2
* Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4
* This program is free software; you can redistribute it and/or modify
5
* it under the terms of the GNU General Public License as published by
6
* the Free Software Foundation, version 2.
9
* Casey Schaufler <casey@schaufler-ca.com>
13
#ifndef _SECURITY_SMACK_H
14
#define _SECURITY_SMACK_H
16
#include <linux/capability.h>
17
#include <linux/spinlock.h>
18
#include <linux/security.h>
20
#include <net/netlabel.h>
21
#include <linux/list.h>
22
#include <linux/rculist.h>
23
#include <linux/lsm_audit.h>
26
* Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
27
* bigger than can be used, and 24 is the next lower multiple
28
* of 8, and there are too many issues if there isn't space set
29
* aside for the terminating null byte.
32
#define SMK_LABELLEN (SMK_MAXLEN+1)
34
struct superblock_smack {
40
spinlock_t smk_sblock; /* for initialization */
44
char *smk_out; /* outbound label */
45
char *smk_in; /* inbound label */
46
char *smk_packet; /* TCP peer label */
53
char *smk_inode; /* label of the fso */
54
char *smk_task; /* label of the task */
55
char *smk_mmap; /* label of the mmap domain */
56
struct mutex smk_lock; /* initialization lock */
57
int smk_flags; /* smack inode flags */
61
char *smk_task; /* label for access control */
62
char *smk_forked; /* label when forked */
63
struct list_head smk_rules; /* per task access rules */
64
struct mutex smk_rules_lock; /* lock for the rules */
67
#define SMK_INODE_INSTANT 0x01 /* inode is instantiated */
68
#define SMK_INODE_TRANSMUTE 0x02 /* directory is transmuting */
71
* A label access rule.
74
struct list_head list;
81
* An entry in the table mapping smack values to
82
* CIPSO level/category-set values.
86
char smk_catset[SMK_LABELLEN];
90
* An entry in the table identifying hosts.
92
struct smk_netlbladdr {
93
struct list_head list;
94
struct sockaddr_in smk_host; /* network address */
95
struct in_addr smk_mask; /* network mask */
96
char *smk_label; /* label */
100
* This is the repository for labels seen so that it is
101
* not necessary to keep allocating tiny chuncks of memory
102
* and so that they can be shared.
104
* Labels are never modified in place. Anytime a label
105
* is imported (e.g. xattrset on a file) the list is checked
106
* for it and it is added if it doesn't exist. The address
107
* is passed out in either case. Entries are added, but
110
* Since labels are hanging around anyway it doesn't
111
* hurt to maintain a secid for those awkward situations
112
* where kernel components that ought to use LSM independent
113
* interfaces don't. The secid should go away when all of
114
* these components have been repaired.
116
* If there is a cipso value associated with the label it
117
* gets stored here, too. This will most likely be rare as
118
* the cipso direct mapping in used internally.
120
* Keep the access rules for this subject label here so that
121
* the entire set of rules does not need to be examined every
125
struct list_head list;
126
char smk_known[SMK_LABELLEN];
128
struct smack_cipso *smk_cipso;
129
spinlock_t smk_cipsolock; /* for changing cipso map */
130
struct list_head smk_rules; /* access rules */
131
struct mutex smk_rules_lock; /* lock for the rules */
137
#define SMK_FSDEFAULT "smackfsdef="
138
#define SMK_FSFLOOR "smackfsfloor="
139
#define SMK_FSHAT "smackfshat="
140
#define SMK_FSROOT "smackfsroot="
142
#define SMACK_CIPSO_OPTION "-CIPSO"
145
* How communications on this socket are treated.
146
* Usually it's determined by the underlying netlabel code
147
* but there are certain cases, including single label hosts
148
* and potentially single label interfaces for which the
149
* treatment can not be known in advance.
151
* The possibility of additional labeling schemes being
152
* introduced in the future exists as well.
154
#define SMACK_UNLABELED_SOCKET 0
155
#define SMACK_CIPSO_SOCKET 1
158
* smackfs magic number
160
#define SMACK_MAGIC 0x43415d53 /* "SMAC" */
165
#define SMACK_CIPSO_DOI_DEFAULT 3 /* Historical */
166
#define SMACK_CIPSO_DOI_INVALID -1 /* Not a DOI */
167
#define SMACK_CIPSO_DIRECT_DEFAULT 250 /* Arbitrary */
168
#define SMACK_CIPSO_MAXCATVAL 63 /* Bigger gets harder */
169
#define SMACK_CIPSO_MAXLEVEL 255 /* CIPSO 2.2 standard */
170
#define SMACK_CIPSO_MAXCATNUM 239 /* CIPSO 2.2 standard */
173
* Flag for transmute access
175
#define MAY_TRANSMUTE 64
177
* Just to make the common cases easier to deal with
179
#define MAY_ANYREAD (MAY_READ | MAY_EXEC)
180
#define MAY_READWRITE (MAY_READ | MAY_WRITE)
184
* Number of access types used by Smack (rwxat)
186
#define SMK_NUM_ACCESS_TYPE 5
189
* Smack audit data; is empty if CONFIG_AUDIT not set
192
struct smk_audit_info {
194
struct common_audit_data a;
198
* These functions are in smack_lsm.c
200
struct inode_smack *new_inode_smack(char *);
203
* These functions are in smack_access.c
205
int smk_access_entry(char *, char *, struct list_head *);
206
int smk_access(char *, char *, int, struct smk_audit_info *);
207
int smk_curacc(char *, u32, struct smk_audit_info *);
208
int smack_to_cipso(const char *, struct smack_cipso *);
209
char *smack_from_cipso(u32, char *);
210
char *smack_from_secid(const u32);
211
void smk_parse_smack(const char *string, int len, char *smack);
212
char *smk_import(const char *, int);
213
struct smack_known *smk_import_entry(const char *, int);
214
struct smack_known *smk_find_entry(const char *);
215
u32 smack_to_secid(const char *);
220
extern int smack_cipso_direct;
221
extern char *smack_net_ambient;
222
extern char *smack_onlycap;
223
extern const char *smack_cipso_option;
225
extern struct smack_known smack_known_floor;
226
extern struct smack_known smack_known_hat;
227
extern struct smack_known smack_known_huh;
228
extern struct smack_known smack_known_invalid;
229
extern struct smack_known smack_known_star;
230
extern struct smack_known smack_known_web;
232
extern struct list_head smack_known_list;
233
extern struct list_head smk_netlbladdr_list;
235
extern struct security_operations smack_ops;
238
* Stricly for CIPSO level manipulation.
239
* Set the category bit number in a smack label sized buffer.
241
static inline void smack_catset_bit(int cat, char *catsetp)
243
if (cat > SMK_LABELLEN * 8)
246
catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
250
* Is the directory transmuting?
252
static inline int smk_inode_transmutable(const struct inode *isp)
254
struct inode_smack *sip = isp->i_security;
255
return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
259
* Present a pointer to the smack label in an inode blob.
261
static inline char *smk_of_inode(const struct inode *isp)
263
struct inode_smack *sip = isp->i_security;
264
return sip->smk_inode;
268
* Present a pointer to the smack label in an task blob.
270
static inline char *smk_of_task(const struct task_smack *tsp)
272
return tsp->smk_task;
276
* Present a pointer to the forked smack label in an task blob.
278
static inline char *smk_of_forked(const struct task_smack *tsp)
280
return tsp->smk_forked;
284
* Present a pointer to the smack label in the current task blob.
286
static inline char *smk_of_current(void)
288
return smk_of_task(current_security());
294
#define SMACK_AUDIT_DENIED 0x1
295
#define SMACK_AUDIT_ACCEPT 0x2
296
extern int log_policy;
298
void smack_log(char *subject_label, char *object_label,
300
int result, struct smk_audit_info *auditdata);
305
* some inline functions to set up audit data
306
* they do nothing if CONFIG_AUDIT is not set
309
static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
312
memset(a, 0, sizeof(*a));
314
a->a.smack_audit_data.function = func;
317
static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
318
struct task_struct *t)
322
static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
327
static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
332
static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
337
static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
345
static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
349
static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
350
struct task_struct *t)
353
static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
357
static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
361
static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
365
static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
369
static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
375
#endif /* _SECURITY_SMACK_H */