security/smack/smack_access.c

   1 /*
   2  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
   3  *
   4  *      This program is free software; you can redistribute it and/or modify
   5  *      it under the terms of the GNU General Public License as published by
   6  *      the Free Software Foundation, version 2.
   7  *
   8  * Author:
   9  *      Casey Schaufler <casey@schaufler-ca.com>
  10  *
  11  */
  12
  13 #include <linux/types.h>
  14 #include <linux/fs.h>
  15 #include <linux/sched.h>
  16 #include "smack.h"
  17
  18 struct smack_known smack_known_huh = {
  19         .smk_next       = NULL,
  20         .smk_known      = "?",
  21         .smk_secid      = 2,
  22         .smk_cipso      = NULL,
  23 };
  24
  25 struct smack_known smack_known_hat = {
  26         .smk_next       = &smack_known_huh,
  27         .smk_known      = "^",
  28         .smk_secid      = 3,
  29         .smk_cipso      = NULL,
  30 };
  31
  32 struct smack_known smack_known_star = {
  33         .smk_next       = &smack_known_hat,
  34         .smk_known      = "*",
  35         .smk_secid      = 4,
  36         .smk_cipso      = NULL,
  37 };
  38
  39 struct smack_known smack_known_floor = {
  40         .smk_next       = &smack_known_star,
  41         .smk_known      = "_",
  42         .smk_secid      = 5,
  43         .smk_cipso      = NULL,
  44 };
  45
  46 struct smack_known smack_known_invalid = {
  47         .smk_next       = &smack_known_floor,
  48         .smk_known      = "",
  49         .smk_secid      = 6,
  50         .smk_cipso      = NULL,
  51 };
  52
  53 struct smack_known smack_known_web = {
  54         .smk_next       = &smack_known_invalid,
  55         .smk_known      = "@",
  56         .smk_secid      = 7,
  57         .smk_cipso      = NULL,
  58 };
  59
  60 struct smack_known *smack_known = &smack_known_web;
  61
  62 /*
  63  * The initial value needs to be bigger than any of the
  64  * known values above.
  65  */
  66 static u32 smack_next_secid = 10;
  67
  68 /**
  69  * smk_access - determine if a subject has a specific access to an object
  70  * @subject_label: a pointer to the subject's Smack label
  71  * @object_label: a pointer to the object's Smack label
  72  * @request: the access requested, in "MAY" format
  73  *
  74  * This function looks up the subject/object pair in the
  75  * access rule list and returns 0 if the access is permitted,
  76  * non zero otherwise.
  77  *
  78  * Even though Smack labels are usually shared on smack_list
  79  * labels that come in off the network can't be imported
  80  * and added to the list for locking reasons.
  81  *
  82  * Therefore, it is necessary to check the contents of the labels,
  83  * not just the pointer values. Of course, in most cases the labels
  84  * will be on the list, so checking the pointers may be a worthwhile
  85  * optimization.
  86  */
  87 int smk_access(char *subject_label, char *object_label, int request)
  88 {
  89         u32 may = MAY_NOT;
  90         struct smk_list_entry *sp;
  91         struct smack_rule *srp;
  92
  93         /*
  94          * Hardcoded comparisons.
  95          *
  96          * A star subject can't access any object.
  97          */
  98         if (subject_label == smack_known_star.smk_known ||
  99             strcmp(subject_label, smack_known_star.smk_known) == 0)
 100                 return -EACCES;
 101         /*
 102          * An internet object can be accessed by any subject.
 103          * Tasks cannot be assigned the internet label.
 104          * An internet subject can access any object.
 105          */
 106         if (object_label == smack_known_web.smk_known ||
 107             subject_label == smack_known_web.smk_known ||
 108             strcmp(object_label, smack_known_web.smk_known) == 0 ||
 109             strcmp(subject_label, smack_known_web.smk_known) == 0)
 110                 return 0;
 111         /*
 112          * A star object can be accessed by any subject.
 113          */
 114         if (object_label == smack_known_star.smk_known ||
 115             strcmp(object_label, smack_known_star.smk_known) == 0)
 116                 return 0;
 117         /*
 118          * An object can be accessed in any way by a subject
 119          * with the same label.
 120          */
 121         if (subject_label == object_label ||
 122             strcmp(subject_label, object_label) == 0)
 123                 return 0;
 124         /*
 125          * A hat subject can read any object.
 126          * A floor object can be read by any subject.
 127          */
 128         if ((request & MAY_ANYREAD) == request) {
 129                 if (object_label == smack_known_floor.smk_known ||
 130                     strcmp(object_label, smack_known_floor.smk_known) == 0)
 131                         return 0;
 132                 if (subject_label == smack_known_hat.smk_known ||
 133                     strcmp(subject_label, smack_known_hat.smk_known) == 0)
 134                         return 0;
 135         }
 136         /*
 137          * Beyond here an explicit relationship is required.
 138          * If the requested access is contained in the available
 139          * access (e.g. read is included in readwrite) it's
 140          * good.
 141          */
 142         for (sp = smack_list; sp != NULL; sp = sp->smk_next) {
 143                 srp = &sp->smk_rule;
 144
 145                 if (srp->smk_subject == subject_label ||
 146                     strcmp(srp->smk_subject, subject_label) == 0) {
 147                         if (srp->smk_object == object_label ||
 148                             strcmp(srp->smk_object, object_label) == 0) {
 149                                 may = srp->smk_access;
 150                                 break;
 151                         }
 152                 }
 153         }
 154         /*
 155          * This is a bit map operation.
 156          */
 157         if ((request & may) == request)
 158                 return 0;
 159
 160         return -EACCES;
 161 }
 162
 163 /**
 164  * smk_curacc - determine if current has a specific access to an object
 165  * @object_label: a pointer to the object's Smack label
 166  * @request: the access requested, in "MAY" format
 167  *
 168  * This function checks the current subject label/object label pair
 169  * in the access rule list and returns 0 if the access is permitted,
 170  * non zero otherwise. It allows that current may have the capability
 171  * to override the rules.
 172  */
 173 int smk_curacc(char *obj_label, u32 mode)
 174 {
 175         int rc;
 176
 177         rc = smk_access(current_security(), obj_label, mode);
 178         if (rc == 0)
 179                 return 0;
 180
 181         /*
 182          * Return if a specific label has been designated as the
 183          * only one that gets privilege and current does not
 184          * have that label.
 185          */
 186         if (smack_onlycap != NULL && smack_onlycap != current->cred->security)
 187                 return rc;
 188
 189         if (capable(CAP_MAC_OVERRIDE))
 190                 return 0;
 191
 192         return rc;
 193 }
 194
 195 static DEFINE_MUTEX(smack_known_lock);
 196
 197 /**
 198  * smk_import_entry - import a label, return the list entry
 199  * @string: a text string that might be a Smack label
 200  * @len: the maximum size, or zero if it is NULL terminated.
 201  *
 202  * Returns a pointer to the entry in the label list that
 203  * matches the passed string, adding it if necessary.
 204  */
 205 struct smack_known *smk_import_entry(const char *string, int len)
 206 {
 207         struct smack_known *skp;
 208         char smack[SMK_LABELLEN];
 209         int found;
 210         int i;
 211
 212         if (len <= 0 || len > SMK_MAXLEN)
 213                 len = SMK_MAXLEN;
 214
 215         for (i = 0, found = 0; i < SMK_LABELLEN; i++) {
 216                 if (found)
 217                         smack[i] = '\0';
 218                 else if (i >= len || string[i] > '~' || string[i] <= ' ' ||
 219                          string[i] == '/') {
 220                         smack[i] = '\0';
 221                         found = 1;
 222                 } else
 223                         smack[i] = string[i];
 224         }
 225
 226         if (smack[0] == '\0')
 227                 return NULL;
 228
 229         mutex_lock(&smack_known_lock);
 230
 231         for (skp = smack_known; skp != NULL; skp = skp->smk_next)
 232                 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0)
 233                         break;
 234
 235         if (skp == NULL) {
 236                 skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL);
 237                 if (skp != NULL) {
 238                         skp->smk_next = smack_known;
 239                         strncpy(skp->smk_known, smack, SMK_MAXLEN);
 240                         skp->smk_secid = smack_next_secid++;
 241                         skp->smk_cipso = NULL;
 242                         spin_lock_init(&skp->smk_cipsolock);
 243                         /*
 244                          * Make sure that the entry is actually
 245                          * filled before putting it on the list.
 246                          */
 247                         smp_mb();
 248                         smack_known = skp;
 249                 }
 250         }
 251
 252         mutex_unlock(&smack_known_lock);
 253
 254         return skp;
 255 }
 256
 257 /**
 258  * smk_import - import a smack label
 259  * @string: a text string that might be a Smack label
 260  * @len: the maximum size, or zero if it is NULL terminated.
 261  *
 262  * Returns a pointer to the label in the label list that
 263  * matches the passed string, adding it if necessary.
 264  */
 265 char *smk_import(const char *string, int len)
 266 {
 267         struct smack_known *skp;
 268
 269         skp = smk_import_entry(string, len);
 270         if (skp == NULL)
 271                 return NULL;
 272         return skp->smk_known;
 273 }
 274
 275 /**
 276  * smack_from_secid - find the Smack label associated with a secid
 277  * @secid: an integer that might be associated with a Smack label
 278  *
 279  * Returns a pointer to the appropraite Smack label if there is one,
 280  * otherwise a pointer to the invalid Smack label.
 281  */
 282 char *smack_from_secid(const u32 secid)
 283 {
 284         struct smack_known *skp;
 285
 286         for (skp = smack_known; skp != NULL; skp = skp->smk_next)
 287                 if (skp->smk_secid == secid)
 288                         return skp->smk_known;
 289
 290         /*
 291          * If we got this far someone asked for the translation
 292          * of a secid that is not on the list.
 293          */
 294         return smack_known_invalid.smk_known;
 295 }
 296
 297 /**
 298  * smack_to_secid - find the secid associated with a Smack label
 299  * @smack: the Smack label
 300  *
 301  * Returns the appropriate secid if there is one,
 302  * otherwise 0
 303  */
 304 u32 smack_to_secid(const char *smack)
 305 {
 306         struct smack_known *skp;
 307
 308         for (skp = smack_known; skp != NULL; skp = skp->smk_next)
 309                 if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0)
 310                         return skp->smk_secid;
 311         return 0;
 312 }
 313
 314 /**
 315  * smack_from_cipso - find the Smack label associated with a CIPSO option
 316  * @level: Bell & LaPadula level from the network
 317  * @cp: Bell & LaPadula categories from the network
 318  * @result: where to put the Smack value
 319  *
 320  * This is a simple lookup in the label table.
 321  *
 322  * This is an odd duck as far as smack handling goes in that
 323  * it sends back a copy of the smack label rather than a pointer
 324  * to the master list. This is done because it is possible for
 325  * a foreign host to send a smack label that is new to this
 326  * machine and hence not on the list. That would not be an
 327  * issue except that adding an entry to the master list can't
 328  * be done at that point.
 329  */
 330 void smack_from_cipso(u32 level, char *cp, char *result)
 331 {
 332         struct smack_known *kp;
 333         char *final = NULL;
 334
 335         for (kp = smack_known; final == NULL && kp != NULL; kp = kp->smk_next) {
 336                 if (kp->smk_cipso == NULL)
 337                         continue;
 338
 339                 spin_lock_bh(&kp->smk_cipsolock);
 340
 341                 if (kp->smk_cipso->smk_level == level &&
 342                     memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0)
 343                         final = kp->smk_known;
 344
 345                 spin_unlock_bh(&kp->smk_cipsolock);
 346         }
 347         if (final == NULL)
 348                 final = smack_known_huh.smk_known;
 349         strncpy(result, final, SMK_MAXLEN);
 350         return;
 351 }
 352
 353 /**
 354  * smack_to_cipso - find the CIPSO option to go with a Smack label
 355  * @smack: a pointer to the smack label in question
 356  * @cp: where to put the result
 357  *
 358  * Returns zero if a value is available, non-zero otherwise.
 359  */
 360 int smack_to_cipso(const char *smack, struct smack_cipso *cp)
 361 {
 362         struct smack_known *kp;
 363
 364         for (kp = smack_known; kp != NULL; kp = kp->smk_next)
 365                 if (kp->smk_known == smack ||
 366                     strcmp(kp->smk_known, smack) == 0)
 367                         break;
 368
 369         if (kp == NULL || kp->smk_cipso == NULL)
 370                 return -ENOENT;
 371
 372         memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso));
 373         return 0;
 374 }