_net_ambient;
301 extern struct smack_known *smack_syslog_label;
302 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
303 extern struct smack_known *smack_unconfined;
304 #endif
305 extern int smack_ptrace_rule;
306 extern struct lsm_blob_sizes smack_blob_sizes;
307 
308 extern struct smack_known smack_known_floor;
309 extern struct smack_known smack_known_hat;
310 extern struct smack_known smack_known_huh;
311 extern struct smack_known smack_known_star;
312 extern struct smack_known smack_known_web;
313 
314 extern struct mutex	smack_known_lock;
315 extern struct list_head smack_known_list;
316 extern struct list_head smk_net4addr_list;
317 extern struct list_head smk_net6addr_list;
318 
319 extern struct mutex     smack_onlycap_lock;
320 extern struct list_head smack_onlycap_list;
321 
322 #define SMACK_HASH_SLOTS 16
323 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
324 extern struct kmem_cache *smack_rule_cache;
325 
smack_cred(const struct cred * cred)326 static inline struct task_smack *smack_cred(const struct cred *cred)
327 {
328 	return cred->security + smack_blob_sizes.lbs_cred;
329 }
330 
smack_file(const struct file * file)331 static inline struct smack_known **smack_file(const struct file *file)
332 {
333 	return (struct smack_known **)(file->f_security +
334 				       smack_blob_sizes.lbs_file);
335 }
336 
smack_inode(const struct inode * inode)337 static inline struct inode_smack *smack_inode(const struct inode *inode)
338 {
339 	return inode->i_security + smack_blob_sizes.lbs_inode;
340 }
341 
smack_msg_msg(const struct msg_msg * msg)342 static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
343 {
344 	return msg->security + smack_blob_sizes.lbs_msg_msg;
345 }
346 
smack_ipc(const struct kern_ipc_perm * ipc)347 static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
348 {
349 	return ipc->security + smack_blob_sizes.lbs_ipc;
350 }
351 
smack_superblock(const struct super_block * superblock)352 static inline struct superblock_smack *smack_superblock(
353 					const struct super_block *superblock)
354 {
355 	return superblock->s_security + smack_blob_sizes.lbs_superblock;
356 }
357 
358 /*
359  * Is the directory transmuting?
360  */
smk_inode_transmutable(const struct inode * isp)361 static inline int smk_inode_transmutable(const struct inode *isp)
362 {
363 	struct inode_smack *sip = smack_inode(isp);
364 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
365 }
366 
367 /*
368  * Present a pointer to the smack label entry in an inode blob.
369  */
smk_of_inode(const struct inode * isp)370 static inline struct smack_known *smk_of_inode(const struct inode *isp)
371 {
372 	struct inode_smack *sip = smack_inode(isp);
373 	return sip->smk_inode;
374 }
375 
376 /*
377  * Present a pointer to the smack label entry in an task blob.
378  */
smk_of_task(const struct task_smack * tsp)379 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
380 {
381 	return tsp->smk_task;
382 }
383 
smk_of_task_struct_obj(const struct task_struct * t)384 static inline struct smack_known *smk_of_task_struct_obj(
385 						const struct task_struct *t)
386 {
387 	struct smack_known *skp;
388 	const struct cred *cred;
389 
390 	rcu_read_lock();
391 
392 	cred = __task_cred(t);
393 	skp = smk_of_task(smack_cred(cred));
394 
395 	rcu_read_unlock();
396 
397 	return skp;
398 }
399 
400 /*
401  * Present a pointer to the forked smack label entry in an task blob.
402  */
smk_of_forked(const struct task_smack * tsp)403 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
404 {
405 	return tsp->smk_forked;
406 }
407 
408 /*
409  * Present a pointer to the smack label in the current task blob.
410  */
smk_of_current(void)411 static inline struct smack_known *smk_of_current(void)
412 {
413 	return smk_of_task(smack_cred(current_cred()));
414 }
415 
416 /*
417  * logging functions
418  */
419 #define SMACK_AUDIT_DENIED 0x1
420 #define SMACK_AUDIT_ACCEPT 0x2
421 extern int log_policy;
422 
423 void smack_log(char *subject_label, char *object_label,
424 		int request,
425 		int result, struct smk_audit_info *auditdata);
426 
427 #ifdef CONFIG_AUDIT
428 
429 /*
430  * some inline functions to set up audit data
431  * they do nothing if CONFIG_AUDIT is not set
432  *
433  */
smk_ad_init(struct smk_audit_info * a,const char * func,char type)434 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
435 			       char type)
436 {
437 	memset(&a->sad, 0, sizeof(a->sad));
438 	a->a.type = type;
439 	a->a.smack_audit_data = &a->sad;
440 	a->a.smack_audit_data->function = func;
441 }
442 
smk_ad_init_net(struct smk_audit_info * a,const char * func,char type,struct lsm_network_audit * net)443 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
444 				   char type, struct lsm_network_audit *net)
445 {
446 	smk_ad_init(a, func, type);
447 	memset(net, 0, sizeof(*net));
448 	a->a.u.net = net;
449 }
450 
smk_ad_setfield_u_tsk(struct smk_audit_info * a,struct task_struct * t)451 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
452 					 struct task_struct *t)
453 {
454 	a->a.u.tsk = t;
455 }
smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info * a,struct dentry * d)456 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
457 						    struct dentry *d)
458 {
459 	a->a.u.dentry = d;
460 }
smk_ad_setfield_u_fs_inode(struct smk_audit_info * a,struct inode * i)461 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
462 					      struct inode *i)
463 {
464 	a->a.u.inode = i;
465 }
smk_ad_setfield_u_fs_path(struct smk_audit_info * a,struct path p)466 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
467 					     struct path p)
468 {
469 	a->a.u.path = p;
470 }
smk_ad_setfield_u_net_sk(struct smk_audit_info * a,struct sock * sk)471 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
472 					    struct sock *sk)
473 {
474 	a->a.u.net->sk = sk;
475 }
476 
477 #else /* no AUDIT */
478 
smk_ad_init(struct smk_audit_info * a,const char * func,char type)479 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
480 			       char type)
481 {
482 }
smk_ad_setfield_u_tsk(struct smk_audit_info * a,struct task_struct * t)483 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
484 					 struct task_struct *t)
485 {
486 }
smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info * a,struct dentry * d)487 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
488 						    struct dentry *d)
489 {
490 }
smk_ad_setfield_u_fs_inode(struct smk_audit_info * a,struct inode * i)491 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
492 					      struct inode *i)
493 {
494 }
smk_ad_setfield_u_fs_path(struct smk_audit_info * a,struct path p)495 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
496 					     struct path p)
497 {
498 }
smk_ad_setfield_u_net_sk(struct smk_audit_info * a,struct sock * sk)499 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
500 					    struct sock *sk)
501 {
502 }
503 #endif
504 
505 #endif  /* _SECURITY_SMACK_H */
506