Commit | Line | Data |
---|---|---|
e114e473 CS |
1 | /* |
2 | * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com> | |
3 | * | |
4 | * This program is free software; you can redistribute it and/or modify | |
5 | * it under the terms of the GNU General Public License as published by | |
6 | * the Free Software Foundation, version 2. | |
7 | * | |
8 | * Author: | |
9 | * Casey Schaufler <casey@schaufler-ca.com> | |
10 | * | |
11 | */ | |
12 | ||
13 | #include <linux/types.h> | |
14 | #include <linux/fs.h> | |
15 | #include <linux/sched.h> | |
16 | #include "smack.h" | |
17 | ||
e114e473 | 18 | struct smack_known smack_known_huh = { |
e114e473 CS |
19 | .smk_known = "?", |
20 | .smk_secid = 2, | |
21 | .smk_cipso = NULL, | |
22 | }; | |
23 | ||
24 | struct smack_known smack_known_hat = { | |
e114e473 CS |
25 | .smk_known = "^", |
26 | .smk_secid = 3, | |
27 | .smk_cipso = NULL, | |
28 | }; | |
29 | ||
30 | struct smack_known smack_known_star = { | |
e114e473 CS |
31 | .smk_known = "*", |
32 | .smk_secid = 4, | |
33 | .smk_cipso = NULL, | |
34 | }; | |
35 | ||
36 | struct smack_known smack_known_floor = { | |
e114e473 CS |
37 | .smk_known = "_", |
38 | .smk_secid = 5, | |
39 | .smk_cipso = NULL, | |
40 | }; | |
41 | ||
42 | struct smack_known smack_known_invalid = { | |
e114e473 CS |
43 | .smk_known = "", |
44 | .smk_secid = 6, | |
45 | .smk_cipso = NULL, | |
46 | }; | |
47 | ||
6d3dc07c | 48 | struct smack_known smack_known_web = { |
6d3dc07c CS |
49 | .smk_known = "@", |
50 | .smk_secid = 7, | |
51 | .smk_cipso = NULL, | |
52 | }; | |
53 | ||
7198e2ee | 54 | LIST_HEAD(smack_known_list); |
e114e473 CS |
55 | |
56 | /* | |
57 | * The initial value needs to be bigger than any of the | |
58 | * known values above. | |
59 | */ | |
60 | static u32 smack_next_secid = 10; | |
61 | ||
ecfcc53f EB |
62 | /* |
63 | * what events do we log | |
64 | * can be overwritten at run-time by /smack/logging | |
65 | */ | |
66 | int log_policy = SMACK_AUDIT_DENIED; | |
67 | ||
e114e473 CS |
68 | /** |
69 | * smk_access - determine if a subject has a specific access to an object | |
70 | * @subject_label: a pointer to the subject's Smack label | |
71 | * @object_label: a pointer to the object's Smack label | |
72 | * @request: the access requested, in "MAY" format | |
ecfcc53f | 73 | * @a : a pointer to the audit data |
e114e473 CS |
74 | * |
75 | * This function looks up the subject/object pair in the | |
76 | * access rule list and returns 0 if the access is permitted, | |
77 | * non zero otherwise. | |
78 | * | |
79 | * Even though Smack labels are usually shared on smack_list | |
80 | * labels that come in off the network can't be imported | |
81 | * and added to the list for locking reasons. | |
82 | * | |
83 | * Therefore, it is necessary to check the contents of the labels, | |
84 | * not just the pointer values. Of course, in most cases the labels | |
85 | * will be on the list, so checking the pointers may be a worthwhile | |
86 | * optimization. | |
87 | */ | |
ecfcc53f EB |
88 | int smk_access(char *subject_label, char *object_label, int request, |
89 | struct smk_audit_info *a) | |
e114e473 CS |
90 | { |
91 | u32 may = MAY_NOT; | |
e114e473 | 92 | struct smack_rule *srp; |
ecfcc53f | 93 | int rc = 0; |
e114e473 CS |
94 | |
95 | /* | |
96 | * Hardcoded comparisons. | |
97 | * | |
98 | * A star subject can't access any object. | |
99 | */ | |
100 | if (subject_label == smack_known_star.smk_known || | |
ecfcc53f EB |
101 | strcmp(subject_label, smack_known_star.smk_known) == 0) { |
102 | rc = -EACCES; | |
103 | goto out_audit; | |
104 | } | |
6d3dc07c CS |
105 | /* |
106 | * An internet object can be accessed by any subject. | |
107 | * Tasks cannot be assigned the internet label. | |
108 | * An internet subject can access any object. | |
109 | */ | |
110 | if (object_label == smack_known_web.smk_known || | |
111 | subject_label == smack_known_web.smk_known || | |
112 | strcmp(object_label, smack_known_web.smk_known) == 0 || | |
113 | strcmp(subject_label, smack_known_web.smk_known) == 0) | |
ecfcc53f | 114 | goto out_audit; |
e114e473 CS |
115 | /* |
116 | * A star object can be accessed by any subject. | |
117 | */ | |
118 | if (object_label == smack_known_star.smk_known || | |
119 | strcmp(object_label, smack_known_star.smk_known) == 0) | |
ecfcc53f | 120 | goto out_audit; |
e114e473 CS |
121 | /* |
122 | * An object can be accessed in any way by a subject | |
123 | * with the same label. | |
124 | */ | |
125 | if (subject_label == object_label || | |
126 | strcmp(subject_label, object_label) == 0) | |
ecfcc53f | 127 | goto out_audit; |
e114e473 CS |
128 | /* |
129 | * A hat subject can read any object. | |
130 | * A floor object can be read by any subject. | |
131 | */ | |
132 | if ((request & MAY_ANYREAD) == request) { | |
133 | if (object_label == smack_known_floor.smk_known || | |
134 | strcmp(object_label, smack_known_floor.smk_known) == 0) | |
ecfcc53f | 135 | goto out_audit; |
e114e473 CS |
136 | if (subject_label == smack_known_hat.smk_known || |
137 | strcmp(subject_label, smack_known_hat.smk_known) == 0) | |
ecfcc53f | 138 | goto out_audit; |
e114e473 CS |
139 | } |
140 | /* | |
141 | * Beyond here an explicit relationship is required. | |
142 | * If the requested access is contained in the available | |
143 | * access (e.g. read is included in readwrite) it's | |
144 | * good. | |
145 | */ | |
7198e2ee EB |
146 | rcu_read_lock(); |
147 | list_for_each_entry_rcu(srp, &smack_rule_list, list) { | |
e114e473 CS |
148 | if (srp->smk_subject == subject_label || |
149 | strcmp(srp->smk_subject, subject_label) == 0) { | |
150 | if (srp->smk_object == object_label || | |
151 | strcmp(srp->smk_object, object_label) == 0) { | |
152 | may = srp->smk_access; | |
153 | break; | |
154 | } | |
155 | } | |
156 | } | |
7198e2ee | 157 | rcu_read_unlock(); |
e114e473 CS |
158 | /* |
159 | * This is a bit map operation. | |
160 | */ | |
161 | if ((request & may) == request) | |
ecfcc53f | 162 | goto out_audit; |
e114e473 | 163 | |
ecfcc53f EB |
164 | rc = -EACCES; |
165 | out_audit: | |
166 | #ifdef CONFIG_AUDIT | |
167 | if (a) | |
168 | smack_log(subject_label, object_label, request, rc, a); | |
169 | #endif | |
170 | return rc; | |
e114e473 CS |
171 | } |
172 | ||
173 | /** | |
174 | * smk_curacc - determine if current has a specific access to an object | |
251a2a95 RD |
175 | * @obj_label: a pointer to the object's Smack label |
176 | * @mode: the access requested, in "MAY" format | |
ecfcc53f | 177 | * @a : common audit data |
e114e473 CS |
178 | * |
179 | * This function checks the current subject label/object label pair | |
180 | * in the access rule list and returns 0 if the access is permitted, | |
15446235 | 181 | * non zero otherwise. It allows that current may have the capability |
e114e473 CS |
182 | * to override the rules. |
183 | */ | |
ecfcc53f | 184 | int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a) |
e114e473 CS |
185 | { |
186 | int rc; | |
ecfcc53f | 187 | char *sp = current_security(); |
e114e473 | 188 | |
ecfcc53f | 189 | rc = smk_access(sp, obj_label, mode, NULL); |
e114e473 | 190 | if (rc == 0) |
ecfcc53f | 191 | goto out_audit; |
e114e473 | 192 | |
15446235 CS |
193 | /* |
194 | * Return if a specific label has been designated as the | |
195 | * only one that gets privilege and current does not | |
196 | * have that label. | |
197 | */ | |
b6dff3ec | 198 | if (smack_onlycap != NULL && smack_onlycap != current->cred->security) |
ecfcc53f | 199 | goto out_audit; |
15446235 | 200 | |
e114e473 CS |
201 | if (capable(CAP_MAC_OVERRIDE)) |
202 | return 0; | |
203 | ||
ecfcc53f EB |
204 | out_audit: |
205 | #ifdef CONFIG_AUDIT | |
206 | if (a) | |
207 | smack_log(sp, obj_label, mode, rc, a); | |
208 | #endif | |
e114e473 CS |
209 | return rc; |
210 | } | |
211 | ||
ecfcc53f EB |
212 | #ifdef CONFIG_AUDIT |
213 | /** | |
214 | * smack_str_from_perm : helper to transalate an int to a | |
215 | * readable string | |
216 | * @string : the string to fill | |
217 | * @access : the int | |
218 | * | |
219 | */ | |
220 | static inline void smack_str_from_perm(char *string, int access) | |
221 | { | |
222 | int i = 0; | |
223 | if (access & MAY_READ) | |
224 | string[i++] = 'r'; | |
225 | if (access & MAY_WRITE) | |
226 | string[i++] = 'w'; | |
227 | if (access & MAY_EXEC) | |
228 | string[i++] = 'x'; | |
229 | if (access & MAY_APPEND) | |
230 | string[i++] = 'a'; | |
231 | string[i] = '\0'; | |
232 | } | |
233 | /** | |
234 | * smack_log_callback - SMACK specific information | |
235 | * will be called by generic audit code | |
236 | * @ab : the audit_buffer | |
237 | * @a : audit_data | |
238 | * | |
239 | */ | |
240 | static void smack_log_callback(struct audit_buffer *ab, void *a) | |
241 | { | |
242 | struct common_audit_data *ad = a; | |
d4131ded | 243 | struct smack_audit_data *sad = &ad->smack_audit_data; |
ed5215a2 | 244 | audit_log_format(ab, "lsm=SMACK fn=%s action=%s", |
d4131ded | 245 | ad->smack_audit_data.function, |
ecfcc53f EB |
246 | sad->result ? "denied" : "granted"); |
247 | audit_log_format(ab, " subject="); | |
248 | audit_log_untrustedstring(ab, sad->subject); | |
249 | audit_log_format(ab, " object="); | |
250 | audit_log_untrustedstring(ab, sad->object); | |
251 | audit_log_format(ab, " requested=%s", sad->request); | |
252 | } | |
253 | ||
254 | /** | |
255 | * smack_log - Audit the granting or denial of permissions. | |
256 | * @subject_label : smack label of the requester | |
257 | * @object_label : smack label of the object being accessed | |
258 | * @request: requested permissions | |
259 | * @result: result from smk_access | |
260 | * @a: auxiliary audit data | |
261 | * | |
262 | * Audit the granting or denial of permissions in accordance | |
263 | * with the policy. | |
264 | */ | |
265 | void smack_log(char *subject_label, char *object_label, int request, | |
266 | int result, struct smk_audit_info *ad) | |
267 | { | |
268 | char request_buffer[SMK_NUM_ACCESS_TYPE + 1]; | |
269 | struct smack_audit_data *sad; | |
270 | struct common_audit_data *a = &ad->a; | |
271 | ||
272 | /* check if we have to log the current event */ | |
273 | if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0) | |
274 | return; | |
275 | if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0) | |
276 | return; | |
277 | ||
d4131ded TL |
278 | if (a->smack_audit_data.function == NULL) |
279 | a->smack_audit_data.function = "unknown"; | |
ecfcc53f EB |
280 | |
281 | /* end preparing the audit data */ | |
d4131ded | 282 | sad = &a->smack_audit_data; |
ecfcc53f EB |
283 | smack_str_from_perm(request_buffer, request); |
284 | sad->subject = subject_label; | |
285 | sad->object = object_label; | |
286 | sad->request = request_buffer; | |
287 | sad->result = result; | |
288 | a->lsm_pre_audit = smack_log_callback; | |
289 | ||
290 | common_lsm_audit(a); | |
291 | } | |
292 | #else /* #ifdef CONFIG_AUDIT */ | |
293 | void smack_log(char *subject_label, char *object_label, int request, | |
294 | int result, struct smk_audit_info *ad) | |
295 | { | |
296 | } | |
297 | #endif | |
298 | ||
e114e473 CS |
299 | static DEFINE_MUTEX(smack_known_lock); |
300 | ||
301 | /** | |
302 | * smk_import_entry - import a label, return the list entry | |
303 | * @string: a text string that might be a Smack label | |
304 | * @len: the maximum size, or zero if it is NULL terminated. | |
305 | * | |
306 | * Returns a pointer to the entry in the label list that | |
307 | * matches the passed string, adding it if necessary. | |
308 | */ | |
309 | struct smack_known *smk_import_entry(const char *string, int len) | |
310 | { | |
311 | struct smack_known *skp; | |
312 | char smack[SMK_LABELLEN]; | |
313 | int found; | |
314 | int i; | |
315 | ||
316 | if (len <= 0 || len > SMK_MAXLEN) | |
317 | len = SMK_MAXLEN; | |
318 | ||
319 | for (i = 0, found = 0; i < SMK_LABELLEN; i++) { | |
320 | if (found) | |
321 | smack[i] = '\0'; | |
322 | else if (i >= len || string[i] > '~' || string[i] <= ' ' || | |
ecfcc53f EB |
323 | string[i] == '/' || string[i] == '"' || |
324 | string[i] == '\\' || string[i] == '\'') { | |
e114e473 CS |
325 | smack[i] = '\0'; |
326 | found = 1; | |
327 | } else | |
328 | smack[i] = string[i]; | |
329 | } | |
330 | ||
331 | if (smack[0] == '\0') | |
332 | return NULL; | |
333 | ||
334 | mutex_lock(&smack_known_lock); | |
335 | ||
7198e2ee EB |
336 | found = 0; |
337 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
338 | if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) { | |
339 | found = 1; | |
e114e473 | 340 | break; |
7198e2ee EB |
341 | } |
342 | } | |
e114e473 | 343 | |
7198e2ee | 344 | if (found == 0) { |
e114e473 CS |
345 | skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL); |
346 | if (skp != NULL) { | |
e114e473 CS |
347 | strncpy(skp->smk_known, smack, SMK_MAXLEN); |
348 | skp->smk_secid = smack_next_secid++; | |
349 | skp->smk_cipso = NULL; | |
350 | spin_lock_init(&skp->smk_cipsolock); | |
351 | /* | |
352 | * Make sure that the entry is actually | |
353 | * filled before putting it on the list. | |
354 | */ | |
7198e2ee | 355 | list_add_rcu(&skp->list, &smack_known_list); |
e114e473 CS |
356 | } |
357 | } | |
358 | ||
359 | mutex_unlock(&smack_known_lock); | |
360 | ||
361 | return skp; | |
362 | } | |
363 | ||
364 | /** | |
365 | * smk_import - import a smack label | |
366 | * @string: a text string that might be a Smack label | |
367 | * @len: the maximum size, or zero if it is NULL terminated. | |
368 | * | |
369 | * Returns a pointer to the label in the label list that | |
370 | * matches the passed string, adding it if necessary. | |
371 | */ | |
372 | char *smk_import(const char *string, int len) | |
373 | { | |
374 | struct smack_known *skp; | |
375 | ||
4303154e EB |
376 | /* labels cannot begin with a '-' */ |
377 | if (string[0] == '-') | |
378 | return NULL; | |
e114e473 CS |
379 | skp = smk_import_entry(string, len); |
380 | if (skp == NULL) | |
381 | return NULL; | |
382 | return skp->smk_known; | |
383 | } | |
384 | ||
385 | /** | |
386 | * smack_from_secid - find the Smack label associated with a secid | |
387 | * @secid: an integer that might be associated with a Smack label | |
388 | * | |
389 | * Returns a pointer to the appropraite Smack label if there is one, | |
390 | * otherwise a pointer to the invalid Smack label. | |
391 | */ | |
392 | char *smack_from_secid(const u32 secid) | |
393 | { | |
394 | struct smack_known *skp; | |
395 | ||
7198e2ee EB |
396 | rcu_read_lock(); |
397 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
398 | if (skp->smk_secid == secid) { | |
399 | rcu_read_unlock(); | |
e114e473 | 400 | return skp->smk_known; |
7198e2ee EB |
401 | } |
402 | } | |
e114e473 CS |
403 | |
404 | /* | |
405 | * If we got this far someone asked for the translation | |
406 | * of a secid that is not on the list. | |
407 | */ | |
7198e2ee | 408 | rcu_read_unlock(); |
e114e473 CS |
409 | return smack_known_invalid.smk_known; |
410 | } | |
411 | ||
412 | /** | |
413 | * smack_to_secid - find the secid associated with a Smack label | |
414 | * @smack: the Smack label | |
415 | * | |
416 | * Returns the appropriate secid if there is one, | |
417 | * otherwise 0 | |
418 | */ | |
419 | u32 smack_to_secid(const char *smack) | |
420 | { | |
421 | struct smack_known *skp; | |
422 | ||
7198e2ee EB |
423 | rcu_read_lock(); |
424 | list_for_each_entry_rcu(skp, &smack_known_list, list) { | |
425 | if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0) { | |
426 | rcu_read_unlock(); | |
e114e473 | 427 | return skp->smk_secid; |
7198e2ee EB |
428 | } |
429 | } | |
430 | rcu_read_unlock(); | |
e114e473 CS |
431 | return 0; |
432 | } | |
433 | ||
434 | /** | |
435 | * smack_from_cipso - find the Smack label associated with a CIPSO option | |
436 | * @level: Bell & LaPadula level from the network | |
437 | * @cp: Bell & LaPadula categories from the network | |
438 | * @result: where to put the Smack value | |
439 | * | |
440 | * This is a simple lookup in the label table. | |
441 | * | |
442 | * This is an odd duck as far as smack handling goes in that | |
443 | * it sends back a copy of the smack label rather than a pointer | |
444 | * to the master list. This is done because it is possible for | |
445 | * a foreign host to send a smack label that is new to this | |
446 | * machine and hence not on the list. That would not be an | |
447 | * issue except that adding an entry to the master list can't | |
448 | * be done at that point. | |
449 | */ | |
450 | void smack_from_cipso(u32 level, char *cp, char *result) | |
451 | { | |
452 | struct smack_known *kp; | |
453 | char *final = NULL; | |
454 | ||
7198e2ee EB |
455 | rcu_read_lock(); |
456 | list_for_each_entry(kp, &smack_known_list, list) { | |
e114e473 CS |
457 | if (kp->smk_cipso == NULL) |
458 | continue; | |
459 | ||
460 | spin_lock_bh(&kp->smk_cipsolock); | |
461 | ||
462 | if (kp->smk_cipso->smk_level == level && | |
463 | memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0) | |
464 | final = kp->smk_known; | |
465 | ||
466 | spin_unlock_bh(&kp->smk_cipsolock); | |
467 | } | |
7198e2ee | 468 | rcu_read_unlock(); |
e114e473 CS |
469 | if (final == NULL) |
470 | final = smack_known_huh.smk_known; | |
471 | strncpy(result, final, SMK_MAXLEN); | |
472 | return; | |
473 | } | |
474 | ||
475 | /** | |
476 | * smack_to_cipso - find the CIPSO option to go with a Smack label | |
477 | * @smack: a pointer to the smack label in question | |
478 | * @cp: where to put the result | |
479 | * | |
480 | * Returns zero if a value is available, non-zero otherwise. | |
481 | */ | |
482 | int smack_to_cipso(const char *smack, struct smack_cipso *cp) | |
483 | { | |
484 | struct smack_known *kp; | |
7198e2ee | 485 | int found = 0; |
e114e473 | 486 | |
7198e2ee EB |
487 | rcu_read_lock(); |
488 | list_for_each_entry_rcu(kp, &smack_known_list, list) { | |
e114e473 | 489 | if (kp->smk_known == smack || |
7198e2ee EB |
490 | strcmp(kp->smk_known, smack) == 0) { |
491 | found = 1; | |
e114e473 | 492 | break; |
7198e2ee EB |
493 | } |
494 | } | |
495 | rcu_read_unlock(); | |
e114e473 | 496 | |
7198e2ee | 497 | if (found == 0 || kp->smk_cipso == NULL) |
e114e473 CS |
498 | return -ENOENT; |
499 | ||
500 | memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso)); | |
501 | return 0; | |
502 | } |