1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Simplified MAC Kernel (smack) security module
4 *
5 * This file contains the smack hook function implementations.
6 *
7 * Authors:
8 * Casey Schaufler <casey@schaufler-ca.com>
9 * Jarkko Sakkinen <jarkko.sakkinen@intel.com>
10 *
11 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
12 * Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
13 * Paul Moore <paul@paul-moore.com>
14 * Copyright (C) 2010 Nokia Corporation
15 * Copyright (C) 2011 Intel Corporation.
16 */
17
18 #include <linux/xattr.h>
19 #include <linux/pagemap.h>
20 #include <linux/mount.h>
21 #include <linux/stat.h>
22 #include <linux/kd.h>
23 #include <asm/ioctls.h>
24 #include <linux/ip.h>
25 #include <linux/tcp.h>
26 #include <linux/udp.h>
27 #include <linux/dccp.h>
28 #include <linux/icmpv6.h>
29 #include <linux/slab.h>
30 #include <linux/mutex.h>
31 #include <net/cipso_ipv4.h>
32 #include <net/ip.h>
33 #include <net/ipv6.h>
34 #include <linux/audit.h>
35 #include <linux/magic.h>
36 #include <linux/dcache.h>
37 #include <linux/personality.h>
38 #include <linux/msg.h>
39 #include <linux/shm.h>
40 #include <linux/binfmts.h>
41 #include <linux/parser.h>
42 #include <linux/fs_context.h>
43 #include <linux/fs_parser.h>
44 #include <linux/watch_queue.h>
45 #include <linux/io_uring.h>
46 #include "smack.h"
47
48 #define TRANS_TRUE "TRUE"
49 #define TRANS_TRUE_SIZE 4
50
51 #define SMK_CONNECTING 0
52 #define SMK_RECEIVING 1
53 #define SMK_SENDING 2
54
55 /*
56 * Smack uses multiple xattrs.
57 * SMACK64 - for access control,
58 * SMACK64TRANSMUTE - label initialization,
59 * Not saved on files - SMACK64IPIN and SMACK64IPOUT,
60 * Must be set explicitly - SMACK64EXEC and SMACK64MMAP
61 */
62 #define SMACK_INODE_INIT_XATTRS 2
63
64 #ifdef SMACK_IPV6_PORT_LABELING
65 static DEFINE_MUTEX(smack_ipv6_lock);
66 static LIST_HEAD(smk_ipv6_port_list);
67 #endif
68 struct kmem_cache *smack_rule_cache;
69 int smack_enabled __initdata;
70
71 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s}
72 static struct {
73 const char *name;
74 int len;
75 int opt;
76 } smk_mount_opts[] = {
77 {"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault},
78 A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute)
79 };
80 #undef A
81
match_opt_prefix(char * s,int l,char ** arg)82 static int match_opt_prefix(char *s, int l, char **arg)
83 {
84 int i;
85
86 for (i = 0; i < ARRAY_SIZE(smk_mount_opts); i++) {
87 size_t len = smk_mount_opts[i].len;
88 if (len > l || memcmp(s, smk_mount_opts[i].name, len))
89 continue;
90 if (len == l || s[len] != '=')
91 continue;
92 *arg = s + len + 1;
93 return smk_mount_opts[i].opt;
94 }
95 return Opt_error;
96 }
97
98 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
99 static char *smk_bu_mess[] = {
100 "Bringup Error", /* Unused */
101 "Bringup", /* SMACK_BRINGUP_ALLOW */
102 "Unconfined Subject", /* SMACK_UNCONFINED_SUBJECT */
103 "Unconfined Object", /* SMACK_UNCONFINED_OBJECT */
104 };
105
smk_bu_mode(int mode,char * s)106 static void smk_bu_mode(int mode, char *s)
107 {
108 int i = 0;
109
110 if (mode & MAY_READ)
111 s[i++] = 'r';
112 if (mode & MAY_WRITE)
113 s[i++] = 'w';
114 if (mode & MAY_EXEC)
115 s[i++] = 'x';
116 if (mode & MAY_APPEND)
117 s[i++] = 'a';
118 if (mode & MAY_TRANSMUTE)
119 s[i++] = 't';
120 if (mode & MAY_LOCK)
121 s[i++] = 'l';
122 if (i == 0)
123 s[i++] = '-';
124 s[i] = '\0';
125 }
126 #endif
127
128 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_note(char * note,struct smack_known * sskp,struct smack_known * oskp,int mode,int rc)129 static int smk_bu_note(char *note, struct smack_known *sskp,
130 struct smack_known *oskp, int mode, int rc)
131 {
132 char acc[SMK_NUM_ACCESS_TYPE + 1];
133
134 if (rc <= 0)
135 return rc;
136 if (rc > SMACK_UNCONFINED_OBJECT)
137 rc = 0;
138
139 smk_bu_mode(mode, acc);
140 pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc],
141 sskp->smk_known, oskp->smk_known, acc, note);
142 return 0;
143 }
144 #else
145 #define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
146 #endif
147
148 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_current(char * note,struct smack_known * oskp,int mode,int rc)149 static int smk_bu_current(char *note, struct smack_known *oskp,
150 int mode, int rc)
151 {
152 struct task_smack *tsp = smack_cred(current_cred());
153 char acc[SMK_NUM_ACCESS_TYPE + 1];
154
155 if (rc <= 0)
156 return rc;
157 if (rc > SMACK_UNCONFINED_OBJECT)
158 rc = 0;
159
160 smk_bu_mode(mode, acc);
161 pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc],
162 tsp->smk_task->smk_known, oskp->smk_known,
163 acc, current->comm, note);
164 return 0;
165 }
166 #else
167 #define smk_bu_current(note, oskp, mode, RC) (RC)
168 #endif
169
170 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_task(struct task_struct * otp,int mode,int rc)171 static int smk_bu_task(struct task_struct *otp, int mode, int rc)
172 {
173 struct task_smack *tsp = smack_cred(current_cred());
174 struct smack_known *smk_task = smk_of_task_struct_obj(otp);
175 char acc[SMK_NUM_ACCESS_TYPE + 1];
176
177 if (rc <= 0)
178 return rc;
179 if (rc > SMACK_UNCONFINED_OBJECT)
180 rc = 0;
181
182 smk_bu_mode(mode, acc);
183 pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc],
184 tsp->smk_task->smk_known, smk_task->smk_known, acc,
185 current->comm, otp->comm);
186 return 0;
187 }
188 #else
189 #define smk_bu_task(otp, mode, RC) (RC)
190 #endif
191
192 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_inode(struct inode * inode,int mode,int rc)193 static int smk_bu_inode(struct inode *inode, int mode, int rc)
194 {
195 struct task_smack *tsp = smack_cred(current_cred());
196 struct inode_smack *isp = smack_inode(inode);
197 char acc[SMK_NUM_ACCESS_TYPE + 1];
198
199 if (isp->smk_flags & SMK_INODE_IMPURE)
200 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
201 inode->i_sb->s_id, inode->i_ino, current->comm);
202
203 if (rc <= 0)
204 return rc;
205 if (rc > SMACK_UNCONFINED_OBJECT)
206 rc = 0;
207 if (rc == SMACK_UNCONFINED_SUBJECT &&
208 (mode & (MAY_WRITE | MAY_APPEND)))
209 isp->smk_flags |= SMK_INODE_IMPURE;
210
211 smk_bu_mode(mode, acc);
212
213 pr_info("Smack %s: (%s %s %s) inode=(%s %ld) %s\n", smk_bu_mess[rc],
214 tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc,
215 inode->i_sb->s_id, inode->i_ino, current->comm);
216 return 0;
217 }
218 #else
219 #define smk_bu_inode(inode, mode, RC) (RC)
220 #endif
221
222 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_file(struct file * file,int mode,int rc)223 static int smk_bu_file(struct file *file, int mode, int rc)
224 {
225 struct task_smack *tsp = smack_cred(current_cred());
226 struct smack_known *sskp = tsp->smk_task;
227 struct inode *inode = file_inode(file);
228 struct inode_smack *isp = smack_inode(inode);
229 char acc[SMK_NUM_ACCESS_TYPE + 1];
230
231 if (isp->smk_flags & SMK_INODE_IMPURE)
232 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
233 inode->i_sb->s_id, inode->i_ino, current->comm);
234
235 if (rc <= 0)
236 return rc;
237 if (rc > SMACK_UNCONFINED_OBJECT)
238 rc = 0;
239
240 smk_bu_mode(mode, acc);
241 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
242 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
243 inode->i_sb->s_id, inode->i_ino, file,
244 current->comm);
245 return 0;
246 }
247 #else
248 #define smk_bu_file(file, mode, RC) (RC)
249 #endif
250
251 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_credfile(const struct cred * cred,struct file * file,int mode,int rc)252 static int smk_bu_credfile(const struct cred *cred, struct file *file,
253 int mode, int rc)
254 {
255 struct task_smack *tsp = smack_cred(cred);
256 struct smack_known *sskp = tsp->smk_task;
257 struct inode *inode = file_inode(file);
258 struct inode_smack *isp = smack_inode(inode);
259 char acc[SMK_NUM_ACCESS_TYPE + 1];
260
261 if (isp->smk_flags & SMK_INODE_IMPURE)
262 pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
263 inode->i_sb->s_id, inode->i_ino, current->comm);
264
265 if (rc <= 0)
266 return rc;
267 if (rc > SMACK_UNCONFINED_OBJECT)
268 rc = 0;
269
270 smk_bu_mode(mode, acc);
271 pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
272 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
273 inode->i_sb->s_id, inode->i_ino, file,
274 current->comm);
275 return 0;
276 }
277 #else
278 #define smk_bu_credfile(cred, file, mode, RC) (RC)
279 #endif
280
281 /**
282 * smk_fetch - Fetch the smack label from a file.
283 * @name: type of the label (attribute)
284 * @ip: a pointer to the inode
285 * @dp: a pointer to the dentry
286 *
287 * Returns a pointer to the master list entry for the Smack label,
288 * NULL if there was no label to fetch, or an error code.
289 */
smk_fetch(const char * name,struct inode * ip,struct dentry * dp)290 static struct smack_known *smk_fetch(const char *name, struct inode *ip,
291 struct dentry *dp)
292 {
293 int rc;
294 char *buffer;
295 struct smack_known *skp = NULL;
296
297 if (!(ip->i_opflags & IOP_XATTR))
298 return ERR_PTR(-EOPNOTSUPP);
299
300 buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS);
301 if (buffer == NULL)
302 return ERR_PTR(-ENOMEM);
303
304 rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL);
305 if (rc < 0)
306 skp = ERR_PTR(rc);
307 else if (rc == 0)
308 skp = NULL;
309 else
310 skp = smk_import_entry(buffer, rc);
311
312 kfree(buffer);
313
314 return skp;
315 }
316
317 /**
318 * init_inode_smack - initialize an inode security blob
319 * @inode: inode to extract the info from
320 * @skp: a pointer to the Smack label entry to use in the blob
321 *
322 */
init_inode_smack(struct inode * inode,struct smack_known * skp)323 static void init_inode_smack(struct inode *inode, struct smack_known *skp)
324 {
325 struct inode_smack *isp = smack_inode(inode);
326
327 isp->smk_inode = skp;
328 isp->smk_flags = 0;
329 }
330
331 /**
332 * init_task_smack - initialize a task security blob
333 * @tsp: blob to initialize
334 * @task: a pointer to the Smack label for the running task
335 * @forked: a pointer to the Smack label for the forked task
336 *
337 */
init_task_smack(struct task_smack * tsp,struct smack_known * task,struct smack_known * forked)338 static void init_task_smack(struct task_smack *tsp, struct smack_known *task,
339 struct smack_known *forked)
340 {
341 tsp->smk_task = task;
342 tsp->smk_forked = forked;
343 INIT_LIST_HEAD(&tsp->smk_rules);
344 INIT_LIST_HEAD(&tsp->smk_relabel);
345 mutex_init(&tsp->smk_rules_lock);
346 }
347
348 /**
349 * smk_copy_rules - copy a rule set
350 * @nhead: new rules header pointer
351 * @ohead: old rules header pointer
352 * @gfp: type of the memory for the allocation
353 *
354 * Returns 0 on success, -ENOMEM on error
355 */
smk_copy_rules(struct list_head * nhead,struct list_head * ohead,gfp_t gfp)356 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
357 gfp_t gfp)
358 {
359 struct smack_rule *nrp;
360 struct smack_rule *orp;
361 int rc = 0;
362
363 list_for_each_entry_rcu(orp, ohead, list) {
364 nrp = kmem_cache_zalloc(smack_rule_cache, gfp);
365 if (nrp == NULL) {
366 rc = -ENOMEM;
367 break;
368 }
369 *nrp = *orp;
370 list_add_rcu(&nrp->list, nhead);
371 }
372 return rc;
373 }
374
375 /**
376 * smk_copy_relabel - copy smk_relabel labels list
377 * @nhead: new rules header pointer
378 * @ohead: old rules header pointer
379 * @gfp: type of the memory for the allocation
380 *
381 * Returns 0 on success, -ENOMEM on error
382 */
smk_copy_relabel(struct list_head * nhead,struct list_head * ohead,gfp_t gfp)383 static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead,
384 gfp_t gfp)
385 {
386 struct smack_known_list_elem *nklep;
387 struct smack_known_list_elem *oklep;
388
389 list_for_each_entry(oklep, ohead, list) {
390 nklep = kzalloc(sizeof(struct smack_known_list_elem), gfp);
391 if (nklep == NULL) {
392 smk_destroy_label_list(nhead);
393 return -ENOMEM;
394 }
395 nklep->smk_label = oklep->smk_label;
396 list_add(&nklep->list, nhead);
397 }
398
399 return 0;
400 }
401
402 /**
403 * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_*
404 * @mode: input mode in form of PTRACE_MODE_*
405 *
406 * Returns a converted MAY_* mode usable by smack rules
407 */
smk_ptrace_mode(unsigned int mode)408 static inline unsigned int smk_ptrace_mode(unsigned int mode)
409 {
410 if (mode & PTRACE_MODE_ATTACH)
411 return MAY_READWRITE;
412 if (mode & PTRACE_MODE_READ)
413 return MAY_READ;
414
415 return 0;
416 }
417
418 /**
419 * smk_ptrace_rule_check - helper for ptrace access
420 * @tracer: tracer process
421 * @tracee_known: label entry of the process that's about to be traced
422 * @mode: ptrace attachment mode (PTRACE_MODE_*)
423 * @func: name of the function that called us, used for audit
424 *
425 * Returns 0 on access granted, -error on error
426 */
smk_ptrace_rule_check(struct task_struct * tracer,struct smack_known * tracee_known,unsigned int mode,const char * func)427 static int smk_ptrace_rule_check(struct task_struct *tracer,
428 struct smack_known *tracee_known,
429 unsigned int mode, const char *func)
430 {
431 int rc;
432 struct smk_audit_info ad, *saip = NULL;
433 struct task_smack *tsp;
434 struct smack_known *tracer_known;
435 const struct cred *tracercred;
436
437 if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
438 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
439 smk_ad_setfield_u_tsk(&ad, tracer);
440 saip = &ad;
441 }
442
443 rcu_read_lock();
444 tracercred = __task_cred(tracer);
445 tsp = smack_cred(tracercred);
446 tracer_known = smk_of_task(tsp);
447
448 if ((mode & PTRACE_MODE_ATTACH) &&
449 (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
450 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
451 if (tracer_known->smk_known == tracee_known->smk_known)
452 rc = 0;
453 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
454 rc = -EACCES;
455 else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
456 rc = 0;
457 else
458 rc = -EACCES;
459
460 if (saip)
461 smack_log(tracer_known->smk_known,
462 tracee_known->smk_known,
463 0, rc, saip);
464
465 rcu_read_unlock();
466 return rc;
467 }
468
469 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
470 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
471
472 rcu_read_unlock();
473 return rc;
474 }
475
476 /*
477 * LSM hooks.
478 * We he, that is fun!
479 */
480
481 /**
482 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH
483 * @ctp: child task pointer
484 * @mode: ptrace attachment mode (PTRACE_MODE_*)
485 *
486 * Returns 0 if access is OK, an error code otherwise
487 *
488 * Do the capability checks.
489 */
smack_ptrace_access_check(struct task_struct * ctp,unsigned int mode)490 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
491 {
492 struct smack_known *skp;
493
494 skp = smk_of_task_struct_obj(ctp);
495
496 return smk_ptrace_rule_check(current, skp, mode, __func__);
497 }
498
499 /**
500 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
501 * @ptp: parent task pointer
502 *
503 * Returns 0 if access is OK, an error code otherwise
504 *
505 * Do the capability checks, and require PTRACE_MODE_ATTACH.
506 */
smack_ptrace_traceme(struct task_struct * ptp)507 static int smack_ptrace_traceme(struct task_struct *ptp)
508 {
509 struct smack_known *skp;
510
511 skp = smk_of_task(smack_cred(current_cred()));
512
513 return smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
514 }
515
516 /**
517 * smack_syslog - Smack approval on syslog
518 * @typefrom_file: unused
519 *
520 * Returns 0 on success, error code otherwise.
521 */
smack_syslog(int typefrom_file)522 static int smack_syslog(int typefrom_file)
523 {
524 int rc = 0;
525 struct smack_known *skp = smk_of_current();
526
527 if (smack_privileged(CAP_MAC_OVERRIDE))
528 return 0;
529
530 if (smack_syslog_label != NULL && smack_syslog_label != skp)
531 rc = -EACCES;
532
533 return rc;
534 }
535
536 /*
537 * Superblock Hooks.
538 */
539
540 /**
541 * smack_sb_alloc_security - allocate a superblock blob
542 * @sb: the superblock getting the blob
543 *
544 * Returns 0 on success or -ENOMEM on error.
545 */
smack_sb_alloc_security(struct super_block * sb)546 static int smack_sb_alloc_security(struct super_block *sb)
547 {
548 struct superblock_smack *sbsp = smack_superblock(sb);
549
550 sbsp->smk_root = &smack_known_floor;
551 sbsp->smk_default = &smack_known_floor;
552 sbsp->smk_floor = &smack_known_floor;
553 sbsp->smk_hat = &smack_known_hat;
554 /*
555 * SMK_SB_INITIALIZED will be zero from kzalloc.
556 */
557
558 return 0;
559 }
560
561 struct smack_mnt_opts {
562 const char *fsdefault;
563 const char *fsfloor;
564 const char *fshat;
565 const char *fsroot;
566 const char *fstransmute;
567 };
568
smack_free_mnt_opts(void * mnt_opts)569 static void smack_free_mnt_opts(void *mnt_opts)
570 {
571 kfree(mnt_opts);
572 }
573
smack_add_opt(int token,const char * s,void ** mnt_opts)574 static int smack_add_opt(int token, const char *s, void **mnt_opts)
575 {
576 struct smack_mnt_opts *opts = *mnt_opts;
577 struct smack_known *skp;
578
579 if (!opts) {
580 opts = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
581 if (!opts)
582 return -ENOMEM;
583 *mnt_opts = opts;
584 }
585 if (!s)
586 return -ENOMEM;
587
588 skp = smk_import_entry(s, 0);
589 if (IS_ERR(skp))
590 return PTR_ERR(skp);
591
592 switch (token) {
593 case Opt_fsdefault:
594 if (opts->fsdefault)
595 goto out_opt_err;
596 opts->fsdefault = skp->smk_known;
597 break;
598 case Opt_fsfloor:
599 if (opts->fsfloor)
600 goto out_opt_err;
601 opts->fsfloor = skp->smk_known;
602 break;
603 case Opt_fshat:
604 if (opts->fshat)
605 goto out_opt_err;
606 opts->fshat = skp->smk_known;
607 break;
608 case Opt_fsroot:
609 if (opts->fsroot)
610 goto out_opt_err;
611 opts->fsroot = skp->smk_known;
612 break;
613 case Opt_fstransmute:
614 if (opts->fstransmute)
615 goto out_opt_err;
616 opts->fstransmute = skp->smk_known;
617 break;
618 }
619 return 0;
620
621 out_opt_err:
622 pr_warn("Smack: duplicate mount options\n");
623 return -EINVAL;
624 }
625
626 /**
627 * smack_fs_context_submount - Initialise security data for a filesystem context
628 * @fc: The filesystem context.
629 * @reference: reference superblock
630 *
631 * Returns 0 on success or -ENOMEM on error.
632 */
smack_fs_context_submount(struct fs_context * fc,struct super_block * reference)633 static int smack_fs_context_submount(struct fs_context *fc,
634 struct super_block *reference)
635 {
636 struct superblock_smack *sbsp;
637 struct smack_mnt_opts *ctx;
638 struct inode_smack *isp;
639
640 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
641 if (!ctx)
642 return -ENOMEM;
643 fc->security = ctx;
644
645 sbsp = smack_superblock(reference);
646 isp = smack_inode(reference->s_root->d_inode);
647
648 if (sbsp->smk_default) {
649 ctx->fsdefault = kstrdup(sbsp->smk_default->smk_known, GFP_KERNEL);
650 if (!ctx->fsdefault)
651 return -ENOMEM;
652 }
653
654 if (sbsp->smk_floor) {
655 ctx->fsfloor = kstrdup(sbsp->smk_floor->smk_known, GFP_KERNEL);
656 if (!ctx->fsfloor)
657 return -ENOMEM;
658 }
659
660 if (sbsp->smk_hat) {
661 ctx->fshat = kstrdup(sbsp->smk_hat->smk_known, GFP_KERNEL);
662 if (!ctx->fshat)
663 return -ENOMEM;
664 }
665
666 if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
667 if (sbsp->smk_root) {
668 ctx->fstransmute = kstrdup(sbsp->smk_root->smk_known, GFP_KERNEL);
669 if (!ctx->fstransmute)
670 return -ENOMEM;
671 }
672 }
673 return 0;
674 }
675
676 /**
677 * smack_fs_context_dup - Duplicate the security data on fs_context duplication
678 * @fc: The new filesystem context.
679 * @src_fc: The source filesystem context being duplicated.
680 *
681 * Returns 0 on success or -ENOMEM on error.
682 */
smack_fs_context_dup(struct fs_context * fc,struct fs_context * src_fc)683 static int smack_fs_context_dup(struct fs_context *fc,
684 struct fs_context *src_fc)
685 {
686 struct smack_mnt_opts *dst, *src = src_fc->security;
687
688 if (!src)
689 return 0;
690
691 fc->security = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
692 if (!fc->security)
693 return -ENOMEM;
694
695 dst = fc->security;
696 dst->fsdefault = src->fsdefault;
697 dst->fsfloor = src->fsfloor;
698 dst->fshat = src->fshat;
699 dst->fsroot = src->fsroot;
700 dst->fstransmute = src->fstransmute;
701
702 return 0;
703 }
704
705 static const struct fs_parameter_spec smack_fs_parameters[] = {
706 fsparam_string("smackfsdef", Opt_fsdefault),
707 fsparam_string("smackfsdefault", Opt_fsdefault),
708 fsparam_string("smackfsfloor", Opt_fsfloor),
709 fsparam_string("smackfshat", Opt_fshat),
710 fsparam_string("smackfsroot", Opt_fsroot),
711 fsparam_string("smackfstransmute", Opt_fstransmute),
712 {}
713 };
714
715 /**
716 * smack_fs_context_parse_param - Parse a single mount parameter
717 * @fc: The new filesystem context being constructed.
718 * @param: The parameter.
719 *
720 * Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on
721 * error.
722 */
smack_fs_context_parse_param(struct fs_context * fc,struct fs_parameter * param)723 static int smack_fs_context_parse_param(struct fs_context *fc,
724 struct fs_parameter *param)
725 {
726 struct fs_parse_result result;
727 int opt, rc;
728
729 opt = fs_parse(fc, smack_fs_parameters, param, &result);
730 if (opt < 0)
731 return opt;
732
733 rc = smack_add_opt(opt, param->string, &fc->security);
734 if (!rc)
735 param->string = NULL;
736 return rc;
737 }
738
smack_sb_eat_lsm_opts(char * options,void ** mnt_opts)739 static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts)
740 {
741 char *from = options, *to = options;
742 bool first = true;
743
744 while (1) {
745 char *next = strchr(from, ',');
746 int token, len, rc;
747 char *arg = NULL;
748
749 if (next)
750 len = next - from;
751 else
752 len = strlen(from);
753
754 token = match_opt_prefix(from, len, &arg);
755 if (token != Opt_error) {
756 arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL);
757 rc = smack_add_opt(token, arg, mnt_opts);
758 kfree(arg);
759 if (unlikely(rc)) {
760 if (*mnt_opts)
761 smack_free_mnt_opts(*mnt_opts);
762 *mnt_opts = NULL;
763 return rc;
764 }
765 } else {
766 if (!first) { // copy with preceding comma
767 from--;
768 len++;
769 }
770 if (to != from)
771 memmove(to, from, len);
772 to += len;
773 first = false;
774 }
775 if (!from[len])
776 break;
777 from += len + 1;
778 }
779 *to = '\0';
780 return 0;
781 }
782
783 /**
784 * smack_set_mnt_opts - set Smack specific mount options
785 * @sb: the file system superblock
786 * @mnt_opts: Smack mount options
787 * @kern_flags: mount option from kernel space or user space
788 * @set_kern_flags: where to store converted mount opts
789 *
790 * Returns 0 on success, an error code on failure
791 *
792 * Allow filesystems with binary mount data to explicitly set Smack mount
793 * labels.
794 */
smack_set_mnt_opts(struct super_block * sb,void * mnt_opts,unsigned long kern_flags,unsigned long * set_kern_flags)795 static int smack_set_mnt_opts(struct super_block *sb,
796 void *mnt_opts,
797 unsigned long kern_flags,
798 unsigned long *set_kern_flags)
799 {
800 struct dentry *root = sb->s_root;
801 struct inode *inode = d_backing_inode(root);
802 struct superblock_smack *sp = smack_superblock(sb);
803 struct inode_smack *isp;
804 struct smack_known *skp;
805 struct smack_mnt_opts *opts = mnt_opts;
806 bool transmute = false;
807
808 if (sp->smk_flags & SMK_SB_INITIALIZED)
809 return 0;
810
811 if (!smack_privileged(CAP_MAC_ADMIN)) {
812 /*
813 * Unprivileged mounts don't get to specify Smack values.
814 */
815 if (opts)
816 return -EPERM;
817 /*
818 * Unprivileged mounts get root and default from the caller.
819 */
820 skp = smk_of_current();
821 sp->smk_root = skp;
822 sp->smk_default = skp;
823 /*
824 * For a handful of fs types with no user-controlled
825 * backing store it's okay to trust security labels
826 * in the filesystem. The rest are untrusted.
827 */
828 if (sb->s_user_ns != &init_user_ns &&
829 sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC &&
830 sb->s_magic != RAMFS_MAGIC) {
831 transmute = true;
832 sp->smk_flags |= SMK_SB_UNTRUSTED;
833 }
834 }
835
836 sp->smk_flags |= SMK_SB_INITIALIZED;
837
838 if (opts) {
839 if (opts->fsdefault) {
840 skp = smk_import_entry(opts->fsdefault, 0);
841 if (IS_ERR(skp))
842 return PTR_ERR(skp);
843 sp->smk_default = skp;
844 }
845 if (opts->fsfloor) {
846 skp = smk_import_entry(opts->fsfloor, 0);
847 if (IS_ERR(skp))
848 return PTR_ERR(skp);
849 sp->smk_floor = skp;
850 }
851 if (opts->fshat) {
852 skp = smk_import_entry(opts->fshat, 0);
853 if (IS_ERR(skp))
854 return PTR_ERR(skp);
855 sp->smk_hat = skp;
856 }
857 if (opts->fsroot) {
858 skp = smk_import_entry(opts->fsroot, 0);
859 if (IS_ERR(skp))
860 return PTR_ERR(skp);
861 sp->smk_root = skp;
862 }
863 if (opts->fstransmute) {
864 skp = smk_import_entry(opts->fstransmute, 0);
865 if (IS_ERR(skp))
866 return PTR_ERR(skp);
867 sp->smk_root = skp;
868 transmute = true;
869 }
870 }
871
872 /*
873 * Initialize the root inode.
874 */
875 init_inode_smack(inode, sp->smk_root);
876
877 if (transmute) {
878 isp = smack_inode(inode);
879 isp->smk_flags |= SMK_INODE_TRANSMUTE;
880 }
881
882 return 0;
883 }
884
885 /**
886 * smack_sb_statfs - Smack check on statfs
887 * @dentry: identifies the file system in question
888 *
889 * Returns 0 if current can read the floor of the filesystem,
890 * and error code otherwise
891 */
smack_sb_statfs(struct dentry * dentry)892 static int smack_sb_statfs(struct dentry *dentry)
893 {
894 struct superblock_smack *sbp = smack_superblock(dentry->d_sb);
895 int rc;
896 struct smk_audit_info ad;
897
898 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
899 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
900
901 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
902 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
903 return rc;
904 }
905
906 /*
907 * BPRM hooks
908 */
909
910 /**
911 * smack_bprm_creds_for_exec - Update bprm->cred if needed for exec
912 * @bprm: the exec information
913 *
914 * Returns 0 if it gets a blob, -EPERM if exec forbidden and -ENOMEM otherwise
915 */
smack_bprm_creds_for_exec(struct linux_binprm * bprm)916 static int smack_bprm_creds_for_exec(struct linux_binprm *bprm)
917 {
918 struct inode *inode = file_inode(bprm->file);
919 struct task_smack *bsp = smack_cred(bprm->cred);
920 struct inode_smack *isp;
921 struct superblock_smack *sbsp;
922 int rc;
923
924 isp = smack_inode(inode);
925 if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
926 return 0;
927
928 sbsp = smack_superblock(inode->i_sb);
929 if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
930 isp->smk_task != sbsp->smk_root)
931 return 0;
932
933 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
934 struct task_struct *tracer;
935 rc = 0;
936
937 rcu_read_lock();
938 tracer = ptrace_parent(current);
939 if (likely(tracer != NULL))
940 rc = smk_ptrace_rule_check(tracer,
941 isp->smk_task,
942 PTRACE_MODE_ATTACH,
943 __func__);
944 rcu_read_unlock();
945
946 if (rc != 0)
947 return rc;
948 }
949 if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)
950 return -EPERM;
951
952 bsp->smk_task = isp->smk_task;
953 bprm->per_clear |= PER_CLEAR_ON_SETID;
954
955 /* Decide if this is a secure exec. */
956 if (bsp->smk_task != bsp->smk_forked)
957 bprm->secureexec = 1;
958
959 return 0;
960 }
961
962 /*
963 * Inode hooks
964 */
965
966 /**
967 * smack_inode_alloc_security - allocate an inode blob
968 * @inode: the inode in need of a blob
969 *
970 * Returns 0
971 */
smack_inode_alloc_security(struct inode * inode)972 static int smack_inode_alloc_security(struct inode *inode)
973 {
974 struct smack_known *skp = smk_of_current();
975
976 init_inode_smack(inode, skp);
977 return 0;
978 }
979
980 /**
981 * smack_inode_init_security - copy out the smack from an inode
982 * @inode: the newly created inode
983 * @dir: containing directory object
984 * @qstr: unused
985 * @xattrs: where to put the attributes
986 * @xattr_count: current number of LSM-provided xattrs (updated)
987 *
988 * Returns 0 if it all works out, -ENOMEM if there's no memory
989 */
smack_inode_init_security(struct inode * inode,struct inode * dir,const struct qstr * qstr,struct xattr * xattrs,int * xattr_count)990 static int smack_inode_init_security(struct inode *inode, struct inode *dir,
991 const struct qstr *qstr,
992 struct xattr *xattrs, int *xattr_count)
993 {
994 struct task_smack *tsp = smack_cred(current_cred());
995 struct smack_known *skp = smk_of_task(tsp);
996 struct smack_known *isp = smk_of_inode(inode);
997 struct smack_known *dsp = smk_of_inode(dir);
998 struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
999 int may;
1000
1001 if (xattr) {
1002 /*
1003 * If equal, transmuting already occurred in
1004 * smack_dentry_create_files_as(). No need to check again.
1005 */
1006 if (tsp->smk_task != tsp->smk_transmuted) {
1007 rcu_read_lock();
1008 may = smk_access_entry(skp->smk_known, dsp->smk_known,
1009 &skp->smk_rules);
1010 rcu_read_unlock();
1011 }
1012
1013 /*
1014 * In addition to having smk_task equal to smk_transmuted,
1015 * if the access rule allows transmutation and the directory
1016 * requests transmutation then by all means transmute.
1017 * Mark the inode as changed.
1018 */
1019 if ((tsp->smk_task == tsp->smk_transmuted) ||
1020 (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
1021 smk_inode_transmutable(dir))) {
1022 struct xattr *xattr_transmute;
1023
1024 /*
1025 * The caller of smack_dentry_create_files_as()
1026 * should have overridden the current cred, so the
1027 * inode label was already set correctly in
1028 * smack_inode_alloc_security().
1029 */
1030 if (tsp->smk_task != tsp->smk_transmuted)
1031 isp = dsp;
1032 xattr_transmute = lsm_get_xattr_slot(xattrs,
1033 xattr_count);
1034 if (xattr_transmute) {
1035 xattr_transmute->value = kmemdup(TRANS_TRUE,
1036 TRANS_TRUE_SIZE,
1037 GFP_NOFS);
1038 if (!xattr_transmute->value)
1039 return -ENOMEM;
1040
1041 xattr_transmute->value_len = TRANS_TRUE_SIZE;
1042 xattr_transmute->name = XATTR_SMACK_TRANSMUTE;
1043 }
1044 }
1045
1046 xattr->value = kstrdup(isp->smk_known, GFP_NOFS);
1047 if (!xattr->value)
1048 return -ENOMEM;
1049
1050 xattr->value_len = strlen(isp->smk_known);
1051 xattr->name = XATTR_SMACK_SUFFIX;
1052 }
1053
1054 return 0;
1055 }
1056
1057 /**
1058 * smack_inode_link - Smack check on link
1059 * @old_dentry: the existing object
1060 * @dir: unused
1061 * @new_dentry: the new object
1062 *
1063 * Returns 0 if access is permitted, an error code otherwise
1064 */
smack_inode_link(struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry)1065 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
1066 struct dentry *new_dentry)
1067 {
1068 struct smack_known *isp;
1069 struct smk_audit_info ad;
1070 int rc;
1071
1072 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1073 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1074
1075 isp = smk_of_inode(d_backing_inode(old_dentry));
1076 rc = smk_curacc(isp, MAY_WRITE, &ad);
1077 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc);
1078
1079 if (rc == 0 && d_is_positive(new_dentry)) {
1080 isp = smk_of_inode(d_backing_inode(new_dentry));
1081 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1082 rc = smk_curacc(isp, MAY_WRITE, &ad);
1083 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc);
1084 }
1085
1086 return rc;
1087 }
1088
1089 /**
1090 * smack_inode_unlink - Smack check on inode deletion
1091 * @dir: containing directory object
1092 * @dentry: file to unlink
1093 *
1094 * Returns 0 if current can write the containing directory
1095 * and the object, error code otherwise
1096 */
smack_inode_unlink(struct inode * dir,struct dentry * dentry)1097 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
1098 {
1099 struct inode *ip = d_backing_inode(dentry);
1100 struct smk_audit_info ad;
1101 int rc;
1102
1103 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1104 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1105
1106 /*
1107 * You need write access to the thing you're unlinking
1108 */
1109 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
1110 rc = smk_bu_inode(ip, MAY_WRITE, rc);
1111 if (rc == 0) {
1112 /*
1113 * You also need write access to the containing directory
1114 */
1115 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1116 smk_ad_setfield_u_fs_inode(&ad, dir);
1117 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1118 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1119 }
1120 return rc;
1121 }
1122
1123 /**
1124 * smack_inode_rmdir - Smack check on directory deletion
1125 * @dir: containing directory object
1126 * @dentry: directory to unlink
1127 *
1128 * Returns 0 if current can write the containing directory
1129 * and the directory, error code otherwise
1130 */
smack_inode_rmdir(struct inode * dir,struct dentry * dentry)1131 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
1132 {
1133 struct smk_audit_info ad;
1134 int rc;
1135
1136 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1137 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1138
1139 /*
1140 * You need write access to the thing you're removing
1141 */
1142 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1143 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1144 if (rc == 0) {
1145 /*
1146 * You also need write access to the containing directory
1147 */
1148 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1149 smk_ad_setfield_u_fs_inode(&ad, dir);
1150 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1151 rc = smk_bu_inode(dir, MAY_WRITE, rc);
1152 }
1153
1154 return rc;
1155 }
1156
1157 /**
1158 * smack_inode_rename - Smack check on rename
1159 * @old_inode: unused
1160 * @old_dentry: the old object
1161 * @new_inode: unused
1162 * @new_dentry: the new object
1163 *
1164 * Read and write access is required on both the old and
1165 * new directories.
1166 *
1167 * Returns 0 if access is permitted, an error code otherwise
1168 */
smack_inode_rename(struct inode * old_inode,struct dentry * old_dentry,struct inode * new_inode,struct dentry * new_dentry)1169 static int smack_inode_rename(struct inode *old_inode,
1170 struct dentry *old_dentry,
1171 struct inode *new_inode,
1172 struct dentry *new_dentry)
1173 {
1174 int rc;
1175 struct smack_known *isp;
1176 struct smk_audit_info ad;
1177
1178 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1179 smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1180
1181 isp = smk_of_inode(d_backing_inode(old_dentry));
1182 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1183 rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc);
1184
1185 if (rc == 0 && d_is_positive(new_dentry)) {
1186 isp = smk_of_inode(d_backing_inode(new_dentry));
1187 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1188 rc = smk_curacc(isp, MAY_READWRITE, &ad);
1189 rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc);
1190 }
1191 return rc;
1192 }
1193
1194 /**
1195 * smack_inode_permission - Smack version of permission()
1196 * @inode: the inode in question
1197 * @mask: the access requested
1198 *
1199 * This is the important Smack hook.
1200 *
1201 * Returns 0 if access is permitted, an error code otherwise
1202 */
smack_inode_permission(struct inode * inode,int mask)1203 static int smack_inode_permission(struct inode *inode, int mask)
1204 {
1205 struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
1206 struct smk_audit_info ad;
1207 int no_block = mask & MAY_NOT_BLOCK;
1208 int rc;
1209
1210 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
1211 /*
1212 * No permission to check. Existence test. Yup, it's there.
1213 */
1214 if (mask == 0)
1215 return 0;
1216
1217 if (sbsp->smk_flags & SMK_SB_UNTRUSTED) {
1218 if (smk_of_inode(inode) != sbsp->smk_root)
1219 return -EACCES;
1220 }
1221
1222 /* May be droppable after audit */
1223 if (no_block)
1224 return -ECHILD;
1225 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1226 smk_ad_setfield_u_fs_inode(&ad, inode);
1227 rc = smk_curacc(smk_of_inode(inode), mask, &ad);
1228 rc = smk_bu_inode(inode, mask, rc);
1229 return rc;
1230 }
1231
1232 /**
1233 * smack_inode_setattr - Smack check for setting attributes
1234 * @dentry: the object
1235 * @iattr: for the force flag
1236 *
1237 * Returns 0 if access is permitted, an error code otherwise
1238 */
smack_inode_setattr(struct dentry * dentry,struct iattr * iattr)1239 static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
1240 {
1241 struct smk_audit_info ad;
1242 int rc;
1243
1244 /*
1245 * Need to allow for clearing the setuid bit.
1246 */
1247 if (iattr->ia_valid & ATTR_FORCE)
1248 return 0;
1249 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1250 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1251
1252 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1253 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1254 return rc;
1255 }
1256
1257 /**
1258 * smack_inode_getattr - Smack check for getting attributes
1259 * @path: path to extract the info from
1260 *
1261 * Returns 0 if access is permitted, an error code otherwise
1262 */
smack_inode_getattr(const struct path * path)1263 static int smack_inode_getattr(const struct path *path)
1264 {
1265 struct smk_audit_info ad;
1266 struct inode *inode = d_backing_inode(path->dentry);
1267 int rc;
1268
1269 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1270 smk_ad_setfield_u_fs_path(&ad, *path);
1271 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1272 rc = smk_bu_inode(inode, MAY_READ, rc);
1273 return rc;
1274 }
1275
1276 /**
1277 * smack_inode_setxattr - Smack check for setting xattrs
1278 * @idmap: idmap of the mount
1279 * @dentry: the object
1280 * @name: name of the attribute
1281 * @value: value of the attribute
1282 * @size: size of the value
1283 * @flags: unused
1284 *
1285 * This protects the Smack attribute explicitly.
1286 *
1287 * Returns 0 if access is permitted, an error code otherwise
1288 */
smack_inode_setxattr(struct mnt_idmap * idmap,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)1289 static int smack_inode_setxattr(struct mnt_idmap *idmap,
1290 struct dentry *dentry, const char *name,
1291 const void *value, size_t size, int flags)
1292 {
1293 struct smk_audit_info ad;
1294 struct smack_known *skp;
1295 int check_priv = 0;
1296 int check_import = 0;
1297 int check_star = 0;
1298 int rc = 0;
1299
1300 /*
1301 * Check label validity here so import won't fail in post_setxattr
1302 */
1303 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1304 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1305 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
1306 check_priv = 1;
1307 check_import = 1;
1308 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1309 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1310 check_priv = 1;
1311 check_import = 1;
1312 check_star = 1;
1313 } else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1314 check_priv = 1;
1315 if (!S_ISDIR(d_backing_inode(dentry)->i_mode) ||
1316 size != TRANS_TRUE_SIZE ||
1317 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
1318 rc = -EINVAL;
1319 } else
1320 rc = cap_inode_setxattr(dentry, name, value, size, flags);
1321
1322 if (check_priv && !smack_privileged(CAP_MAC_ADMIN))
1323 rc = -EPERM;
1324
1325 if (rc == 0 && check_import) {
1326 skp = size ? smk_import_entry(value, size) : NULL;
1327 if (IS_ERR(skp))
1328 rc = PTR_ERR(skp);
1329 else if (skp == NULL || (check_star &&
1330 (skp == &smack_known_star || skp == &smack_known_web)))
1331 rc = -EINVAL;
1332 }
1333
1334 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1335 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1336
1337 if (rc == 0) {
1338 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1339 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1340 }
1341
1342 return rc;
1343 }
1344
1345 /**
1346 * smack_inode_post_setxattr - Apply the Smack update approved above
1347 * @dentry: object
1348 * @name: attribute name
1349 * @value: attribute value
1350 * @size: attribute size
1351 * @flags: unused
1352 *
1353 * Set the pointer in the inode blob to the entry found
1354 * in the master label list.
1355 */
smack_inode_post_setxattr(struct dentry * dentry,const char * name,const void * value,size_t size,int flags)1356 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
1357 const void *value, size_t size, int flags)
1358 {
1359 struct smack_known *skp;
1360 struct inode_smack *isp = smack_inode(d_backing_inode(dentry));
1361
1362 if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1363 isp->smk_flags |= SMK_INODE_TRANSMUTE;
1364 return;
1365 }
1366
1367 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1368 skp = smk_import_entry(value, size);
1369 if (!IS_ERR(skp))
1370 isp->smk_inode = skp;
1371 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
1372 skp = smk_import_entry(value, size);
1373 if (!IS_ERR(skp))
1374 isp->smk_task = skp;
1375 } else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1376 skp = smk_import_entry(value, size);
1377 if (!IS_ERR(skp))
1378 isp->smk_mmap = skp;
1379 }
1380
1381 return;
1382 }
1383
1384 /**
1385 * smack_inode_getxattr - Smack check on getxattr
1386 * @dentry: the object
1387 * @name: unused
1388 *
1389 * Returns 0 if access is permitted, an error code otherwise
1390 */
smack_inode_getxattr(struct dentry * dentry,const char * name)1391 static int smack_inode_getxattr(struct dentry *dentry, const char *name)
1392 {
1393 struct smk_audit_info ad;
1394 int rc;
1395
1396 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1397 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1398
1399 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
1400 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
1401 return rc;
1402 }
1403
1404 /**
1405 * smack_inode_removexattr - Smack check on removexattr
1406 * @idmap: idmap of the mount
1407 * @dentry: the object
1408 * @name: name of the attribute
1409 *
1410 * Removing the Smack attribute requires CAP_MAC_ADMIN
1411 *
1412 * Returns 0 if access is permitted, an error code otherwise
1413 */
smack_inode_removexattr(struct mnt_idmap * idmap,struct dentry * dentry,const char * name)1414 static int smack_inode_removexattr(struct mnt_idmap *idmap,
1415 struct dentry *dentry, const char *name)
1416 {
1417 struct inode_smack *isp;
1418 struct smk_audit_info ad;
1419 int rc = 0;
1420
1421 if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1422 strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1423 strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
1424 strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1425 strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
1426 strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1427 if (!smack_privileged(CAP_MAC_ADMIN))
1428 rc = -EPERM;
1429 } else
1430 rc = cap_inode_removexattr(idmap, dentry, name);
1431
1432 if (rc != 0)
1433 return rc;
1434
1435 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1436 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1437
1438 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1439 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1440 if (rc != 0)
1441 return rc;
1442
1443 isp = smack_inode(d_backing_inode(dentry));
1444 /*
1445 * Don't do anything special for these.
1446 * XATTR_NAME_SMACKIPIN
1447 * XATTR_NAME_SMACKIPOUT
1448 */
1449 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1450 struct super_block *sbp = dentry->d_sb;
1451 struct superblock_smack *sbsp = smack_superblock(sbp);
1452
1453 isp->smk_inode = sbsp->smk_default;
1454 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
1455 isp->smk_task = NULL;
1456 else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0)
1457 isp->smk_mmap = NULL;
1458 else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
1459 isp->smk_flags &= ~SMK_INODE_TRANSMUTE;
1460
1461 return 0;
1462 }
1463
1464 /**
1465 * smack_inode_set_acl - Smack check for setting posix acls
1466 * @idmap: idmap of the mnt this request came from
1467 * @dentry: the object
1468 * @acl_name: name of the posix acl
1469 * @kacl: the posix acls
1470 *
1471 * Returns 0 if access is permitted, an error code otherwise
1472 */
smack_inode_set_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name,struct posix_acl * kacl)1473 static int smack_inode_set_acl(struct mnt_idmap *idmap,
1474 struct dentry *dentry, const char *acl_name,
1475 struct posix_acl *kacl)
1476 {
1477 struct smk_audit_info ad;
1478 int rc;
1479
1480 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1481 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1482
1483 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1484 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1485 return rc;
1486 }
1487
1488 /**
1489 * smack_inode_get_acl - Smack check for getting posix acls
1490 * @idmap: idmap of the mnt this request came from
1491 * @dentry: the object
1492 * @acl_name: name of the posix acl
1493 *
1494 * Returns 0 if access is permitted, an error code otherwise
1495 */
smack_inode_get_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name)1496 static int smack_inode_get_acl(struct mnt_idmap *idmap,
1497 struct dentry *dentry, const char *acl_name)
1498 {
1499 struct smk_audit_info ad;
1500 int rc;
1501
1502 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1503 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1504
1505 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
1506 rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
1507 return rc;
1508 }
1509
1510 /**
1511 * smack_inode_remove_acl - Smack check for getting posix acls
1512 * @idmap: idmap of the mnt this request came from
1513 * @dentry: the object
1514 * @acl_name: name of the posix acl
1515 *
1516 * Returns 0 if access is permitted, an error code otherwise
1517 */
smack_inode_remove_acl(struct mnt_idmap * idmap,struct dentry * dentry,const char * acl_name)1518 static int smack_inode_remove_acl(struct mnt_idmap *idmap,
1519 struct dentry *dentry, const char *acl_name)
1520 {
1521 struct smk_audit_info ad;
1522 int rc;
1523
1524 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1525 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1526
1527 rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1528 rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1529 return rc;
1530 }
1531
1532 /**
1533 * smack_inode_getsecurity - get smack xattrs
1534 * @idmap: idmap of the mount
1535 * @inode: the object
1536 * @name: attribute name
1537 * @buffer: where to put the result
1538 * @alloc: duplicate memory
1539 *
1540 * Returns the size of the attribute or an error code
1541 */
smack_inode_getsecurity(struct mnt_idmap * idmap,struct inode * inode,const char * name,void ** buffer,bool alloc)1542 static int smack_inode_getsecurity(struct mnt_idmap *idmap,
1543 struct inode *inode, const char *name,
1544 void **buffer, bool alloc)
1545 {
1546 struct socket_smack *ssp;
1547 struct socket *sock;
1548 struct super_block *sbp;
1549 struct inode *ip = inode;
1550 struct smack_known *isp;
1551 struct inode_smack *ispp;
1552 size_t label_len;
1553 char *label = NULL;
1554
1555 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
1556 isp = smk_of_inode(inode);
1557 } else if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
1558 ispp = smack_inode(inode);
1559 if (ispp->smk_flags & SMK_INODE_TRANSMUTE)
1560 label = TRANS_TRUE;
1561 else
1562 label = "";
1563 } else {
1564 /*
1565 * The rest of the Smack xattrs are only on sockets.
1566 */
1567 sbp = ip->i_sb;
1568 if (sbp->s_magic != SOCKFS_MAGIC)
1569 return -EOPNOTSUPP;
1570
1571 sock = SOCKET_I(ip);
1572 if (sock == NULL || sock->sk == NULL)
1573 return -EOPNOTSUPP;
1574
1575 ssp = sock->sk->sk_security;
1576
1577 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1578 isp = ssp->smk_in;
1579 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1580 isp = ssp->smk_out;
1581 else
1582 return -EOPNOTSUPP;
1583 }
1584
1585 if (!label)
1586 label = isp->smk_known;
1587
1588 label_len = strlen(label);
1589
1590 if (alloc) {
1591 *buffer = kstrdup(label, GFP_KERNEL);
1592 if (*buffer == NULL)
1593 return -ENOMEM;
1594 }
1595
1596 return label_len;
1597 }
1598
1599
1600 /**
1601 * smack_inode_listsecurity - list the Smack attributes
1602 * @inode: the object
1603 * @buffer: where they go
1604 * @buffer_size: size of buffer
1605 */
smack_inode_listsecurity(struct inode * inode,char * buffer,size_t buffer_size)1606 static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1607 size_t buffer_size)
1608 {
1609 int len = sizeof(XATTR_NAME_SMACK);
1610
1611 if (buffer != NULL && len <= buffer_size)
1612 memcpy(buffer, XATTR_NAME_SMACK, len);
1613
1614 return len;
1615 }
1616
1617 /**
1618 * smack_inode_getsecid - Extract inode's security id
1619 * @inode: inode to extract the info from
1620 * @secid: where result will be saved
1621 */
smack_inode_getsecid(struct inode * inode,u32 * secid)1622 static void smack_inode_getsecid(struct inode *inode, u32 *secid)
1623 {
1624 struct smack_known *skp = smk_of_inode(inode);
1625
1626 *secid = skp->smk_secid;
1627 }
1628
1629 /*
1630 * File Hooks
1631 */
1632
1633 /*
1634 * There is no smack_file_permission hook
1635 *
1636 * Should access checks be done on each read or write?
1637 * UNICOS and SELinux say yes.
1638 * Trusted Solaris, Trusted Irix, and just about everyone else says no.
1639 *
1640 * I'll say no for now. Smack does not do the frequent
1641 * label changing that SELinux does.
1642 */
1643
1644 /**
1645 * smack_file_alloc_security - assign a file security blob
1646 * @file: the object
1647 *
1648 * The security blob for a file is a pointer to the master
1649 * label list, so no allocation is done.
1650 *
1651 * f_security is the owner security information. It
1652 * isn't used on file access checks, it's for send_sigio.
1653 *
1654 * Returns 0
1655 */
smack_file_alloc_security(struct file * file)1656 static int smack_file_alloc_security(struct file *file)
1657 {
1658 struct smack_known **blob = smack_file(file);
1659
1660 *blob = smk_of_current();
1661 return 0;
1662 }
1663
1664 /**
1665 * smack_file_ioctl - Smack check on ioctls
1666 * @file: the object
1667 * @cmd: what to do
1668 * @arg: unused
1669 *
1670 * Relies heavily on the correct use of the ioctl command conventions.
1671 *
1672 * Returns 0 if allowed, error code otherwise
1673 */
smack_file_ioctl(struct file * file,unsigned int cmd,unsigned long arg)1674 static int smack_file_ioctl(struct file *file, unsigned int cmd,
1675 unsigned long arg)
1676 {
1677 int rc = 0;
1678 struct smk_audit_info ad;
1679 struct inode *inode = file_inode(file);
1680
1681 if (unlikely(IS_PRIVATE(inode)))
1682 return 0;
1683
1684 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1685 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1686
1687 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1688 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1689 rc = smk_bu_file(file, MAY_WRITE, rc);
1690 }
1691
1692 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1693 rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1694 rc = smk_bu_file(file, MAY_READ, rc);
1695 }
1696
1697 return rc;
1698 }
1699
1700 /**
1701 * smack_file_lock - Smack check on file locking
1702 * @file: the object
1703 * @cmd: unused
1704 *
1705 * Returns 0 if current has lock access, error code otherwise
1706 */
smack_file_lock(struct file * file,unsigned int cmd)1707 static int smack_file_lock(struct file *file, unsigned int cmd)
1708 {
1709 struct smk_audit_info ad;
1710 int rc;
1711 struct inode *inode = file_inode(file);
1712
1713 if (unlikely(IS_PRIVATE(inode)))
1714 return 0;
1715
1716 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1717 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1718 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1719 rc = smk_bu_file(file, MAY_LOCK, rc);
1720 return rc;
1721 }
1722
1723 /**
1724 * smack_file_fcntl - Smack check on fcntl
1725 * @file: the object
1726 * @cmd: what action to check
1727 * @arg: unused
1728 *
1729 * Generally these operations are harmless.
1730 * File locking operations present an obvious mechanism
1731 * for passing information, so they require write access.
1732 *
1733 * Returns 0 if current has access, error code otherwise
1734 */
smack_file_fcntl(struct file * file,unsigned int cmd,unsigned long arg)1735 static int smack_file_fcntl(struct file *file, unsigned int cmd,
1736 unsigned long arg)
1737 {
1738 struct smk_audit_info ad;
1739 int rc = 0;
1740 struct inode *inode = file_inode(file);
1741
1742 if (unlikely(IS_PRIVATE(inode)))
1743 return 0;
1744
1745 switch (cmd) {
1746 case F_GETLK:
1747 break;
1748 case F_SETLK:
1749 case F_SETLKW:
1750 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1751 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1752 rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1753 rc = smk_bu_file(file, MAY_LOCK, rc);
1754 break;
1755 case F_SETOWN:
1756 case F_SETSIG:
1757 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1758 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1759 rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1760 rc = smk_bu_file(file, MAY_WRITE, rc);
1761 break;
1762 default:
1763 break;
1764 }
1765
1766 return rc;
1767 }
1768
1769 /**
1770 * smack_mmap_file - Check permissions for a mmap operation.
1771 * @file: contains the file structure for file to map (may be NULL).
1772 * @reqprot: contains the protection requested by the application.
1773 * @prot: contains the protection that will be applied by the kernel.
1774 * @flags: contains the operational flags.
1775 *
1776 * The @file may be NULL, e.g. if mapping anonymous memory.
1777 *
1778 * Return 0 if permission is granted.
1779 */
smack_mmap_file(struct file * file,unsigned long reqprot,unsigned long prot,unsigned long flags)1780 static int smack_mmap_file(struct file *file,
1781 unsigned long reqprot, unsigned long prot,
1782 unsigned long flags)
1783 {
1784 struct smack_known *skp;
1785 struct smack_known *mkp;
1786 struct smack_rule *srp;
1787 struct task_smack *tsp;
1788 struct smack_known *okp;
1789 struct inode_smack *isp;
1790 struct superblock_smack *sbsp;
1791 int may;
1792 int mmay;
1793 int tmay;
1794 int rc;
1795
1796 if (file == NULL)
1797 return 0;
1798
1799 if (unlikely(IS_PRIVATE(file_inode(file))))
1800 return 0;
1801
1802 isp = smack_inode(file_inode(file));
1803 if (isp->smk_mmap == NULL)
1804 return 0;
1805 sbsp = smack_superblock(file_inode(file)->i_sb);
1806 if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
1807 isp->smk_mmap != sbsp->smk_root)
1808 return -EACCES;
1809 mkp = isp->smk_mmap;
1810
1811 tsp = smack_cred(current_cred());
1812 skp = smk_of_current();
1813 rc = 0;
1814
1815 rcu_read_lock();
1816 /*
1817 * For each Smack rule associated with the subject
1818 * label verify that the SMACK64MMAP also has access
1819 * to that rule's object label.
1820 */
1821 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1822 okp = srp->smk_object;
1823 /*
1824 * Matching labels always allows access.
1825 */
1826 if (mkp->smk_known == okp->smk_known)
1827 continue;
1828 /*
1829 * If there is a matching local rule take
1830 * that into account as well.
1831 */
1832 may = smk_access_entry(srp->smk_subject->smk_known,
1833 okp->smk_known,
1834 &tsp->smk_rules);
1835 if (may == -ENOENT)
1836 may = srp->smk_access;
1837 else
1838 may &= srp->smk_access;
1839 /*
1840 * If may is zero the SMACK64MMAP subject can't
1841 * possibly have less access.
1842 */
1843 if (may == 0)
1844 continue;
1845
1846 /*
1847 * Fetch the global list entry.
1848 * If there isn't one a SMACK64MMAP subject
1849 * can't have as much access as current.
1850 */
1851 mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1852 &mkp->smk_rules);
1853 if (mmay == -ENOENT) {
1854 rc = -EACCES;
1855 break;
1856 }
1857 /*
1858 * If there is a local entry it modifies the
1859 * potential access, too.
1860 */
1861 tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1862 &tsp->smk_rules);
1863 if (tmay != -ENOENT)
1864 mmay &= tmay;
1865
1866 /*
1867 * If there is any access available to current that is
1868 * not available to a SMACK64MMAP subject
1869 * deny access.
1870 */
1871 if ((may | mmay) != mmay) {
1872 rc = -EACCES;
1873 break;
1874 }
1875 }
1876
1877 rcu_read_unlock();
1878
1879 return rc;
1880 }
1881
1882 /**
1883 * smack_file_set_fowner - set the file security blob value
1884 * @file: object in question
1885 *
1886 */
smack_file_set_fowner(struct file * file)1887 static void smack_file_set_fowner(struct file *file)
1888 {
1889 struct smack_known **blob = smack_file(file);
1890
1891 *blob = smk_of_current();
1892 }
1893
1894 /**
1895 * smack_file_send_sigiotask - Smack on sigio
1896 * @tsk: The target task
1897 * @fown: the object the signal come from
1898 * @signum: unused
1899 *
1900 * Allow a privileged task to get signals even if it shouldn't
1901 *
1902 * Returns 0 if a subject with the object's smack could
1903 * write to the task, an error code otherwise.
1904 */
smack_file_send_sigiotask(struct task_struct * tsk,struct fown_struct * fown,int signum)1905 static int smack_file_send_sigiotask(struct task_struct *tsk,
1906 struct fown_struct *fown, int signum)
1907 {
1908 struct smack_known **blob;
1909 struct smack_known *skp;
1910 struct smack_known *tkp = smk_of_task(smack_cred(tsk->cred));
1911 const struct cred *tcred;
1912 struct file *file;
1913 int rc;
1914 struct smk_audit_info ad;
1915
1916 /*
1917 * struct fown_struct is never outside the context of a struct file
1918 */
1919 file = container_of(fown, struct file, f_owner);
1920
1921 /* we don't log here as rc can be overriden */
1922 blob = smack_file(file);
1923 skp = *blob;
1924 rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
1925 rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
1926
1927 rcu_read_lock();
1928 tcred = __task_cred(tsk);
1929 if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
1930 rc = 0;
1931 rcu_read_unlock();
1932
1933 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1934 smk_ad_setfield_u_tsk(&ad, tsk);
1935 smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad);
1936 return rc;
1937 }
1938
1939 /**
1940 * smack_file_receive - Smack file receive check
1941 * @file: the object
1942 *
1943 * Returns 0 if current has access, error code otherwise
1944 */
smack_file_receive(struct file * file)1945 static int smack_file_receive(struct file *file)
1946 {
1947 int rc;
1948 int may = 0;
1949 struct smk_audit_info ad;
1950 struct inode *inode = file_inode(file);
1951 struct socket *sock;
1952 struct task_smack *tsp;
1953 struct socket_smack *ssp;
1954
1955 if (unlikely(IS_PRIVATE(inode)))
1956 return 0;
1957
1958 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1959 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1960
1961 if (inode->i_sb->s_magic == SOCKFS_MAGIC) {
1962 sock = SOCKET_I(inode);
1963 ssp = sock->sk->sk_security;
1964 tsp = smack_cred(current_cred());
1965 /*
1966 * If the receiving process can't write to the
1967 * passed socket or if the passed socket can't
1968 * write to the receiving process don't accept
1969 * the passed socket.
1970 */
1971 rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad);
1972 rc = smk_bu_file(file, may, rc);
1973 if (rc < 0)
1974 return rc;
1975 rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad);
1976 rc = smk_bu_file(file, may, rc);
1977 return rc;
1978 }
1979 /*
1980 * This code relies on bitmasks.
1981 */
1982 if (file->f_mode & FMODE_READ)
1983 may = MAY_READ;
1984 if (file->f_mode & FMODE_WRITE)
1985 may |= MAY_WRITE;
1986
1987 rc = smk_curacc(smk_of_inode(inode), may, &ad);
1988 rc = smk_bu_file(file, may, rc);
1989 return rc;
1990 }
1991
1992 /**
1993 * smack_file_open - Smack dentry open processing
1994 * @file: the object
1995 *
1996 * Set the security blob in the file structure.
1997 * Allow the open only if the task has read access. There are
1998 * many read operations (e.g. fstat) that you can do with an
1999 * fd even if you have the file open write-only.
2000 *
2001 * Returns 0 if current has access, error code otherwise
2002 */
smack_file_open(struct file * file)2003 static int smack_file_open(struct file *file)
2004 {
2005 struct task_smack *tsp = smack_cred(file->f_cred);
2006 struct inode *inode = file_inode(file);
2007 struct smk_audit_info ad;
2008 int rc;
2009
2010 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
2011 smk_ad_setfield_u_fs_path(&ad, file->f_path);
2012 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
2013 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
2014
2015 return rc;
2016 }
2017
2018 /*
2019 * Task hooks
2020 */
2021
2022 /**
2023 * smack_cred_alloc_blank - "allocate" blank task-level security credentials
2024 * @cred: the new credentials
2025 * @gfp: the atomicity of any memory allocations
2026 *
2027 * Prepare a blank set of credentials for modification. This must allocate all
2028 * the memory the LSM module might require such that cred_transfer() can
2029 * complete without error.
2030 */
smack_cred_alloc_blank(struct cred * cred,gfp_t gfp)2031 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
2032 {
2033 init_task_smack(smack_cred(cred), NULL, NULL);
2034 return 0;
2035 }
2036
2037
2038 /**
2039 * smack_cred_free - "free" task-level security credentials
2040 * @cred: the credentials in question
2041 *
2042 */
smack_cred_free(struct cred * cred)2043 static void smack_cred_free(struct cred *cred)
2044 {
2045 struct task_smack *tsp = smack_cred(cred);
2046 struct smack_rule *rp;
2047 struct list_head *l;
2048 struct list_head *n;
2049
2050 smk_destroy_label_list(&tsp->smk_relabel);
2051
2052 list_for_each_safe(l, n, &tsp->smk_rules) {
2053 rp = list_entry(l, struct smack_rule, list);
2054 list_del(&rp->list);
2055 kmem_cache_free(smack_rule_cache, rp);
2056 }
2057 }
2058
2059 /**
2060 * smack_cred_prepare - prepare new set of credentials for modification
2061 * @new: the new credentials
2062 * @old: the original credentials
2063 * @gfp: the atomicity of any memory allocations
2064 *
2065 * Prepare a new set of credentials for modification.
2066 */
smack_cred_prepare(struct cred * new,const struct cred * old,gfp_t gfp)2067 static int smack_cred_prepare(struct cred *new, const struct cred *old,
2068 gfp_t gfp)
2069 {
2070 struct task_smack *old_tsp = smack_cred(old);
2071 struct task_smack *new_tsp = smack_cred(new);
2072 int rc;
2073
2074 init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task);
2075
2076 rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
2077 if (rc != 0)
2078 return rc;
2079
2080 rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel,
2081 gfp);
2082 return rc;
2083 }
2084
2085 /**
2086 * smack_cred_transfer - Transfer the old credentials to the new credentials
2087 * @new: the new credentials
2088 * @old: the original credentials
2089 *
2090 * Fill in a set of blank credentials from another set of credentials.
2091 */
smack_cred_transfer(struct cred * new,const struct cred * old)2092 static void smack_cred_transfer(struct cred *new, const struct cred *old)
2093 {
2094 struct task_smack *old_tsp = smack_cred(old);
2095 struct task_smack *new_tsp = smack_cred(new);
2096
2097 new_tsp->smk_task = old_tsp->smk_task;
2098 new_tsp->smk_forked = old_tsp->smk_task;
2099 mutex_init(&new_tsp->smk_rules_lock);
2100 INIT_LIST_HEAD(&new_tsp->smk_rules);
2101
2102 /* cbs copy rule list */
2103 }
2104
2105 /**
2106 * smack_cred_getsecid - get the secid corresponding to a creds structure
2107 * @cred: the object creds
2108 * @secid: where to put the result
2109 *
2110 * Sets the secid to contain a u32 version of the smack label.
2111 */
smack_cred_getsecid(const struct cred * cred,u32 * secid)2112 static void smack_cred_getsecid(const struct cred *cred, u32 *secid)
2113 {
2114 struct smack_known *skp;
2115
2116 rcu_read_lock();
2117 skp = smk_of_task(smack_cred(cred));
2118 *secid = skp->smk_secid;
2119 rcu_read_unlock();
2120 }
2121
2122 /**
2123 * smack_kernel_act_as - Set the subjective context in a set of credentials
2124 * @new: points to the set of credentials to be modified.
2125 * @secid: specifies the security ID to be set
2126 *
2127 * Set the security data for a kernel service.
2128 */
smack_kernel_act_as(struct cred * new,u32 secid)2129 static int smack_kernel_act_as(struct cred *new, u32 secid)
2130 {
2131 struct task_smack *new_tsp = smack_cred(new);
2132
2133 new_tsp->smk_task = smack_from_secid(secid);
2134 return 0;
2135 }
2136
2137 /**
2138 * smack_kernel_create_files_as - Set the file creation label in a set of creds
2139 * @new: points to the set of credentials to be modified
2140 * @inode: points to the inode to use as a reference
2141 *
2142 * Set the file creation context in a set of credentials to the same
2143 * as the objective context of the specified inode
2144 */
smack_kernel_create_files_as(struct cred * new,struct inode * inode)2145 static int smack_kernel_create_files_as(struct cred *new,
2146 struct inode *inode)
2147 {
2148 struct inode_smack *isp = smack_inode(inode);
2149 struct task_smack *tsp = smack_cred(new);
2150
2151 tsp->smk_forked = isp->smk_inode;
2152 tsp->smk_task = tsp->smk_forked;
2153 return 0;
2154 }
2155
2156 /**
2157 * smk_curacc_on_task - helper to log task related access
2158 * @p: the task object
2159 * @access: the access requested
2160 * @caller: name of the calling function for audit
2161 *
2162 * Return 0 if access is permitted
2163 */
smk_curacc_on_task(struct task_struct * p,int access,const char * caller)2164 static int smk_curacc_on_task(struct task_struct *p, int access,
2165 const char *caller)
2166 {
2167 struct smk_audit_info ad;
2168 struct smack_known *skp = smk_of_task_struct_obj(p);
2169 int rc;
2170
2171 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
2172 smk_ad_setfield_u_tsk(&ad, p);
2173 rc = smk_curacc(skp, access, &ad);
2174 rc = smk_bu_task(p, access, rc);
2175 return rc;
2176 }
2177
2178 /**
2179 * smack_task_setpgid - Smack check on setting pgid
2180 * @p: the task object
2181 * @pgid: unused
2182 *
2183 * Return 0 if write access is permitted
2184 */
smack_task_setpgid(struct task_struct * p,pid_t pgid)2185 static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
2186 {
2187 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2188 }
2189
2190 /**
2191 * smack_task_getpgid - Smack access check for getpgid
2192 * @p: the object task
2193 *
2194 * Returns 0 if current can read the object task, error code otherwise
2195 */
smack_task_getpgid(struct task_struct * p)2196 static int smack_task_getpgid(struct task_struct *p)
2197 {
2198 return smk_curacc_on_task(p, MAY_READ, __func__);
2199 }
2200
2201 /**
2202 * smack_task_getsid - Smack access check for getsid
2203 * @p: the object task
2204 *
2205 * Returns 0 if current can read the object task, error code otherwise
2206 */
smack_task_getsid(struct task_struct * p)2207 static int smack_task_getsid(struct task_struct *p)
2208 {
2209 return smk_curacc_on_task(p, MAY_READ, __func__);
2210 }
2211
2212 /**
2213 * smack_current_getsecid_subj - get the subjective secid of the current task
2214 * @secid: where to put the result
2215 *
2216 * Sets the secid to contain a u32 version of the task's subjective smack label.
2217 */
smack_current_getsecid_subj(u32 * secid)2218 static void smack_current_getsecid_subj(u32 *secid)
2219 {
2220 struct smack_known *skp = smk_of_current();
2221
2222 *secid = skp->smk_secid;
2223 }
2224
2225 /**
2226 * smack_task_getsecid_obj - get the objective secid of the task
2227 * @p: the task
2228 * @secid: where to put the result
2229 *
2230 * Sets the secid to contain a u32 version of the task's objective smack label.
2231 */
smack_task_getsecid_obj(struct task_struct * p,u32 * secid)2232 static void smack_task_getsecid_obj(struct task_struct *p, u32 *secid)
2233 {
2234 struct smack_known *skp = smk_of_task_struct_obj(p);
2235
2236 *secid = skp->smk_secid;
2237 }
2238
2239 /**
2240 * smack_task_setnice - Smack check on setting nice
2241 * @p: the task object
2242 * @nice: unused
2243 *
2244 * Return 0 if write access is permitted
2245 */
smack_task_setnice(struct task_struct * p,int nice)2246 static int smack_task_setnice(struct task_struct *p, int nice)
2247 {
2248 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2249 }
2250
2251 /**
2252 * smack_task_setioprio - Smack check on setting ioprio
2253 * @p: the task object
2254 * @ioprio: unused
2255 *
2256 * Return 0 if write access is permitted
2257 */
smack_task_setioprio(struct task_struct * p,int ioprio)2258 static int smack_task_setioprio(struct task_struct *p, int ioprio)
2259 {
2260 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2261 }
2262
2263 /**
2264 * smack_task_getioprio - Smack check on reading ioprio
2265 * @p: the task object
2266 *
2267 * Return 0 if read access is permitted
2268 */
smack_task_getioprio(struct task_struct * p)2269 static int smack_task_getioprio(struct task_struct *p)
2270 {
2271 return smk_curacc_on_task(p, MAY_READ, __func__);
2272 }
2273
2274 /**
2275 * smack_task_setscheduler - Smack check on setting scheduler
2276 * @p: the task object
2277 *
2278 * Return 0 if read access is permitted
2279 */
smack_task_setscheduler(struct task_struct * p)2280 static int smack_task_setscheduler(struct task_struct *p)
2281 {
2282 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2283 }
2284
2285 /**
2286 * smack_task_getscheduler - Smack check on reading scheduler
2287 * @p: the task object
2288 *
2289 * Return 0 if read access is permitted
2290 */
smack_task_getscheduler(struct task_struct * p)2291 static int smack_task_getscheduler(struct task_struct *p)
2292 {
2293 return smk_curacc_on_task(p, MAY_READ, __func__);
2294 }
2295
2296 /**
2297 * smack_task_movememory - Smack check on moving memory
2298 * @p: the task object
2299 *
2300 * Return 0 if write access is permitted
2301 */
smack_task_movememory(struct task_struct * p)2302 static int smack_task_movememory(struct task_struct *p)
2303 {
2304 return smk_curacc_on_task(p, MAY_WRITE, __func__);
2305 }
2306
2307 /**
2308 * smack_task_kill - Smack check on signal delivery
2309 * @p: the task object
2310 * @info: unused
2311 * @sig: unused
2312 * @cred: identifies the cred to use in lieu of current's
2313 *
2314 * Return 0 if write access is permitted
2315 *
2316 */
smack_task_kill(struct task_struct * p,struct kernel_siginfo * info,int sig,const struct cred * cred)2317 static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info,
2318 int sig, const struct cred *cred)
2319 {
2320 struct smk_audit_info ad;
2321 struct smack_known *skp;
2322 struct smack_known *tkp = smk_of_task_struct_obj(p);
2323 int rc;
2324
2325 if (!sig)
2326 return 0; /* null signal; existence test */
2327
2328 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
2329 smk_ad_setfield_u_tsk(&ad, p);
2330 /*
2331 * Sending a signal requires that the sender
2332 * can write the receiver.
2333 */
2334 if (cred == NULL) {
2335 rc = smk_curacc(tkp, MAY_DELIVER, &ad);
2336 rc = smk_bu_task(p, MAY_DELIVER, rc);
2337 return rc;
2338 }
2339 /*
2340 * If the cred isn't NULL we're dealing with some USB IO
2341 * specific behavior. This is not clean. For one thing
2342 * we can't take privilege into account.
2343 */
2344 skp = smk_of_task(smack_cred(cred));
2345 rc = smk_access(skp, tkp, MAY_DELIVER, &ad);
2346 rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc);
2347 return rc;
2348 }
2349
2350 /**
2351 * smack_task_to_inode - copy task smack into the inode blob
2352 * @p: task to copy from
2353 * @inode: inode to copy to
2354 *
2355 * Sets the smack pointer in the inode security blob
2356 */
smack_task_to_inode(struct task_struct * p,struct inode * inode)2357 static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
2358 {
2359 struct inode_smack *isp = smack_inode(inode);
2360 struct smack_known *skp = smk_of_task_struct_obj(p);
2361
2362 isp->smk_inode = skp;
2363 isp->smk_flags |= SMK_INODE_INSTANT;
2364 }
2365
2366 /*
2367 * Socket hooks.
2368 */
2369
2370 /**
2371 * smack_sk_alloc_security - Allocate a socket blob
2372 * @sk: the socket
2373 * @family: unused
2374 * @gfp_flags: memory allocation flags
2375 *
2376 * Assign Smack pointers to current
2377 *
2378 * Returns 0 on success, -ENOMEM is there's no memory
2379 */
smack_sk_alloc_security(struct sock * sk,int family,gfp_t gfp_flags)2380 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
2381 {
2382 struct smack_known *skp = smk_of_current();
2383 struct socket_smack *ssp;
2384
2385 ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
2386 if (ssp == NULL)
2387 return -ENOMEM;
2388
2389 /*
2390 * Sockets created by kernel threads receive web label.
2391 */
2392 if (unlikely(current->flags & PF_KTHREAD)) {
2393 ssp->smk_in = &smack_known_web;
2394 ssp->smk_out = &smack_known_web;
2395 } else {
2396 ssp->smk_in = skp;
2397 ssp->smk_out = skp;
2398 }
2399 ssp->smk_packet = NULL;
2400
2401 sk->sk_security = ssp;
2402
2403 return 0;
2404 }
2405
2406 /**
2407 * smack_sk_free_security - Free a socket blob
2408 * @sk: the socket
2409 *
2410 * Clears the blob pointer
2411 */
smack_sk_free_security(struct sock * sk)2412 static void smack_sk_free_security(struct sock *sk)
2413 {
2414 #ifdef SMACK_IPV6_PORT_LABELING
2415 struct smk_port_label *spp;
2416
2417 if (sk->sk_family == PF_INET6) {
2418 rcu_read_lock();
2419 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2420 if (spp->smk_sock != sk)
2421 continue;
2422 spp->smk_can_reuse = 1;
2423 break;
2424 }
2425 rcu_read_unlock();
2426 }
2427 #endif
2428 kfree(sk->sk_security);
2429 }
2430
2431 /**
2432 * smack_sk_clone_security - Copy security context
2433 * @sk: the old socket
2434 * @newsk: the new socket
2435 *
2436 * Copy the security context of the old socket pointer to the cloned
2437 */
smack_sk_clone_security(const struct sock * sk,struct sock * newsk)2438 static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk)
2439 {
2440 struct socket_smack *ssp_old = sk->sk_security;
2441 struct socket_smack *ssp_new = newsk->sk_security;
2442
2443 *ssp_new = *ssp_old;
2444 }
2445
2446 /**
2447 * smack_ipv4host_label - check host based restrictions
2448 * @sip: the object end
2449 *
2450 * looks for host based access restrictions
2451 *
2452 * This version will only be appropriate for really small sets of single label
2453 * hosts. The caller is responsible for ensuring that the RCU read lock is
2454 * taken before calling this function.
2455 *
2456 * Returns the label of the far end or NULL if it's not special.
2457 */
smack_ipv4host_label(struct sockaddr_in * sip)2458 static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)
2459 {
2460 struct smk_net4addr *snp;
2461 struct in_addr *siap = &sip->sin_addr;
2462
2463 if (siap->s_addr == 0)
2464 return NULL;
2465
2466 list_for_each_entry_rcu(snp, &smk_net4addr_list, list)
2467 /*
2468 * we break after finding the first match because
2469 * the list is sorted from longest to shortest mask
2470 * so we have found the most specific match
2471 */
2472 if (snp->smk_host.s_addr ==
2473 (siap->s_addr & snp->smk_mask.s_addr))
2474 return snp->smk_label;
2475
2476 return NULL;
2477 }
2478
2479 /*
2480 * smk_ipv6_localhost - Check for local ipv6 host address
2481 * @sip: the address
2482 *
2483 * Returns boolean true if this is the localhost address
2484 */
smk_ipv6_localhost(struct sockaddr_in6 * sip)2485 static bool smk_ipv6_localhost(struct sockaddr_in6 *sip)
2486 {
2487 __be16 *be16p = (__be16 *)&sip->sin6_addr;
2488 __be32 *be32p = (__be32 *)&sip->sin6_addr;
2489
2490 if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 &&
2491 ntohs(be16p[7]) == 1)
2492 return true;
2493 return false;
2494 }
2495
2496 /**
2497 * smack_ipv6host_label - check host based restrictions
2498 * @sip: the object end
2499 *
2500 * looks for host based access restrictions
2501 *
2502 * This version will only be appropriate for really small sets of single label
2503 * hosts. The caller is responsible for ensuring that the RCU read lock is
2504 * taken before calling this function.
2505 *
2506 * Returns the label of the far end or NULL if it's not special.
2507 */
smack_ipv6host_label(struct sockaddr_in6 * sip)2508 static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip)
2509 {
2510 struct smk_net6addr *snp;
2511 struct in6_addr *sap = &sip->sin6_addr;
2512 int i;
2513 int found = 0;
2514
2515 /*
2516 * It's local. Don't look for a host label.
2517 */
2518 if (smk_ipv6_localhost(sip))
2519 return NULL;
2520
2521 list_for_each_entry_rcu(snp, &smk_net6addr_list, list) {
2522 /*
2523 * If the label is NULL the entry has
2524 * been renounced. Ignore it.
2525 */
2526 if (snp->smk_label == NULL)
2527 continue;
2528 /*
2529 * we break after finding the first match because
2530 * the list is sorted from longest to shortest mask
2531 * so we have found the most specific match
2532 */
2533 for (found = 1, i = 0; i < 8; i++) {
2534 if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) !=
2535 snp->smk_host.s6_addr16[i]) {
2536 found = 0;
2537 break;
2538 }
2539 }
2540 if (found)
2541 return snp->smk_label;
2542 }
2543
2544 return NULL;
2545 }
2546
2547 /**
2548 * smack_netlbl_add - Set the secattr on a socket
2549 * @sk: the socket
2550 *
2551 * Attach the outbound smack value (smk_out) to the socket.
2552 *
2553 * Returns 0 on success or an error code
2554 */
smack_netlbl_add(struct sock * sk)2555 static int smack_netlbl_add(struct sock *sk)
2556 {
2557 struct socket_smack *ssp = sk->sk_security;
2558 struct smack_known *skp = ssp->smk_out;
2559 int rc;
2560
2561 local_bh_disable();
2562 bh_lock_sock_nested(sk);
2563
2564 rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel);
2565 switch (rc) {
2566 case 0:
2567 ssp->smk_state = SMK_NETLBL_LABELED;
2568 break;
2569 case -EDESTADDRREQ:
2570 ssp->smk_state = SMK_NETLBL_REQSKB;
2571 rc = 0;
2572 break;
2573 }
2574
2575 bh_unlock_sock(sk);
2576 local_bh_enable();
2577
2578 return rc;
2579 }
2580
2581 /**
2582 * smack_netlbl_delete - Remove the secattr from a socket
2583 * @sk: the socket
2584 *
2585 * Remove the outbound smack value from a socket
2586 */
smack_netlbl_delete(struct sock * sk)2587 static void smack_netlbl_delete(struct sock *sk)
2588 {
2589 struct socket_smack *ssp = sk->sk_security;
2590
2591 /*
2592 * Take the label off the socket if one is set.
2593 */
2594 if (ssp->smk_state != SMK_NETLBL_LABELED)
2595 return;
2596
2597 local_bh_disable();
2598 bh_lock_sock_nested(sk);
2599 netlbl_sock_delattr(sk);
2600 bh_unlock_sock(sk);
2601 local_bh_enable();
2602 ssp->smk_state = SMK_NETLBL_UNLABELED;
2603 }
2604
2605 /**
2606 * smk_ipv4_check - Perform IPv4 host access checks
2607 * @sk: the socket
2608 * @sap: the destination address
2609 *
2610 * Set the correct secattr for the given socket based on the destination
2611 * address and perform any outbound access checks needed.
2612 *
2613 * Returns 0 on success or an error code.
2614 *
2615 */
smk_ipv4_check(struct sock * sk,struct sockaddr_in * sap)2616 static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)
2617 {
2618 struct smack_known *skp;
2619 int rc = 0;
2620 struct smack_known *hkp;
2621 struct socket_smack *ssp = sk->sk_security;
2622 struct smk_audit_info ad;
2623
2624 rcu_read_lock();
2625 hkp = smack_ipv4host_label(sap);
2626 if (hkp != NULL) {
2627 #ifdef CONFIG_AUDIT
2628 struct lsm_network_audit net;
2629
2630 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2631 ad.a.u.net->family = sap->sin_family;
2632 ad.a.u.net->dport = sap->sin_port;
2633 ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
2634 #endif
2635 skp = ssp->smk_out;
2636 rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2637 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2638 /*
2639 * Clear the socket netlabel if it's set.
2640 */
2641 if (!rc)
2642 smack_netlbl_delete(sk);
2643 }
2644 rcu_read_unlock();
2645
2646 return rc;
2647 }
2648
2649 /**
2650 * smk_ipv6_check - check Smack access
2651 * @subject: subject Smack label
2652 * @object: object Smack label
2653 * @address: address
2654 * @act: the action being taken
2655 *
2656 * Check an IPv6 access
2657 */
smk_ipv6_check(struct smack_known * subject,struct smack_known * object,struct sockaddr_in6 * address,int act)2658 static int smk_ipv6_check(struct smack_known *subject,
2659 struct smack_known *object,
2660 struct sockaddr_in6 *address, int act)
2661 {
2662 #ifdef CONFIG_AUDIT
2663 struct lsm_network_audit net;
2664 #endif
2665 struct smk_audit_info ad;
2666 int rc;
2667
2668 #ifdef CONFIG_AUDIT
2669 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2670 ad.a.u.net->family = PF_INET6;
2671 ad.a.u.net->dport = address->sin6_port;
2672 if (act == SMK_RECEIVING)
2673 ad.a.u.net->v6info.saddr = address->sin6_addr;
2674 else
2675 ad.a.u.net->v6info.daddr = address->sin6_addr;
2676 #endif
2677 rc = smk_access(subject, object, MAY_WRITE, &ad);
2678 rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc);
2679 return rc;
2680 }
2681
2682 #ifdef SMACK_IPV6_PORT_LABELING
2683 /**
2684 * smk_ipv6_port_label - Smack port access table management
2685 * @sock: socket
2686 * @address: address
2687 *
2688 * Create or update the port list entry
2689 */
smk_ipv6_port_label(struct socket * sock,struct sockaddr * address)2690 static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address)
2691 {
2692 struct sock *sk = sock->sk;
2693 struct sockaddr_in6 *addr6;
2694 struct socket_smack *ssp = sock->sk->sk_security;
2695 struct smk_port_label *spp;
2696 unsigned short port = 0;
2697
2698 if (address == NULL) {
2699 /*
2700 * This operation is changing the Smack information
2701 * on the bound socket. Take the changes to the port
2702 * as well.
2703 */
2704 rcu_read_lock();
2705 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2706 if (sk != spp->smk_sock)
2707 continue;
2708 spp->smk_in = ssp->smk_in;
2709 spp->smk_out = ssp->smk_out;
2710 rcu_read_unlock();
2711 return;
2712 }
2713 /*
2714 * A NULL address is only used for updating existing
2715 * bound entries. If there isn't one, it's OK.
2716 */
2717 rcu_read_unlock();
2718 return;
2719 }
2720
2721 addr6 = (struct sockaddr_in6 *)address;
2722 port = ntohs(addr6->sin6_port);
2723 /*
2724 * This is a special case that is safely ignored.
2725 */
2726 if (port == 0)
2727 return;
2728
2729 /*
2730 * Look for an existing port list entry.
2731 * This is an indication that a port is getting reused.
2732 */
2733 rcu_read_lock();
2734 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2735 if (spp->smk_port != port || spp->smk_sock_type != sock->type)
2736 continue;
2737 if (spp->smk_can_reuse != 1) {
2738 rcu_read_unlock();
2739 return;
2740 }
2741 spp->smk_port = port;
2742 spp->smk_sock = sk;
2743 spp->smk_in = ssp->smk_in;
2744 spp->smk_out = ssp->smk_out;
2745 spp->smk_can_reuse = 0;
2746 rcu_read_unlock();
2747 return;
2748 }
2749 rcu_read_unlock();
2750 /*
2751 * A new port entry is required.
2752 */
2753 spp = kzalloc(sizeof(*spp), GFP_KERNEL);
2754 if (spp == NULL)
2755 return;
2756
2757 spp->smk_port = port;
2758 spp->smk_sock = sk;
2759 spp->smk_in = ssp->smk_in;
2760 spp->smk_out = ssp->smk_out;
2761 spp->smk_sock_type = sock->type;
2762 spp->smk_can_reuse = 0;
2763
2764 mutex_lock(&smack_ipv6_lock);
2765 list_add_rcu(&spp->list, &smk_ipv6_port_list);
2766 mutex_unlock(&smack_ipv6_lock);
2767 return;
2768 }
2769
2770 /**
2771 * smk_ipv6_port_check - check Smack port access
2772 * @sk: socket
2773 * @address: address
2774 * @act: the action being taken
2775 *
2776 * Create or update the port list entry
2777 */
smk_ipv6_port_check(struct sock * sk,struct sockaddr_in6 * address,int act)2778 static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2779 int act)
2780 {
2781 struct smk_port_label *spp;
2782 struct socket_smack *ssp = sk->sk_security;
2783 struct smack_known *skp = NULL;
2784 unsigned short port;
2785 struct smack_known *object;
2786
2787 if (act == SMK_RECEIVING) {
2788 skp = smack_ipv6host_label(address);
2789 object = ssp->smk_in;
2790 } else {
2791 skp = ssp->smk_out;
2792 object = smack_ipv6host_label(address);
2793 }
2794
2795 /*
2796 * The other end is a single label host.
2797 */
2798 if (skp != NULL && object != NULL)
2799 return smk_ipv6_check(skp, object, address, act);
2800 if (skp == NULL)
2801 skp = smack_net_ambient;
2802 if (object == NULL)
2803 object = smack_net_ambient;
2804
2805 /*
2806 * It's remote, so port lookup does no good.
2807 */
2808 if (!smk_ipv6_localhost(address))
2809 return smk_ipv6_check(skp, object, address, act);
2810
2811 /*
2812 * It's local so the send check has to have passed.
2813 */
2814 if (act == SMK_RECEIVING)
2815 return 0;
2816
2817 port = ntohs(address->sin6_port);
2818 rcu_read_lock();
2819 list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2820 if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type)
2821 continue;
2822 object = spp->smk_in;
2823 if (act == SMK_CONNECTING)
2824 ssp->smk_packet = spp->smk_out;
2825 break;
2826 }
2827 rcu_read_unlock();
2828
2829 return smk_ipv6_check(skp, object, address, act);
2830 }
2831 #endif
2832
2833 /**
2834 * smack_inode_setsecurity - set smack xattrs
2835 * @inode: the object
2836 * @name: attribute name
2837 * @value: attribute value
2838 * @size: size of the attribute
2839 * @flags: unused
2840 *
2841 * Sets the named attribute in the appropriate blob
2842 *
2843 * Returns 0 on success, or an error code
2844 */
smack_inode_setsecurity(struct inode * inode,const char * name,const void * value,size_t size,int flags)2845 static int smack_inode_setsecurity(struct inode *inode, const char *name,
2846 const void *value, size_t size, int flags)
2847 {
2848 struct smack_known *skp;
2849 struct inode_smack *nsp = smack_inode(inode);
2850 struct socket_smack *ssp;
2851 struct socket *sock;
2852 int rc = 0;
2853
2854 if (value == NULL || size > SMK_LONGLABEL || size == 0)
2855 return -EINVAL;
2856
2857 if (strcmp(name, XATTR_SMACK_TRANSMUTE) == 0) {
2858 if (!S_ISDIR(inode->i_mode) || size != TRANS_TRUE_SIZE ||
2859 strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
2860 return -EINVAL;
2861
2862 nsp->smk_flags |= SMK_INODE_TRANSMUTE;
2863 return 0;
2864 }
2865
2866 skp = smk_import_entry(value, size);
2867 if (IS_ERR(skp))
2868 return PTR_ERR(skp);
2869
2870 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2871 nsp->smk_inode = skp;
2872 nsp->smk_flags |= SMK_INODE_INSTANT;
2873 return 0;
2874 }
2875 /*
2876 * The rest of the Smack xattrs are only on sockets.
2877 */
2878 if (inode->i_sb->s_magic != SOCKFS_MAGIC)
2879 return -EOPNOTSUPP;
2880
2881 sock = SOCKET_I(inode);
2882 if (sock == NULL || sock->sk == NULL)
2883 return -EOPNOTSUPP;
2884
2885 ssp = sock->sk->sk_security;
2886
2887 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
2888 ssp->smk_in = skp;
2889 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
2890 ssp->smk_out = skp;
2891 if (sock->sk->sk_family == PF_INET) {
2892 rc = smack_netlbl_add(sock->sk);
2893 if (rc != 0)
2894 printk(KERN_WARNING
2895 "Smack: \"%s\" netlbl error %d.\n",
2896 __func__, -rc);
2897 }
2898 } else
2899 return -EOPNOTSUPP;
2900
2901 #ifdef SMACK_IPV6_PORT_LABELING
2902 if (sock->sk->sk_family == PF_INET6)
2903 smk_ipv6_port_label(sock, NULL);
2904 #endif
2905
2906 return 0;
2907 }
2908
2909 /**
2910 * smack_socket_post_create - finish socket setup
2911 * @sock: the socket
2912 * @family: protocol family
2913 * @type: unused
2914 * @protocol: unused
2915 * @kern: unused
2916 *
2917 * Sets the netlabel information on the socket
2918 *
2919 * Returns 0 on success, and error code otherwise
2920 */
smack_socket_post_create(struct socket * sock,int family,int type,int protocol,int kern)2921 static int smack_socket_post_create(struct socket *sock, int family,
2922 int type, int protocol, int kern)
2923 {
2924 struct socket_smack *ssp;
2925
2926 if (sock->sk == NULL)
2927 return 0;
2928
2929 /*
2930 * Sockets created by kernel threads receive web label.
2931 */
2932 if (unlikely(current->flags & PF_KTHREAD)) {
2933 ssp = sock->sk->sk_security;
2934 ssp->smk_in = &smack_known_web;
2935 ssp->smk_out = &smack_known_web;
2936 }
2937
2938 if (family != PF_INET)
2939 return 0;
2940 /*
2941 * Set the outbound netlbl.
2942 */
2943 return smack_netlbl_add(sock->sk);
2944 }
2945
2946 /**
2947 * smack_socket_socketpair - create socket pair
2948 * @socka: one socket
2949 * @sockb: another socket
2950 *
2951 * Cross reference the peer labels for SO_PEERSEC
2952 *
2953 * Returns 0
2954 */
smack_socket_socketpair(struct socket * socka,struct socket * sockb)2955 static int smack_socket_socketpair(struct socket *socka,
2956 struct socket *sockb)
2957 {
2958 struct socket_smack *asp = socka->sk->sk_security;
2959 struct socket_smack *bsp = sockb->sk->sk_security;
2960
2961 asp->smk_packet = bsp->smk_out;
2962 bsp->smk_packet = asp->smk_out;
2963
2964 return 0;
2965 }
2966
2967 #ifdef SMACK_IPV6_PORT_LABELING
2968 /**
2969 * smack_socket_bind - record port binding information.
2970 * @sock: the socket
2971 * @address: the port address
2972 * @addrlen: size of the address
2973 *
2974 * Records the label bound to a port.
2975 *
2976 * Returns 0 on success, and error code otherwise
2977 */
smack_socket_bind(struct socket * sock,struct sockaddr * address,int addrlen)2978 static int smack_socket_bind(struct socket *sock, struct sockaddr *address,
2979 int addrlen)
2980 {
2981 if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) {
2982 if (addrlen < SIN6_LEN_RFC2133 ||
2983 address->sa_family != AF_INET6)
2984 return -EINVAL;
2985 smk_ipv6_port_label(sock, address);
2986 }
2987 return 0;
2988 }
2989 #endif /* SMACK_IPV6_PORT_LABELING */
2990
2991 /**
2992 * smack_socket_connect - connect access check
2993 * @sock: the socket
2994 * @sap: the other end
2995 * @addrlen: size of sap
2996 *
2997 * Verifies that a connection may be possible
2998 *
2999 * Returns 0 on success, and error code otherwise
3000 */
smack_socket_connect(struct socket * sock,struct sockaddr * sap,int addrlen)3001 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
3002 int addrlen)
3003 {
3004 int rc = 0;
3005
3006 if (sock->sk == NULL)
3007 return 0;
3008 if (sock->sk->sk_family != PF_INET &&
3009 (!IS_ENABLED(CONFIG_IPV6) || sock->sk->sk_family != PF_INET6))
3010 return 0;
3011 if (addrlen < offsetofend(struct sockaddr, sa_family))
3012 return 0;
3013 if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) {
3014 struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
3015 struct smack_known *rsp = NULL;
3016
3017 if (addrlen < SIN6_LEN_RFC2133)
3018 return 0;
3019 if (__is_defined(SMACK_IPV6_SECMARK_LABELING))
3020 rsp = smack_ipv6host_label(sip);
3021 if (rsp != NULL) {
3022 struct socket_smack *ssp = sock->sk->sk_security;
3023
3024 rc = smk_ipv6_check(ssp->smk_out, rsp, sip,
3025 SMK_CONNECTING);
3026 }
3027 #ifdef SMACK_IPV6_PORT_LABELING
3028 rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);
3029 #endif
3030
3031 return rc;
3032 }
3033 if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in))
3034 return 0;
3035 rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap);
3036 return rc;
3037 }
3038
3039 /**
3040 * smack_flags_to_may - convert S_ to MAY_ values
3041 * @flags: the S_ value
3042 *
3043 * Returns the equivalent MAY_ value
3044 */
smack_flags_to_may(int flags)3045 static int smack_flags_to_may(int flags)
3046 {
3047 int may = 0;
3048
3049 if (flags & S_IRUGO)
3050 may |= MAY_READ;
3051 if (flags & S_IWUGO)
3052 may |= MAY_WRITE;
3053 if (flags & S_IXUGO)
3054 may |= MAY_EXEC;
3055
3056 return may;
3057 }
3058
3059 /**
3060 * smack_msg_msg_alloc_security - Set the security blob for msg_msg
3061 * @msg: the object
3062 *
3063 * Returns 0
3064 */
smack_msg_msg_alloc_security(struct msg_msg * msg)3065 static int smack_msg_msg_alloc_security(struct msg_msg *msg)
3066 {
3067 struct smack_known **blob = smack_msg_msg(msg);
3068
3069 *blob = smk_of_current();
3070 return 0;
3071 }
3072
3073 /**
3074 * smack_of_ipc - the smack pointer for the ipc
3075 * @isp: the object
3076 *
3077 * Returns a pointer to the smack value
3078 */
smack_of_ipc(struct kern_ipc_perm * isp)3079 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)
3080 {
3081 struct smack_known **blob = smack_ipc(isp);
3082
3083 return *blob;
3084 }
3085
3086 /**
3087 * smack_ipc_alloc_security - Set the security blob for ipc
3088 * @isp: the object
3089 *
3090 * Returns 0
3091 */
smack_ipc_alloc_security(struct kern_ipc_perm * isp)3092 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp)
3093 {
3094 struct smack_known **blob = smack_ipc(isp);
3095
3096 *blob = smk_of_current();
3097 return 0;
3098 }
3099
3100 /**
3101 * smk_curacc_shm : check if current has access on shm
3102 * @isp : the object
3103 * @access : access requested
3104 *
3105 * Returns 0 if current has the requested access, error code otherwise
3106 */
smk_curacc_shm(struct kern_ipc_perm * isp,int access)3107 static int smk_curacc_shm(struct kern_ipc_perm *isp, int access)
3108 {
3109 struct smack_known *ssp = smack_of_ipc(isp);
3110 struct smk_audit_info ad;
3111 int rc;
3112
3113 #ifdef CONFIG_AUDIT
3114 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3115 ad.a.u.ipc_id = isp->id;
3116 #endif
3117 rc = smk_curacc(ssp, access, &ad);
3118 rc = smk_bu_current("shm", ssp, access, rc);
3119 return rc;
3120 }
3121
3122 /**
3123 * smack_shm_associate - Smack access check for shm
3124 * @isp: the object
3125 * @shmflg: access requested
3126 *
3127 * Returns 0 if current has the requested access, error code otherwise
3128 */
smack_shm_associate(struct kern_ipc_perm * isp,int shmflg)3129 static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg)
3130 {
3131 int may;
3132
3133 may = smack_flags_to_may(shmflg);
3134 return smk_curacc_shm(isp, may);
3135 }
3136
3137 /**
3138 * smack_shm_shmctl - Smack access check for shm
3139 * @isp: the object
3140 * @cmd: what it wants to do
3141 *
3142 * Returns 0 if current has the requested access, error code otherwise
3143 */
smack_shm_shmctl(struct kern_ipc_perm * isp,int cmd)3144 static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd)
3145 {
3146 int may;
3147
3148 switch (cmd) {
3149 case IPC_STAT:
3150 case SHM_STAT:
3151 case SHM_STAT_ANY:
3152 may = MAY_READ;
3153 break;
3154 case IPC_SET:
3155 case SHM_LOCK:
3156 case SHM_UNLOCK:
3157 case IPC_RMID:
3158 may = MAY_READWRITE;
3159 break;
3160 case IPC_INFO:
3161 case SHM_INFO:
3162 /*
3163 * System level information.
3164 */
3165 return 0;
3166 default:
3167 return -EINVAL;
3168 }
3169 return smk_curacc_shm(isp, may);
3170 }
3171
3172 /**
3173 * smack_shm_shmat - Smack access for shmat
3174 * @isp: the object
3175 * @shmaddr: unused
3176 * @shmflg: access requested
3177 *
3178 * Returns 0 if current has the requested access, error code otherwise
3179 */
smack_shm_shmat(struct kern_ipc_perm * isp,char __user * shmaddr,int shmflg)3180 static int smack_shm_shmat(struct kern_ipc_perm *isp, char __user *shmaddr,
3181 int shmflg)
3182 {
3183 int may;
3184
3185 may = smack_flags_to_may(shmflg);
3186 return smk_curacc_shm(isp, may);
3187 }
3188
3189 /**
3190 * smk_curacc_sem : check if current has access on sem
3191 * @isp : the object
3192 * @access : access requested
3193 *
3194 * Returns 0 if current has the requested access, error code otherwise
3195 */
smk_curacc_sem(struct kern_ipc_perm * isp,int access)3196 static int smk_curacc_sem(struct kern_ipc_perm *isp, int access)
3197 {
3198 struct smack_known *ssp = smack_of_ipc(isp);
3199 struct smk_audit_info ad;
3200 int rc;
3201
3202 #ifdef CONFIG_AUDIT
3203 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3204 ad.a.u.ipc_id = isp->id;
3205 #endif
3206 rc = smk_curacc(ssp, access, &ad);
3207 rc = smk_bu_current("sem", ssp, access, rc);
3208 return rc;
3209 }
3210
3211 /**
3212 * smack_sem_associate - Smack access check for sem
3213 * @isp: the object
3214 * @semflg: access requested
3215 *
3216 * Returns 0 if current has the requested access, error code otherwise
3217 */
smack_sem_associate(struct kern_ipc_perm * isp,int semflg)3218 static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg)
3219 {
3220 int may;
3221
3222 may = smack_flags_to_may(semflg);
3223 return smk_curacc_sem(isp, may);
3224 }
3225
3226 /**
3227 * smack_sem_semctl - Smack access check for sem
3228 * @isp: the object
3229 * @cmd: what it wants to do
3230 *
3231 * Returns 0 if current has the requested access, error code otherwise
3232 */
smack_sem_semctl(struct kern_ipc_perm * isp,int cmd)3233 static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd)
3234 {
3235 int may;
3236
3237 switch (cmd) {
3238 case GETPID:
3239 case GETNCNT:
3240 case GETZCNT:
3241 case GETVAL:
3242 case GETALL:
3243 case IPC_STAT:
3244 case SEM_STAT:
3245 case SEM_STAT_ANY:
3246 may = MAY_READ;
3247 break;
3248 case SETVAL:
3249 case SETALL:
3250 case IPC_RMID:
3251 case IPC_SET:
3252 may = MAY_READWRITE;
3253 break;
3254 case IPC_INFO:
3255 case SEM_INFO:
3256 /*
3257 * System level information
3258 */
3259 return 0;
3260 default:
3261 return -EINVAL;
3262 }
3263
3264 return smk_curacc_sem(isp, may);
3265 }
3266
3267 /**
3268 * smack_sem_semop - Smack checks of semaphore operations
3269 * @isp: the object
3270 * @sops: unused
3271 * @nsops: unused
3272 * @alter: unused
3273 *
3274 * Treated as read and write in all cases.
3275 *
3276 * Returns 0 if access is allowed, error code otherwise
3277 */
smack_sem_semop(struct kern_ipc_perm * isp,struct sembuf * sops,unsigned nsops,int alter)3278 static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops,
3279 unsigned nsops, int alter)
3280 {
3281 return smk_curacc_sem(isp, MAY_READWRITE);
3282 }
3283
3284 /**
3285 * smk_curacc_msq : helper to check if current has access on msq
3286 * @isp : the msq
3287 * @access : access requested
3288 *
3289 * return 0 if current has access, error otherwise
3290 */
smk_curacc_msq(struct kern_ipc_perm * isp,int access)3291 static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
3292 {
3293 struct smack_known *msp = smack_of_ipc(isp);
3294 struct smk_audit_info ad;
3295 int rc;
3296
3297 #ifdef CONFIG_AUDIT
3298 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3299 ad.a.u.ipc_id = isp->id;
3300 #endif
3301 rc = smk_curacc(msp, access, &ad);
3302 rc = smk_bu_current("msq", msp, access, rc);
3303 return rc;
3304 }
3305
3306 /**
3307 * smack_msg_queue_associate - Smack access check for msg_queue
3308 * @isp: the object
3309 * @msqflg: access requested
3310 *
3311 * Returns 0 if current has the requested access, error code otherwise
3312 */
smack_msg_queue_associate(struct kern_ipc_perm * isp,int msqflg)3313 static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg)
3314 {
3315 int may;
3316
3317 may = smack_flags_to_may(msqflg);
3318 return smk_curacc_msq(isp, may);
3319 }
3320
3321 /**
3322 * smack_msg_queue_msgctl - Smack access check for msg_queue
3323 * @isp: the object
3324 * @cmd: what it wants to do
3325 *
3326 * Returns 0 if current has the requested access, error code otherwise
3327 */
smack_msg_queue_msgctl(struct kern_ipc_perm * isp,int cmd)3328 static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd)
3329 {
3330 int may;
3331
3332 switch (cmd) {
3333 case IPC_STAT:
3334 case MSG_STAT:
3335 case MSG_STAT_ANY:
3336 may = MAY_READ;
3337 break;
3338 case IPC_SET:
3339 case IPC_RMID:
3340 may = MAY_READWRITE;
3341 break;
3342 case IPC_INFO:
3343 case MSG_INFO:
3344 /*
3345 * System level information
3346 */
3347 return 0;
3348 default:
3349 return -EINVAL;
3350 }
3351
3352 return smk_curacc_msq(isp, may);
3353 }
3354
3355 /**
3356 * smack_msg_queue_msgsnd - Smack access check for msg_queue
3357 * @isp: the object
3358 * @msg: unused
3359 * @msqflg: access requested
3360 *
3361 * Returns 0 if current has the requested access, error code otherwise
3362 */
smack_msg_queue_msgsnd(struct kern_ipc_perm * isp,struct msg_msg * msg,int msqflg)3363 static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg,
3364 int msqflg)
3365 {
3366 int may;
3367
3368 may = smack_flags_to_may(msqflg);
3369 return smk_curacc_msq(isp, may);
3370 }
3371
3372 /**
3373 * smack_msg_queue_msgrcv - Smack access check for msg_queue
3374 * @isp: the object
3375 * @msg: unused
3376 * @target: unused
3377 * @type: unused
3378 * @mode: unused
3379 *
3380 * Returns 0 if current has read and write access, error code otherwise
3381 */
smack_msg_queue_msgrcv(struct kern_ipc_perm * isp,struct msg_msg * msg,struct task_struct * target,long type,int mode)3382 static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp,
3383 struct msg_msg *msg,
3384 struct task_struct *target, long type,
3385 int mode)
3386 {
3387 return smk_curacc_msq(isp, MAY_READWRITE);
3388 }
3389
3390 /**
3391 * smack_ipc_permission - Smack access for ipc_permission()
3392 * @ipp: the object permissions
3393 * @flag: access requested
3394 *
3395 * Returns 0 if current has read and write access, error code otherwise
3396 */
smack_ipc_permission(struct kern_ipc_perm * ipp,short flag)3397 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
3398 {
3399 struct smack_known **blob = smack_ipc(ipp);
3400 struct smack_known *iskp = *blob;
3401 int may = smack_flags_to_may(flag);
3402 struct smk_audit_info ad;
3403 int rc;
3404
3405 #ifdef CONFIG_AUDIT
3406 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3407 ad.a.u.ipc_id = ipp->id;
3408 #endif
3409 rc = smk_curacc(iskp, may, &ad);
3410 rc = smk_bu_current("svipc", iskp, may, rc);
3411 return rc;
3412 }
3413
3414 /**
3415 * smack_ipc_getsecid - Extract smack security id
3416 * @ipp: the object permissions
3417 * @secid: where result will be saved
3418 */
smack_ipc_getsecid(struct kern_ipc_perm * ipp,u32 * secid)3419 static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
3420 {
3421 struct smack_known **blob = smack_ipc(ipp);
3422 struct smack_known *iskp = *blob;
3423
3424 *secid = iskp->smk_secid;
3425 }
3426
3427 /**
3428 * smack_d_instantiate - Make sure the blob is correct on an inode
3429 * @opt_dentry: dentry where inode will be attached
3430 * @inode: the object
3431 *
3432 * Set the inode's security blob if it hasn't been done already.
3433 */
smack_d_instantiate(struct dentry * opt_dentry,struct inode * inode)3434 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
3435 {
3436 struct super_block *sbp;
3437 struct superblock_smack *sbsp;
3438 struct inode_smack *isp;
3439 struct smack_known *skp;
3440 struct smack_known *ckp = smk_of_current();
3441 struct smack_known *final;
3442 char trattr[TRANS_TRUE_SIZE];
3443 int transflag = 0;
3444 int rc;
3445 struct dentry *dp;
3446
3447 if (inode == NULL)
3448 return;
3449
3450 isp = smack_inode(inode);
3451
3452 /*
3453 * If the inode is already instantiated
3454 * take the quick way out
3455 */
3456 if (isp->smk_flags & SMK_INODE_INSTANT)
3457 return;
3458
3459 sbp = inode->i_sb;
3460 sbsp = smack_superblock(sbp);
3461 /*
3462 * We're going to use the superblock default label
3463 * if there's no label on the file.
3464 */
3465 final = sbsp->smk_default;
3466
3467 /*
3468 * If this is the root inode the superblock
3469 * may be in the process of initialization.
3470 * If that is the case use the root value out
3471 * of the superblock.
3472 */
3473 if (opt_dentry->d_parent == opt_dentry) {
3474 switch (sbp->s_magic) {
3475 case CGROUP_SUPER_MAGIC:
3476 case CGROUP2_SUPER_MAGIC:
3477 /*
3478 * The cgroup filesystem is never mounted,
3479 * so there's no opportunity to set the mount
3480 * options.
3481 */
3482 sbsp->smk_root = &smack_known_star;
3483 sbsp->smk_default = &smack_known_star;
3484 isp->smk_inode = sbsp->smk_root;
3485 break;
3486 case TMPFS_MAGIC:
3487 /*
3488 * What about shmem/tmpfs anonymous files with dentry
3489 * obtained from d_alloc_pseudo()?
3490 */
3491 isp->smk_inode = smk_of_current();
3492 break;
3493 case PIPEFS_MAGIC:
3494 isp->smk_inode = smk_of_current();
3495 break;
3496 case SOCKFS_MAGIC:
3497 /*
3498 * Socket access is controlled by the socket
3499 * structures associated with the task involved.
3500 */
3501 isp->smk_inode = &smack_known_star;
3502 break;
3503 default:
3504 isp->smk_inode = sbsp->smk_root;
3505 break;
3506 }
3507 isp->smk_flags |= SMK_INODE_INSTANT;
3508 return;
3509 }
3510
3511 /*
3512 * This is pretty hackish.
3513 * Casey says that we shouldn't have to do
3514 * file system specific code, but it does help
3515 * with keeping it simple.
3516 */
3517 switch (sbp->s_magic) {
3518 case SMACK_MAGIC:
3519 case CGROUP_SUPER_MAGIC:
3520 case CGROUP2_SUPER_MAGIC:
3521 /*
3522 * Casey says that it's a little embarrassing
3523 * that the smack file system doesn't do
3524 * extended attributes.
3525 *
3526 * Cgroupfs is special
3527 */
3528 final = &smack_known_star;
3529 break;
3530 case DEVPTS_SUPER_MAGIC:
3531 /*
3532 * devpts seems content with the label of the task.
3533 * Programs that change smack have to treat the
3534 * pty with respect.
3535 */
3536 final = ckp;
3537 break;
3538 case PROC_SUPER_MAGIC:
3539 /*
3540 * Casey says procfs appears not to care.
3541 * The superblock default suffices.
3542 */
3543 break;
3544 case TMPFS_MAGIC:
3545 /*
3546 * Device labels should come from the filesystem,
3547 * but watch out, because they're volitile,
3548 * getting recreated on every reboot.
3549 */
3550 final = &smack_known_star;
3551 /*
3552 * If a smack value has been set we want to use it,
3553 * but since tmpfs isn't giving us the opportunity
3554 * to set mount options simulate setting the
3555 * superblock default.
3556 */
3557 fallthrough;
3558 default:
3559 /*
3560 * This isn't an understood special case.
3561 * Get the value from the xattr.
3562 */
3563
3564 /*
3565 * UNIX domain sockets use lower level socket data.
3566 */
3567 if (S_ISSOCK(inode->i_mode)) {
3568 final = &smack_known_star;
3569 break;
3570 }
3571 /*
3572 * No xattr support means, alas, no SMACK label.
3573 * Use the aforeapplied default.
3574 * It would be curious if the label of the task
3575 * does not match that assigned.
3576 */
3577 if (!(inode->i_opflags & IOP_XATTR))
3578 break;
3579 /*
3580 * Get the dentry for xattr.
3581 */
3582 dp = dget(opt_dentry);
3583 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
3584 if (!IS_ERR_OR_NULL(skp))
3585 final = skp;
3586
3587 /*
3588 * Transmuting directory
3589 */
3590 if (S_ISDIR(inode->i_mode)) {
3591 /*
3592 * If this is a new directory and the label was
3593 * transmuted when the inode was initialized
3594 * set the transmute attribute on the directory
3595 * and mark the inode.
3596 *
3597 * If there is a transmute attribute on the
3598 * directory mark the inode.
3599 */
3600 rc = __vfs_getxattr(dp, inode,
3601 XATTR_NAME_SMACKTRANSMUTE, trattr,
3602 TRANS_TRUE_SIZE);
3603 if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
3604 TRANS_TRUE_SIZE) != 0)
3605 rc = -EINVAL;
3606 if (rc >= 0)
3607 transflag = SMK_INODE_TRANSMUTE;
3608 }
3609 /*
3610 * Don't let the exec or mmap label be "*" or "@".
3611 */
3612 skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
3613 if (IS_ERR(skp) || skp == &smack_known_star ||
3614 skp == &smack_known_web)
3615 skp = NULL;
3616 isp->smk_task = skp;
3617
3618 skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
3619 if (IS_ERR(skp) || skp == &smack_known_star ||
3620 skp == &smack_known_web)
3621 skp = NULL;
3622 isp->smk_mmap = skp;
3623
3624 dput(dp);
3625 break;
3626 }
3627
3628 if (final == NULL)
3629 isp->smk_inode = ckp;
3630 else
3631 isp->smk_inode = final;
3632
3633 isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
3634
3635 return;
3636 }
3637
3638 /**
3639 * smack_getprocattr - Smack process attribute access
3640 * @p: the object task
3641 * @name: the name of the attribute in /proc/.../attr
3642 * @value: where to put the result
3643 *
3644 * Places a copy of the task Smack into value
3645 *
3646 * Returns the length of the smack label or an error code
3647 */
smack_getprocattr(struct task_struct * p,const char * name,char ** value)3648 static int smack_getprocattr(struct task_struct *p, const char *name, char **value)
3649 {
3650 struct smack_known *skp = smk_of_task_struct_obj(p);
3651 char *cp;
3652 int slen;
3653
3654 if (strcmp(name, "current") != 0)
3655 return -EINVAL;
3656
3657 cp = kstrdup(skp->smk_known, GFP_KERNEL);
3658 if (cp == NULL)
3659 return -ENOMEM;
3660
3661 slen = strlen(cp);
3662 *value = cp;
3663 return slen;
3664 }
3665
3666 /**
3667 * smack_setprocattr - Smack process attribute setting
3668 * @name: the name of the attribute in /proc/.../attr
3669 * @value: the value to set
3670 * @size: the size of the value
3671 *
3672 * Sets the Smack value of the task. Only setting self
3673 * is permitted and only with privilege
3674 *
3675 * Returns the length of the smack label or an error code
3676 */
smack_setprocattr(const char * name,void * value,size_t size)3677 static int smack_setprocattr(const char *name, void *value, size_t size)
3678 {
3679 struct task_smack *tsp = smack_cred(current_cred());
3680 struct cred *new;
3681 struct smack_known *skp;
3682 struct smack_known_list_elem *sklep;
3683 int rc;
3684
3685 if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
3686 return -EPERM;
3687
3688 if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
3689 return -EINVAL;
3690
3691 if (strcmp(name, "current") != 0)
3692 return -EINVAL;
3693
3694 skp = smk_import_entry(value, size);
3695 if (IS_ERR(skp))
3696 return PTR_ERR(skp);
3697
3698 /*
3699 * No process is ever allowed the web ("@") label
3700 * and the star ("*") label.
3701 */
3702 if (skp == &smack_known_web || skp == &smack_known_star)
3703 return -EINVAL;
3704
3705 if (!smack_privileged(CAP_MAC_ADMIN)) {
3706 rc = -EPERM;
3707 list_for_each_entry(sklep, &tsp->smk_relabel, list)
3708 if (sklep->smk_label == skp) {
3709 rc = 0;
3710 break;
3711 }
3712 if (rc)
3713 return rc;
3714 }
3715
3716 new = prepare_creds();
3717 if (new == NULL)
3718 return -ENOMEM;
3719
3720 tsp = smack_cred(new);
3721 tsp->smk_task = skp;
3722 /*
3723 * process can change its label only once
3724 */
3725 smk_destroy_label_list(&tsp->smk_relabel);
3726
3727 commit_creds(new);
3728 return size;
3729 }
3730
3731 /**
3732 * smack_unix_stream_connect - Smack access on UDS
3733 * @sock: one sock
3734 * @other: the other sock
3735 * @newsk: unused
3736 *
3737 * Return 0 if a subject with the smack of sock could access
3738 * an object with the smack of other, otherwise an error code
3739 */
smack_unix_stream_connect(struct sock * sock,struct sock * other,struct sock * newsk)3740 static int smack_unix_stream_connect(struct sock *sock,
3741 struct sock *other, struct sock *newsk)
3742 {
3743 struct smack_known *skp;
3744 struct smack_known *okp;
3745 struct socket_smack *ssp = sock->sk_security;
3746 struct socket_smack *osp = other->sk_security;
3747 struct socket_smack *nsp = newsk->sk_security;
3748 struct smk_audit_info ad;
3749 int rc = 0;
3750 #ifdef CONFIG_AUDIT
3751 struct lsm_network_audit net;
3752 #endif
3753
3754 if (!smack_privileged(CAP_MAC_OVERRIDE)) {
3755 skp = ssp->smk_out;
3756 okp = osp->smk_in;
3757 #ifdef CONFIG_AUDIT
3758 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3759 smk_ad_setfield_u_net_sk(&ad, other);
3760 #endif
3761 rc = smk_access(skp, okp, MAY_WRITE, &ad);
3762 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3763 if (rc == 0) {
3764 okp = osp->smk_out;
3765 skp = ssp->smk_in;
3766 rc = smk_access(okp, skp, MAY_WRITE, &ad);
3767 rc = smk_bu_note("UDS connect", okp, skp,
3768 MAY_WRITE, rc);
3769 }
3770 }
3771
3772 /*
3773 * Cross reference the peer labels for SO_PEERSEC.
3774 */
3775 if (rc == 0) {
3776 nsp->smk_packet = ssp->smk_out;
3777 ssp->smk_packet = osp->smk_out;
3778 }
3779
3780 return rc;
3781 }
3782
3783 /**
3784 * smack_unix_may_send - Smack access on UDS
3785 * @sock: one socket
3786 * @other: the other socket
3787 *
3788 * Return 0 if a subject with the smack of sock could access
3789 * an object with the smack of other, otherwise an error code
3790 */
smack_unix_may_send(struct socket * sock,struct socket * other)3791 static int smack_unix_may_send(struct socket *sock, struct socket *other)
3792 {
3793 struct socket_smack *ssp = sock->sk->sk_security;
3794 struct socket_smack *osp = other->sk->sk_security;
3795 struct smk_audit_info ad;
3796 int rc;
3797
3798 #ifdef CONFIG_AUDIT
3799 struct lsm_network_audit net;
3800
3801 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3802 smk_ad_setfield_u_net_sk(&ad, other->sk);
3803 #endif
3804
3805 if (smack_privileged(CAP_MAC_OVERRIDE))
3806 return 0;
3807
3808 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3809 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3810 return rc;
3811 }
3812
3813 /**
3814 * smack_socket_sendmsg - Smack check based on destination host
3815 * @sock: the socket
3816 * @msg: the message
3817 * @size: the size of the message
3818 *
3819 * Return 0 if the current subject can write to the destination host.
3820 * For IPv4 this is only a question if the destination is a single label host.
3821 * For IPv6 this is a check against the label of the port.
3822 */
smack_socket_sendmsg(struct socket * sock,struct msghdr * msg,int size)3823 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3824 int size)
3825 {
3826 struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
3827 #if IS_ENABLED(CONFIG_IPV6)
3828 struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
3829 #endif
3830 #ifdef SMACK_IPV6_SECMARK_LABELING
3831 struct socket_smack *ssp = sock->sk->sk_security;
3832 struct smack_known *rsp;
3833 #endif
3834 int rc = 0;
3835
3836 /*
3837 * Perfectly reasonable for this to be NULL
3838 */
3839 if (sip == NULL)
3840 return 0;
3841
3842 switch (sock->sk->sk_family) {
3843 case AF_INET:
3844 if (msg->msg_namelen < sizeof(struct sockaddr_in) ||
3845 sip->sin_family != AF_INET)
3846 return -EINVAL;
3847 rc = smk_ipv4_check(sock->sk, sip);
3848 break;
3849 #if IS_ENABLED(CONFIG_IPV6)
3850 case AF_INET6:
3851 if (msg->msg_namelen < SIN6_LEN_RFC2133 ||
3852 sap->sin6_family != AF_INET6)
3853 return -EINVAL;
3854 #ifdef SMACK_IPV6_SECMARK_LABELING
3855 rsp = smack_ipv6host_label(sap);
3856 if (rsp != NULL)
3857 rc = smk_ipv6_check(ssp->smk_out, rsp, sap,
3858 SMK_CONNECTING);
3859 #endif
3860 #ifdef SMACK_IPV6_PORT_LABELING
3861 rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING);
3862 #endif
3863 #endif /* IS_ENABLED(CONFIG_IPV6) */
3864 break;
3865 }
3866 return rc;
3867 }
3868
3869 /**
3870 * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack
3871 * @sap: netlabel secattr
3872 * @ssp: socket security information
3873 *
3874 * Returns a pointer to a Smack label entry found on the label list.
3875 */
smack_from_secattr(struct netlbl_lsm_secattr * sap,struct socket_smack * ssp)3876 static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
3877 struct socket_smack *ssp)
3878 {
3879 struct smack_known *skp;
3880 int found = 0;
3881 int acat;
3882 int kcat;
3883
3884 /*
3885 * Netlabel found it in the cache.
3886 */
3887 if ((sap->flags & NETLBL_SECATTR_CACHE) != 0)
3888 return (struct smack_known *)sap->cache->data;
3889
3890 if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
3891 /*
3892 * Looks like a fallback, which gives us a secid.
3893 */
3894 return smack_from_secid(sap->attr.secid);
3895
3896 if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
3897 /*
3898 * Looks like a CIPSO packet.
3899 * If there are flags but no level netlabel isn't
3900 * behaving the way we expect it to.
3901 *
3902 * Look it up in the label table
3903 * Without guidance regarding the smack value
3904 * for the packet fall back on the network
3905 * ambient value.
3906 */
3907 rcu_read_lock();
3908 list_for_each_entry_rcu(skp, &smack_known_list, list) {
3909 if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl)
3910 continue;
3911 /*
3912 * Compare the catsets. Use the netlbl APIs.
3913 */
3914 if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
3915 if ((skp->smk_netlabel.flags &
3916 NETLBL_SECATTR_MLS_CAT) == 0)
3917 found = 1;
3918 break;
3919 }
3920 for (acat = -1, kcat = -1; acat == kcat; ) {
3921 acat = netlbl_catmap_walk(sap->attr.mls.cat,
3922 acat + 1);
3923 kcat = netlbl_catmap_walk(
3924 skp->smk_netlabel.attr.mls.cat,
3925 kcat + 1);
3926 if (acat < 0 || kcat < 0)
3927 break;
3928 }
3929 if (acat == kcat) {
3930 found = 1;
3931 break;
3932 }
3933 }
3934 rcu_read_unlock();
3935
3936 if (found)
3937 return skp;
3938
3939 if (ssp != NULL && ssp->smk_in == &smack_known_star)
3940 return &smack_known_web;
3941 return &smack_known_star;
3942 }
3943 /*
3944 * Without guidance regarding the smack value
3945 * for the packet fall back on the network
3946 * ambient value.
3947 */
3948 return smack_net_ambient;
3949 }
3950
3951 #if IS_ENABLED(CONFIG_IPV6)
smk_skb_to_addr_ipv6(struct sk_buff * skb,struct sockaddr_in6 * sip)3952 static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
3953 {
3954 u8 nexthdr;
3955 int offset;
3956 int proto = -EINVAL;
3957 struct ipv6hdr _ipv6h;
3958 struct ipv6hdr *ip6;
3959 __be16 frag_off;
3960 struct tcphdr _tcph, *th;
3961 struct udphdr _udph, *uh;
3962 struct dccp_hdr _dccph, *dh;
3963
3964 sip->sin6_port = 0;
3965
3966 offset = skb_network_offset(skb);
3967 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3968 if (ip6 == NULL)
3969 return -EINVAL;
3970 sip->sin6_addr = ip6->saddr;
3971
3972 nexthdr = ip6->nexthdr;
3973 offset += sizeof(_ipv6h);
3974 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3975 if (offset < 0)
3976 return -EINVAL;
3977
3978 proto = nexthdr;
3979 switch (proto) {
3980 case IPPROTO_TCP:
3981 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3982 if (th != NULL)
3983 sip->sin6_port = th->source;
3984 break;
3985 case IPPROTO_UDP:
3986 case IPPROTO_UDPLITE:
3987 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3988 if (uh != NULL)
3989 sip->sin6_port = uh->source;
3990 break;
3991 case IPPROTO_DCCP:
3992 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3993 if (dh != NULL)
3994 sip->sin6_port = dh->dccph_sport;
3995 break;
3996 }
3997 return proto;
3998 }
3999 #endif /* CONFIG_IPV6 */
4000
4001 /**
4002 * smack_from_skb - Smack data from the secmark in an skb
4003 * @skb: packet
4004 *
4005 * Returns smack_known of the secmark or NULL if that won't work.
4006 */
4007 #ifdef CONFIG_NETWORK_SECMARK
smack_from_skb(struct sk_buff * skb)4008 static struct smack_known *smack_from_skb(struct sk_buff *skb)
4009 {
4010 if (skb == NULL || skb->secmark == 0)
4011 return NULL;
4012
4013 return smack_from_secid(skb->secmark);
4014 }
4015 #else
smack_from_skb(struct sk_buff * skb)4016 static inline struct smack_known *smack_from_skb(struct sk_buff *skb)
4017 {
4018 return NULL;
4019 }
4020 #endif
4021
4022 /**
4023 * smack_from_netlbl - Smack data from the IP options in an skb
4024 * @sk: socket data came in on
4025 * @family: address family
4026 * @skb: packet
4027 *
4028 * Find the Smack label in the IP options. If it hasn't been
4029 * added to the netlabel cache, add it here.
4030 *
4031 * Returns smack_known of the IP options or NULL if that won't work.
4032 */
smack_from_netlbl(const struct sock * sk,u16 family,struct sk_buff * skb)4033 static struct smack_known *smack_from_netlbl(const struct sock *sk, u16 family,
4034 struct sk_buff *skb)
4035 {
4036 struct netlbl_lsm_secattr secattr;
4037 struct socket_smack *ssp = NULL;
4038 struct smack_known *skp = NULL;
4039
4040 netlbl_secattr_init(&secattr);
4041
4042 if (sk)
4043 ssp = sk->sk_security;
4044
4045 if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) {
4046 skp = smack_from_secattr(&secattr, ssp);
4047 if (secattr.flags & NETLBL_SECATTR_CACHEABLE)
4048 netlbl_cache_add(skb, family, &skp->smk_netlabel);
4049 }
4050
4051 netlbl_secattr_destroy(&secattr);
4052
4053 return skp;
4054 }
4055
4056 /**
4057 * smack_socket_sock_rcv_skb - Smack packet delivery access check
4058 * @sk: socket
4059 * @skb: packet
4060 *
4061 * Returns 0 if the packet should be delivered, an error code otherwise
4062 */
smack_socket_sock_rcv_skb(struct sock * sk,struct sk_buff * skb)4063 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4064 {
4065 struct socket_smack *ssp = sk->sk_security;
4066 struct smack_known *skp = NULL;
4067 int rc = 0;
4068 struct smk_audit_info ad;
4069 u16 family = sk->sk_family;
4070 #ifdef CONFIG_AUDIT
4071 struct lsm_network_audit net;
4072 #endif
4073 #if IS_ENABLED(CONFIG_IPV6)
4074 struct sockaddr_in6 sadd;
4075 int proto;
4076
4077 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4078 family = PF_INET;
4079 #endif /* CONFIG_IPV6 */
4080
4081 switch (family) {
4082 case PF_INET:
4083 /*
4084 * If there is a secmark use it rather than the CIPSO label.
4085 * If there is no secmark fall back to CIPSO.
4086 * The secmark is assumed to reflect policy better.
4087 */
4088 skp = smack_from_skb(skb);
4089 if (skp == NULL) {
4090 skp = smack_from_netlbl(sk, family, skb);
4091 if (skp == NULL)
4092 skp = smack_net_ambient;
4093 }
4094
4095 #ifdef CONFIG_AUDIT
4096 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4097 ad.a.u.net->family = family;
4098 ad.a.u.net->netif = skb->skb_iif;
4099 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4100 #endif
4101 /*
4102 * Receiving a packet requires that the other end
4103 * be able to write here. Read access is not required.
4104 * This is the simplist possible security model
4105 * for networking.
4106 */
4107 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4108 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
4109 MAY_WRITE, rc);
4110 if (rc != 0)
4111 netlbl_skbuff_err(skb, family, rc, 0);
4112 break;
4113 #if IS_ENABLED(CONFIG_IPV6)
4114 case PF_INET6:
4115 proto = smk_skb_to_addr_ipv6(skb, &sadd);
4116 if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
4117 proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
4118 break;
4119 #ifdef SMACK_IPV6_SECMARK_LABELING
4120 skp = smack_from_skb(skb);
4121 if (skp == NULL) {
4122 if (smk_ipv6_localhost(&sadd))
4123 break;
4124 skp = smack_ipv6host_label(&sadd);
4125 if (skp == NULL)
4126 skp = smack_net_ambient;
4127 }
4128 #ifdef CONFIG_AUDIT
4129 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4130 ad.a.u.net->family = family;
4131 ad.a.u.net->netif = skb->skb_iif;
4132 ipv6_skb_to_auditdata(skb, &ad.a, NULL);
4133 #endif /* CONFIG_AUDIT */
4134 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4135 rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in,
4136 MAY_WRITE, rc);
4137 #endif /* SMACK_IPV6_SECMARK_LABELING */
4138 #ifdef SMACK_IPV6_PORT_LABELING
4139 rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING);
4140 #endif /* SMACK_IPV6_PORT_LABELING */
4141 if (rc != 0)
4142 icmpv6_send(skb, ICMPV6_DEST_UNREACH,
4143 ICMPV6_ADM_PROHIBITED, 0);
4144 break;
4145 #endif /* CONFIG_IPV6 */
4146 }
4147
4148 return rc;
4149 }
4150
4151 /**
4152 * smack_socket_getpeersec_stream - pull in packet label
4153 * @sock: the socket
4154 * @optval: user's destination
4155 * @optlen: size thereof
4156 * @len: max thereof
4157 *
4158 * returns zero on success, an error code otherwise
4159 */
smack_socket_getpeersec_stream(struct socket * sock,sockptr_t optval,sockptr_t optlen,unsigned int len)4160 static int smack_socket_getpeersec_stream(struct socket *sock,
4161 sockptr_t optval, sockptr_t optlen,
4162 unsigned int len)
4163 {
4164 struct socket_smack *ssp;
4165 char *rcp = "";
4166 u32 slen = 1;
4167 int rc = 0;
4168
4169 ssp = sock->sk->sk_security;
4170 if (ssp->smk_packet != NULL) {
4171 rcp = ssp->smk_packet->smk_known;
4172 slen = strlen(rcp) + 1;
4173 }
4174 if (slen > len) {
4175 rc = -ERANGE;
4176 goto out_len;
4177 }
4178
4179 if (copy_to_sockptr(optval, rcp, slen))
4180 rc = -EFAULT;
4181 out_len:
4182 if (copy_to_sockptr(optlen, &slen, sizeof(slen)))
4183 rc = -EFAULT;
4184 return rc;
4185 }
4186
4187
4188 /**
4189 * smack_socket_getpeersec_dgram - pull in packet label
4190 * @sock: the peer socket
4191 * @skb: packet data
4192 * @secid: pointer to where to put the secid of the packet
4193 *
4194 * Sets the netlabel socket state on sk from parent
4195 */
smack_socket_getpeersec_dgram(struct socket * sock,struct sk_buff * skb,u32 * secid)4196 static int smack_socket_getpeersec_dgram(struct socket *sock,
4197 struct sk_buff *skb, u32 *secid)
4198
4199 {
4200 struct socket_smack *ssp = NULL;
4201 struct smack_known *skp;
4202 struct sock *sk = NULL;
4203 int family = PF_UNSPEC;
4204 u32 s = 0; /* 0 is the invalid secid */
4205
4206 if (skb != NULL) {
4207 if (skb->protocol == htons(ETH_P_IP))
4208 family = PF_INET;
4209 #if IS_ENABLED(CONFIG_IPV6)
4210 else if (skb->protocol == htons(ETH_P_IPV6))
4211 family = PF_INET6;
4212 #endif /* CONFIG_IPV6 */
4213 }
4214 if (family == PF_UNSPEC && sock != NULL)
4215 family = sock->sk->sk_family;
4216
4217 switch (family) {
4218 case PF_UNIX:
4219 ssp = sock->sk->sk_security;
4220 s = ssp->smk_out->smk_secid;
4221 break;
4222 case PF_INET:
4223 skp = smack_from_skb(skb);
4224 if (skp) {
4225 s = skp->smk_secid;
4226 break;
4227 }
4228 /*
4229 * Translate what netlabel gave us.
4230 */
4231 if (sock != NULL)
4232 sk = sock->sk;
4233 skp = smack_from_netlbl(sk, family, skb);
4234 if (skp != NULL)
4235 s = skp->smk_secid;
4236 break;
4237 case PF_INET6:
4238 #ifdef SMACK_IPV6_SECMARK_LABELING
4239 skp = smack_from_skb(skb);
4240 if (skp)
4241 s = skp->smk_secid;
4242 #endif
4243 break;
4244 }
4245 *secid = s;
4246 if (s == 0)
4247 return -EINVAL;
4248 return 0;
4249 }
4250
4251 /**
4252 * smack_sock_graft - Initialize a newly created socket with an existing sock
4253 * @sk: child sock
4254 * @parent: parent socket
4255 *
4256 * Set the smk_{in,out} state of an existing sock based on the process that
4257 * is creating the new socket.
4258 */
smack_sock_graft(struct sock * sk,struct socket * parent)4259 static void smack_sock_graft(struct sock *sk, struct socket *parent)
4260 {
4261 struct socket_smack *ssp;
4262 struct smack_known *skp = smk_of_current();
4263
4264 if (sk == NULL ||
4265 (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
4266 return;
4267
4268 ssp = sk->sk_security;
4269 ssp->smk_in = skp;
4270 ssp->smk_out = skp;
4271 /* cssp->smk_packet is already set in smack_inet_csk_clone() */
4272 }
4273
4274 /**
4275 * smack_inet_conn_request - Smack access check on connect
4276 * @sk: socket involved
4277 * @skb: packet
4278 * @req: unused
4279 *
4280 * Returns 0 if a task with the packet label could write to
4281 * the socket, otherwise an error code
4282 */
smack_inet_conn_request(const struct sock * sk,struct sk_buff * skb,struct request_sock * req)4283 static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
4284 struct request_sock *req)
4285 {
4286 u16 family = sk->sk_family;
4287 struct smack_known *skp;
4288 struct socket_smack *ssp = sk->sk_security;
4289 struct sockaddr_in addr;
4290 struct iphdr *hdr;
4291 struct smack_known *hskp;
4292 int rc;
4293 struct smk_audit_info ad;
4294 #ifdef CONFIG_AUDIT
4295 struct lsm_network_audit net;
4296 #endif
4297
4298 #if IS_ENABLED(CONFIG_IPV6)
4299 if (family == PF_INET6) {
4300 /*
4301 * Handle mapped IPv4 packets arriving
4302 * via IPv6 sockets. Don't set up netlabel
4303 * processing on IPv6.
4304 */
4305 if (skb->protocol == htons(ETH_P_IP))
4306 family = PF_INET;
4307 else
4308 return 0;
4309 }
4310 #endif /* CONFIG_IPV6 */
4311
4312 /*
4313 * If there is a secmark use it rather than the CIPSO label.
4314 * If there is no secmark fall back to CIPSO.
4315 * The secmark is assumed to reflect policy better.
4316 */
4317 skp = smack_from_skb(skb);
4318 if (skp == NULL) {
4319 skp = smack_from_netlbl(sk, family, skb);
4320 if (skp == NULL)
4321 skp = &smack_known_huh;
4322 }
4323
4324 #ifdef CONFIG_AUDIT
4325 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4326 ad.a.u.net->family = family;
4327 ad.a.u.net->netif = skb->skb_iif;
4328 ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4329 #endif
4330 /*
4331 * Receiving a packet requires that the other end be able to write
4332 * here. Read access is not required.
4333 */
4334 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4335 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
4336 if (rc != 0)
4337 return rc;
4338
4339 /*
4340 * Save the peer's label in the request_sock so we can later setup
4341 * smk_packet in the child socket so that SO_PEERCRED can report it.
4342 */
4343 req->peer_secid = skp->smk_secid;
4344
4345 /*
4346 * We need to decide if we want to label the incoming connection here
4347 * if we do we only need to label the request_sock and the stack will
4348 * propagate the wire-label to the sock when it is created.
4349 */
4350 hdr = ip_hdr(skb);
4351 addr.sin_addr.s_addr = hdr->saddr;
4352 rcu_read_lock();
4353 hskp = smack_ipv4host_label(&addr);
4354 rcu_read_unlock();
4355
4356 if (hskp == NULL)
4357 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
4358 else
4359 netlbl_req_delattr(req);
4360
4361 return rc;
4362 }
4363
4364 /**
4365 * smack_inet_csk_clone - Copy the connection information to the new socket
4366 * @sk: the new socket
4367 * @req: the connection's request_sock
4368 *
4369 * Transfer the connection's peer label to the newly created socket.
4370 */
smack_inet_csk_clone(struct sock * sk,const struct request_sock * req)4371 static void smack_inet_csk_clone(struct sock *sk,
4372 const struct request_sock *req)
4373 {
4374 struct socket_smack *ssp = sk->sk_security;
4375 struct smack_known *skp;
4376
4377 if (req->peer_secid != 0) {
4378 skp = smack_from_secid(req->peer_secid);
4379 ssp->smk_packet = skp;
4380 } else
4381 ssp->smk_packet = NULL;
4382 }
4383
4384 /*
4385 * Key management security hooks
4386 *
4387 * Casey has not tested key support very heavily.
4388 * The permission check is most likely too restrictive.
4389 * If you care about keys please have a look.
4390 */
4391 #ifdef CONFIG_KEYS
4392
4393 /**
4394 * smack_key_alloc - Set the key security blob
4395 * @key: object
4396 * @cred: the credentials to use
4397 * @flags: unused
4398 *
4399 * No allocation required
4400 *
4401 * Returns 0
4402 */
smack_key_alloc(struct key * key,const struct cred * cred,unsigned long flags)4403 static int smack_key_alloc(struct key *key, const struct cred *cred,
4404 unsigned long flags)
4405 {
4406 struct smack_known *skp = smk_of_task(smack_cred(cred));
4407
4408 key->security = skp;
4409 return 0;
4410 }
4411
4412 /**
4413 * smack_key_free - Clear the key security blob
4414 * @key: the object
4415 *
4416 * Clear the blob pointer
4417 */
smack_key_free(struct key * key)4418 static void smack_key_free(struct key *key)
4419 {
4420 key->security = NULL;
4421 }
4422
4423 /**
4424 * smack_key_permission - Smack access on a key
4425 * @key_ref: gets to the object
4426 * @cred: the credentials to use
4427 * @need_perm: requested key permission
4428 *
4429 * Return 0 if the task has read and write to the object,
4430 * an error code otherwise
4431 */
smack_key_permission(key_ref_t key_ref,const struct cred * cred,enum key_need_perm need_perm)4432 static int smack_key_permission(key_ref_t key_ref,
4433 const struct cred *cred,
4434 enum key_need_perm need_perm)
4435 {
4436 struct key *keyp;
4437 struct smk_audit_info ad;
4438 struct smack_known *tkp = smk_of_task(smack_cred(cred));
4439 int request = 0;
4440 int rc;
4441
4442 /*
4443 * Validate requested permissions
4444 */
4445 switch (need_perm) {
4446 case KEY_NEED_READ:
4447 case KEY_NEED_SEARCH:
4448 case KEY_NEED_VIEW:
4449 request |= MAY_READ;
4450 break;
4451 case KEY_NEED_WRITE:
4452 case KEY_NEED_LINK:
4453 case KEY_NEED_SETATTR:
4454 request |= MAY_WRITE;
4455 break;
4456 case KEY_NEED_UNSPECIFIED:
4457 case KEY_NEED_UNLINK:
4458 case KEY_SYSADMIN_OVERRIDE:
4459 case KEY_AUTHTOKEN_OVERRIDE:
4460 case KEY_DEFER_PERM_CHECK:
4461 return 0;
4462 default:
4463 return -EINVAL;
4464 }
4465
4466 keyp = key_ref_to_ptr(key_ref);
4467 if (keyp == NULL)
4468 return -EINVAL;
4469 /*
4470 * If the key hasn't been initialized give it access so that
4471 * it may do so.
4472 */
4473 if (keyp->security == NULL)
4474 return 0;
4475 /*
4476 * This should not occur
4477 */
4478 if (tkp == NULL)
4479 return -EACCES;
4480
4481 if (smack_privileged(CAP_MAC_OVERRIDE))
4482 return 0;
4483
4484 #ifdef CONFIG_AUDIT
4485 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4486 ad.a.u.key_struct.key = keyp->serial;
4487 ad.a.u.key_struct.key_desc = keyp->description;
4488 #endif
4489 rc = smk_access(tkp, keyp->security, request, &ad);
4490 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
4491 return rc;
4492 }
4493
4494 /*
4495 * smack_key_getsecurity - Smack label tagging the key
4496 * @key points to the key to be queried
4497 * @_buffer points to a pointer that should be set to point to the
4498 * resulting string (if no label or an error occurs).
4499 * Return the length of the string (including terminating NUL) or -ve if
4500 * an error.
4501 * May also return 0 (and a NULL buffer pointer) if there is no label.
4502 */
smack_key_getsecurity(struct key * key,char ** _buffer)4503 static int smack_key_getsecurity(struct key *key, char **_buffer)
4504 {
4505 struct smack_known *skp = key->security;
4506 size_t length;
4507 char *copy;
4508
4509 if (key->security == NULL) {
4510 *_buffer = NULL;
4511 return 0;
4512 }
4513
4514 copy = kstrdup(skp->smk_known, GFP_KERNEL);
4515 if (copy == NULL)
4516 return -ENOMEM;
4517 length = strlen(copy) + 1;
4518
4519 *_buffer = copy;
4520 return length;
4521 }
4522
4523
4524 #ifdef CONFIG_KEY_NOTIFICATIONS
4525 /**
4526 * smack_watch_key - Smack access to watch a key for notifications.
4527 * @key: The key to be watched
4528 *
4529 * Return 0 if the @watch->cred has permission to read from the key object and
4530 * an error otherwise.
4531 */
smack_watch_key(struct key * key)4532 static int smack_watch_key(struct key *key)
4533 {
4534 struct smk_audit_info ad;
4535 struct smack_known *tkp = smk_of_current();
4536 int rc;
4537
4538 if (key == NULL)
4539 return -EINVAL;
4540 /*
4541 * If the key hasn't been initialized give it access so that
4542 * it may do so.
4543 */
4544 if (key->security == NULL)
4545 return 0;
4546 /*
4547 * This should not occur
4548 */
4549 if (tkp == NULL)
4550 return -EACCES;
4551
4552 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))
4553 return 0;
4554
4555 #ifdef CONFIG_AUDIT
4556 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4557 ad.a.u.key_struct.key = key->serial;
4558 ad.a.u.key_struct.key_desc = key->description;
4559 #endif
4560 rc = smk_access(tkp, key->security, MAY_READ, &ad);
4561 rc = smk_bu_note("key watch", tkp, key->security, MAY_READ, rc);
4562 return rc;
4563 }
4564 #endif /* CONFIG_KEY_NOTIFICATIONS */
4565 #endif /* CONFIG_KEYS */
4566
4567 #ifdef CONFIG_WATCH_QUEUE
4568 /**
4569 * smack_post_notification - Smack access to post a notification to a queue
4570 * @w_cred: The credentials of the watcher.
4571 * @cred: The credentials of the event source (may be NULL).
4572 * @n: The notification message to be posted.
4573 */
smack_post_notification(const struct cred * w_cred,const struct cred * cred,struct watch_notification * n)4574 static int smack_post_notification(const struct cred *w_cred,
4575 const struct cred *cred,
4576 struct watch_notification *n)
4577 {
4578 struct smk_audit_info ad;
4579 struct smack_known *subj, *obj;
4580 int rc;
4581
4582 /* Always let maintenance notifications through. */
4583 if (n->type == WATCH_TYPE_META)
4584 return 0;
4585
4586 if (!cred)
4587 return 0;
4588 subj = smk_of_task(smack_cred(cred));
4589 obj = smk_of_task(smack_cred(w_cred));
4590
4591 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NOTIFICATION);
4592 rc = smk_access(subj, obj, MAY_WRITE, &ad);
4593 rc = smk_bu_note("notification", subj, obj, MAY_WRITE, rc);
4594 return rc;
4595 }
4596 #endif /* CONFIG_WATCH_QUEUE */
4597
4598 /*
4599 * Smack Audit hooks
4600 *
4601 * Audit requires a unique representation of each Smack specific
4602 * rule. This unique representation is used to distinguish the
4603 * object to be audited from remaining kernel objects and also
4604 * works as a glue between the audit hooks.
4605 *
4606 * Since repository entries are added but never deleted, we'll use
4607 * the smack_known label address related to the given audit rule as
4608 * the needed unique representation. This also better fits the smack
4609 * model where nearly everything is a label.
4610 */
4611 #ifdef CONFIG_AUDIT
4612
4613 /**
4614 * smack_audit_rule_init - Initialize a smack audit rule
4615 * @field: audit rule fields given from user-space (audit.h)
4616 * @op: required testing operator (=, !=, >, <, ...)
4617 * @rulestr: smack label to be audited
4618 * @vrule: pointer to save our own audit rule representation
4619 * @gfp: type of the memory for the allocation
4620 *
4621 * Prepare to audit cases where (@field @op @rulestr) is true.
4622 * The label to be audited is created if necessay.
4623 */
smack_audit_rule_init(u32 field,u32 op,char * rulestr,void ** vrule,gfp_t gfp)4624 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule,
4625 gfp_t gfp)
4626 {
4627 struct smack_known *skp;
4628 char **rule = (char **)vrule;
4629 *rule = NULL;
4630
4631 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4632 return -EINVAL;
4633
4634 if (op != Audit_equal && op != Audit_not_equal)
4635 return -EINVAL;
4636
4637 skp = smk_import_entry(rulestr, 0);
4638 if (IS_ERR(skp))
4639 return PTR_ERR(skp);
4640
4641 *rule = skp->smk_known;
4642
4643 return 0;
4644 }
4645
4646 /**
4647 * smack_audit_rule_known - Distinguish Smack audit rules
4648 * @krule: rule of interest, in Audit kernel representation format
4649 *
4650 * This is used to filter Smack rules from remaining Audit ones.
4651 * If it's proved that this rule belongs to us, the
4652 * audit_rule_match hook will be called to do the final judgement.
4653 */
smack_audit_rule_known(struct audit_krule * krule)4654 static int smack_audit_rule_known(struct audit_krule *krule)
4655 {
4656 struct audit_field *f;
4657 int i;
4658
4659 for (i = 0; i < krule->field_count; i++) {
4660 f = &krule->fields[i];
4661
4662 if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER)
4663 return 1;
4664 }
4665
4666 return 0;
4667 }
4668
4669 /**
4670 * smack_audit_rule_match - Audit given object ?
4671 * @secid: security id for identifying the object to test
4672 * @field: audit rule flags given from user-space
4673 * @op: required testing operator
4674 * @vrule: smack internal rule presentation
4675 *
4676 * The core Audit hook. It's used to take the decision of
4677 * whether to audit or not to audit a given object.
4678 */
smack_audit_rule_match(u32 secid,u32 field,u32 op,void * vrule)4679 static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule)
4680 {
4681 struct smack_known *skp;
4682 char *rule = vrule;
4683
4684 if (unlikely(!rule)) {
4685 WARN_ONCE(1, "Smack: missing rule\n");
4686 return -ENOENT;
4687 }
4688
4689 if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4690 return 0;
4691
4692 skp = smack_from_secid(secid);
4693
4694 /*
4695 * No need to do string comparisons. If a match occurs,
4696 * both pointers will point to the same smack_known
4697 * label.
4698 */
4699 if (op == Audit_equal)
4700 return (rule == skp->smk_known);
4701 if (op == Audit_not_equal)
4702 return (rule != skp->smk_known);
4703
4704 return 0;
4705 }
4706
4707 /*
4708 * There is no need for a smack_audit_rule_free hook.
4709 * No memory was allocated.
4710 */
4711
4712 #endif /* CONFIG_AUDIT */
4713
4714 /**
4715 * smack_ismaclabel - check if xattr @name references a smack MAC label
4716 * @name: Full xattr name to check.
4717 */
smack_ismaclabel(const char * name)4718 static int smack_ismaclabel(const char *name)
4719 {
4720 return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
4721 }
4722
4723
4724 /**
4725 * smack_secid_to_secctx - return the smack label for a secid
4726 * @secid: incoming integer
4727 * @secdata: destination
4728 * @seclen: how long it is
4729 *
4730 * Exists for networking code.
4731 */
smack_secid_to_secctx(u32 secid,char ** secdata,u32 * seclen)4732 static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4733 {
4734 struct smack_known *skp = smack_from_secid(secid);
4735
4736 if (secdata)
4737 *secdata = skp->smk_known;
4738 *seclen = strlen(skp->smk_known);
4739 return 0;
4740 }
4741
4742 /**
4743 * smack_secctx_to_secid - return the secid for a smack label
4744 * @secdata: smack label
4745 * @seclen: how long result is
4746 * @secid: outgoing integer
4747 *
4748 * Exists for audit and networking code.
4749 */
smack_secctx_to_secid(const char * secdata,u32 seclen,u32 * secid)4750 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
4751 {
4752 struct smack_known *skp = smk_find_entry(secdata);
4753
4754 if (skp)
4755 *secid = skp->smk_secid;
4756 else
4757 *secid = 0;
4758 return 0;
4759 }
4760
4761 /*
4762 * There used to be a smack_release_secctx hook
4763 * that did nothing back when hooks were in a vector.
4764 * Now that there's a list such a hook adds cost.
4765 */
4766
smack_inode_notifysecctx(struct inode * inode,void * ctx,u32 ctxlen)4767 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
4768 {
4769 return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
4770 ctxlen, 0);
4771 }
4772
smack_inode_setsecctx(struct dentry * dentry,void * ctx,u32 ctxlen)4773 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
4774 {
4775 return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SMACK,
4776 ctx, ctxlen, 0);
4777 }
4778
smack_inode_getsecctx(struct inode * inode,void ** ctx,u32 * ctxlen)4779 static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4780 {
4781 struct smack_known *skp = smk_of_inode(inode);
4782
4783 *ctx = skp->smk_known;
4784 *ctxlen = strlen(skp->smk_known);
4785 return 0;
4786 }
4787
smack_inode_copy_up(struct dentry * dentry,struct cred ** new)4788 static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
4789 {
4790
4791 struct task_smack *tsp;
4792 struct smack_known *skp;
4793 struct inode_smack *isp;
4794 struct cred *new_creds = *new;
4795
4796 if (new_creds == NULL) {
4797 new_creds = prepare_creds();
4798 if (new_creds == NULL)
4799 return -ENOMEM;
4800 }
4801
4802 tsp = smack_cred(new_creds);
4803
4804 /*
4805 * Get label from overlay inode and set it in create_sid
4806 */
4807 isp = smack_inode(d_inode(dentry));
4808 skp = isp->smk_inode;
4809 tsp->smk_task = skp;
4810 *new = new_creds;
4811 return 0;
4812 }
4813
smack_inode_copy_up_xattr(const char * name)4814 static int smack_inode_copy_up_xattr(const char *name)
4815 {
4816 /*
4817 * Return 1 if this is the smack access Smack attribute.
4818 */
4819 if (strcmp(name, XATTR_NAME_SMACK) == 0)
4820 return 1;
4821
4822 return -EOPNOTSUPP;
4823 }
4824
smack_dentry_create_files_as(struct dentry * dentry,int mode,struct qstr * name,const struct cred * old,struct cred * new)4825 static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
4826 struct qstr *name,
4827 const struct cred *old,
4828 struct cred *new)
4829 {
4830 struct task_smack *otsp = smack_cred(old);
4831 struct task_smack *ntsp = smack_cred(new);
4832 struct inode_smack *isp;
4833 int may;
4834
4835 /*
4836 * Use the process credential unless all of
4837 * the transmuting criteria are met
4838 */
4839 ntsp->smk_task = otsp->smk_task;
4840
4841 /*
4842 * the attribute of the containing directory
4843 */
4844 isp = smack_inode(d_inode(dentry->d_parent));
4845
4846 if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
4847 rcu_read_lock();
4848 may = smk_access_entry(otsp->smk_task->smk_known,
4849 isp->smk_inode->smk_known,
4850 &otsp->smk_task->smk_rules);
4851 rcu_read_unlock();
4852
4853 /*
4854 * If the directory is transmuting and the rule
4855 * providing access is transmuting use the containing
4856 * directory label instead of the process label.
4857 */
4858 if (may > 0 && (may & MAY_TRANSMUTE)) {
4859 ntsp->smk_task = isp->smk_inode;
4860 ntsp->smk_transmuted = ntsp->smk_task;
4861 }
4862 }
4863 return 0;
4864 }
4865
4866 #ifdef CONFIG_IO_URING
4867 /**
4868 * smack_uring_override_creds - Is io_uring cred override allowed?
4869 * @new: the target creds
4870 *
4871 * Check to see if the current task is allowed to override it's credentials
4872 * to service an io_uring operation.
4873 */
smack_uring_override_creds(const struct cred * new)4874 static int smack_uring_override_creds(const struct cred *new)
4875 {
4876 struct task_smack *tsp = smack_cred(current_cred());
4877 struct task_smack *nsp = smack_cred(new);
4878
4879 /*
4880 * Allow the degenerate case where the new Smack value is
4881 * the same as the current Smack value.
4882 */
4883 if (tsp->smk_task == nsp->smk_task)
4884 return 0;
4885
4886 if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))
4887 return 0;
4888
4889 return -EPERM;
4890 }
4891
4892 /**
4893 * smack_uring_sqpoll - check if a io_uring polling thread can be created
4894 *
4895 * Check to see if the current task is allowed to create a new io_uring
4896 * kernel polling thread.
4897 */
smack_uring_sqpoll(void)4898 static int smack_uring_sqpoll(void)
4899 {
4900 if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred()))
4901 return 0;
4902
4903 return -EPERM;
4904 }
4905
4906 /**
4907 * smack_uring_cmd - check on file operations for io_uring
4908 * @ioucmd: the command in question
4909 *
4910 * Make a best guess about whether a io_uring "command" should
4911 * be allowed. Use the same logic used for determining if the
4912 * file could be opened for read in the absence of better criteria.
4913 */
smack_uring_cmd(struct io_uring_cmd * ioucmd)4914 static int smack_uring_cmd(struct io_uring_cmd *ioucmd)
4915 {
4916 struct file *file = ioucmd->file;
4917 struct smk_audit_info ad;
4918 struct task_smack *tsp;
4919 struct inode *inode;
4920 int rc;
4921
4922 if (!file)
4923 return -EINVAL;
4924
4925 tsp = smack_cred(file->f_cred);
4926 inode = file_inode(file);
4927
4928 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
4929 smk_ad_setfield_u_fs_path(&ad, file->f_path);
4930 rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
4931 rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
4932
4933 return rc;
4934 }
4935
4936 #endif /* CONFIG_IO_URING */
4937
4938 struct lsm_blob_sizes smack_blob_sizes __ro_after_init = {
4939 .lbs_cred = sizeof(struct task_smack),
4940 .lbs_file = sizeof(struct smack_known *),
4941 .lbs_inode = sizeof(struct inode_smack),
4942 .lbs_ipc = sizeof(struct smack_known *),
4943 .lbs_msg_msg = sizeof(struct smack_known *),
4944 .lbs_superblock = sizeof(struct superblock_smack),
4945 .lbs_xattr_count = SMACK_INODE_INIT_XATTRS,
4946 };
4947
4948 static struct security_hook_list smack_hooks[] __ro_after_init = {
4949 LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
4950 LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
4951 LSM_HOOK_INIT(syslog, smack_syslog),
4952
4953 LSM_HOOK_INIT(fs_context_submount, smack_fs_context_submount),
4954 LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup),
4955 LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
4956
4957 LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
4958 LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),
4959 LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts),
4960 LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),
4961 LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts),
4962
4963 LSM_HOOK_INIT(bprm_creds_for_exec, smack_bprm_creds_for_exec),
4964
4965 LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security),
4966 LSM_HOOK_INIT(inode_init_security, smack_inode_init_security),
4967 LSM_HOOK_INIT(inode_link, smack_inode_link),
4968 LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),
4969 LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir),
4970 LSM_HOOK_INIT(inode_rename, smack_inode_rename),
4971 LSM_HOOK_INIT(inode_permission, smack_inode_permission),
4972 LSM_HOOK_INIT(inode_setattr, smack_inode_setattr),
4973 LSM_HOOK_INIT(inode_getattr, smack_inode_getattr),
4974 LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr),
4975 LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr),
4976 LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr),
4977 LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr),
4978 LSM_HOOK_INIT(inode_set_acl, smack_inode_set_acl),
4979 LSM_HOOK_INIT(inode_get_acl, smack_inode_get_acl),
4980 LSM_HOOK_INIT(inode_remove_acl, smack_inode_remove_acl),
4981 LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),
4982 LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),
4983 LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),
4984 LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),
4985
4986 LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
4987 LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
4988 LSM_HOOK_INIT(file_ioctl_compat, smack_file_ioctl),
4989 LSM_HOOK_INIT(file_lock, smack_file_lock),
4990 LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
4991 LSM_HOOK_INIT(mmap_file, smack_mmap_file),
4992 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
4993 LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner),
4994 LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask),
4995 LSM_HOOK_INIT(file_receive, smack_file_receive),
4996
4997 LSM_HOOK_INIT(file_open, smack_file_open),
4998
4999 LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank),
5000 LSM_HOOK_INIT(cred_free, smack_cred_free),
5001 LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
5002 LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
5003 LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid),
5004 LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
5005 LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
5006 LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),
5007 LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),
5008 LSM_HOOK_INIT(task_getsid, smack_task_getsid),
5009 LSM_HOOK_INIT(current_getsecid_subj, smack_current_getsecid_subj),
5010 LSM_HOOK_INIT(task_getsecid_obj, smack_task_getsecid_obj),
5011 LSM_HOOK_INIT(task_setnice, smack_task_setnice),
5012 LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),
5013 LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),
5014 LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),
5015 LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),
5016 LSM_HOOK_INIT(task_movememory, smack_task_movememory),
5017 LSM_HOOK_INIT(task_kill, smack_task_kill),
5018 LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),
5019
5020 LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),
5021 LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),
5022
5023 LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),
5024
5025 LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security),
5026 LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate),
5027 LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl),
5028 LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd),
5029 LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv),
5030
5031 LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security),
5032 LSM_HOOK_INIT(shm_associate, smack_shm_associate),
5033 LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl),
5034 LSM_HOOK_INIT(shm_shmat, smack_shm_shmat),
5035
5036 LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security),
5037 LSM_HOOK_INIT(sem_associate, smack_sem_associate),
5038 LSM_HOOK_INIT(sem_semctl, smack_sem_semctl),
5039 LSM_HOOK_INIT(sem_semop, smack_sem_semop),
5040
5041 LSM_HOOK_INIT(d_instantiate, smack_d_instantiate),
5042
5043 LSM_HOOK_INIT(getprocattr, smack_getprocattr),
5044 LSM_HOOK_INIT(setprocattr, smack_setprocattr),
5045
5046 LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect),
5047 LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),
5048
5049 LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),
5050 LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair),
5051 #ifdef SMACK_IPV6_PORT_LABELING
5052 LSM_HOOK_INIT(socket_bind, smack_socket_bind),
5053 #endif
5054 LSM_HOOK_INIT(socket_connect, smack_socket_connect),
5055 LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg),
5056 LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb),
5057 LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),
5058 LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
5059 LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
5060 LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
5061 LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security),
5062 LSM_HOOK_INIT(sock_graft, smack_sock_graft),
5063 LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
5064 LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
5065
5066 /* key management security hooks */
5067 #ifdef CONFIG_KEYS
5068 LSM_HOOK_INIT(key_alloc, smack_key_alloc),
5069 LSM_HOOK_INIT(key_free, smack_key_free),
5070 LSM_HOOK_INIT(key_permission, smack_key_permission),
5071 LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),
5072 #ifdef CONFIG_KEY_NOTIFICATIONS
5073 LSM_HOOK_INIT(watch_key, smack_watch_key),
5074 #endif
5075 #endif /* CONFIG_KEYS */
5076
5077 #ifdef CONFIG_WATCH_QUEUE
5078 LSM_HOOK_INIT(post_notification, smack_post_notification),
5079 #endif
5080
5081 /* Audit hooks */
5082 #ifdef CONFIG_AUDIT
5083 LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init),
5084 LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known),
5085 LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match),
5086 #endif /* CONFIG_AUDIT */
5087
5088 LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),
5089 LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),
5090 LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),
5091 LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),
5092 LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),
5093 LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),
5094 LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up),
5095 LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr),
5096 LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as),
5097 #ifdef CONFIG_IO_URING
5098 LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds),
5099 LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll),
5100 LSM_HOOK_INIT(uring_cmd, smack_uring_cmd),
5101 #endif
5102 };
5103
5104
init_smack_known_list(void)5105 static __init void init_smack_known_list(void)
5106 {
5107 /*
5108 * Initialize rule list locks
5109 */
5110 mutex_init(&smack_known_huh.smk_rules_lock);
5111 mutex_init(&smack_known_hat.smk_rules_lock);
5112 mutex_init(&smack_known_floor.smk_rules_lock);
5113 mutex_init(&smack_known_star.smk_rules_lock);
5114 mutex_init(&smack_known_web.smk_rules_lock);
5115 /*
5116 * Initialize rule lists
5117 */
5118 INIT_LIST_HEAD(&smack_known_huh.smk_rules);
5119 INIT_LIST_HEAD(&smack_known_hat.smk_rules);
5120 INIT_LIST_HEAD(&smack_known_star.smk_rules);
5121 INIT_LIST_HEAD(&smack_known_floor.smk_rules);
5122 INIT_LIST_HEAD(&smack_known_web.smk_rules);
5123 /*
5124 * Create the known labels list
5125 */
5126 smk_insert_entry(&smack_known_huh);
5127 smk_insert_entry(&smack_known_hat);
5128 smk_insert_entry(&smack_known_star);
5129 smk_insert_entry(&smack_known_floor);
5130 smk_insert_entry(&smack_known_web);
5131 }
5132
5133 /**
5134 * smack_init - initialize the smack system
5135 *
5136 * Returns 0 on success, -ENOMEM is there's no memory
5137 */
smack_init(void)5138 static __init int smack_init(void)
5139 {
5140 struct cred *cred = (struct cred *) current->cred;
5141 struct task_smack *tsp;
5142
5143 smack_rule_cache = KMEM_CACHE(smack_rule, 0);
5144 if (!smack_rule_cache)
5145 return -ENOMEM;
5146
5147 /*
5148 * Set the security state for the initial task.
5149 */
5150 tsp = smack_cred(cred);
5151 init_task_smack(tsp, &smack_known_floor, &smack_known_floor);
5152
5153 /*
5154 * Register with LSM
5155 */
5156 security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
5157 smack_enabled = 1;
5158
5159 pr_info("Smack: Initializing.\n");
5160 #ifdef CONFIG_SECURITY_SMACK_NETFILTER
5161 pr_info("Smack: Netfilter enabled.\n");
5162 #endif
5163 #ifdef SMACK_IPV6_PORT_LABELING
5164 pr_info("Smack: IPv6 port labeling enabled.\n");
5165 #endif
5166 #ifdef SMACK_IPV6_SECMARK_LABELING
5167 pr_info("Smack: IPv6 Netfilter enabled.\n");
5168 #endif
5169
5170 /* initialize the smack_known_list */
5171 init_smack_known_list();
5172
5173 return 0;
5174 }
5175
5176 /*
5177 * Smack requires early initialization in order to label
5178 * all processes and objects when they are created.
5179 */
5180 DEFINE_LSM(smack) = {
5181 .name = "smack",
5182 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
5183 .blobs = &smack_blob_sizes,
5184 .init = smack_init,
5185 };
5186