xref: /openbmc/linux/security/smack/smack.h (revision fa7f32422ea1ac276b45b96a540ed5981caaa61f)
1 /*
2  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3  *
4  *      This program is free software; you can redistribute it and/or modify
5  *      it under the terms of the GNU General Public License as published by
6  *      the Free Software Foundation, version 2.
7  *
8  * Author:
9  *      Casey Schaufler <casey@schaufler-ca.com>
10  *
11  */
12 
13 #ifndef _SECURITY_SMACK_H
14 #define _SECURITY_SMACK_H
15 
16 #include <linux/capability.h>
17 #include <linux/spinlock.h>
18 #include <linux/lsm_hooks.h>
19 #include <linux/in.h>
20 #if IS_ENABLED(CONFIG_IPV6)
21 #include <linux/in6.h>
22 #endif /* CONFIG_IPV6 */
23 #include <net/netlabel.h>
24 #include <linux/list.h>
25 #include <linux/rculist.h>
26 #include <linux/lsm_audit.h>
27 
28 /*
29  * Use IPv6 port labeling if IPv6 is enabled and secmarks
30  * are not being used.
31  */
32 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
33 #define SMACK_IPV6_PORT_LABELING 1
34 #endif
35 
36 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
37 #define SMACK_IPV6_SECMARK_LABELING 1
38 #endif
39 
40 /*
41  * Smack labels were limited to 23 characters for a long time.
42  */
43 #define SMK_LABELLEN	24
44 #define SMK_LONGLABEL	256
45 
46 /*
47  * This is the repository for labels seen so that it is
48  * not necessary to keep allocating tiny chuncks of memory
49  * and so that they can be shared.
50  *
51  * Labels are never modified in place. Anytime a label
52  * is imported (e.g. xattrset on a file) the list is checked
53  * for it and it is added if it doesn't exist. The address
54  * is passed out in either case. Entries are added, but
55  * never deleted.
56  *
57  * Since labels are hanging around anyway it doesn't
58  * hurt to maintain a secid for those awkward situations
59  * where kernel components that ought to use LSM independent
60  * interfaces don't. The secid should go away when all of
61  * these components have been repaired.
62  *
63  * The cipso value associated with the label gets stored here, too.
64  *
65  * Keep the access rules for this subject label here so that
66  * the entire set of rules does not need to be examined every
67  * time.
68  */
69 struct smack_known {
70 	struct list_head		list;
71 	struct hlist_node		smk_hashed;
72 	char				*smk_known;
73 	u32				smk_secid;
74 	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
75 	struct list_head		smk_rules;	/* access rules */
76 	struct mutex			smk_rules_lock;	/* lock for rules */
77 };
78 
79 /*
80  * Maximum number of bytes for the levels in a CIPSO IP option.
81  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
82  * bigger than can be used, and 24 is the next lower multiple
83  * of 8, and there are too many issues if there isn't space set
84  * aside for the terminating null byte.
85  */
86 #define SMK_CIPSOLEN	24
87 
88 struct superblock_smack {
89 	struct smack_known	*smk_root;
90 	struct smack_known	*smk_floor;
91 	struct smack_known	*smk_hat;
92 	struct smack_known	*smk_default;
93 	int			smk_flags;
94 };
95 
96 /*
97  * Superblock flags
98  */
99 #define SMK_SB_INITIALIZED	0x01
100 #define SMK_SB_UNTRUSTED	0x02
101 
102 struct socket_smack {
103 	struct smack_known	*smk_out;	/* outbound label */
104 	struct smack_known	*smk_in;	/* inbound label */
105 	struct smack_known	*smk_packet;	/* TCP peer label */
106 };
107 
108 /*
109  * Inode smack data
110  */
111 struct inode_smack {
112 	struct smack_known	*smk_inode;	/* label of the fso */
113 	struct smack_known	*smk_task;	/* label of the task */
114 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
115 	struct mutex		smk_lock;	/* initialization lock */
116 	int			smk_flags;	/* smack inode flags */
117 };
118 
119 struct task_smack {
120 	struct smack_known	*smk_task;	/* label for access control */
121 	struct smack_known	*smk_forked;	/* label when forked */
122 	struct list_head	smk_rules;	/* per task access rules */
123 	struct mutex		smk_rules_lock;	/* lock for the rules */
124 	struct list_head	smk_relabel;	/* transit allowed labels */
125 };
126 
127 #define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
128 #define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
129 #define	SMK_INODE_CHANGED	0x04	/* smack was transmuted */
130 #define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
131 
132 /*
133  * A label access rule.
134  */
135 struct smack_rule {
136 	struct list_head	list;
137 	struct smack_known	*smk_subject;
138 	struct smack_known	*smk_object;
139 	int			smk_access;
140 };
141 
142 /*
143  * An entry in the table identifying IPv4 hosts.
144  */
145 struct smk_net4addr {
146 	struct list_head	list;
147 	struct in_addr		smk_host;	/* network address */
148 	struct in_addr		smk_mask;	/* network mask */
149 	int			smk_masks;	/* mask size */
150 	struct smack_known	*smk_label;	/* label */
151 };
152 
153 #if IS_ENABLED(CONFIG_IPV6)
154 /*
155  * An entry in the table identifying IPv6 hosts.
156  */
157 struct smk_net6addr {
158 	struct list_head	list;
159 	struct in6_addr		smk_host;	/* network address */
160 	struct in6_addr		smk_mask;	/* network mask */
161 	int			smk_masks;	/* mask size */
162 	struct smack_known	*smk_label;	/* label */
163 };
164 #endif /* CONFIG_IPV6 */
165 
166 #ifdef SMACK_IPV6_PORT_LABELING
167 /*
168  * An entry in the table identifying ports.
169  */
170 struct smk_port_label {
171 	struct list_head	list;
172 	struct sock		*smk_sock;	/* socket initialized on */
173 	unsigned short		smk_port;	/* the port number */
174 	struct smack_known	*smk_in;	/* inbound label */
175 	struct smack_known	*smk_out;	/* outgoing label */
176 };
177 #endif /* SMACK_IPV6_PORT_LABELING */
178 
179 struct smack_known_list_elem {
180 	struct list_head	list;
181 	struct smack_known	*smk_label;
182 };
183 
184 /* Super block security struct flags for mount options */
185 #define FSDEFAULT_MNT	0x01
186 #define FSFLOOR_MNT	0x02
187 #define FSHAT_MNT	0x04
188 #define FSROOT_MNT	0x08
189 #define FSTRANS_MNT	0x10
190 
191 #define NUM_SMK_MNT_OPTS	5
192 
193 enum {
194 	Opt_error = -1,
195 	Opt_fsdefault = 1,
196 	Opt_fsfloor = 2,
197 	Opt_fshat = 3,
198 	Opt_fsroot = 4,
199 	Opt_fstransmute = 5,
200 };
201 
202 /*
203  * Mount options
204  */
205 #define SMK_FSDEFAULT	"smackfsdef="
206 #define SMK_FSFLOOR	"smackfsfloor="
207 #define SMK_FSHAT	"smackfshat="
208 #define SMK_FSROOT	"smackfsroot="
209 #define SMK_FSTRANS	"smackfstransmute="
210 
211 #define SMACK_DELETE_OPTION	"-DELETE"
212 #define SMACK_CIPSO_OPTION 	"-CIPSO"
213 
214 /*
215  * How communications on this socket are treated.
216  * Usually it's determined by the underlying netlabel code
217  * but there are certain cases, including single label hosts
218  * and potentially single label interfaces for which the
219  * treatment can not be known in advance.
220  *
221  * The possibility of additional labeling schemes being
222  * introduced in the future exists as well.
223  */
224 #define SMACK_UNLABELED_SOCKET	0
225 #define SMACK_CIPSO_SOCKET	1
226 
227 /*
228  * CIPSO defaults.
229  */
230 #define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
231 #define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
232 #define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
233 #define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
234 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
235 /*
236  * CIPSO 2.2 standard is 239, but Smack wants to use the
237  * categories in a structured way that limits the value to
238  * the bits in 23 bytes, hence the unusual number.
239  */
240 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
241 
242 /*
243  * Ptrace rules
244  */
245 #define SMACK_PTRACE_DEFAULT	0
246 #define SMACK_PTRACE_EXACT	1
247 #define SMACK_PTRACE_DRACONIAN	2
248 #define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
249 
250 /*
251  * Flags for untraditional access modes.
252  * It shouldn't be necessary to avoid conflicts with definitions
253  * in fs.h, but do so anyway.
254  */
255 #define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
256 #define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
257 #define MAY_BRINGUP	0x00004000	/* Report use of this rule */
258 
259 /*
260  * The policy for delivering signals is configurable.
261  * It is usually "write", but can be "append".
262  */
263 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
264 #define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
265 #else
266 #define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
267 #endif
268 
269 #define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
270 #define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
271 #define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
272 
273 /*
274  * Just to make the common cases easier to deal with
275  */
276 #define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
277 #define MAY_READWRITE	(MAY_READ | MAY_WRITE)
278 #define MAY_NOT		0
279 
280 /*
281  * Number of access types used by Smack (rwxatlb)
282  */
283 #define SMK_NUM_ACCESS_TYPE 7
284 
285 /* SMACK data */
286 struct smack_audit_data {
287 	const char *function;
288 	char *subject;
289 	char *object;
290 	char *request;
291 	int result;
292 };
293 
294 /*
295  * Smack audit data; is empty if CONFIG_AUDIT not set
296  * to save some stack
297  */
298 struct smk_audit_info {
299 #ifdef CONFIG_AUDIT
300 	struct common_audit_data a;
301 	struct smack_audit_data sad;
302 #endif
303 };
304 
305 /*
306  * These functions are in smack_access.c
307  */
308 int smk_access_entry(char *, char *, struct list_head *);
309 int smk_access(struct smack_known *, struct smack_known *,
310 	       int, struct smk_audit_info *);
311 int smk_tskacc(struct task_smack *, struct smack_known *,
312 	       u32, struct smk_audit_info *);
313 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
314 struct smack_known *smack_from_secid(const u32);
315 char *smk_parse_smack(const char *string, int len);
316 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
317 struct smack_known *smk_import_entry(const char *, int);
318 void smk_insert_entry(struct smack_known *skp);
319 struct smack_known *smk_find_entry(const char *);
320 int smack_privileged(int cap);
321 void smk_destroy_label_list(struct list_head *list);
322 
323 /*
324  * Shared data.
325  */
326 extern int smack_enabled;
327 extern int smack_cipso_direct;
328 extern int smack_cipso_mapped;
329 extern struct smack_known *smack_net_ambient;
330 extern struct smack_known *smack_syslog_label;
331 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
332 extern struct smack_known *smack_unconfined;
333 #endif
334 extern int smack_ptrace_rule;
335 
336 extern struct smack_known smack_known_floor;
337 extern struct smack_known smack_known_hat;
338 extern struct smack_known smack_known_huh;
339 extern struct smack_known smack_known_invalid;
340 extern struct smack_known smack_known_star;
341 extern struct smack_known smack_known_web;
342 
343 extern struct mutex	smack_known_lock;
344 extern struct list_head smack_known_list;
345 extern struct list_head smk_net4addr_list;
346 #if IS_ENABLED(CONFIG_IPV6)
347 extern struct list_head smk_net6addr_list;
348 #endif /* CONFIG_IPV6 */
349 
350 extern struct mutex     smack_onlycap_lock;
351 extern struct list_head smack_onlycap_list;
352 
353 #define SMACK_HASH_SLOTS 16
354 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
355 
356 /*
357  * Is the directory transmuting?
358  */
359 static inline int smk_inode_transmutable(const struct inode *isp)
360 {
361 	struct inode_smack *sip = isp->i_security;
362 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
363 }
364 
365 /*
366  * Present a pointer to the smack label entry in an inode blob.
367  */
368 static inline struct smack_known *smk_of_inode(const struct inode *isp)
369 {
370 	struct inode_smack *sip = isp->i_security;
371 	return sip->smk_inode;
372 }
373 
374 /*
375  * Present a pointer to the smack label entry in an task blob.
376  */
377 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
378 {
379 	return tsp->smk_task;
380 }
381 
382 static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
383 {
384 	struct smack_known *skp;
385 
386 	rcu_read_lock();
387 	skp = smk_of_task(__task_cred(t)->security);
388 	rcu_read_unlock();
389 	return skp;
390 }
391 
392 /*
393  * Present a pointer to the forked smack label entry in an task blob.
394  */
395 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
396 {
397 	return tsp->smk_forked;
398 }
399 
400 /*
401  * Present a pointer to the smack label in the current task blob.
402  */
403 static inline struct smack_known *smk_of_current(void)
404 {
405 	return smk_of_task(current_security());
406 }
407 
408 /*
409  * logging functions
410  */
411 #define SMACK_AUDIT_DENIED 0x1
412 #define SMACK_AUDIT_ACCEPT 0x2
413 extern int log_policy;
414 
415 void smack_log(char *subject_label, char *object_label,
416 		int request,
417 		int result, struct smk_audit_info *auditdata);
418 
419 #ifdef CONFIG_AUDIT
420 
421 /*
422  * some inline functions to set up audit data
423  * they do nothing if CONFIG_AUDIT is not set
424  *
425  */
426 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
427 			       char type)
428 {
429 	memset(&a->sad, 0, sizeof(a->sad));
430 	a->a.type = type;
431 	a->a.smack_audit_data = &a->sad;
432 	a->a.smack_audit_data->function = func;
433 }
434 
435 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
436 				   char type, struct lsm_network_audit *net)
437 {
438 	smk_ad_init(a, func, type);
439 	memset(net, 0, sizeof(*net));
440 	a->a.u.net = net;
441 }
442 
443 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
444 					 struct task_struct *t)
445 {
446 	a->a.u.tsk = t;
447 }
448 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
449 						    struct dentry *d)
450 {
451 	a->a.u.dentry = d;
452 }
453 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
454 					      struct inode *i)
455 {
456 	a->a.u.inode = i;
457 }
458 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
459 					     struct path p)
460 {
461 	a->a.u.path = p;
462 }
463 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
464 					    struct sock *sk)
465 {
466 	a->a.u.net->sk = sk;
467 }
468 
469 #else /* no AUDIT */
470 
471 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
472 			       char type)
473 {
474 }
475 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
476 					 struct task_struct *t)
477 {
478 }
479 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
480 						    struct dentry *d)
481 {
482 }
483 static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
484 						 struct vfsmount *m)
485 {
486 }
487 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
488 					      struct inode *i)
489 {
490 }
491 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
492 					     struct path p)
493 {
494 }
495 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
496 					    struct sock *sk)
497 {
498 }
499 #endif
500 
501 #endif  /* _SECURITY_SMACK_H */
502