smack_lsm.c 86.5 KB
Newer Older
1 2 3 4 5
/*
 *  Simplified MAC Kernel (smack) security module
 *
 *  This file contains the smack hook function implementations.
 *
6
 *  Authors:
7
 *	Casey Schaufler <casey@schaufler-ca.com>
8
 *	Jarkko Sakkinen <jarkko.sakkinen@intel.com>
9 10
 *
 *  Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
11
 *  Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
12
 *                Paul Moore <paul@paul-moore.com>
13
 *  Copyright (C) 2010 Nokia Corporation
14
 *  Copyright (C) 2011 Intel Corporation.
15 16 17 18 19 20 21 22 23 24 25 26
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License version 2,
 *      as published by the Free Software Foundation.
 */

#include <linux/xattr.h>
#include <linux/pagemap.h>
#include <linux/mount.h>
#include <linux/stat.h>
#include <linux/kd.h>
#include <asm/ioctls.h>
27
#include <linux/ip.h>
28 29
#include <linux/tcp.h>
#include <linux/udp.h>
30
#include <linux/slab.h>
31 32 33 34
#include <linux/mutex.h>
#include <linux/pipe_fs_i.h>
#include <net/netlabel.h>
#include <net/cipso_ipv4.h>
35
#include <linux/audit.h>
Nick Black's avatar
Nick Black committed
36
#include <linux/magic.h>
37
#include <linux/dcache.h>
Jarkko Sakkinen's avatar
Jarkko Sakkinen committed
38
#include <linux/personality.h>
Al Viro's avatar
Al Viro committed
39 40 41
#include <linux/msg.h>
#include <linux/shm.h>
#include <linux/binfmts.h>
42 43
#include "smack.h"

44 45
#define task_security(task)	(task_cred_xxx((task), security))

46 47 48
#define TRANS_TRUE	"TRUE"
#define TRANS_TRUE_SIZE	4

49 50 51 52 53 54 55 56
/**
 * smk_fetch - Fetch the smack label from a file.
 * @ip: a pointer to the inode
 * @dp: a pointer to the dentry
 *
 * Returns a pointer to the master list entry for the Smack label
 * or NULL if there was no label to fetch.
 */
57
static char *smk_fetch(const char *name, struct inode *ip, struct dentry *dp)
58 59 60 61 62 63 64
{
	int rc;
	char in[SMK_LABELLEN];

	if (ip->i_op->getxattr == NULL)
		return NULL;

65
	rc = ip->i_op->getxattr(dp, name, in, SMK_LABELLEN);
66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92
	if (rc < 0)
		return NULL;

	return smk_import(in, rc);
}

/**
 * new_inode_smack - allocate an inode security blob
 * @smack: a pointer to the Smack label to use in the blob
 *
 * Returns the new blob or NULL if there's no memory available
 */
struct inode_smack *new_inode_smack(char *smack)
{
	struct inode_smack *isp;

	isp = kzalloc(sizeof(struct inode_smack), GFP_KERNEL);
	if (isp == NULL)
		return NULL;

	isp->smk_inode = smack;
	isp->smk_flags = 0;
	mutex_init(&isp->smk_lock);

	return isp;
}

93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142
/**
 * new_task_smack - allocate a task security blob
 * @smack: a pointer to the Smack label to use in the blob
 *
 * Returns the new blob or NULL if there's no memory available
 */
static struct task_smack *new_task_smack(char *task, char *forked, gfp_t gfp)
{
	struct task_smack *tsp;

	tsp = kzalloc(sizeof(struct task_smack), gfp);
	if (tsp == NULL)
		return NULL;

	tsp->smk_task = task;
	tsp->smk_forked = forked;
	INIT_LIST_HEAD(&tsp->smk_rules);
	mutex_init(&tsp->smk_rules_lock);

	return tsp;
}

/**
 * smk_copy_rules - copy a rule set
 * @nhead - new rules header pointer
 * @ohead - old rules header pointer
 *
 * Returns 0 on success, -ENOMEM on error
 */
static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
				gfp_t gfp)
{
	struct smack_rule *nrp;
	struct smack_rule *orp;
	int rc = 0;

	INIT_LIST_HEAD(nhead);

	list_for_each_entry_rcu(orp, ohead, list) {
		nrp = kzalloc(sizeof(struct smack_rule), gfp);
		if (nrp == NULL) {
			rc = -ENOMEM;
			break;
		}
		*nrp = *orp;
		list_add_rcu(&nrp->list, nhead);
	}
	return rc;
}

143 144 145 146 147 148
/*
 * LSM hooks.
 * We he, that is fun!
 */

/**
149
 * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH
150
 * @ctp: child task pointer
151
 * @mode: ptrace attachment mode
152 153 154 155 156
 *
 * Returns 0 if access is OK, an error code otherwise
 *
 * Do the capability checks, and require read and write.
 */
157
static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
158 159
{
	int rc;
Etienne Basset's avatar
Etienne Basset committed
160
	struct smk_audit_info ad;
161
	char *tsp;
162

163
	rc = cap_ptrace_access_check(ctp, mode);
164 165 166
	if (rc != 0)
		return rc;

167
	tsp = smk_of_task(task_security(ctp));
Etienne Basset's avatar
Etienne Basset committed
168 169 170
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
	smk_ad_setfield_u_tsk(&ad, ctp);

171
	rc = smk_curacc(tsp, MAY_READWRITE, &ad);
172 173 174 175 176 177 178 179 180 181 182 183 184 185
	return rc;
}

/**
 * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
 * @ptp: parent task pointer
 *
 * Returns 0 if access is OK, an error code otherwise
 *
 * Do the capability checks, and require read and write.
 */
static int smack_ptrace_traceme(struct task_struct *ptp)
{
	int rc;
Etienne Basset's avatar
Etienne Basset committed
186
	struct smk_audit_info ad;
187
	char *tsp;
188 189 190 191

	rc = cap_ptrace_traceme(ptp);
	if (rc != 0)
		return rc;
192

193
	tsp = smk_of_task(task_security(ptp));
Etienne Basset's avatar
Etienne Basset committed
194 195 196
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
	smk_ad_setfield_u_tsk(&ad, ptp);

197
	rc = smk_curacc(tsp, MAY_READWRITE, &ad);
198 199 200 201 202 203 204 205 206 207 208
	return rc;
}

/**
 * smack_syslog - Smack approval on syslog
 * @type: message type
 *
 * Require that the task has the floor label
 *
 * Returns 0 on success, error code otherwise.
 */
209
static int smack_syslog(int typefrom_file)
210
{
211
	int rc = 0;
212
	char *sp = smk_of_current();
213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268

	if (capable(CAP_MAC_OVERRIDE))
		return 0;

	 if (sp != smack_known_floor.smk_known)
		rc = -EACCES;

	return rc;
}


/*
 * Superblock Hooks.
 */

/**
 * smack_sb_alloc_security - allocate a superblock blob
 * @sb: the superblock getting the blob
 *
 * Returns 0 on success or -ENOMEM on error.
 */
static int smack_sb_alloc_security(struct super_block *sb)
{
	struct superblock_smack *sbsp;

	sbsp = kzalloc(sizeof(struct superblock_smack), GFP_KERNEL);

	if (sbsp == NULL)
		return -ENOMEM;

	sbsp->smk_root = smack_known_floor.smk_known;
	sbsp->smk_default = smack_known_floor.smk_known;
	sbsp->smk_floor = smack_known_floor.smk_known;
	sbsp->smk_hat = smack_known_hat.smk_known;
	sbsp->smk_initialized = 0;
	spin_lock_init(&sbsp->smk_sblock);

	sb->s_security = sbsp;

	return 0;
}

/**
 * smack_sb_free_security - free a superblock blob
 * @sb: the superblock getting the blob
 *
 */
static void smack_sb_free_security(struct super_block *sb)
{
	kfree(sb->s_security);
	sb->s_security = NULL;
}

/**
 * smack_sb_copy_data - copy mount options data for processing
 * @orig: where to start
269
 * @smackopts: mount options string
270 271 272 273 274 275
 *
 * Returns 0 on success or -ENOMEM on error.
 *
 * Copy the Smack specific mount options out of the mount
 * options list.
 */
276
static int smack_sb_copy_data(char *orig, char *smackopts)
277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313
{
	char *cp, *commap, *otheropts, *dp;

	otheropts = (char *)get_zeroed_page(GFP_KERNEL);
	if (otheropts == NULL)
		return -ENOMEM;

	for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) {
		if (strstr(cp, SMK_FSDEFAULT) == cp)
			dp = smackopts;
		else if (strstr(cp, SMK_FSFLOOR) == cp)
			dp = smackopts;
		else if (strstr(cp, SMK_FSHAT) == cp)
			dp = smackopts;
		else if (strstr(cp, SMK_FSROOT) == cp)
			dp = smackopts;
		else
			dp = otheropts;

		commap = strchr(cp, ',');
		if (commap != NULL)
			*commap = '\0';

		if (*dp != '\0')
			strcat(dp, ",");
		strcat(dp, cp);
	}

	strcpy(orig, otheropts);
	free_page((unsigned long)otheropts);

	return 0;
}

/**
 * smack_sb_kern_mount - Smack specific mount processing
 * @sb: the file system superblock
314
 * @flags: the mount flags
315 316 317 318
 * @data: the smack mount options
 *
 * Returns 0 on success, an error code on failure
 */
319
static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387
{
	struct dentry *root = sb->s_root;
	struct inode *inode = root->d_inode;
	struct superblock_smack *sp = sb->s_security;
	struct inode_smack *isp;
	char *op;
	char *commap;
	char *nsp;

	spin_lock(&sp->smk_sblock);
	if (sp->smk_initialized != 0) {
		spin_unlock(&sp->smk_sblock);
		return 0;
	}
	sp->smk_initialized = 1;
	spin_unlock(&sp->smk_sblock);

	for (op = data; op != NULL; op = commap) {
		commap = strchr(op, ',');
		if (commap != NULL)
			*commap++ = '\0';

		if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) {
			op += strlen(SMK_FSHAT);
			nsp = smk_import(op, 0);
			if (nsp != NULL)
				sp->smk_hat = nsp;
		} else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) {
			op += strlen(SMK_FSFLOOR);
			nsp = smk_import(op, 0);
			if (nsp != NULL)
				sp->smk_floor = nsp;
		} else if (strncmp(op, SMK_FSDEFAULT,
				   strlen(SMK_FSDEFAULT)) == 0) {
			op += strlen(SMK_FSDEFAULT);
			nsp = smk_import(op, 0);
			if (nsp != NULL)
				sp->smk_default = nsp;
		} else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) {
			op += strlen(SMK_FSROOT);
			nsp = smk_import(op, 0);
			if (nsp != NULL)
				sp->smk_root = nsp;
		}
	}

	/*
	 * Initialize the root inode.
	 */
	isp = inode->i_security;
	if (isp == NULL)
		inode->i_security = new_inode_smack(sp->smk_root);
	else
		isp->smk_inode = sp->smk_root;

	return 0;
}

/**
 * smack_sb_statfs - Smack check on statfs
 * @dentry: identifies the file system in question
 *
 * Returns 0 if current can read the floor of the filesystem,
 * and error code otherwise
 */
static int smack_sb_statfs(struct dentry *dentry)
{
	struct superblock_smack *sbp = dentry->d_sb->s_security;
Etienne Basset's avatar
Etienne Basset committed
388 389 390
	int rc;
	struct smk_audit_info ad;

391
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
392
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
393

Etienne Basset's avatar
Etienne Basset committed
394 395
	rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
	return rc;
396 397 398 399 400
}

/**
 * smack_sb_mount - Smack check for mounting
 * @dev_name: unused
401
 * @path: mount point
402 403 404 405 406 407 408
 * @type: unused
 * @flags: unused
 * @data: unused
 *
 * Returns 0 if current can write the floor of the filesystem
 * being mounted on, an error code otherwise.
 */
409
static int smack_sb_mount(char *dev_name, struct path *path,
410 411
			  char *type, unsigned long flags, void *data)
{
412
	struct superblock_smack *sbp = path->dentry->d_sb->s_security;
Etienne Basset's avatar
Etienne Basset committed
413
	struct smk_audit_info ad;
414

415
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
Etienne Basset's avatar
Etienne Basset committed
416 417 418
	smk_ad_setfield_u_fs_path(&ad, *path);

	return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
419 420 421 422 423 424 425 426 427 428 429 430 431
}

/**
 * smack_sb_umount - Smack check for unmounting
 * @mnt: file system to unmount
 * @flags: unused
 *
 * Returns 0 if current can write the floor of the filesystem
 * being unmounted, an error code otherwise.
 */
static int smack_sb_umount(struct vfsmount *mnt, int flags)
{
	struct superblock_smack *sbp;
Etienne Basset's avatar
Etienne Basset committed
432
	struct smk_audit_info ad;
433
	struct path path;
434

435 436
	path.dentry = mnt->mnt_root;
	path.mnt = mnt;
437

438
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
439
	smk_ad_setfield_u_fs_path(&ad, path);
440

441
	sbp = path.dentry->d_sb->s_security;
Etienne Basset's avatar
Etienne Basset committed
442
	return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
443 444
}

445 446 447 448
/*
 * BPRM hooks
 */

Casey Schaufler's avatar
Casey Schaufler committed
449 450 451 452 453 454
/**
 * smack_bprm_set_creds - set creds for exec
 * @bprm: the exec information
 *
 * Returns 0 if it gets a blob, -ENOMEM otherwise
 */
455 456
static int smack_bprm_set_creds(struct linux_binprm *bprm)
{
457 458
	struct inode *inode = bprm->file->f_path.dentry->d_inode;
	struct task_smack *bsp = bprm->cred->security;
459 460 461 462 463 464 465 466 467 468
	struct inode_smack *isp;
	int rc;

	rc = cap_bprm_set_creds(bprm);
	if (rc != 0)
		return rc;

	if (bprm->cred_prepared)
		return 0;

469 470
	isp = inode->i_security;
	if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
471 472
		return 0;

473 474
	if (bprm->unsafe)
		return -EPERM;
475

476 477
	bsp->smk_task = isp->smk_task;
	bprm->per_clear |= PER_CLEAR_ON_SETID;
478

479 480
	return 0;
}
481

482 483 484 485 486 487 488 489 490
/**
 * smack_bprm_committing_creds - Prepare to install the new credentials
 * from bprm.
 *
 * @bprm: binprm for exec
 */
static void smack_bprm_committing_creds(struct linux_binprm *bprm)
{
	struct task_smack *bsp = bprm->cred->security;
491

492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510
	if (bsp->smk_task != bsp->smk_forked)
		current->pdeath_signal = 0;
}

/**
 * smack_bprm_secureexec - Return the decision to use secureexec.
 * @bprm: binprm for exec
 *
 * Returns 0 on success.
 */
static int smack_bprm_secureexec(struct linux_binprm *bprm)
{
	struct task_smack *tsp = current_security();
	int ret = cap_bprm_secureexec(bprm);

	if (!ret && (tsp->smk_task != tsp->smk_forked))
		ret = 1;

	return ret;
511 512
}

513 514 515 516 517 518
/*
 * Inode hooks
 */

/**
 * smack_inode_alloc_security - allocate an inode blob
519
 * @inode: the inode in need of a blob
520 521 522 523 524
 *
 * Returns 0 if it gets a blob, -ENOMEM otherwise
 */
static int smack_inode_alloc_security(struct inode *inode)
{
525
	inode->i_security = new_inode_smack(smk_of_current());
526 527 528 529 530 531 532
	if (inode->i_security == NULL)
		return -ENOMEM;
	return 0;
}

/**
 * smack_inode_free_security - free an inode blob
533
 * @inode: the inode with a blob
534 535 536 537 538 539 540 541 542 543 544 545 546
 *
 * Clears the blob pointer in inode
 */
static void smack_inode_free_security(struct inode *inode)
{
	kfree(inode->i_security);
	inode->i_security = NULL;
}

/**
 * smack_inode_init_security - copy out the smack from an inode
 * @inode: the inode
 * @dir: unused
547
 * @qstr: unused
548 549 550 551 552 553 554
 * @name: where to put the attribute name
 * @value: where to put the attribute value
 * @len: where to put the length of the attribute
 *
 * Returns 0 if it all works out, -ENOMEM if there's no memory
 */
static int smack_inode_init_security(struct inode *inode, struct inode *dir,
555 556
				     const struct qstr *qstr, char **name,
				     void **value, size_t *len)
557
{
558 559
	struct smack_known *skp;
	char *csp = smk_of_current();
560
	char *isp = smk_of_inode(inode);
561
	char *dsp = smk_of_inode(dir);
562
	int may;
563 564 565 566 567 568 569 570

	if (name) {
		*name = kstrdup(XATTR_SMACK_SUFFIX, GFP_KERNEL);
		if (*name == NULL)
			return -ENOMEM;
	}

	if (value) {
571
		skp = smk_find_entry(csp);
572
		rcu_read_lock();
573
		may = smk_access_entry(csp, dsp, &skp->smk_rules);
574
		rcu_read_unlock();
575 576 577 578 579 580

		/*
		 * If the access rule allows transmutation and
		 * the directory requests transmutation then
		 * by all means transmute.
		 */
581 582
		if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
		    smk_inode_transmutable(dir))
583 584
			isp = dsp;

585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607
		*value = kstrdup(isp, GFP_KERNEL);
		if (*value == NULL)
			return -ENOMEM;
	}

	if (len)
		*len = strlen(isp) + 1;

	return 0;
}

/**
 * smack_inode_link - Smack check on link
 * @old_dentry: the existing object
 * @dir: unused
 * @new_dentry: the new object
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
			    struct dentry *new_dentry)
{
	char *isp;
Etienne Basset's avatar
Etienne Basset committed
608 609 610
	struct smk_audit_info ad;
	int rc;

611
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
612
	smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
613 614

	isp = smk_of_inode(old_dentry->d_inode);
Etienne Basset's avatar
Etienne Basset committed
615
	rc = smk_curacc(isp, MAY_WRITE, &ad);
616 617 618

	if (rc == 0 && new_dentry->d_inode != NULL) {
		isp = smk_of_inode(new_dentry->d_inode);
Etienne Basset's avatar
Etienne Basset committed
619 620
		smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
		rc = smk_curacc(isp, MAY_WRITE, &ad);
621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636
	}

	return rc;
}

/**
 * smack_inode_unlink - Smack check on inode deletion
 * @dir: containing directory object
 * @dentry: file to unlink
 *
 * Returns 0 if current can write the containing directory
 * and the object, error code otherwise
 */
static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
{
	struct inode *ip = dentry->d_inode;
Etienne Basset's avatar
Etienne Basset committed
637
	struct smk_audit_info ad;
638 639
	int rc;

640
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
641 642
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);

643 644 645
	/*
	 * You need write access to the thing you're unlinking
	 */
Etienne Basset's avatar
Etienne Basset committed
646 647
	rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
	if (rc == 0) {
648 649 650
		/*
		 * You also need write access to the containing directory
		 */
Etienne Basset's avatar
Etienne Basset committed
651 652 653 654
		smk_ad_setfield_u_fs_path_dentry(&ad, NULL);
		smk_ad_setfield_u_fs_inode(&ad, dir);
		rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
	}
655 656 657 658 659 660 661 662 663 664 665 666 667
	return rc;
}

/**
 * smack_inode_rmdir - Smack check on directory deletion
 * @dir: containing directory object
 * @dentry: directory to unlink
 *
 * Returns 0 if current can write the containing directory
 * and the directory, error code otherwise
 */
static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
{
Etienne Basset's avatar
Etienne Basset committed
668
	struct smk_audit_info ad;
669 670
	int rc;

671
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
672 673
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);

674 675 676
	/*
	 * You need write access to the thing you're removing
	 */
Etienne Basset's avatar
Etienne Basset committed
677 678
	rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
	if (rc == 0) {
679 680 681
		/*
		 * You also need write access to the containing directory
		 */
Etienne Basset's avatar
Etienne Basset committed
682 683 684 685
		smk_ad_setfield_u_fs_path_dentry(&ad, NULL);
		smk_ad_setfield_u_fs_inode(&ad, dir);
		rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
	}
686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708

	return rc;
}

/**
 * smack_inode_rename - Smack check on rename
 * @old_inode: the old directory
 * @old_dentry: unused
 * @new_inode: the new directory
 * @new_dentry: unused
 *
 * Read and write access is required on both the old and
 * new directories.
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
static int smack_inode_rename(struct inode *old_inode,
			      struct dentry *old_dentry,
			      struct inode *new_inode,
			      struct dentry *new_dentry)
{
	int rc;
	char *isp;
Etienne Basset's avatar
Etienne Basset committed
709 710
	struct smk_audit_info ad;

711
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
712
	smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
713 714

	isp = smk_of_inode(old_dentry->d_inode);
Etienne Basset's avatar
Etienne Basset committed
715
	rc = smk_curacc(isp, MAY_READWRITE, &ad);
716 717 718

	if (rc == 0 && new_dentry->d_inode != NULL) {
		isp = smk_of_inode(new_dentry->d_inode);
Etienne Basset's avatar
Etienne Basset committed
719 720
		smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
		rc = smk_curacc(isp, MAY_READWRITE, &ad);
721 722 723 724 725 726 727 728 729 730 731 732 733
	}
	return rc;
}

/**
 * smack_inode_permission - Smack version of permission()
 * @inode: the inode in question
 * @mask: the access requested
 *
 * This is the important Smack hook.
 *
 * Returns 0 if access is permitted, -EACCES otherwise
 */
734
static int smack_inode_permission(struct inode *inode, int mask)
735
{
Etienne Basset's avatar
Etienne Basset committed
736
	struct smk_audit_info ad;
737
	int no_block = mask & MAY_NOT_BLOCK;
738 739

	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
740 741 742 743 744
	/*
	 * No permission to check. Existence test. Yup, it's there.
	 */
	if (mask == 0)
		return 0;
745 746

	/* May be droppable after audit */
747
	if (no_block)
748
		return -ECHILD;
749
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
Etienne Basset's avatar
Etienne Basset committed
750 751
	smk_ad_setfield_u_fs_inode(&ad, inode);
	return smk_curacc(smk_of_inode(inode), mask, &ad);
752 753 754 755 756 757 758 759 760 761 762
}

/**
 * smack_inode_setattr - Smack check for setting attributes
 * @dentry: the object
 * @iattr: for the force flag
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
{
Etienne Basset's avatar
Etienne Basset committed
763
	struct smk_audit_info ad;
764 765 766 767 768
	/*
	 * Need to allow for clearing the setuid bit.
	 */
	if (iattr->ia_valid & ATTR_FORCE)
		return 0;
769
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
770
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
771

Etienne Basset's avatar
Etienne Basset committed
772
	return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
773 774 775 776 777 778 779 780 781 782 783
}

/**
 * smack_inode_getattr - Smack check for getting attributes
 * @mnt: unused
 * @dentry: the object
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
{
Etienne Basset's avatar
Etienne Basset committed
784
	struct smk_audit_info ad;
785
	struct path path;
Etienne Basset's avatar
Etienne Basset committed
786

787 788
	path.dentry = dentry;
	path.mnt = mnt;
Etienne Basset's avatar
Etienne Basset committed
789

790
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
791
	smk_ad_setfield_u_fs_path(&ad, path);
Etienne Basset's avatar
Etienne Basset committed
792
	return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
793 794 795 796 797 798 799 800 801 802 803 804 805 806
}

/**
 * smack_inode_setxattr - Smack check for setting xattrs
 * @dentry: the object
 * @name: name of the attribute
 * @value: unused
 * @size: unused
 * @flags: unused
 *
 * This protects the Smack attribute explicitly.
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
807 808
static int smack_inode_setxattr(struct dentry *dentry, const char *name,
				const void *value, size_t size, int flags)
809
{
Etienne Basset's avatar
Etienne Basset committed
810
	struct smk_audit_info ad;
811
	int rc = 0;
812

813 814
	if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
	    strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
815
	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
816 817
	    strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
	    strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
818 819
		if (!capable(CAP_MAC_ADMIN))
			rc = -EPERM;
820 821 822 823 824 825
		/*
		 * check label validity here so import wont fail on
		 * post_setxattr
		 */
		if (size == 0 || size >= SMK_LABELLEN ||
		    smk_import(value, size) == NULL)
826
			rc = -EINVAL;
827 828 829 830 831 832
	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
		if (!capable(CAP_MAC_ADMIN))
			rc = -EPERM;
		if (size != TRANS_TRUE_SIZE ||
		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
			rc = -EINVAL;
833 834 835
	} else
		rc = cap_inode_setxattr(dentry, name, value, size, flags);

836
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
837 838
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);

839
	if (rc == 0)
Etienne Basset's avatar
Etienne Basset committed
840
		rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
841 842

	return rc;
843 844 845 846 847 848 849 850 851 852 853 854 855
}

/**
 * smack_inode_post_setxattr - Apply the Smack update approved above
 * @dentry: object
 * @name: attribute name
 * @value: attribute value
 * @size: attribute size
 * @flags: unused
 *
 * Set the pointer in the inode blob to the entry found
 * in the master label list.
 */
856 857
static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
				      const void *value, size_t size, int flags)
858 859
{
	char *nsp;
860
	struct inode_smack *isp = dentry->d_inode->i_security;
861 862

	if (strcmp(name, XATTR_NAME_SMACK) == 0) {
863
		nsp = smk_import(value, size);
864 865 866 867
		if (nsp != NULL)
			isp->smk_inode = nsp;
		else
			isp->smk_inode = smack_known_invalid.smk_known;
868 869
	} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
		nsp = smk_import(value, size);
870 871 872 873
		if (nsp != NULL)
			isp->smk_task = nsp;
		else
			isp->smk_task = smack_known_invalid.smk_known;
874 875 876 877 878 879
	} else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
		nsp = smk_import(value, size);
		if (nsp != NULL)
			isp->smk_mmap = nsp;
		else
			isp->smk_mmap = smack_known_invalid.smk_known;
880 881
	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
		isp->smk_flags |= SMK_INODE_TRANSMUTE;
882 883 884 885

	return;
}

Casey Schaufler's avatar
Casey Schaufler committed
886
/**
887 888 889 890 891 892
 * smack_inode_getxattr - Smack check on getxattr
 * @dentry: the object
 * @name: unused
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
893
static int smack_inode_getxattr(struct dentry *dentry, const char *name)
894
{
Etienne Basset's avatar
Etienne Basset committed
895 896
	struct smk_audit_info ad;

897
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
898 899 900
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);

	return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
901 902
}

Casey Schaufler's avatar
Casey Schaufler committed
903
/**
904 905 906 907 908 909 910 911
 * smack_inode_removexattr - Smack check on removexattr
 * @dentry: the object
 * @name: name of the attribute
 *
 * Removing the Smack attribute requires CAP_MAC_ADMIN
 *
 * Returns 0 if access is permitted, an error code otherwise
 */
912
static int smack_inode_removexattr(struct dentry *dentry, const char *name)
913
{
914
	struct inode_smack *isp;
Etienne Basset's avatar
Etienne Basset committed
915
	struct smk_audit_info ad;
916
	int rc = 0;
917

918 919
	if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
	    strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
920
	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
921
	    strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
922 923
	    strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
	    strcmp(name, XATTR_NAME_SMACKMMAP)) {
924 925 926 927 928
		if (!capable(CAP_MAC_ADMIN))
			rc = -EPERM;
	} else
		rc = cap_inode_removexattr(dentry, name);

929
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
Etienne Basset's avatar
Etienne Basset committed
930
	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
931
	if (rc == 0)
Etienne Basset's avatar
Etienne Basset committed
932
		rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
933

934 935 936
	if (rc == 0) {
		isp = dentry->d_inode->i_security;
		isp->smk_task = NULL;
937
		isp->smk_mmap = NULL;
938 939
	}

940
	return rc;
941 942 943 944 945 946 947
}

/**
 * smack_inode_getsecurity - get smack xattrs
 * @inode: the object
 * @name: attribute name
 * @buffer: where to put the result
948
 * @alloc: unused
949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978
 *
 * Returns the size of the attribute or an error code
 */
static int smack_inode_getsecurity(const struct inode *inode,
				   const char *name, void **buffer,
				   bool alloc)
{
	struct socket_smack *ssp;
	struct socket *sock;
	struct super_block *sbp;
	struct inode *ip = (struct inode *)inode;
	char *isp;
	int ilen;
	int rc = 0;

	if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
		isp = smk_of_inode(inode);
		ilen = strlen(isp) + 1;
		*buffer = isp;
		return ilen;
	}

	/*
	 * The rest of the Smack xattrs are only on sockets.
	 */
	sbp = ip->i_sb;
	if (sbp->s_magic != SOCKFS_MAGIC)
		return -EOPNOTSUPP;

	sock = SOCKET_I(ip);
979
	if (sock == NULL || sock->sk == NULL)
980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020
		return -EOPNOTSUPP;

	ssp = sock->sk->sk_security;

	if (strcmp(name, XATTR_SMACK_IPIN) == 0)
		isp = ssp->smk_in;
	else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
		isp = ssp->smk_out;
	else
		return -EOPNOTSUPP;

	ilen = strlen(isp) + 1;
	if (rc == 0) {
		*buffer = isp;
		rc = ilen;
	}

	return rc;
}


/**
 * smack_inode_listsecurity - list the Smack attributes
 * @inode: the object
 * @buffer: where they go
 * @buffer_size: size of buffer
 *
 * Returns 0 on success, -EINVAL otherwise
 */
static int smack_inode_listsecurity(struct inode *inode, char *buffer,
				    size_t buffer_size)
{
	int len = strlen(XATTR_NAME_SMACK);

	if (buffer != NULL && len <= buffer_size) {
		memcpy(buffer, XATTR_NAME_SMACK, len);
		return len;
	}
	return -EINVAL;
}

1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032
/**
 * smack_inode_getsecid - Extract inode's security id
 * @inode: inode to extract the info from
 * @secid: where result will be saved
 */
static void smack_inode_getsecid(const struct inode *inode, u32 *secid)
{
	struct inode_smack *isp = inode->i_security;

	*secid = smack_to_secid(isp->smk_inode);
}

1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066
/*
 * File Hooks
 */

/**
 * smack_file_permission - Smack check on file operations
 * @file: unused
 * @mask: unused
 *
 * Returns 0
 *
 * Should access checks be done on each read or write?
 * UNICOS and SELinux say yes.
 * Trusted Solaris, Trusted Irix, and just about everyone else says no.
 *
 * I'll say no for now. Smack does not do the frequent
 * label changing that SELinux does.
 */
static int smack_file_permission(struct file *file, int mask)
{
	return 0;
}

/**
 * smack_file_alloc_security - assign a file security blob
 * @file: the object
 *
 * The security blob for a file is a pointer to the master
 * label list, so no allocation is done.
 *
 * Returns 0
 */
static int smack_file_alloc_security(struct file *file)
{
1067
	file->f_security = smk_of_current();
1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096
	return 0;
}

/**
 * smack_file_free_security - clear a file security blob
 * @file: the object
 *
 * The security blob for a file is a pointer to the master
 * label list, so no memory is freed.
 */
static void smack_file_free_security(struct file *file)
{
	file->f_security = NULL;
}

/**
 * smack_file_ioctl - Smack check on ioctls
 * @file: the object
 * @cmd: what to do
 * @arg: unused
 *
 * Relies heavily on the correct use of the ioctl command conventions.
 *
 * Returns 0 if allowed, error code otherwise
 */
static int smack_file_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg)
{
	int rc = 0;
Etienne Basset's avatar
Etienne Basset committed
1097 1098
	struct smk_audit_info ad;

1099
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
Etienne Basset's avatar
Etienne Basset committed
1100
	smk_ad_setfield_u_fs_path(&ad, file->f_path);
1101 1102

	if (_IOC_DIR(cmd) & _IOC_WRITE)
Etienne Basset's avatar
Etienne Basset committed
1103
		rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1104 1105

	if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ))
Etienne Basset's avatar
Etienne Basset committed
1106
		rc = smk_curacc(file->f_security, MAY_READ, &ad);
1107 1108 1109 1110 1111 1112 1113

	return rc;
}

/**
 * smack_file_lock - Smack check on file locking
 * @file: the object
1114
 * @cmd: unused
1115 1116 1117 1118 1119
 *
 * Returns 0 if current has write access, error code otherwise
 */
static int smack_file_lock(struct file *file, unsigned int cmd)
{
Etienne Basset's avatar
Etienne Basset committed
1120 1121
	struct smk_audit_info ad;

1122 1123
	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
	smk_ad_setfield_u_fs_path(&ad, file->f_path);
Etienne Basset's avatar
Etienne Basset committed
1124
	return smk_curacc(file->f_security, MAY_WRITE, &ad);
1125 1126 1127 1128 1129 1130 1131 1132
}

/**
 * smack_file_fcntl - Smack check on fcntl
 * @file: the object
 * @cmd: what action to check
 * @arg: unused
 *
1133 1134 1135 1136
 * Generally these operations are harmless.
 * File locking operations present an obvious mechanism
 * for passing information, so they require write access.
 *
1137 1138 1139 1140 1141
 * Returns 0 if current has access, error code otherwise
 */
static int smack_file_fcntl(struct file *file, unsigned int cmd,
			    unsigned long arg)
{
Etienne Basset's avatar
Etienne Basset committed
1142
	struct smk_audit_info ad;
1143
	int rc = 0;
1144

Etienne Basset's avatar
Etienne Basset committed
1145

1146 1147 1148 1149 1150 1151
	switch (cmd) {
	case F_GETLK:
	case F_SETLK:
	case F_SETLKW:
	case F_SETOWN:
	case F_SETSIG:
1152 1153
		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
		smk_ad_setfield_u_fs_path(&ad, file->f_path);
Etienne Basset's avatar
Etienne Basset committed
1154
		rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1155 1156
		break;
	default:
1157
		break;
1158 1159 1160 1161 1162
	}

	return rc;
}

1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177
/**
 * smack_file_mmap :
 * Check permissions for a mmap operation.  The @file may be NULL, e.g.
 * if mapping anonymous memory.
 * @file contains the file structure for file to map (may be NULL).
 * @reqprot contains the protection requested by the application.
 * @prot contains the protection that will be applied by the kernel.
 * @flags contains the operational flags.
 * Return 0 if permission is granted.
 */
static int smack_file_mmap(struct file *file,
			   unsigned long reqprot, unsigned long prot,
			   unsigned long flags, unsigned long addr,
			   unsigned long addr_only)
{
1178
	struct smack_known *skp;
1179 1180 1181 1182
	struct smack_rule *srp;
	struct task_smack *tsp;
	char *sp;
	char *msmack;
1183
	char *osmack;
1184 1185
	struct inode_smack *isp;
	struct dentry *dp;
1186 1187 1188
	int may;
	int mmay;
	int tmay;
1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
	int rc;