1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  *  Simplified MAC Kernel (smack) security module
4  *
5  *  This file contains the smack hook function implementations.
6  *
7  *  Authors:
8  *	Casey Schaufler <casey@schaufler-ca.com>
9  *	Jarkko Sakkinen <jarkko.sakkinen@intel.com>
10  *
11  *  Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
12  *  Copyright (C) 2009 Hewlett-Packard Development Company, L.P.
13  *                Paul Moore <paul@paul-moore.com>
14  *  Copyright (C) 2010 Nokia Corporation
15  *  Copyright (C) 2011 Intel Corporation.
16  */
17 
18 #include <linux/xattr.h>
19 #include <linux/pagemap.h>
20 #include <linux/mount.h>
21 #include <linux/stat.h>
22 #include <linux/kd.h>
23 #include <asm/ioctls.h>
24 #include <linux/ip.h>
25 #include <linux/tcp.h>
26 #include <linux/udp.h>
27 #include <linux/dccp.h>
28 #include <linux/icmpv6.h>
29 #include <linux/slab.h>
30 #include <linux/mutex.h>
31 #include <net/cipso_ipv4.h>
32 #include <net/ip.h>
33 #include <net/ipv6.h>
34 #include <linux/audit.h>
35 #include <linux/magic.h>
36 #include <linux/dcache.h>
37 #include <linux/personality.h>
38 #include <linux/msg.h>
39 #include <linux/shm.h>
40 #include <linux/binfmts.h>
41 #include <linux/parser.h>
42 #include <linux/fs_context.h>
43 #include <linux/fs_parser.h>
44 #include <linux/watch_queue.h>
45 #include <linux/io_uring.h>
46 #include "smack.h"
47 
48 #define TRANS_TRUE	"TRUE"
49 #define TRANS_TRUE_SIZE	4
50 
51 #define SMK_CONNECTING	0
52 #define SMK_RECEIVING	1
53 #define SMK_SENDING	2
54 
55 #ifdef SMACK_IPV6_PORT_LABELING
56 static DEFINE_MUTEX(smack_ipv6_lock);
57 static LIST_HEAD(smk_ipv6_port_list);
58 #endif
59 struct kmem_cache *smack_rule_cache;
60 int smack_enabled __initdata;
61 
62 #define A(s) {"smack"#s, sizeof("smack"#s) - 1, Opt_##s}
63 static struct {
64 	const char *name;
65 	int len;
66 	int opt;
67 } smk_mount_opts[] = {
68 	{"smackfsdef", sizeof("smackfsdef") - 1, Opt_fsdefault},
69 	A(fsdefault), A(fsfloor), A(fshat), A(fsroot), A(fstransmute)
70 };
71 #undef A
72 
match_opt_prefix(char * s,int l,char ** arg)73 static int match_opt_prefix(char *s, int l, char **arg)
74 {
75 	int i;
76 
77 	for (i = 0; i < ARRAY_SIZE(smk_mount_opts); i++) {
78 		size_t len = smk_mount_opts[i].len;
79 		if (len > l || memcmp(s, smk_mount_opts[i].name, len))
80 			continue;
81 		if (len == l || s[len] != '=')
82 			continue;
83 		*arg = s + len + 1;
84 		return smk_mount_opts[i].opt;
85 	}
86 	return Opt_error;
87 }
88 
89 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
90 static char *smk_bu_mess[] = {
91 	"Bringup Error",	/* Unused */
92 	"Bringup",		/* SMACK_BRINGUP_ALLOW */
93 	"Unconfined Subject",	/* SMACK_UNCONFINED_SUBJECT */
94 	"Unconfined Object",	/* SMACK_UNCONFINED_OBJECT */
95 };
96 
smk_bu_mode(int mode,char * s)97 static void smk_bu_mode(int mode, char *s)
98 {
99 	int i = 0;
100 
101 	if (mode & MAY_READ)
102 		s[i++] = 'r';
103 	if (mode & MAY_WRITE)
104 		s[i++] = 'w';
105 	if (mode & MAY_EXEC)
106 		s[i++] = 'x';
107 	if (mode & MAY_APPEND)
108 		s[i++] = 'a';
109 	if (mode & MAY_TRANSMUTE)
110 		s[i++] = 't';
111 	if (mode & MAY_LOCK)
112 		s[i++] = 'l';
113 	if (i == 0)
114 		s[i++] = '-';
115 	s[i] = '\0';
116 }
117 #endif
118 
119 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_note(char * note,struct smack_known * sskp,struct smack_known * oskp,int mode,int rc)120 static int smk_bu_note(char *note, struct smack_known *sskp,
121 		       struct smack_known *oskp, int mode, int rc)
122 {
123 	char acc[SMK_NUM_ACCESS_TYPE + 1];
124 
125 	if (rc <= 0)
126 		return rc;
127 	if (rc > SMACK_UNCONFINED_OBJECT)
128 		rc = 0;
129 
130 	smk_bu_mode(mode, acc);
131 	pr_info("Smack %s: (%s %s %s) %s\n", smk_bu_mess[rc],
132 		sskp->smk_known, oskp->smk_known, acc, note);
133 	return 0;
134 }
135 #else
136 #define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
137 #endif
138 
139 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_current(char * note,struct smack_known * oskp,int mode,int rc)140 static int smk_bu_current(char *note, struct smack_known *oskp,
141 			  int mode, int rc)
142 {
143 	struct task_smack *tsp = smack_cred(current_cred());
144 	char acc[SMK_NUM_ACCESS_TYPE + 1];
145 
146 	if (rc <= 0)
147 		return rc;
148 	if (rc > SMACK_UNCONFINED_OBJECT)
149 		rc = 0;
150 
151 	smk_bu_mode(mode, acc);
152 	pr_info("Smack %s: (%s %s %s) %s %s\n", smk_bu_mess[rc],
153 		tsp->smk_task->smk_known, oskp->smk_known,
154 		acc, current->comm, note);
155 	return 0;
156 }
157 #else
158 #define smk_bu_current(note, oskp, mode, RC) (RC)
159 #endif
160 
161 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_task(struct task_struct * otp,int mode,int rc)162 static int smk_bu_task(struct task_struct *otp, int mode, int rc)
163 {
164 	struct task_smack *tsp = smack_cred(current_cred());
165 	struct smack_known *smk_task = smk_of_task_struct_obj(otp);
166 	char acc[SMK_NUM_ACCESS_TYPE + 1];
167 
168 	if (rc <= 0)
169 		return rc;
170 	if (rc > SMACK_UNCONFINED_OBJECT)
171 		rc = 0;
172 
173 	smk_bu_mode(mode, acc);
174 	pr_info("Smack %s: (%s %s %s) %s to %s\n", smk_bu_mess[rc],
175 		tsp->smk_task->smk_known, smk_task->smk_known, acc,
176 		current->comm, otp->comm);
177 	return 0;
178 }
179 #else
180 #define smk_bu_task(otp, mode, RC) (RC)
181 #endif
182 
183 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_inode(struct inode * inode,int mode,int rc)184 static int smk_bu_inode(struct inode *inode, int mode, int rc)
185 {
186 	struct task_smack *tsp = smack_cred(current_cred());
187 	struct inode_smack *isp = smack_inode(inode);
188 	char acc[SMK_NUM_ACCESS_TYPE + 1];
189 
190 	if (isp->smk_flags & SMK_INODE_IMPURE)
191 		pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
192 			inode->i_sb->s_id, inode->i_ino, current->comm);
193 
194 	if (rc <= 0)
195 		return rc;
196 	if (rc > SMACK_UNCONFINED_OBJECT)
197 		rc = 0;
198 	if (rc == SMACK_UNCONFINED_SUBJECT &&
199 	    (mode & (MAY_WRITE | MAY_APPEND)))
200 		isp->smk_flags |= SMK_INODE_IMPURE;
201 
202 	smk_bu_mode(mode, acc);
203 
204 	pr_info("Smack %s: (%s %s %s) inode=(%s %ld) %s\n", smk_bu_mess[rc],
205 		tsp->smk_task->smk_known, isp->smk_inode->smk_known, acc,
206 		inode->i_sb->s_id, inode->i_ino, current->comm);
207 	return 0;
208 }
209 #else
210 #define smk_bu_inode(inode, mode, RC) (RC)
211 #endif
212 
213 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_file(struct file * file,int mode,int rc)214 static int smk_bu_file(struct file *file, int mode, int rc)
215 {
216 	struct task_smack *tsp = smack_cred(current_cred());
217 	struct smack_known *sskp = tsp->smk_task;
218 	struct inode *inode = file_inode(file);
219 	struct inode_smack *isp = smack_inode(inode);
220 	char acc[SMK_NUM_ACCESS_TYPE + 1];
221 
222 	if (isp->smk_flags & SMK_INODE_IMPURE)
223 		pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
224 			inode->i_sb->s_id, inode->i_ino, current->comm);
225 
226 	if (rc <= 0)
227 		return rc;
228 	if (rc > SMACK_UNCONFINED_OBJECT)
229 		rc = 0;
230 
231 	smk_bu_mode(mode, acc);
232 	pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
233 		sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
234 		inode->i_sb->s_id, inode->i_ino, file,
235 		current->comm);
236 	return 0;
237 }
238 #else
239 #define smk_bu_file(file, mode, RC) (RC)
240 #endif
241 
242 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
smk_bu_credfile(const struct cred * cred,struct file * file,int mode,int rc)243 static int smk_bu_credfile(const struct cred *cred, struct file *file,
244 				int mode, int rc)
245 {
246 	struct task_smack *tsp = smack_cred(cred);
247 	struct smack_known *sskp = tsp->smk_task;
248 	struct inode *inode = file_inode(file);
249 	struct inode_smack *isp = smack_inode(inode);
250 	char acc[SMK_NUM_ACCESS_TYPE + 1];
251 
252 	if (isp->smk_flags & SMK_INODE_IMPURE)
253 		pr_info("Smack Unconfined Corruption: inode=(%s %ld) %s\n",
254 			inode->i_sb->s_id, inode->i_ino, current->comm);
255 
256 	if (rc <= 0)
257 		return rc;
258 	if (rc > SMACK_UNCONFINED_OBJECT)
259 		rc = 0;
260 
261 	smk_bu_mode(mode, acc);
262 	pr_info("Smack %s: (%s %s %s) file=(%s %ld %pD) %s\n", smk_bu_mess[rc],
263 		sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
264 		inode->i_sb->s_id, inode->i_ino, file,
265 		current->comm);
266 	return 0;
267 }
268 #else
269 #define smk_bu_credfile(cred, file, mode, RC) (RC)
270 #endif
271 
272 /**
273  * smk_fetch - Fetch the smack label from a file.
274  * @name: type of the label (attribute)
275  * @ip: a pointer to the inode
276  * @dp: a pointer to the dentry
277  *
278  * Returns a pointer to the master list entry for the Smack label,
279  * NULL if there was no label to fetch, or an error code.
280  */
smk_fetch(const char * name,struct inode * ip,struct dentry * dp)281 static struct smack_known *smk_fetch(const char *name, struct inode *ip,
282 					struct dentry *dp)
283 {
284 	int rc;
285 	char *buffer;
286 	struct smack_known *skp = NULL;
287 
288 	if (!(ip->i_opflags & IOP_XATTR))
289 		return ERR_PTR(-EOPNOTSUPP);
290 
291 	buffer = kzalloc(SMK_LONGLABEL, GFP_NOFS);
292 	if (buffer == NULL)
293 		return ERR_PTR(-ENOMEM);
294 
295 	rc = __vfs_getxattr(dp, ip, name, buffer, SMK_LONGLABEL);
296 	if (rc < 0)
297 		skp = ERR_PTR(rc);
298 	else if (rc == 0)
299 		skp = NULL;
300 	else
301 		skp = smk_import_entry(buffer, rc);
302 
303 	kfree(buffer);
304 
305 	return skp;
306 }
307 
308 /**
309  * init_inode_smack - initialize an inode security blob
310  * @inode: inode to extract the info from
311  * @skp: a pointer to the Smack label entry to use in the blob
312  *
313  */
init_inode_smack(struct inode * inode,struct smack_known * skp)314 static void init_inode_smack(struct inode *inode, struct smack_known *skp)
315 {
316 	struct inode_smack *isp = smack_inode(inode);
317 
318 	isp->smk_inode = skp;
319 	isp->smk_flags = 0;
320 }
321 
322 /**
323  * init_task_smack - initialize a task security blob
324  * @tsp: blob to initialize
325  * @task: a pointer to the Smack label for the running task
326  * @forked: a pointer to the Smack label for the forked task
327  *
328  */
init_task_smack(struct task_smack * tsp,struct smack_known * task,struct smack_known * forked)329 static void init_task_smack(struct task_smack *tsp, struct smack_known *task,
330 					struct smack_known *forked)
331 {
332 	tsp->smk_task = task;
333 	tsp->smk_forked = forked;
334 	INIT_LIST_HEAD(&tsp->smk_rules);
335 	INIT_LIST_HEAD(&tsp->smk_relabel);
336 	mutex_init(&tsp->smk_rules_lock);
337 }
338 
339 /**
340  * smk_copy_rules - copy a rule set
341  * @nhead: new rules header pointer
342  * @ohead: old rules header pointer
343  * @gfp: type of the memory for the allocation
344  *
345  * Returns 0 on success, -ENOMEM on error
346  */
smk_copy_rules(struct list_head * nhead,struct list_head * ohead,gfp_t gfp)347 static int smk_copy_rules(struct list_head *nhead, struct list_head *ohead,
348 				gfp_t gfp)
349 {
350 	struct smack_rule *nrp;
351 	struct smack_rule *orp;
352 	int rc = 0;
353 
354 	list_for_each_entry_rcu(orp, ohead, list) {
355 		nrp = kmem_cache_zalloc(smack_rule_cache, gfp);
356 		if (nrp == NULL) {
357 			rc = -ENOMEM;
358 			break;
359 		}
360 		*nrp = *orp;
361 		list_add_rcu(&nrp->list, nhead);
362 	}
363 	return rc;
364 }
365 
366 /**
367  * smk_copy_relabel - copy smk_relabel labels list
368  * @nhead: new rules header pointer
369  * @ohead: old rules header pointer
370  * @gfp: type of the memory for the allocation
371  *
372  * Returns 0 on success, -ENOMEM on error
373  */
smk_copy_relabel(struct list_head * nhead,struct list_head * ohead,gfp_t gfp)374 static int smk_copy_relabel(struct list_head *nhead, struct list_head *ohead,
375 				gfp_t gfp)
376 {
377 	struct smack_known_list_elem *nklep;
378 	struct smack_known_list_elem *oklep;
379 
380 	list_for_each_entry(oklep, ohead, list) {
381 		nklep = kzalloc(sizeof(struct smack_known_list_elem), gfp);
382 		if (nklep == NULL) {
383 			smk_destroy_label_list(nhead);
384 			return -ENOMEM;
385 		}
386 		nklep->smk_label = oklep->smk_label;
387 		list_add(&nklep->list, nhead);
388 	}
389 
390 	return 0;
391 }
392 
393 /**
394  * smk_ptrace_mode - helper function for converting PTRACE_MODE_* into MAY_*
395  * @mode: input mode in form of PTRACE_MODE_*
396  *
397  * Returns a converted MAY_* mode usable by smack rules
398  */
smk_ptrace_mode(unsigned int mode)399 static inline unsigned int smk_ptrace_mode(unsigned int mode)
400 {
401 	if (mode & PTRACE_MODE_ATTACH)
402 		return MAY_READWRITE;
403 	if (mode & PTRACE_MODE_READ)
404 		return MAY_READ;
405 
406 	return 0;
407 }
408 
409 /**
410  * smk_ptrace_rule_check - helper for ptrace access
411  * @tracer: tracer process
412  * @tracee_known: label entry of the process that's about to be traced
413  * @mode: ptrace attachment mode (PTRACE_MODE_*)
414  * @func: name of the function that called us, used for audit
415  *
416  * Returns 0 on access granted, -error on error
417  */
smk_ptrace_rule_check(struct task_struct * tracer,struct smack_known * tracee_known,unsigned int mode,const char * func)418 static int smk_ptrace_rule_check(struct task_struct *tracer,
419 				 struct smack_known *tracee_known,
420 				 unsigned int mode, const char *func)
421 {
422 	int rc;
423 	struct smk_audit_info ad, *saip = NULL;
424 	struct task_smack *tsp;
425 	struct smack_known *tracer_known;
426 	const struct cred *tracercred;
427 
428 	if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
429 		smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
430 		smk_ad_setfield_u_tsk(&ad, tracer);
431 		saip = &ad;
432 	}
433 
434 	rcu_read_lock();
435 	tracercred = __task_cred(tracer);
436 	tsp = smack_cred(tracercred);
437 	tracer_known = smk_of_task(tsp);
438 
439 	if ((mode & PTRACE_MODE_ATTACH) &&
440 	    (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
441 	     smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
442 		if (tracer_known->smk_known == tracee_known->smk_known)
443 			rc = 0;
444 		else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
445 			rc = -EACCES;
446 		else if (smack_privileged_cred(CAP_SYS_PTRACE, tracercred))
447 			rc = 0;
448 		else
449 			rc = -EACCES;
450 
451 		if (saip)
452 			smack_log(tracer_known->smk_known,
453 				  tracee_known->smk_known,
454 				  0, rc, saip);
455 
456 		rcu_read_unlock();
457 		return rc;
458 	}
459 
460 	/* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
461 	rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
462 
463 	rcu_read_unlock();
464 	return rc;
465 }
466 
467 /*
468  * LSM hooks.
469  * We he, that is fun!
470  */
471 
472 /**
473  * smack_ptrace_access_check - Smack approval on PTRACE_ATTACH
474  * @ctp: child task pointer
475  * @mode: ptrace attachment mode (PTRACE_MODE_*)
476  *
477  * Returns 0 if access is OK, an error code otherwise
478  *
479  * Do the capability checks.
480  */
smack_ptrace_access_check(struct task_struct * ctp,unsigned int mode)481 static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
482 {
483 	struct smack_known *skp;
484 
485 	skp = smk_of_task_struct_obj(ctp);
486 
487 	return smk_ptrace_rule_check(current, skp, mode, __func__);
488 }
489 
490 /**
491  * smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
492  * @ptp: parent task pointer
493  *
494  * Returns 0 if access is OK, an error code otherwise
495  *
496  * Do the capability checks, and require PTRACE_MODE_ATTACH.
497  */
smack_ptrace_traceme(struct task_struct * ptp)498 static int smack_ptrace_traceme(struct task_struct *ptp)
499 {
500 	struct smack_known *skp;
501 
502 	skp = smk_of_task(smack_cred(current_cred()));
503 
504 	return smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
505 }
506 
507 /**
508  * smack_syslog - Smack approval on syslog
509  * @typefrom_file: unused
510  *
511  * Returns 0 on success, error code otherwise.
512  */
smack_syslog(int typefrom_file)513 static int smack_syslog(int typefrom_file)
514 {
515 	int rc = 0;
516 	struct smack_known *skp = smk_of_current();
517 
518 	if (smack_privileged(CAP_MAC_OVERRIDE))
519 		return 0;
520 
521 	if (smack_syslog_label != NULL && smack_syslog_label != skp)
522 		rc = -EACCES;
523 
524 	return rc;
525 }
526 
527 /*
528  * Superblock Hooks.
529  */
530 
531 /**
532  * smack_sb_alloc_security - allocate a superblock blob
533  * @sb: the superblock getting the blob
534  *
535  * Returns 0 on success or -ENOMEM on error.
536  */
smack_sb_alloc_security(struct super_block * sb)537 static int smack_sb_alloc_security(struct super_block *sb)
538 {
539 	struct superblock_smack *sbsp = smack_superblock(sb);
540 
541 	sbsp->smk_root = &smack_known_floor;
542 	sbsp->smk_default = &smack_known_floor;
543 	sbsp->smk_floor = &smack_known_floor;
544 	sbsp->smk_hat = &smack_known_hat;
545 	/*
546 	 * SMK_SB_INITIALIZED will be zero from kzalloc.
547 	 */
548 
549 	return 0;
550 }
551 
552 struct smack_mnt_opts {
553 	const char *fsdefault, *fsfloor, *fshat, *fsroot, *fstransmute;
554 };
555 
smack_free_mnt_opts(void * mnt_opts)556 static void smack_free_mnt_opts(void *mnt_opts)
557 {
558 	struct smack_mnt_opts *opts = mnt_opts;
559 	kfree(opts->fsdefault);
560 	kfree(opts->fsfloor);
561 	kfree(opts->fshat);
562 	kfree(opts->fsroot);
563 	kfree(opts->fstransmute);
564 	kfree(opts);
565 }
566 
smack_add_opt(int token,const char * s,void ** mnt_opts)567 static int smack_add_opt(int token, const char *s, void **mnt_opts)
568 {
569 	struct smack_mnt_opts *opts = *mnt_opts;
570 
571 	if (!opts) {
572 		opts = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
573 		if (!opts)
574 			return -ENOMEM;
575 		*mnt_opts = opts;
576 	}
577 	if (!s)
578 		return -ENOMEM;
579 
580 	switch (token) {
581 	case Opt_fsdefault:
582 		if (opts->fsdefault)
583 			goto out_opt_err;
584 		opts->fsdefault = s;
585 		break;
586 	case Opt_fsfloor:
587 		if (opts->fsfloor)
588 			goto out_opt_err;
589 		opts->fsfloor = s;
590 		break;
591 	case Opt_fshat:
592 		if (opts->fshat)
593 			goto out_opt_err;
594 		opts->fshat = s;
595 		break;
596 	case Opt_fsroot:
597 		if (opts->fsroot)
598 			goto out_opt_err;
599 		opts->fsroot = s;
600 		break;
601 	case Opt_fstransmute:
602 		if (opts->fstransmute)
603 			goto out_opt_err;
604 		opts->fstransmute = s;
605 		break;
606 	}
607 	return 0;
608 
609 out_opt_err:
610 	pr_warn("Smack: duplicate mount options\n");
611 	return -EINVAL;
612 }
613 
614 /**
615  * smack_fs_context_dup - Duplicate the security data on fs_context duplication
616  * @fc: The new filesystem context.
617  * @src_fc: The source filesystem context being duplicated.
618  *
619  * Returns 0 on success or -ENOMEM on error.
620  */
smack_fs_context_dup(struct fs_context * fc,struct fs_context * src_fc)621 static int smack_fs_context_dup(struct fs_context *fc,
622 				struct fs_context *src_fc)
623 {
624 	struct smack_mnt_opts *dst, *src = src_fc->security;
625 
626 	if (!src)
627 		return 0;
628 
629 	fc->security = kzalloc(sizeof(struct smack_mnt_opts), GFP_KERNEL);
630 	if (!fc->security)
631 		return -ENOMEM;
632 	dst = fc->security;
633 
634 	if (src->fsdefault) {
635 		dst->fsdefault = kstrdup(src->fsdefault, GFP_KERNEL);
636 		if (!dst->fsdefault)
637 			return -ENOMEM;
638 	}
639 	if (src->fsfloor) {
640 		dst->fsfloor = kstrdup(src->fsfloor, GFP_KERNEL);
641 		if (!dst->fsfloor)
642 			return -ENOMEM;
643 	}
644 	if (src->fshat) {
645 		dst->fshat = kstrdup(src->fshat, GFP_KERNEL);
646 		if (!dst->fshat)
647 			return -ENOMEM;
648 	}
649 	if (src->fsroot) {
650 		dst->fsroot = kstrdup(src->fsroot, GFP_KERNEL);
651 		if (!dst->fsroot)
652 			return -ENOMEM;
653 	}
654 	if (src->fstransmute) {
655 		dst->fstransmute = kstrdup(src->fstransmute, GFP_KERNEL);
656 		if (!dst->fstransmute)
657 			return -ENOMEM;
658 	}
659 	return 0;
660 }
661 
662 static const struct fs_parameter_spec smack_fs_parameters[] = {
663 	fsparam_string("smackfsdef",		Opt_fsdefault),
664 	fsparam_string("smackfsdefault",	Opt_fsdefault),
665 	fsparam_string("smackfsfloor",		Opt_fsfloor),
666 	fsparam_string("smackfshat",		Opt_fshat),
667 	fsparam_string("smackfsroot",		Opt_fsroot),
668 	fsparam_string("smackfstransmute",	Opt_fstransmute),
669 	{}
670 };
671 
672 /**
673  * smack_fs_context_parse_param - Parse a single mount parameter
674  * @fc: The new filesystem context being constructed.
675  * @param: The parameter.
676  *
677  * Returns 0 on success, -ENOPARAM to pass the parameter on or anything else on
678  * error.
679  */
smack_fs_context_parse_param(struct fs_context * fc,struct fs_parameter * param)680 static int smack_fs_context_parse_param(struct fs_context *fc,
681 					struct fs_parameter *param)
682 {
683 	struct fs_parse_result result;
684 	int opt, rc;
685 
686 	opt = fs_parse(fc, smack_fs_parameters, param, &result);
687 	if (opt < 0)
688 		return opt;
689 
690 	rc = smack_add_opt(opt, param->string, &fc->security);
691 	if (!rc)
692 		param->string = NULL;
693 	return rc;
694 }
695 
smack_sb_eat_lsm_opts(char * options,void ** mnt_opts)696 static int smack_sb_eat_lsm_opts(char *options, void **mnt_opts)
697 {
698 	char *from = options, *to = options;
699 	bool first = true;
700 
701 	while (1) {
702 		char *next = strchr(from, ',');
703 		int token, len, rc;
704 		char *arg = NULL;
705 
706 		if (next)
707 			len = next - from;
708 		else
709 			len = strlen(from);
710 
711 		token = match_opt_prefix(from, len, &arg);
712 		if (token != Opt_error) {
713 			arg = kmemdup_nul(arg, from + len - arg, GFP_KERNEL);
714 			rc = smack_add_opt(token, arg, mnt_opts);
715 			if (unlikely(rc)) {
716 				kfree(arg);
717 				if (*mnt_opts)
718 					smack_free_mnt_opts(*mnt_opts);
719 				*mnt_opts = NULL;
720 				return rc;
721 			}
722 		} else {
723 			if (!first) {	// copy with preceding comma
724 				from--;
725 				len++;
726 			}
727 			if (to != from)
728 				memmove(to, from, len);
729 			to += len;
730 			first = false;
731 		}
732 		if (!from[len])
733 			break;
734 		from += len + 1;
735 	}
736 	*to = '\0';
737 	return 0;
738 }
739 
740 /**
741  * smack_set_mnt_opts - set Smack specific mount options
742  * @sb: the file system superblock
743  * @mnt_opts: Smack mount options
744  * @kern_flags: mount option from kernel space or user space
745  * @set_kern_flags: where to store converted mount opts
746  *
747  * Returns 0 on success, an error code on failure
748  *
749  * Allow filesystems with binary mount data to explicitly set Smack mount
750  * labels.
751  */
smack_set_mnt_opts(struct super_block * sb,void * mnt_opts,unsigned long kern_flags,unsigned long * set_kern_flags)752 static int smack_set_mnt_opts(struct super_block *sb,
753 		void *mnt_opts,
754 		unsigned long kern_flags,
755 		unsigned long *set_kern_flags)
756 {
757 	struct dentry *root = sb->s_root;
758 	struct inode *inode = d_backing_inode(root);
759 	struct superblock_smack *sp = smack_superblock(sb);
760 	struct inode_smack *isp;
761 	struct smack_known *skp;
762 	struct smack_mnt_opts *opts = mnt_opts;
763 	bool transmute = false;
764 
765 	if (sp->smk_flags & SMK_SB_INITIALIZED)
766 		return 0;
767 
768 	if (!smack_privileged(CAP_MAC_ADMIN)) {
769 		/*
770 		 * Unprivileged mounts don't get to specify Smack values.
771 		 */
772 		if (opts)
773 			return -EPERM;
774 		/*
775 		 * Unprivileged mounts get root and default from the caller.
776 		 */
777 		skp = smk_of_current();
778 		sp->smk_root = skp;
779 		sp->smk_default = skp;
780 		/*
781 		 * For a handful of fs types with no user-controlled
782 		 * backing store it's okay to trust security labels
783 		 * in the filesystem. The rest are untrusted.
784 		 */
785 		if (sb->s_user_ns != &init_user_ns &&
786 		    sb->s_magic != SYSFS_MAGIC && sb->s_magic != TMPFS_MAGIC &&
787 		    sb->s_magic != RAMFS_MAGIC) {
788 			transmute = true;
789 			sp->smk_flags |= SMK_SB_UNTRUSTED;
790 		}
791 	}
792 
793 	sp->smk_flags |= SMK_SB_INITIALIZED;
794 
795 	if (opts) {
796 		if (opts->fsdefault) {
797 			skp = smk_import_entry(opts->fsdefault, 0);
798 			if (IS_ERR(skp))
799 				return PTR_ERR(skp);
800 			sp->smk_default = skp;
801 		}
802 		if (opts->fsfloor) {
803 			skp = smk_import_entry(opts->fsfloor, 0);
804 			if (IS_ERR(skp))
805 				return PTR_ERR(skp);
806 			sp->smk_floor = skp;
807 		}
808 		if (opts->fshat) {
809 			skp = smk_import_entry(opts->fshat, 0);
810 			if (IS_ERR(skp))
811 				return PTR_ERR(skp);
812 			sp->smk_hat = skp;
813 		}
814 		if (opts->fsroot) {
815 			skp = smk_import_entry(opts->fsroot, 0);
816 			if (IS_ERR(skp))
817 				return PTR_ERR(skp);
818 			sp->smk_root = skp;
819 		}
820 		if (opts->fstransmute) {
821 			skp = smk_import_entry(opts->fstransmute, 0);
822 			if (IS_ERR(skp))
823 				return PTR_ERR(skp);
824 			sp->smk_root = skp;
825 			transmute = true;
826 		}
827 	}
828 
829 	/*
830 	 * Initialize the root inode.
831 	 */
832 	init_inode_smack(inode, sp->smk_root);
833 
834 	if (transmute) {
835 		isp = smack_inode(inode);
836 		isp->smk_flags |= SMK_INODE_TRANSMUTE;
837 	}
838 
839 	return 0;
840 }
841 
842 /**
843  * smack_sb_statfs - Smack check on statfs
844  * @dentry: identifies the file system in question
845  *
846  * Returns 0 if current can read the floor of the filesystem,
847  * and error code otherwise
848  */
smack_sb_statfs(struct dentry * dentry)849 static int smack_sb_statfs(struct dentry *dentry)
850 {
851 	struct superblock_smack *sbp = smack_superblock(dentry->d_sb);
852 	int rc;
853 	struct smk_audit_info ad;
854 
855 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
856 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
857 
858 	rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
859 	rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
860 	return rc;
861 }
862 
863 /*
864  * BPRM hooks
865  */
866 
867 /**
868  * smack_bprm_creds_for_exec - Update bprm->cred if needed for exec
869  * @bprm: the exec information
870  *
871  * Returns 0 if it gets a blob, -EPERM if exec forbidden and -ENOMEM otherwise
872  */
smack_bprm_creds_for_exec(struct linux_binprm * bprm)873 static int smack_bprm_creds_for_exec(struct linux_binprm *bprm)
874 {
875 	struct inode *inode = file_inode(bprm->file);
876 	struct task_smack *bsp = smack_cred(bprm->cred);
877 	struct inode_smack *isp;
878 	struct superblock_smack *sbsp;
879 	int rc;
880 
881 	isp = smack_inode(inode);
882 	if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
883 		return 0;
884 
885 	sbsp = smack_superblock(inode->i_sb);
886 	if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
887 	    isp->smk_task != sbsp->smk_root)
888 		return 0;
889 
890 	if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
891 		struct task_struct *tracer;
892 		rc = 0;
893 
894 		rcu_read_lock();
895 		tracer = ptrace_parent(current);
896 		if (likely(tracer != NULL))
897 			rc = smk_ptrace_rule_check(tracer,
898 						   isp->smk_task,
899 						   PTRACE_MODE_ATTACH,
900 						   __func__);
901 		rcu_read_unlock();
902 
903 		if (rc != 0)
904 			return rc;
905 	}
906 	if (bprm->unsafe & ~LSM_UNSAFE_PTRACE)
907 		return -EPERM;
908 
909 	bsp->smk_task = isp->smk_task;
910 	bprm->per_clear |= PER_CLEAR_ON_SETID;
911 
912 	/* Decide if this is a secure exec. */
913 	if (bsp->smk_task != bsp->smk_forked)
914 		bprm->secureexec = 1;
915 
916 	return 0;
917 }
918 
919 /*
920  * Inode hooks
921  */
922 
923 /**
924  * smack_inode_alloc_security - allocate an inode blob
925  * @inode: the inode in need of a blob
926  *
927  * Returns 0
928  */
smack_inode_alloc_security(struct inode * inode)929 static int smack_inode_alloc_security(struct inode *inode)
930 {
931 	struct smack_known *skp = smk_of_current();
932 
933 	init_inode_smack(inode, skp);
934 	return 0;
935 }
936 
937 /**
938  * smack_inode_init_security - copy out the smack from an inode
939  * @inode: the newly created inode
940  * @dir: containing directory object
941  * @qstr: unused
942  * @name: where to put the attribute name
943  * @value: where to put the attribute value
944  * @len: where to put the length of the attribute
945  *
946  * Returns 0 if it all works out, -ENOMEM if there's no memory
947  */
smack_inode_init_security(struct inode * inode,struct inode * dir,const struct qstr * qstr,const char ** name,void ** value,size_t * len)948 static int smack_inode_init_security(struct inode *inode, struct inode *dir,
949 				     const struct qstr *qstr, const char **name,
950 				     void **value, size_t *len)
951 {
952 	struct inode_smack *issp = smack_inode(inode);
953 	struct smack_known *skp = smk_of_current();
954 	struct smack_known *isp = smk_of_inode(inode);
955 	struct smack_known *dsp = smk_of_inode(dir);
956 	int may;
957 
958 	if (name)
959 		*name = XATTR_SMACK_SUFFIX;
960 
961 	if (value && len) {
962 		rcu_read_lock();
963 		may = smk_access_entry(skp->smk_known, dsp->smk_known,
964 				       &skp->smk_rules);
965 		rcu_read_unlock();
966 
967 		/*
968 		 * If the access rule allows transmutation and
969 		 * the directory requests transmutation then
970 		 * by all means transmute.
971 		 * Mark the inode as changed.
972 		 */
973 		if (may > 0 && ((may & MAY_TRANSMUTE) != 0) &&
974 		    smk_inode_transmutable(dir)) {
975 			isp = dsp;
976 			issp->smk_flags |= SMK_INODE_CHANGED;
977 		}
978 
979 		*value = kstrdup(isp->smk_known, GFP_NOFS);
980 		if (*value == NULL)
981 			return -ENOMEM;
982 
983 		*len = strlen(isp->smk_known);
984 	}
985 
986 	return 0;
987 }
988 
989 /**
990  * smack_inode_link - Smack check on link
991  * @old_dentry: the existing object
992  * @dir: unused
993  * @new_dentry: the new object
994  *
995  * Returns 0 if access is permitted, an error code otherwise
996  */
smack_inode_link(struct dentry * old_dentry,struct inode * dir,struct dentry * new_dentry)997 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
998 			    struct dentry *new_dentry)
999 {
1000 	struct smack_known *isp;
1001 	struct smk_audit_info ad;
1002 	int rc;
1003 
1004 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1005 	smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1006 
1007 	isp = smk_of_inode(d_backing_inode(old_dentry));
1008 	rc = smk_curacc(isp, MAY_WRITE, &ad);
1009 	rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_WRITE, rc);
1010 
1011 	if (rc == 0 && d_is_positive(new_dentry)) {
1012 		isp = smk_of_inode(d_backing_inode(new_dentry));
1013 		smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1014 		rc = smk_curacc(isp, MAY_WRITE, &ad);
1015 		rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_WRITE, rc);
1016 	}
1017 
1018 	return rc;
1019 }
1020 
1021 /**
1022  * smack_inode_unlink - Smack check on inode deletion
1023  * @dir: containing directory object
1024  * @dentry: file to unlink
1025  *
1026  * Returns 0 if current can write the containing directory
1027  * and the object, error code otherwise
1028  */
smack_inode_unlink(struct inode * dir,struct dentry * dentry)1029 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
1030 {
1031 	struct inode *ip = d_backing_inode(dentry);
1032 	struct smk_audit_info ad;
1033 	int rc;
1034 
1035 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1036 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1037 
1038 	/*
1039 	 * You need write access to the thing you're unlinking
1040 	 */
1041 	rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
1042 	rc = smk_bu_inode(ip, MAY_WRITE, rc);
1043 	if (rc == 0) {
1044 		/*
1045 		 * You also need write access to the containing directory
1046 		 */
1047 		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1048 		smk_ad_setfield_u_fs_inode(&ad, dir);
1049 		rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1050 		rc = smk_bu_inode(dir, MAY_WRITE, rc);
1051 	}
1052 	return rc;
1053 }
1054 
1055 /**
1056  * smack_inode_rmdir - Smack check on directory deletion
1057  * @dir: containing directory object
1058  * @dentry: directory to unlink
1059  *
1060  * Returns 0 if current can write the containing directory
1061  * and the directory, error code otherwise
1062  */
smack_inode_rmdir(struct inode * dir,struct dentry * dentry)1063 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
1064 {
1065 	struct smk_audit_info ad;
1066 	int rc;
1067 
1068 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1069 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1070 
1071 	/*
1072 	 * You need write access to the thing you're removing
1073 	 */
1074 	rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1075 	rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1076 	if (rc == 0) {
1077 		/*
1078 		 * You also need write access to the containing directory
1079 		 */
1080 		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1081 		smk_ad_setfield_u_fs_inode(&ad, dir);
1082 		rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
1083 		rc = smk_bu_inode(dir, MAY_WRITE, rc);
1084 	}
1085 
1086 	return rc;
1087 }
1088 
1089 /**
1090  * smack_inode_rename - Smack check on rename
1091  * @old_inode: unused
1092  * @old_dentry: the old object
1093  * @new_inode: unused
1094  * @new_dentry: the new object
1095  *
1096  * Read and write access is required on both the old and
1097  * new directories.
1098  *
1099  * Returns 0 if access is permitted, an error code otherwise
1100  */
smack_inode_rename(struct inode * old_inode,struct dentry * old_dentry,struct inode * new_inode,struct dentry * new_dentry)1101 static int smack_inode_rename(struct inode *old_inode,
1102 			      struct dentry *old_dentry,
1103 			      struct inode *new_inode,
1104 			      struct dentry *new_dentry)
1105 {
1106 	int rc;
1107 	struct smack_known *isp;
1108 	struct smk_audit_info ad;
1109 
1110 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1111 	smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
1112 
1113 	isp = smk_of_inode(d_backing_inode(old_dentry));
1114 	rc = smk_curacc(isp, MAY_READWRITE, &ad);
1115 	rc = smk_bu_inode(d_backing_inode(old_dentry), MAY_READWRITE, rc);
1116 
1117 	if (rc == 0 && d_is_positive(new_dentry)) {
1118 		isp = smk_of_inode(d_backing_inode(new_dentry));
1119 		smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
1120 		rc = smk_curacc(isp, MAY_READWRITE, &ad);
1121 		rc = smk_bu_inode(d_backing_inode(new_dentry), MAY_READWRITE, rc);
1122 	}
1123 	return rc;
1124 }
1125 
1126 /**
1127  * smack_inode_permission - Smack version of permission()
1128  * @inode: the inode in question
1129  * @mask: the access requested
1130  *
1131  * This is the important Smack hook.
1132  *
1133  * Returns 0 if access is permitted, an error code otherwise
1134  */
smack_inode_permission(struct inode * inode,int mask)1135 static int smack_inode_permission(struct inode *inode, int mask)
1136 {
1137 	struct superblock_smack *sbsp = smack_superblock(inode->i_sb);
1138 	struct smk_audit_info ad;
1139 	int no_block = mask & MAY_NOT_BLOCK;
1140 	int rc;
1141 
1142 	mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
1143 	/*
1144 	 * No permission to check. Existence test. Yup, it's there.
1145 	 */
1146 	if (mask == 0)
1147 		return 0;
1148 
1149 	if (sbsp->smk_flags & SMK_SB_UNTRUSTED) {
1150 		if (smk_of_inode(inode) != sbsp->smk_root)
1151 			return -EACCES;
1152 	}
1153 
1154 	/* May be droppable after audit */
1155 	if (no_block)
1156 		return -ECHILD;
1157 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
1158 	smk_ad_setfield_u_fs_inode(&ad, inode);
1159 	rc = smk_curacc(smk_of_inode(inode), mask, &ad);
1160 	rc = smk_bu_inode(inode, mask, rc);
1161 	return rc;
1162 }
1163 
1164 /**
1165  * smack_inode_setattr - Smack check for setting attributes
1166  * @dentry: the object
1167  * @iattr: for the force flag
1168  *
1169  * Returns 0 if access is permitted, an error code otherwise
1170  */
smack_inode_setattr(struct dentry * dentry,struct iattr * iattr)1171 static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
1172 {
1173 	struct smk_audit_info ad;
1174 	int rc;
1175 
1176 	/*
1177 	 * Need to allow for clearing the setuid bit.
1178 	 */
1179 	if (iattr->ia_valid & ATTR_FORCE)
1180 		return 0;
1181 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1182 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1183 
1184 	rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1185 	rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1186 	return rc;
1187 }
1188 
1189 /**
1190  * smack_inode_getattr - Smack check for getting attributes
1191  * @path: path to extract the info from
1192  *
1193  * Returns 0 if access is permitted, an error code otherwise
1194  */
smack_inode_getattr(const struct path * path)1195 static int smack_inode_getattr(const struct path *path)
1196 {
1197 	struct smk_audit_info ad;
1198 	struct inode *inode = d_backing_inode(path->dentry);
1199 	int rc;
1200 
1201 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1202 	smk_ad_setfield_u_fs_path(&ad, *path);
1203 	rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1204 	rc = smk_bu_inode(inode, MAY_READ, rc);
1205 	return rc;
1206 }
1207 
1208 /**
1209  * smack_inode_setxattr - Smack check for setting xattrs
1210  * @mnt_userns: active user namespace
1211  * @dentry: the object
1212  * @name: name of the attribute
1213  * @value: value of the attribute
1214  * @size: size of the value
1215  * @flags: unused
1216  *
1217  * This protects the Smack attribute explicitly.
1218  *
1219  * Returns 0 if access is permitted, an error code otherwise
1220  */
smack_inode_setxattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)1221 static int smack_inode_setxattr(struct user_namespace *mnt_userns,
1222 				struct dentry *dentry, const char *name,
1223 				const void *value, size_t size, int flags)
1224 {
1225 	struct smk_audit_info ad;
1226 	struct smack_known *skp;
1227 	int check_priv = 0;
1228 	int check_import = 0;
1229 	int check_star = 0;
1230 	int rc = 0;
1231 
1232 	/*
1233 	 * Check label validity here so import won't fail in post_setxattr
1234 	 */
1235 	if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1236 	    strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1237 	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
1238 		check_priv = 1;
1239 		check_import = 1;
1240 	} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1241 		   strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1242 		check_priv = 1;
1243 		check_import = 1;
1244 		check_star = 1;
1245 	} else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1246 		check_priv = 1;
1247 		if (size != TRANS_TRUE_SIZE ||
1248 		    strncmp(value, TRANS_TRUE, TRANS_TRUE_SIZE) != 0)
1249 			rc = -EINVAL;
1250 	} else
1251 		rc = cap_inode_setxattr(dentry, name, value, size, flags);
1252 
1253 	if (check_priv && !smack_privileged(CAP_MAC_ADMIN))
1254 		rc = -EPERM;
1255 
1256 	if (rc == 0 && check_import) {
1257 		skp = size ? smk_import_entry(value, size) : NULL;
1258 		if (IS_ERR(skp))
1259 			rc = PTR_ERR(skp);
1260 		else if (skp == NULL || (check_star &&
1261 		    (skp == &smack_known_star || skp == &smack_known_web)))
1262 			rc = -EINVAL;
1263 	}
1264 
1265 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1266 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1267 
1268 	if (rc == 0) {
1269 		rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1270 		rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1271 	}
1272 
1273 	return rc;
1274 }
1275 
1276 /**
1277  * smack_inode_post_setxattr - Apply the Smack update approved above
1278  * @dentry: object
1279  * @name: attribute name
1280  * @value: attribute value
1281  * @size: attribute size
1282  * @flags: unused
1283  *
1284  * Set the pointer in the inode blob to the entry found
1285  * in the master label list.
1286  */
smack_inode_post_setxattr(struct dentry * dentry,const char * name,const void * value,size_t size,int flags)1287 static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
1288 				      const void *value, size_t size, int flags)
1289 {
1290 	struct smack_known *skp;
1291 	struct inode_smack *isp = smack_inode(d_backing_inode(dentry));
1292 
1293 	if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0) {
1294 		isp->smk_flags |= SMK_INODE_TRANSMUTE;
1295 		return;
1296 	}
1297 
1298 	if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1299 		skp = smk_import_entry(value, size);
1300 		if (!IS_ERR(skp))
1301 			isp->smk_inode = skp;
1302 	} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
1303 		skp = smk_import_entry(value, size);
1304 		if (!IS_ERR(skp))
1305 			isp->smk_task = skp;
1306 	} else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1307 		skp = smk_import_entry(value, size);
1308 		if (!IS_ERR(skp))
1309 			isp->smk_mmap = skp;
1310 	}
1311 
1312 	return;
1313 }
1314 
1315 /**
1316  * smack_inode_getxattr - Smack check on getxattr
1317  * @dentry: the object
1318  * @name: unused
1319  *
1320  * Returns 0 if access is permitted, an error code otherwise
1321  */
smack_inode_getxattr(struct dentry * dentry,const char * name)1322 static int smack_inode_getxattr(struct dentry *dentry, const char *name)
1323 {
1324 	struct smk_audit_info ad;
1325 	int rc;
1326 
1327 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1328 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1329 
1330 	rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_READ, &ad);
1331 	rc = smk_bu_inode(d_backing_inode(dentry), MAY_READ, rc);
1332 	return rc;
1333 }
1334 
1335 /**
1336  * smack_inode_removexattr - Smack check on removexattr
1337  * @mnt_userns: active user namespace
1338  * @dentry: the object
1339  * @name: name of the attribute
1340  *
1341  * Removing the Smack attribute requires CAP_MAC_ADMIN
1342  *
1343  * Returns 0 if access is permitted, an error code otherwise
1344  */
smack_inode_removexattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name)1345 static int smack_inode_removexattr(struct user_namespace *mnt_userns,
1346 				   struct dentry *dentry, const char *name)
1347 {
1348 	struct inode_smack *isp;
1349 	struct smk_audit_info ad;
1350 	int rc = 0;
1351 
1352 	if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
1353 	    strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
1354 	    strcmp(name, XATTR_NAME_SMACKIPOUT) == 0 ||
1355 	    strcmp(name, XATTR_NAME_SMACKEXEC) == 0 ||
1356 	    strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0 ||
1357 	    strcmp(name, XATTR_NAME_SMACKMMAP) == 0) {
1358 		if (!smack_privileged(CAP_MAC_ADMIN))
1359 			rc = -EPERM;
1360 	} else
1361 		rc = cap_inode_removexattr(mnt_userns, dentry, name);
1362 
1363 	if (rc != 0)
1364 		return rc;
1365 
1366 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
1367 	smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1368 
1369 	rc = smk_curacc(smk_of_inode(d_backing_inode(dentry)), MAY_WRITE, &ad);
1370 	rc = smk_bu_inode(d_backing_inode(dentry), MAY_WRITE, rc);
1371 	if (rc != 0)
1372 		return rc;
1373 
1374 	isp = smack_inode(d_backing_inode(dentry));
1375 	/*
1376 	 * Don't do anything special for these.
1377 	 *	XATTR_NAME_SMACKIPIN
1378 	 *	XATTR_NAME_SMACKIPOUT
1379 	 */
1380 	if (strcmp(name, XATTR_NAME_SMACK) == 0) {
1381 		struct super_block *sbp = dentry->d_sb;
1382 		struct superblock_smack *sbsp = smack_superblock(sbp);
1383 
1384 		isp->smk_inode = sbsp->smk_default;
1385 	} else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0)
1386 		isp->smk_task = NULL;
1387 	else if (strcmp(name, XATTR_NAME_SMACKMMAP) == 0)
1388 		isp->smk_mmap = NULL;
1389 	else if (strcmp(name, XATTR_NAME_SMACKTRANSMUTE) == 0)
1390 		isp->smk_flags &= ~SMK_INODE_TRANSMUTE;
1391 
1392 	return 0;
1393 }
1394 
1395 /**
1396  * smack_inode_getsecurity - get smack xattrs
1397  * @mnt_userns: active user namespace
1398  * @inode: the object
1399  * @name: attribute name
1400  * @buffer: where to put the result
1401  * @alloc: duplicate memory
1402  *
1403  * Returns the size of the attribute or an error code
1404  */
smack_inode_getsecurity(struct user_namespace * mnt_userns,struct inode * inode,const char * name,void ** buffer,bool alloc)1405 static int smack_inode_getsecurity(struct user_namespace *mnt_userns,
1406 				   struct inode *inode, const char *name,
1407 				   void **buffer, bool alloc)
1408 {
1409 	struct socket_smack *ssp;
1410 	struct socket *sock;
1411 	struct super_block *sbp;
1412 	struct inode *ip = (struct inode *)inode;
1413 	struct smack_known *isp;
1414 
1415 	if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
1416 		isp = smk_of_inode(inode);
1417 	else {
1418 		/*
1419 		 * The rest of the Smack xattrs are only on sockets.
1420 		 */
1421 		sbp = ip->i_sb;
1422 		if (sbp->s_magic != SOCKFS_MAGIC)
1423 			return -EOPNOTSUPP;
1424 
1425 		sock = SOCKET_I(ip);
1426 		if (sock == NULL || sock->sk == NULL)
1427 			return -EOPNOTSUPP;
1428 
1429 		ssp = sock->sk->sk_security;
1430 
1431 		if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1432 			isp = ssp->smk_in;
1433 		else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1434 			isp = ssp->smk_out;
1435 		else
1436 			return -EOPNOTSUPP;
1437 	}
1438 
1439 	if (alloc) {
1440 		*buffer = kstrdup(isp->smk_known, GFP_KERNEL);
1441 		if (*buffer == NULL)
1442 			return -ENOMEM;
1443 	}
1444 
1445 	return strlen(isp->smk_known);
1446 }
1447 
1448 
1449 /**
1450  * smack_inode_listsecurity - list the Smack attributes
1451  * @inode: the object
1452  * @buffer: where they go
1453  * @buffer_size: size of buffer
1454  */
smack_inode_listsecurity(struct inode * inode,char * buffer,size_t buffer_size)1455 static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1456 				    size_t buffer_size)
1457 {
1458 	int len = sizeof(XATTR_NAME_SMACK);
1459 
1460 	if (buffer != NULL && len <= buffer_size)
1461 		memcpy(buffer, XATTR_NAME_SMACK, len);
1462 
1463 	return len;
1464 }
1465 
1466 /**
1467  * smack_inode_getsecid - Extract inode's security id
1468  * @inode: inode to extract the info from
1469  * @secid: where result will be saved
1470  */
smack_inode_getsecid(struct inode * inode,u32 * secid)1471 static void smack_inode_getsecid(struct inode *inode, u32 *secid)
1472 {
1473 	struct smack_known *skp = smk_of_inode(inode);
1474 
1475 	*secid = skp->smk_secid;
1476 }
1477 
1478 /*
1479  * File Hooks
1480  */
1481 
1482 /*
1483  * There is no smack_file_permission hook
1484  *
1485  * Should access checks be done on each read or write?
1486  * UNICOS and SELinux say yes.
1487  * Trusted Solaris, Trusted Irix, and just about everyone else says no.
1488  *
1489  * I'll say no for now. Smack does not do the frequent
1490  * label changing that SELinux does.
1491  */
1492 
1493 /**
1494  * smack_file_alloc_security - assign a file security blob
1495  * @file: the object
1496  *
1497  * The security blob for a file is a pointer to the master
1498  * label list, so no allocation is done.
1499  *
1500  * f_security is the owner security information. It
1501  * isn't used on file access checks, it's for send_sigio.
1502  *
1503  * Returns 0
1504  */
smack_file_alloc_security(struct file * file)1505 static int smack_file_alloc_security(struct file *file)
1506 {
1507 	struct smack_known **blob = smack_file(file);
1508 
1509 	*blob = smk_of_current();
1510 	return 0;
1511 }
1512 
1513 /**
1514  * smack_file_ioctl - Smack check on ioctls
1515  * @file: the object
1516  * @cmd: what to do
1517  * @arg: unused
1518  *
1519  * Relies heavily on the correct use of the ioctl command conventions.
1520  *
1521  * Returns 0 if allowed, error code otherwise
1522  */
smack_file_ioctl(struct file * file,unsigned int cmd,unsigned long arg)1523 static int smack_file_ioctl(struct file *file, unsigned int cmd,
1524 			    unsigned long arg)
1525 {
1526 	int rc = 0;
1527 	struct smk_audit_info ad;
1528 	struct inode *inode = file_inode(file);
1529 
1530 	if (unlikely(IS_PRIVATE(inode)))
1531 		return 0;
1532 
1533 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1534 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
1535 
1536 	if (_IOC_DIR(cmd) & _IOC_WRITE) {
1537 		rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1538 		rc = smk_bu_file(file, MAY_WRITE, rc);
1539 	}
1540 
1541 	if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1542 		rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
1543 		rc = smk_bu_file(file, MAY_READ, rc);
1544 	}
1545 
1546 	return rc;
1547 }
1548 
1549 /**
1550  * smack_file_lock - Smack check on file locking
1551  * @file: the object
1552  * @cmd: unused
1553  *
1554  * Returns 0 if current has lock access, error code otherwise
1555  */
smack_file_lock(struct file * file,unsigned int cmd)1556 static int smack_file_lock(struct file *file, unsigned int cmd)
1557 {
1558 	struct smk_audit_info ad;
1559 	int rc;
1560 	struct inode *inode = file_inode(file);
1561 
1562 	if (unlikely(IS_PRIVATE(inode)))
1563 		return 0;
1564 
1565 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1566 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
1567 	rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1568 	rc = smk_bu_file(file, MAY_LOCK, rc);
1569 	return rc;
1570 }
1571 
1572 /**
1573  * smack_file_fcntl - Smack check on fcntl
1574  * @file: the object
1575  * @cmd: what action to check
1576  * @arg: unused
1577  *
1578  * Generally these operations are harmless.
1579  * File locking operations present an obvious mechanism
1580  * for passing information, so they require write access.
1581  *
1582  * Returns 0 if current has access, error code otherwise
1583  */
smack_file_fcntl(struct file * file,unsigned int cmd,unsigned long arg)1584 static int smack_file_fcntl(struct file *file, unsigned int cmd,
1585 			    unsigned long arg)
1586 {
1587 	struct smk_audit_info ad;
1588 	int rc = 0;
1589 	struct inode *inode = file_inode(file);
1590 
1591 	if (unlikely(IS_PRIVATE(inode)))
1592 		return 0;
1593 
1594 	switch (cmd) {
1595 	case F_GETLK:
1596 		break;
1597 	case F_SETLK:
1598 	case F_SETLKW:
1599 		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1600 		smk_ad_setfield_u_fs_path(&ad, file->f_path);
1601 		rc = smk_curacc(smk_of_inode(inode), MAY_LOCK, &ad);
1602 		rc = smk_bu_file(file, MAY_LOCK, rc);
1603 		break;
1604 	case F_SETOWN:
1605 	case F_SETSIG:
1606 		smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1607 		smk_ad_setfield_u_fs_path(&ad, file->f_path);
1608 		rc = smk_curacc(smk_of_inode(inode), MAY_WRITE, &ad);
1609 		rc = smk_bu_file(file, MAY_WRITE, rc);
1610 		break;
1611 	default:
1612 		break;
1613 	}
1614 
1615 	return rc;
1616 }
1617 
1618 /**
1619  * smack_mmap_file - Check permissions for a mmap operation.
1620  * @file: contains the file structure for file to map (may be NULL).
1621  * @reqprot: contains the protection requested by the application.
1622  * @prot: contains the protection that will be applied by the kernel.
1623  * @flags: contains the operational flags.
1624  *
1625  * The @file may be NULL, e.g. if mapping anonymous memory.
1626  *
1627  * Return 0 if permission is granted.
1628  */
smack_mmap_file(struct file * file,unsigned long reqprot,unsigned long prot,unsigned long flags)1629 static int smack_mmap_file(struct file *file,
1630 			   unsigned long reqprot, unsigned long prot,
1631 			   unsigned long flags)
1632 {
1633 	struct smack_known *skp;
1634 	struct smack_known *mkp;
1635 	struct smack_rule *srp;
1636 	struct task_smack *tsp;
1637 	struct smack_known *okp;
1638 	struct inode_smack *isp;
1639 	struct superblock_smack *sbsp;
1640 	int may;
1641 	int mmay;
1642 	int tmay;
1643 	int rc;
1644 
1645 	if (file == NULL)
1646 		return 0;
1647 
1648 	if (unlikely(IS_PRIVATE(file_inode(file))))
1649 		return 0;
1650 
1651 	isp = smack_inode(file_inode(file));
1652 	if (isp->smk_mmap == NULL)
1653 		return 0;
1654 	sbsp = smack_superblock(file_inode(file)->i_sb);
1655 	if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
1656 	    isp->smk_mmap != sbsp->smk_root)
1657 		return -EACCES;
1658 	mkp = isp->smk_mmap;
1659 
1660 	tsp = smack_cred(current_cred());
1661 	skp = smk_of_current();
1662 	rc = 0;
1663 
1664 	rcu_read_lock();
1665 	/*
1666 	 * For each Smack rule associated with the subject
1667 	 * label verify that the SMACK64MMAP also has access
1668 	 * to that rule's object label.
1669 	 */
1670 	list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1671 		okp = srp->smk_object;
1672 		/*
1673 		 * Matching labels always allows access.
1674 		 */
1675 		if (mkp->smk_known == okp->smk_known)
1676 			continue;
1677 		/*
1678 		 * If there is a matching local rule take
1679 		 * that into account as well.
1680 		 */
1681 		may = smk_access_entry(srp->smk_subject->smk_known,
1682 				       okp->smk_known,
1683 				       &tsp->smk_rules);
1684 		if (may == -ENOENT)
1685 			may = srp->smk_access;
1686 		else
1687 			may &= srp->smk_access;
1688 		/*
1689 		 * If may is zero the SMACK64MMAP subject can't
1690 		 * possibly have less access.
1691 		 */
1692 		if (may == 0)
1693 			continue;
1694 
1695 		/*
1696 		 * Fetch the global list entry.
1697 		 * If there isn't one a SMACK64MMAP subject
1698 		 * can't have as much access as current.
1699 		 */
1700 		mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1701 					&mkp->smk_rules);
1702 		if (mmay == -ENOENT) {
1703 			rc = -EACCES;
1704 			break;
1705 		}
1706 		/*
1707 		 * If there is a local entry it modifies the
1708 		 * potential access, too.
1709 		 */
1710 		tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1711 					&tsp->smk_rules);
1712 		if (tmay != -ENOENT)
1713 			mmay &= tmay;
1714 
1715 		/*
1716 		 * If there is any access available to current that is
1717 		 * not available to a SMACK64MMAP subject
1718 		 * deny access.
1719 		 */
1720 		if ((may | mmay) != mmay) {
1721 			rc = -EACCES;
1722 			break;
1723 		}
1724 	}
1725 
1726 	rcu_read_unlock();
1727 
1728 	return rc;
1729 }
1730 
1731 /**
1732  * smack_file_set_fowner - set the file security blob value
1733  * @file: object in question
1734  *
1735  */
smack_file_set_fowner(struct file * file)1736 static void smack_file_set_fowner(struct file *file)
1737 {
1738 	struct smack_known **blob = smack_file(file);
1739 
1740 	*blob = smk_of_current();
1741 }
1742 
1743 /**
1744  * smack_file_send_sigiotask - Smack on sigio
1745  * @tsk: The target task
1746  * @fown: the object the signal come from
1747  * @signum: unused
1748  *
1749  * Allow a privileged task to get signals even if it shouldn't
1750  *
1751  * Returns 0 if a subject with the object's smack could
1752  * write to the task, an error code otherwise.
1753  */
smack_file_send_sigiotask(struct task_struct * tsk,struct fown_struct * fown,int signum)1754 static int smack_file_send_sigiotask(struct task_struct *tsk,
1755 				     struct fown_struct *fown, int signum)
1756 {
1757 	struct smack_known **blob;
1758 	struct smack_known *skp;
1759 	struct smack_known *tkp = smk_of_task(smack_cred(tsk->cred));
1760 	const struct cred *tcred;
1761 	struct file *file;
1762 	int rc;
1763 	struct smk_audit_info ad;
1764 
1765 	/*
1766 	 * struct fown_struct is never outside the context of a struct file
1767 	 */
1768 	file = container_of(fown, struct file, f_owner);
1769 
1770 	/* we don't log here as rc can be overriden */
1771 	blob = smack_file(file);
1772 	skp = *blob;
1773 	rc = smk_access(skp, tkp, MAY_DELIVER, NULL);
1774 	rc = smk_bu_note("sigiotask", skp, tkp, MAY_DELIVER, rc);
1775 
1776 	rcu_read_lock();
1777 	tcred = __task_cred(tsk);
1778 	if (rc != 0 && smack_privileged_cred(CAP_MAC_OVERRIDE, tcred))
1779 		rc = 0;
1780 	rcu_read_unlock();
1781 
1782 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1783 	smk_ad_setfield_u_tsk(&ad, tsk);
1784 	smack_log(skp->smk_known, tkp->smk_known, MAY_DELIVER, rc, &ad);
1785 	return rc;
1786 }
1787 
1788 /**
1789  * smack_file_receive - Smack file receive check
1790  * @file: the object
1791  *
1792  * Returns 0 if current has access, error code otherwise
1793  */
smack_file_receive(struct file * file)1794 static int smack_file_receive(struct file *file)
1795 {
1796 	int rc;
1797 	int may = 0;
1798 	struct smk_audit_info ad;
1799 	struct inode *inode = file_inode(file);
1800 	struct socket *sock;
1801 	struct task_smack *tsp;
1802 	struct socket_smack *ssp;
1803 
1804 	if (unlikely(IS_PRIVATE(inode)))
1805 		return 0;
1806 
1807 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1808 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
1809 
1810 	if (inode->i_sb->s_magic == SOCKFS_MAGIC) {
1811 		sock = SOCKET_I(inode);
1812 		ssp = sock->sk->sk_security;
1813 		tsp = smack_cred(current_cred());
1814 		/*
1815 		 * If the receiving process can't write to the
1816 		 * passed socket or if the passed socket can't
1817 		 * write to the receiving process don't accept
1818 		 * the passed socket.
1819 		 */
1820 		rc = smk_access(tsp->smk_task, ssp->smk_out, MAY_WRITE, &ad);
1821 		rc = smk_bu_file(file, may, rc);
1822 		if (rc < 0)
1823 			return rc;
1824 		rc = smk_access(ssp->smk_in, tsp->smk_task, MAY_WRITE, &ad);
1825 		rc = smk_bu_file(file, may, rc);
1826 		return rc;
1827 	}
1828 	/*
1829 	 * This code relies on bitmasks.
1830 	 */
1831 	if (file->f_mode & FMODE_READ)
1832 		may = MAY_READ;
1833 	if (file->f_mode & FMODE_WRITE)
1834 		may |= MAY_WRITE;
1835 
1836 	rc = smk_curacc(smk_of_inode(inode), may, &ad);
1837 	rc = smk_bu_file(file, may, rc);
1838 	return rc;
1839 }
1840 
1841 /**
1842  * smack_file_open - Smack dentry open processing
1843  * @file: the object
1844  *
1845  * Set the security blob in the file structure.
1846  * Allow the open only if the task has read access. There are
1847  * many read operations (e.g. fstat) that you can do with an
1848  * fd even if you have the file open write-only.
1849  *
1850  * Returns 0 if current has access, error code otherwise
1851  */
smack_file_open(struct file * file)1852 static int smack_file_open(struct file *file)
1853 {
1854 	struct task_smack *tsp = smack_cred(file->f_cred);
1855 	struct inode *inode = file_inode(file);
1856 	struct smk_audit_info ad;
1857 	int rc;
1858 
1859 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1860 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
1861 	rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
1862 	rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
1863 
1864 	return rc;
1865 }
1866 
1867 /*
1868  * Task hooks
1869  */
1870 
1871 /**
1872  * smack_cred_alloc_blank - "allocate" blank task-level security credentials
1873  * @cred: the new credentials
1874  * @gfp: the atomicity of any memory allocations
1875  *
1876  * Prepare a blank set of credentials for modification.  This must allocate all
1877  * the memory the LSM module might require such that cred_transfer() can
1878  * complete without error.
1879  */
smack_cred_alloc_blank(struct cred * cred,gfp_t gfp)1880 static int smack_cred_alloc_blank(struct cred *cred, gfp_t gfp)
1881 {
1882 	init_task_smack(smack_cred(cred), NULL, NULL);
1883 	return 0;
1884 }
1885 
1886 
1887 /**
1888  * smack_cred_free - "free" task-level security credentials
1889  * @cred: the credentials in question
1890  *
1891  */
smack_cred_free(struct cred * cred)1892 static void smack_cred_free(struct cred *cred)
1893 {
1894 	struct task_smack *tsp = smack_cred(cred);
1895 	struct smack_rule *rp;
1896 	struct list_head *l;
1897 	struct list_head *n;
1898 
1899 	smk_destroy_label_list(&tsp->smk_relabel);
1900 
1901 	list_for_each_safe(l, n, &tsp->smk_rules) {
1902 		rp = list_entry(l, struct smack_rule, list);
1903 		list_del(&rp->list);
1904 		kmem_cache_free(smack_rule_cache, rp);
1905 	}
1906 }
1907 
1908 /**
1909  * smack_cred_prepare - prepare new set of credentials for modification
1910  * @new: the new credentials
1911  * @old: the original credentials
1912  * @gfp: the atomicity of any memory allocations
1913  *
1914  * Prepare a new set of credentials for modification.
1915  */
smack_cred_prepare(struct cred * new,const struct cred * old,gfp_t gfp)1916 static int smack_cred_prepare(struct cred *new, const struct cred *old,
1917 			      gfp_t gfp)
1918 {
1919 	struct task_smack *old_tsp = smack_cred(old);
1920 	struct task_smack *new_tsp = smack_cred(new);
1921 	int rc;
1922 
1923 	init_task_smack(new_tsp, old_tsp->smk_task, old_tsp->smk_task);
1924 
1925 	rc = smk_copy_rules(&new_tsp->smk_rules, &old_tsp->smk_rules, gfp);
1926 	if (rc != 0)
1927 		return rc;
1928 
1929 	rc = smk_copy_relabel(&new_tsp->smk_relabel, &old_tsp->smk_relabel,
1930 				gfp);
1931 	return rc;
1932 }
1933 
1934 /**
1935  * smack_cred_transfer - Transfer the old credentials to the new credentials
1936  * @new: the new credentials
1937  * @old: the original credentials
1938  *
1939  * Fill in a set of blank credentials from another set of credentials.
1940  */
smack_cred_transfer(struct cred * new,const struct cred * old)1941 static void smack_cred_transfer(struct cred *new, const struct cred *old)
1942 {
1943 	struct task_smack *old_tsp = smack_cred(old);
1944 	struct task_smack *new_tsp = smack_cred(new);
1945 
1946 	new_tsp->smk_task = old_tsp->smk_task;
1947 	new_tsp->smk_forked = old_tsp->smk_task;
1948 	mutex_init(&new_tsp->smk_rules_lock);
1949 	INIT_LIST_HEAD(&new_tsp->smk_rules);
1950 
1951 	/* cbs copy rule list */
1952 }
1953 
1954 /**
1955  * smack_cred_getsecid - get the secid corresponding to a creds structure
1956  * @cred: the object creds
1957  * @secid: where to put the result
1958  *
1959  * Sets the secid to contain a u32 version of the smack label.
1960  */
smack_cred_getsecid(const struct cred * cred,u32 * secid)1961 static void smack_cred_getsecid(const struct cred *cred, u32 *secid)
1962 {
1963 	struct smack_known *skp;
1964 
1965 	rcu_read_lock();
1966 	skp = smk_of_task(smack_cred(cred));
1967 	*secid = skp->smk_secid;
1968 	rcu_read_unlock();
1969 }
1970 
1971 /**
1972  * smack_kernel_act_as - Set the subjective context in a set of credentials
1973  * @new: points to the set of credentials to be modified.
1974  * @secid: specifies the security ID to be set
1975  *
1976  * Set the security data for a kernel service.
1977  */
smack_kernel_act_as(struct cred * new,u32 secid)1978 static int smack_kernel_act_as(struct cred *new, u32 secid)
1979 {
1980 	struct task_smack *new_tsp = smack_cred(new);
1981 
1982 	new_tsp->smk_task = smack_from_secid(secid);
1983 	return 0;
1984 }
1985 
1986 /**
1987  * smack_kernel_create_files_as - Set the file creation label in a set of creds
1988  * @new: points to the set of credentials to be modified
1989  * @inode: points to the inode to use as a reference
1990  *
1991  * Set the file creation context in a set of credentials to the same
1992  * as the objective context of the specified inode
1993  */
smack_kernel_create_files_as(struct cred * new,struct inode * inode)1994 static int smack_kernel_create_files_as(struct cred *new,
1995 					struct inode *inode)
1996 {
1997 	struct inode_smack *isp = smack_inode(inode);
1998 	struct task_smack *tsp = smack_cred(new);
1999 
2000 	tsp->smk_forked = isp->smk_inode;
2001 	tsp->smk_task = tsp->smk_forked;
2002 	return 0;
2003 }
2004 
2005 /**
2006  * smk_curacc_on_task - helper to log task related access
2007  * @p: the task object
2008  * @access: the access requested
2009  * @caller: name of the calling function for audit
2010  *
2011  * Return 0 if access is permitted
2012  */
smk_curacc_on_task(struct task_struct * p,int access,const char * caller)2013 static int smk_curacc_on_task(struct task_struct *p, int access,
2014 				const char *caller)
2015 {
2016 	struct smk_audit_info ad;
2017 	struct smack_known *skp = smk_of_task_struct_obj(p);
2018 	int rc;
2019 
2020 	smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
2021 	smk_ad_setfield_u_tsk(&ad, p);
2022 	rc = smk_curacc(skp, access, &ad);
2023 	rc = smk_bu_task(p, access, rc);
2024 	return rc;
2025 }
2026 
2027 /**
2028  * smack_task_setpgid - Smack check on setting pgid
2029  * @p: the task object
2030  * @pgid: unused
2031  *
2032  * Return 0 if write access is permitted
2033  */
smack_task_setpgid(struct task_struct * p,pid_t pgid)2034 static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
2035 {
2036 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
2037 }
2038 
2039 /**
2040  * smack_task_getpgid - Smack access check for getpgid
2041  * @p: the object task
2042  *
2043  * Returns 0 if current can read the object task, error code otherwise
2044  */
smack_task_getpgid(struct task_struct * p)2045 static int smack_task_getpgid(struct task_struct *p)
2046 {
2047 	return smk_curacc_on_task(p, MAY_READ, __func__);
2048 }
2049 
2050 /**
2051  * smack_task_getsid - Smack access check for getsid
2052  * @p: the object task
2053  *
2054  * Returns 0 if current can read the object task, error code otherwise
2055  */
smack_task_getsid(struct task_struct * p)2056 static int smack_task_getsid(struct task_struct *p)
2057 {
2058 	return smk_curacc_on_task(p, MAY_READ, __func__);
2059 }
2060 
2061 /**
2062  * smack_current_getsecid_subj - get the subjective secid of the current task
2063  * @secid: where to put the result
2064  *
2065  * Sets the secid to contain a u32 version of the task's subjective smack label.
2066  */
smack_current_getsecid_subj(u32 * secid)2067 static void smack_current_getsecid_subj(u32 *secid)
2068 {
2069 	struct smack_known *skp = smk_of_current();
2070 
2071 	*secid = skp->smk_secid;
2072 }
2073 
2074 /**
2075  * smack_task_getsecid_obj - get the objective secid of the task
2076  * @p: the task
2077  * @secid: where to put the result
2078  *
2079  * Sets the secid to contain a u32 version of the task's objective smack label.
2080  */
smack_task_getsecid_obj(struct task_struct * p,u32 * secid)2081 static void smack_task_getsecid_obj(struct task_struct *p, u32 *secid)
2082 {
2083 	struct smack_known *skp = smk_of_task_struct_obj(p);
2084 
2085 	*secid = skp->smk_secid;
2086 }
2087 
2088 /**
2089  * smack_task_setnice - Smack check on setting nice
2090  * @p: the task object
2091  * @nice: unused
2092  *
2093  * Return 0 if write access is permitted
2094  */
smack_task_setnice(struct task_struct * p,int nice)2095 static int smack_task_setnice(struct task_struct *p, int nice)
2096 {
2097 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
2098 }
2099 
2100 /**
2101  * smack_task_setioprio - Smack check on setting ioprio
2102  * @p: the task object
2103  * @ioprio: unused
2104  *
2105  * Return 0 if write access is permitted
2106  */
smack_task_setioprio(struct task_struct * p,int ioprio)2107 static int smack_task_setioprio(struct task_struct *p, int ioprio)
2108 {
2109 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
2110 }
2111 
2112 /**
2113  * smack_task_getioprio - Smack check on reading ioprio
2114  * @p: the task object
2115  *
2116  * Return 0 if read access is permitted
2117  */
smack_task_getioprio(struct task_struct * p)2118 static int smack_task_getioprio(struct task_struct *p)
2119 {
2120 	return smk_curacc_on_task(p, MAY_READ, __func__);
2121 }
2122 
2123 /**
2124  * smack_task_setscheduler - Smack check on setting scheduler
2125  * @p: the task object
2126  *
2127  * Return 0 if read access is permitted
2128  */
smack_task_setscheduler(struct task_struct * p)2129 static int smack_task_setscheduler(struct task_struct *p)
2130 {
2131 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
2132 }
2133 
2134 /**
2135  * smack_task_getscheduler - Smack check on reading scheduler
2136  * @p: the task object
2137  *
2138  * Return 0 if read access is permitted
2139  */
smack_task_getscheduler(struct task_struct * p)2140 static int smack_task_getscheduler(struct task_struct *p)
2141 {
2142 	return smk_curacc_on_task(p, MAY_READ, __func__);
2143 }
2144 
2145 /**
2146  * smack_task_movememory - Smack check on moving memory
2147  * @p: the task object
2148  *
2149  * Return 0 if write access is permitted
2150  */
smack_task_movememory(struct task_struct * p)2151 static int smack_task_movememory(struct task_struct *p)
2152 {
2153 	return smk_curacc_on_task(p, MAY_WRITE, __func__);
2154 }
2155 
2156 /**
2157  * smack_task_kill - Smack check on signal delivery
2158  * @p: the task object
2159  * @info: unused
2160  * @sig: unused
2161  * @cred: identifies the cred to use in lieu of current's
2162  *
2163  * Return 0 if write access is permitted
2164  *
2165  */
smack_task_kill(struct task_struct * p,struct kernel_siginfo * info,int sig,const struct cred * cred)2166 static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info,
2167 			   int sig, const struct cred *cred)
2168 {
2169 	struct smk_audit_info ad;
2170 	struct smack_known *skp;
2171 	struct smack_known *tkp = smk_of_task_struct_obj(p);
2172 	int rc;
2173 
2174 	if (!sig)
2175 		return 0; /* null signal; existence test */
2176 
2177 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
2178 	smk_ad_setfield_u_tsk(&ad, p);
2179 	/*
2180 	 * Sending a signal requires that the sender
2181 	 * can write the receiver.
2182 	 */
2183 	if (cred == NULL) {
2184 		rc = smk_curacc(tkp, MAY_DELIVER, &ad);
2185 		rc = smk_bu_task(p, MAY_DELIVER, rc);
2186 		return rc;
2187 	}
2188 	/*
2189 	 * If the cred isn't NULL we're dealing with some USB IO
2190 	 * specific behavior. This is not clean. For one thing
2191 	 * we can't take privilege into account.
2192 	 */
2193 	skp = smk_of_task(smack_cred(cred));
2194 	rc = smk_access(skp, tkp, MAY_DELIVER, &ad);
2195 	rc = smk_bu_note("USB signal", skp, tkp, MAY_DELIVER, rc);
2196 	return rc;
2197 }
2198 
2199 /**
2200  * smack_task_to_inode - copy task smack into the inode blob
2201  * @p: task to copy from
2202  * @inode: inode to copy to
2203  *
2204  * Sets the smack pointer in the inode security blob
2205  */
smack_task_to_inode(struct task_struct * p,struct inode * inode)2206 static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
2207 {
2208 	struct inode_smack *isp = smack_inode(inode);
2209 	struct smack_known *skp = smk_of_task_struct_obj(p);
2210 
2211 	isp->smk_inode = skp;
2212 	isp->smk_flags |= SMK_INODE_INSTANT;
2213 }
2214 
2215 /*
2216  * Socket hooks.
2217  */
2218 
2219 /**
2220  * smack_sk_alloc_security - Allocate a socket blob
2221  * @sk: the socket
2222  * @family: unused
2223  * @gfp_flags: memory allocation flags
2224  *
2225  * Assign Smack pointers to current
2226  *
2227  * Returns 0 on success, -ENOMEM is there's no memory
2228  */
smack_sk_alloc_security(struct sock * sk,int family,gfp_t gfp_flags)2229 static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags)
2230 {
2231 	struct smack_known *skp = smk_of_current();
2232 	struct socket_smack *ssp;
2233 
2234 	ssp = kzalloc(sizeof(struct socket_smack), gfp_flags);
2235 	if (ssp == NULL)
2236 		return -ENOMEM;
2237 
2238 	/*
2239 	 * Sockets created by kernel threads receive web label.
2240 	 */
2241 	if (unlikely(current->flags & PF_KTHREAD)) {
2242 		ssp->smk_in = &smack_known_web;
2243 		ssp->smk_out = &smack_known_web;
2244 	} else {
2245 		ssp->smk_in = skp;
2246 		ssp->smk_out = skp;
2247 	}
2248 	ssp->smk_packet = NULL;
2249 
2250 	sk->sk_security = ssp;
2251 
2252 	return 0;
2253 }
2254 
2255 /**
2256  * smack_sk_free_security - Free a socket blob
2257  * @sk: the socket
2258  *
2259  * Clears the blob pointer
2260  */
smack_sk_free_security(struct sock * sk)2261 static void smack_sk_free_security(struct sock *sk)
2262 {
2263 #ifdef SMACK_IPV6_PORT_LABELING
2264 	struct smk_port_label *spp;
2265 
2266 	if (sk->sk_family == PF_INET6) {
2267 		rcu_read_lock();
2268 		list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2269 			if (spp->smk_sock != sk)
2270 				continue;
2271 			spp->smk_can_reuse = 1;
2272 			break;
2273 		}
2274 		rcu_read_unlock();
2275 	}
2276 #endif
2277 	kfree(sk->sk_security);
2278 }
2279 
2280 /**
2281  * smack_sk_clone_security - Copy security context
2282  * @sk: the old socket
2283  * @newsk: the new socket
2284  *
2285  * Copy the security context of the old socket pointer to the cloned
2286  */
smack_sk_clone_security(const struct sock * sk,struct sock * newsk)2287 static void smack_sk_clone_security(const struct sock *sk, struct sock *newsk)
2288 {
2289 	struct socket_smack *ssp_old = sk->sk_security;
2290 	struct socket_smack *ssp_new = newsk->sk_security;
2291 
2292 	*ssp_new = *ssp_old;
2293 }
2294 
2295 /**
2296 * smack_ipv4host_label - check host based restrictions
2297 * @sip: the object end
2298 *
2299 * looks for host based access restrictions
2300 *
2301 * This version will only be appropriate for really small sets of single label
2302 * hosts.  The caller is responsible for ensuring that the RCU read lock is
2303 * taken before calling this function.
2304 *
2305 * Returns the label of the far end or NULL if it's not special.
2306 */
smack_ipv4host_label(struct sockaddr_in * sip)2307 static struct smack_known *smack_ipv4host_label(struct sockaddr_in *sip)
2308 {
2309 	struct smk_net4addr *snp;
2310 	struct in_addr *siap = &sip->sin_addr;
2311 
2312 	if (siap->s_addr == 0)
2313 		return NULL;
2314 
2315 	list_for_each_entry_rcu(snp, &smk_net4addr_list, list)
2316 		/*
2317 		 * we break after finding the first match because
2318 		 * the list is sorted from longest to shortest mask
2319 		 * so we have found the most specific match
2320 		 */
2321 		if (snp->smk_host.s_addr ==
2322 		    (siap->s_addr & snp->smk_mask.s_addr))
2323 			return snp->smk_label;
2324 
2325 	return NULL;
2326 }
2327 
2328 /*
2329  * smk_ipv6_localhost - Check for local ipv6 host address
2330  * @sip: the address
2331  *
2332  * Returns boolean true if this is the localhost address
2333  */
smk_ipv6_localhost(struct sockaddr_in6 * sip)2334 static bool smk_ipv6_localhost(struct sockaddr_in6 *sip)
2335 {
2336 	__be16 *be16p = (__be16 *)&sip->sin6_addr;
2337 	__be32 *be32p = (__be32 *)&sip->sin6_addr;
2338 
2339 	if (be32p[0] == 0 && be32p[1] == 0 && be32p[2] == 0 && be16p[6] == 0 &&
2340 	    ntohs(be16p[7]) == 1)
2341 		return true;
2342 	return false;
2343 }
2344 
2345 /**
2346 * smack_ipv6host_label - check host based restrictions
2347 * @sip: the object end
2348 *
2349 * looks for host based access restrictions
2350 *
2351 * This version will only be appropriate for really small sets of single label
2352 * hosts.  The caller is responsible for ensuring that the RCU read lock is
2353 * taken before calling this function.
2354 *
2355 * Returns the label of the far end or NULL if it's not special.
2356 */
smack_ipv6host_label(struct sockaddr_in6 * sip)2357 static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip)
2358 {
2359 	struct smk_net6addr *snp;
2360 	struct in6_addr *sap = &sip->sin6_addr;
2361 	int i;
2362 	int found = 0;
2363 
2364 	/*
2365 	 * It's local. Don't look for a host label.
2366 	 */
2367 	if (smk_ipv6_localhost(sip))
2368 		return NULL;
2369 
2370 	list_for_each_entry_rcu(snp, &smk_net6addr_list, list) {
2371 		/*
2372 		 * If the label is NULL the entry has
2373 		 * been renounced. Ignore it.
2374 		 */
2375 		if (snp->smk_label == NULL)
2376 			continue;
2377 		/*
2378 		* we break after finding the first match because
2379 		* the list is sorted from longest to shortest mask
2380 		* so we have found the most specific match
2381 		*/
2382 		for (found = 1, i = 0; i < 8; i++) {
2383 			if ((sap->s6_addr16[i] & snp->smk_mask.s6_addr16[i]) !=
2384 			    snp->smk_host.s6_addr16[i]) {
2385 				found = 0;
2386 				break;
2387 			}
2388 		}
2389 		if (found)
2390 			return snp->smk_label;
2391 	}
2392 
2393 	return NULL;
2394 }
2395 
2396 /**
2397  * smack_netlbl_add - Set the secattr on a socket
2398  * @sk: the socket
2399  *
2400  * Attach the outbound smack value (smk_out) to the socket.
2401  *
2402  * Returns 0 on success or an error code
2403  */
smack_netlbl_add(struct sock * sk)2404 static int smack_netlbl_add(struct sock *sk)
2405 {
2406 	struct socket_smack *ssp = sk->sk_security;
2407 	struct smack_known *skp = ssp->smk_out;
2408 	int rc;
2409 
2410 	local_bh_disable();
2411 	bh_lock_sock_nested(sk);
2412 
2413 	rc = netlbl_sock_setattr(sk, sk->sk_family, &skp->smk_netlabel);
2414 	switch (rc) {
2415 	case 0:
2416 		ssp->smk_state = SMK_NETLBL_LABELED;
2417 		break;
2418 	case -EDESTADDRREQ:
2419 		ssp->smk_state = SMK_NETLBL_REQSKB;
2420 		rc = 0;
2421 		break;
2422 	}
2423 
2424 	bh_unlock_sock(sk);
2425 	local_bh_enable();
2426 
2427 	return rc;
2428 }
2429 
2430 /**
2431  * smack_netlbl_delete - Remove the secattr from a socket
2432  * @sk: the socket
2433  *
2434  * Remove the outbound smack value from a socket
2435  */
smack_netlbl_delete(struct sock * sk)2436 static void smack_netlbl_delete(struct sock *sk)
2437 {
2438 	struct socket_smack *ssp = sk->sk_security;
2439 
2440 	/*
2441 	 * Take the label off the socket if one is set.
2442 	 */
2443 	if (ssp->smk_state != SMK_NETLBL_LABELED)
2444 		return;
2445 
2446 	local_bh_disable();
2447 	bh_lock_sock_nested(sk);
2448 	netlbl_sock_delattr(sk);
2449 	bh_unlock_sock(sk);
2450 	local_bh_enable();
2451 	ssp->smk_state = SMK_NETLBL_UNLABELED;
2452 }
2453 
2454 /**
2455  * smk_ipv4_check - Perform IPv4 host access checks
2456  * @sk: the socket
2457  * @sap: the destination address
2458  *
2459  * Set the correct secattr for the given socket based on the destination
2460  * address and perform any outbound access checks needed.
2461  *
2462  * Returns 0 on success or an error code.
2463  *
2464  */
smk_ipv4_check(struct sock * sk,struct sockaddr_in * sap)2465 static int smk_ipv4_check(struct sock *sk, struct sockaddr_in *sap)
2466 {
2467 	struct smack_known *skp;
2468 	int rc = 0;
2469 	struct smack_known *hkp;
2470 	struct socket_smack *ssp = sk->sk_security;
2471 	struct smk_audit_info ad;
2472 
2473 	rcu_read_lock();
2474 	hkp = smack_ipv4host_label(sap);
2475 	if (hkp != NULL) {
2476 #ifdef CONFIG_AUDIT
2477 		struct lsm_network_audit net;
2478 
2479 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2480 		ad.a.u.net->family = sap->sin_family;
2481 		ad.a.u.net->dport = sap->sin_port;
2482 		ad.a.u.net->v4info.daddr = sap->sin_addr.s_addr;
2483 #endif
2484 		skp = ssp->smk_out;
2485 		rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2486 		rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2487 		/*
2488 		 * Clear the socket netlabel if it's set.
2489 		 */
2490 		if (!rc)
2491 			smack_netlbl_delete(sk);
2492 	}
2493 	rcu_read_unlock();
2494 
2495 	return rc;
2496 }
2497 
2498 /**
2499  * smk_ipv6_check - check Smack access
2500  * @subject: subject Smack label
2501  * @object: object Smack label
2502  * @address: address
2503  * @act: the action being taken
2504  *
2505  * Check an IPv6 access
2506  */
smk_ipv6_check(struct smack_known * subject,struct smack_known * object,struct sockaddr_in6 * address,int act)2507 static int smk_ipv6_check(struct smack_known *subject,
2508 				struct smack_known *object,
2509 				struct sockaddr_in6 *address, int act)
2510 {
2511 #ifdef CONFIG_AUDIT
2512 	struct lsm_network_audit net;
2513 #endif
2514 	struct smk_audit_info ad;
2515 	int rc;
2516 
2517 #ifdef CONFIG_AUDIT
2518 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
2519 	ad.a.u.net->family = PF_INET6;
2520 	ad.a.u.net->dport = address->sin6_port;
2521 	if (act == SMK_RECEIVING)
2522 		ad.a.u.net->v6info.saddr = address->sin6_addr;
2523 	else
2524 		ad.a.u.net->v6info.daddr = address->sin6_addr;
2525 #endif
2526 	rc = smk_access(subject, object, MAY_WRITE, &ad);
2527 	rc = smk_bu_note("IPv6 check", subject, object, MAY_WRITE, rc);
2528 	return rc;
2529 }
2530 
2531 #ifdef SMACK_IPV6_PORT_LABELING
2532 /**
2533  * smk_ipv6_port_label - Smack port access table management
2534  * @sock: socket
2535  * @address: address
2536  *
2537  * Create or update the port list entry
2538  */
smk_ipv6_port_label(struct socket * sock,struct sockaddr * address)2539 static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address)
2540 {
2541 	struct sock *sk = sock->sk;
2542 	struct sockaddr_in6 *addr6;
2543 	struct socket_smack *ssp = sock->sk->sk_security;
2544 	struct smk_port_label *spp;
2545 	unsigned short port = 0;
2546 
2547 	if (address == NULL) {
2548 		/*
2549 		 * This operation is changing the Smack information
2550 		 * on the bound socket. Take the changes to the port
2551 		 * as well.
2552 		 */
2553 		rcu_read_lock();
2554 		list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2555 			if (sk != spp->smk_sock)
2556 				continue;
2557 			spp->smk_in = ssp->smk_in;
2558 			spp->smk_out = ssp->smk_out;
2559 			rcu_read_unlock();
2560 			return;
2561 		}
2562 		/*
2563 		 * A NULL address is only used for updating existing
2564 		 * bound entries. If there isn't one, it's OK.
2565 		 */
2566 		rcu_read_unlock();
2567 		return;
2568 	}
2569 
2570 	addr6 = (struct sockaddr_in6 *)address;
2571 	port = ntohs(addr6->sin6_port);
2572 	/*
2573 	 * This is a special case that is safely ignored.
2574 	 */
2575 	if (port == 0)
2576 		return;
2577 
2578 	/*
2579 	 * Look for an existing port list entry.
2580 	 * This is an indication that a port is getting reused.
2581 	 */
2582 	rcu_read_lock();
2583 	list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2584 		if (spp->smk_port != port || spp->smk_sock_type != sock->type)
2585 			continue;
2586 		if (spp->smk_can_reuse != 1) {
2587 			rcu_read_unlock();
2588 			return;
2589 		}
2590 		spp->smk_port = port;
2591 		spp->smk_sock = sk;
2592 		spp->smk_in = ssp->smk_in;
2593 		spp->smk_out = ssp->smk_out;
2594 		spp->smk_can_reuse = 0;
2595 		rcu_read_unlock();
2596 		return;
2597 	}
2598 	rcu_read_unlock();
2599 	/*
2600 	 * A new port entry is required.
2601 	 */
2602 	spp = kzalloc(sizeof(*spp), GFP_KERNEL);
2603 	if (spp == NULL)
2604 		return;
2605 
2606 	spp->smk_port = port;
2607 	spp->smk_sock = sk;
2608 	spp->smk_in = ssp->smk_in;
2609 	spp->smk_out = ssp->smk_out;
2610 	spp->smk_sock_type = sock->type;
2611 	spp->smk_can_reuse = 0;
2612 
2613 	mutex_lock(&smack_ipv6_lock);
2614 	list_add_rcu(&spp->list, &smk_ipv6_port_list);
2615 	mutex_unlock(&smack_ipv6_lock);
2616 	return;
2617 }
2618 
2619 /**
2620  * smk_ipv6_port_check - check Smack port access
2621  * @sk: socket
2622  * @address: address
2623  * @act: the action being taken
2624  *
2625  * Create or update the port list entry
2626  */
smk_ipv6_port_check(struct sock * sk,struct sockaddr_in6 * address,int act)2627 static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2628 				int act)
2629 {
2630 	struct smk_port_label *spp;
2631 	struct socket_smack *ssp = sk->sk_security;
2632 	struct smack_known *skp = NULL;
2633 	unsigned short port;
2634 	struct smack_known *object;
2635 
2636 	if (act == SMK_RECEIVING) {
2637 		skp = smack_ipv6host_label(address);
2638 		object = ssp->smk_in;
2639 	} else {
2640 		skp = ssp->smk_out;
2641 		object = smack_ipv6host_label(address);
2642 	}
2643 
2644 	/*
2645 	 * The other end is a single label host.
2646 	 */
2647 	if (skp != NULL && object != NULL)
2648 		return smk_ipv6_check(skp, object, address, act);
2649 	if (skp == NULL)
2650 		skp = smack_net_ambient;
2651 	if (object == NULL)
2652 		object = smack_net_ambient;
2653 
2654 	/*
2655 	 * It's remote, so port lookup does no good.
2656 	 */
2657 	if (!smk_ipv6_localhost(address))
2658 		return smk_ipv6_check(skp, object, address, act);
2659 
2660 	/*
2661 	 * It's local so the send check has to have passed.
2662 	 */
2663 	if (act == SMK_RECEIVING)
2664 		return 0;
2665 
2666 	port = ntohs(address->sin6_port);
2667 	rcu_read_lock();
2668 	list_for_each_entry_rcu(spp, &smk_ipv6_port_list, list) {
2669 		if (spp->smk_port != port || spp->smk_sock_type != sk->sk_type)
2670 			continue;
2671 		object = spp->smk_in;
2672 		if (act == SMK_CONNECTING)
2673 			ssp->smk_packet = spp->smk_out;
2674 		break;
2675 	}
2676 	rcu_read_unlock();
2677 
2678 	return smk_ipv6_check(skp, object, address, act);
2679 }
2680 #endif
2681 
2682 /**
2683  * smack_inode_setsecurity - set smack xattrs
2684  * @inode: the object
2685  * @name: attribute name
2686  * @value: attribute value
2687  * @size: size of the attribute
2688  * @flags: unused
2689  *
2690  * Sets the named attribute in the appropriate blob
2691  *
2692  * Returns 0 on success, or an error code
2693  */
smack_inode_setsecurity(struct inode * inode,const char * name,const void * value,size_t size,int flags)2694 static int smack_inode_setsecurity(struct inode *inode, const char *name,
2695 				   const void *value, size_t size, int flags)
2696 {
2697 	struct smack_known *skp;
2698 	struct inode_smack *nsp = smack_inode(inode);
2699 	struct socket_smack *ssp;
2700 	struct socket *sock;
2701 	int rc = 0;
2702 
2703 	if (value == NULL || size > SMK_LONGLABEL || size == 0)
2704 		return -EINVAL;
2705 
2706 	skp = smk_import_entry(value, size);
2707 	if (IS_ERR(skp))
2708 		return PTR_ERR(skp);
2709 
2710 	if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2711 		nsp->smk_inode = skp;
2712 		nsp->smk_flags |= SMK_INODE_INSTANT;
2713 		return 0;
2714 	}
2715 	/*
2716 	 * The rest of the Smack xattrs are only on sockets.
2717 	 */
2718 	if (inode->i_sb->s_magic != SOCKFS_MAGIC)
2719 		return -EOPNOTSUPP;
2720 
2721 	sock = SOCKET_I(inode);
2722 	if (sock == NULL || sock->sk == NULL)
2723 		return -EOPNOTSUPP;
2724 
2725 	ssp = sock->sk->sk_security;
2726 
2727 	if (strcmp(name, XATTR_SMACK_IPIN) == 0)
2728 		ssp->smk_in = skp;
2729 	else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) {
2730 		ssp->smk_out = skp;
2731 		if (sock->sk->sk_family == PF_INET) {
2732 			rc = smack_netlbl_add(sock->sk);
2733 			if (rc != 0)
2734 				printk(KERN_WARNING
2735 					"Smack: \"%s\" netlbl error %d.\n",
2736 					__func__, -rc);
2737 		}
2738 	} else
2739 		return -EOPNOTSUPP;
2740 
2741 #ifdef SMACK_IPV6_PORT_LABELING
2742 	if (sock->sk->sk_family == PF_INET6)
2743 		smk_ipv6_port_label(sock, NULL);
2744 #endif
2745 
2746 	return 0;
2747 }
2748 
2749 /**
2750  * smack_socket_post_create - finish socket setup
2751  * @sock: the socket
2752  * @family: protocol family
2753  * @type: unused
2754  * @protocol: unused
2755  * @kern: unused
2756  *
2757  * Sets the netlabel information on the socket
2758  *
2759  * Returns 0 on success, and error code otherwise
2760  */
smack_socket_post_create(struct socket * sock,int family,int type,int protocol,int kern)2761 static int smack_socket_post_create(struct socket *sock, int family,
2762 				    int type, int protocol, int kern)
2763 {
2764 	struct socket_smack *ssp;
2765 
2766 	if (sock->sk == NULL)
2767 		return 0;
2768 
2769 	/*
2770 	 * Sockets created by kernel threads receive web label.
2771 	 */
2772 	if (unlikely(current->flags & PF_KTHREAD)) {
2773 		ssp = sock->sk->sk_security;
2774 		ssp->smk_in = &smack_known_web;
2775 		ssp->smk_out = &smack_known_web;
2776 	}
2777 
2778 	if (family != PF_INET)
2779 		return 0;
2780 	/*
2781 	 * Set the outbound netlbl.
2782 	 */
2783 	return smack_netlbl_add(sock->sk);
2784 }
2785 
2786 /**
2787  * smack_socket_socketpair - create socket pair
2788  * @socka: one socket
2789  * @sockb: another socket
2790  *
2791  * Cross reference the peer labels for SO_PEERSEC
2792  *
2793  * Returns 0
2794  */
smack_socket_socketpair(struct socket * socka,struct socket * sockb)2795 static int smack_socket_socketpair(struct socket *socka,
2796 		                   struct socket *sockb)
2797 {
2798 	struct socket_smack *asp = socka->sk->sk_security;
2799 	struct socket_smack *bsp = sockb->sk->sk_security;
2800 
2801 	asp->smk_packet = bsp->smk_out;
2802 	bsp->smk_packet = asp->smk_out;
2803 
2804 	return 0;
2805 }
2806 
2807 #ifdef SMACK_IPV6_PORT_LABELING
2808 /**
2809  * smack_socket_bind - record port binding information.
2810  * @sock: the socket
2811  * @address: the port address
2812  * @addrlen: size of the address
2813  *
2814  * Records the label bound to a port.
2815  *
2816  * Returns 0 on success, and error code otherwise
2817  */
smack_socket_bind(struct socket * sock,struct sockaddr * address,int addrlen)2818 static int smack_socket_bind(struct socket *sock, struct sockaddr *address,
2819 				int addrlen)
2820 {
2821 	if (sock->sk != NULL && sock->sk->sk_family == PF_INET6) {
2822 		if (addrlen < SIN6_LEN_RFC2133 ||
2823 		    address->sa_family != AF_INET6)
2824 			return -EINVAL;
2825 		smk_ipv6_port_label(sock, address);
2826 	}
2827 	return 0;
2828 }
2829 #endif /* SMACK_IPV6_PORT_LABELING */
2830 
2831 /**
2832  * smack_socket_connect - connect access check
2833  * @sock: the socket
2834  * @sap: the other end
2835  * @addrlen: size of sap
2836  *
2837  * Verifies that a connection may be possible
2838  *
2839  * Returns 0 on success, and error code otherwise
2840  */
smack_socket_connect(struct socket * sock,struct sockaddr * sap,int addrlen)2841 static int smack_socket_connect(struct socket *sock, struct sockaddr *sap,
2842 				int addrlen)
2843 {
2844 	int rc = 0;
2845 
2846 	if (sock->sk == NULL)
2847 		return 0;
2848 	if (sock->sk->sk_family != PF_INET &&
2849 	    (!IS_ENABLED(CONFIG_IPV6) || sock->sk->sk_family != PF_INET6))
2850 		return 0;
2851 	if (addrlen < offsetofend(struct sockaddr, sa_family))
2852 		return 0;
2853 	if (IS_ENABLED(CONFIG_IPV6) && sap->sa_family == AF_INET6) {
2854 		struct sockaddr_in6 *sip = (struct sockaddr_in6 *)sap;
2855 		struct smack_known *rsp = NULL;
2856 
2857 		if (addrlen < SIN6_LEN_RFC2133)
2858 			return 0;
2859 		if (__is_defined(SMACK_IPV6_SECMARK_LABELING))
2860 			rsp = smack_ipv6host_label(sip);
2861 		if (rsp != NULL) {
2862 			struct socket_smack *ssp = sock->sk->sk_security;
2863 
2864 			rc = smk_ipv6_check(ssp->smk_out, rsp, sip,
2865 					    SMK_CONNECTING);
2866 		}
2867 #ifdef SMACK_IPV6_PORT_LABELING
2868 		rc = smk_ipv6_port_check(sock->sk, sip, SMK_CONNECTING);
2869 #endif
2870 
2871 		return rc;
2872 	}
2873 	if (sap->sa_family != AF_INET || addrlen < sizeof(struct sockaddr_in))
2874 		return 0;
2875 	rc = smk_ipv4_check(sock->sk, (struct sockaddr_in *)sap);
2876 	return rc;
2877 }
2878 
2879 /**
2880  * smack_flags_to_may - convert S_ to MAY_ values
2881  * @flags: the S_ value
2882  *
2883  * Returns the equivalent MAY_ value
2884  */
smack_flags_to_may(int flags)2885 static int smack_flags_to_may(int flags)
2886 {
2887 	int may = 0;
2888 
2889 	if (flags & S_IRUGO)
2890 		may |= MAY_READ;
2891 	if (flags & S_IWUGO)
2892 		may |= MAY_WRITE;
2893 	if (flags & S_IXUGO)
2894 		may |= MAY_EXEC;
2895 
2896 	return may;
2897 }
2898 
2899 /**
2900  * smack_msg_msg_alloc_security - Set the security blob for msg_msg
2901  * @msg: the object
2902  *
2903  * Returns 0
2904  */
smack_msg_msg_alloc_security(struct msg_msg * msg)2905 static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2906 {
2907 	struct smack_known **blob = smack_msg_msg(msg);
2908 
2909 	*blob = smk_of_current();
2910 	return 0;
2911 }
2912 
2913 /**
2914  * smack_of_ipc - the smack pointer for the ipc
2915  * @isp: the object
2916  *
2917  * Returns a pointer to the smack value
2918  */
smack_of_ipc(struct kern_ipc_perm * isp)2919 static struct smack_known *smack_of_ipc(struct kern_ipc_perm *isp)
2920 {
2921 	struct smack_known **blob = smack_ipc(isp);
2922 
2923 	return *blob;
2924 }
2925 
2926 /**
2927  * smack_ipc_alloc_security - Set the security blob for ipc
2928  * @isp: the object
2929  *
2930  * Returns 0
2931  */
smack_ipc_alloc_security(struct kern_ipc_perm * isp)2932 static int smack_ipc_alloc_security(struct kern_ipc_perm *isp)
2933 {
2934 	struct smack_known **blob = smack_ipc(isp);
2935 
2936 	*blob = smk_of_current();
2937 	return 0;
2938 }
2939 
2940 /**
2941  * smk_curacc_shm : check if current has access on shm
2942  * @isp : the object
2943  * @access : access requested
2944  *
2945  * Returns 0 if current has the requested access, error code otherwise
2946  */
smk_curacc_shm(struct kern_ipc_perm * isp,int access)2947 static int smk_curacc_shm(struct kern_ipc_perm *isp, int access)
2948 {
2949 	struct smack_known *ssp = smack_of_ipc(isp);
2950 	struct smk_audit_info ad;
2951 	int rc;
2952 
2953 #ifdef CONFIG_AUDIT
2954 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2955 	ad.a.u.ipc_id = isp->id;
2956 #endif
2957 	rc = smk_curacc(ssp, access, &ad);
2958 	rc = smk_bu_current("shm", ssp, access, rc);
2959 	return rc;
2960 }
2961 
2962 /**
2963  * smack_shm_associate - Smack access check for shm
2964  * @isp: the object
2965  * @shmflg: access requested
2966  *
2967  * Returns 0 if current has the requested access, error code otherwise
2968  */
smack_shm_associate(struct kern_ipc_perm * isp,int shmflg)2969 static int smack_shm_associate(struct kern_ipc_perm *isp, int shmflg)
2970 {
2971 	int may;
2972 
2973 	may = smack_flags_to_may(shmflg);
2974 	return smk_curacc_shm(isp, may);
2975 }
2976 
2977 /**
2978  * smack_shm_shmctl - Smack access check for shm
2979  * @isp: the object
2980  * @cmd: what it wants to do
2981  *
2982  * Returns 0 if current has the requested access, error code otherwise
2983  */
smack_shm_shmctl(struct kern_ipc_perm * isp,int cmd)2984 static int smack_shm_shmctl(struct kern_ipc_perm *isp, int cmd)
2985 {
2986 	int may;
2987 
2988 	switch (cmd) {
2989 	case IPC_STAT:
2990 	case SHM_STAT:
2991 	case SHM_STAT_ANY:
2992 		may = MAY_READ;
2993 		break;
2994 	case IPC_SET:
2995 	case SHM_LOCK:
2996 	case SHM_UNLOCK:
2997 	case IPC_RMID:
2998 		may = MAY_READWRITE;
2999 		break;
3000 	case IPC_INFO:
3001 	case SHM_INFO:
3002 		/*
3003 		 * System level information.
3004 		 */
3005 		return 0;
3006 	default:
3007 		return -EINVAL;
3008 	}
3009 	return smk_curacc_shm(isp, may);
3010 }
3011 
3012 /**
3013  * smack_shm_shmat - Smack access for shmat
3014  * @isp: the object
3015  * @shmaddr: unused
3016  * @shmflg: access requested
3017  *
3018  * Returns 0 if current has the requested access, error code otherwise
3019  */
smack_shm_shmat(struct kern_ipc_perm * isp,char __user * shmaddr,int shmflg)3020 static int smack_shm_shmat(struct kern_ipc_perm *isp, char __user *shmaddr,
3021 			   int shmflg)
3022 {
3023 	int may;
3024 
3025 	may = smack_flags_to_may(shmflg);
3026 	return smk_curacc_shm(isp, may);
3027 }
3028 
3029 /**
3030  * smk_curacc_sem : check if current has access on sem
3031  * @isp : the object
3032  * @access : access requested
3033  *
3034  * Returns 0 if current has the requested access, error code otherwise
3035  */
smk_curacc_sem(struct kern_ipc_perm * isp,int access)3036 static int smk_curacc_sem(struct kern_ipc_perm *isp, int access)
3037 {
3038 	struct smack_known *ssp = smack_of_ipc(isp);
3039 	struct smk_audit_info ad;
3040 	int rc;
3041 
3042 #ifdef CONFIG_AUDIT
3043 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3044 	ad.a.u.ipc_id = isp->id;
3045 #endif
3046 	rc = smk_curacc(ssp, access, &ad);
3047 	rc = smk_bu_current("sem", ssp, access, rc);
3048 	return rc;
3049 }
3050 
3051 /**
3052  * smack_sem_associate - Smack access check for sem
3053  * @isp: the object
3054  * @semflg: access requested
3055  *
3056  * Returns 0 if current has the requested access, error code otherwise
3057  */
smack_sem_associate(struct kern_ipc_perm * isp,int semflg)3058 static int smack_sem_associate(struct kern_ipc_perm *isp, int semflg)
3059 {
3060 	int may;
3061 
3062 	may = smack_flags_to_may(semflg);
3063 	return smk_curacc_sem(isp, may);
3064 }
3065 
3066 /**
3067  * smack_sem_semctl - Smack access check for sem
3068  * @isp: the object
3069  * @cmd: what it wants to do
3070  *
3071  * Returns 0 if current has the requested access, error code otherwise
3072  */
smack_sem_semctl(struct kern_ipc_perm * isp,int cmd)3073 static int smack_sem_semctl(struct kern_ipc_perm *isp, int cmd)
3074 {
3075 	int may;
3076 
3077 	switch (cmd) {
3078 	case GETPID:
3079 	case GETNCNT:
3080 	case GETZCNT:
3081 	case GETVAL:
3082 	case GETALL:
3083 	case IPC_STAT:
3084 	case SEM_STAT:
3085 	case SEM_STAT_ANY:
3086 		may = MAY_READ;
3087 		break;
3088 	case SETVAL:
3089 	case SETALL:
3090 	case IPC_RMID:
3091 	case IPC_SET:
3092 		may = MAY_READWRITE;
3093 		break;
3094 	case IPC_INFO:
3095 	case SEM_INFO:
3096 		/*
3097 		 * System level information
3098 		 */
3099 		return 0;
3100 	default:
3101 		return -EINVAL;
3102 	}
3103 
3104 	return smk_curacc_sem(isp, may);
3105 }
3106 
3107 /**
3108  * smack_sem_semop - Smack checks of semaphore operations
3109  * @isp: the object
3110  * @sops: unused
3111  * @nsops: unused
3112  * @alter: unused
3113  *
3114  * Treated as read and write in all cases.
3115  *
3116  * Returns 0 if access is allowed, error code otherwise
3117  */
smack_sem_semop(struct kern_ipc_perm * isp,struct sembuf * sops,unsigned nsops,int alter)3118 static int smack_sem_semop(struct kern_ipc_perm *isp, struct sembuf *sops,
3119 			   unsigned nsops, int alter)
3120 {
3121 	return smk_curacc_sem(isp, MAY_READWRITE);
3122 }
3123 
3124 /**
3125  * smk_curacc_msq : helper to check if current has access on msq
3126  * @isp : the msq
3127  * @access : access requested
3128  *
3129  * return 0 if current has access, error otherwise
3130  */
smk_curacc_msq(struct kern_ipc_perm * isp,int access)3131 static int smk_curacc_msq(struct kern_ipc_perm *isp, int access)
3132 {
3133 	struct smack_known *msp = smack_of_ipc(isp);
3134 	struct smk_audit_info ad;
3135 	int rc;
3136 
3137 #ifdef CONFIG_AUDIT
3138 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3139 	ad.a.u.ipc_id = isp->id;
3140 #endif
3141 	rc = smk_curacc(msp, access, &ad);
3142 	rc = smk_bu_current("msq", msp, access, rc);
3143 	return rc;
3144 }
3145 
3146 /**
3147  * smack_msg_queue_associate - Smack access check for msg_queue
3148  * @isp: the object
3149  * @msqflg: access requested
3150  *
3151  * Returns 0 if current has the requested access, error code otherwise
3152  */
smack_msg_queue_associate(struct kern_ipc_perm * isp,int msqflg)3153 static int smack_msg_queue_associate(struct kern_ipc_perm *isp, int msqflg)
3154 {
3155 	int may;
3156 
3157 	may = smack_flags_to_may(msqflg);
3158 	return smk_curacc_msq(isp, may);
3159 }
3160 
3161 /**
3162  * smack_msg_queue_msgctl - Smack access check for msg_queue
3163  * @isp: the object
3164  * @cmd: what it wants to do
3165  *
3166  * Returns 0 if current has the requested access, error code otherwise
3167  */
smack_msg_queue_msgctl(struct kern_ipc_perm * isp,int cmd)3168 static int smack_msg_queue_msgctl(struct kern_ipc_perm *isp, int cmd)
3169 {
3170 	int may;
3171 
3172 	switch (cmd) {
3173 	case IPC_STAT:
3174 	case MSG_STAT:
3175 	case MSG_STAT_ANY:
3176 		may = MAY_READ;
3177 		break;
3178 	case IPC_SET:
3179 	case IPC_RMID:
3180 		may = MAY_READWRITE;
3181 		break;
3182 	case IPC_INFO:
3183 	case MSG_INFO:
3184 		/*
3185 		 * System level information
3186 		 */
3187 		return 0;
3188 	default:
3189 		return -EINVAL;
3190 	}
3191 
3192 	return smk_curacc_msq(isp, may);
3193 }
3194 
3195 /**
3196  * smack_msg_queue_msgsnd - Smack access check for msg_queue
3197  * @isp: the object
3198  * @msg: unused
3199  * @msqflg: access requested
3200  *
3201  * Returns 0 if current has the requested access, error code otherwise
3202  */
smack_msg_queue_msgsnd(struct kern_ipc_perm * isp,struct msg_msg * msg,int msqflg)3203 static int smack_msg_queue_msgsnd(struct kern_ipc_perm *isp, struct msg_msg *msg,
3204 				  int msqflg)
3205 {
3206 	int may;
3207 
3208 	may = smack_flags_to_may(msqflg);
3209 	return smk_curacc_msq(isp, may);
3210 }
3211 
3212 /**
3213  * smack_msg_queue_msgrcv - Smack access check for msg_queue
3214  * @isp: the object
3215  * @msg: unused
3216  * @target: unused
3217  * @type: unused
3218  * @mode: unused
3219  *
3220  * Returns 0 if current has read and write access, error code otherwise
3221  */
smack_msg_queue_msgrcv(struct kern_ipc_perm * isp,struct msg_msg * msg,struct task_struct * target,long type,int mode)3222 static int smack_msg_queue_msgrcv(struct kern_ipc_perm *isp,
3223 				  struct msg_msg *msg,
3224 				  struct task_struct *target, long type,
3225 				  int mode)
3226 {
3227 	return smk_curacc_msq(isp, MAY_READWRITE);
3228 }
3229 
3230 /**
3231  * smack_ipc_permission - Smack access for ipc_permission()
3232  * @ipp: the object permissions
3233  * @flag: access requested
3234  *
3235  * Returns 0 if current has read and write access, error code otherwise
3236  */
smack_ipc_permission(struct kern_ipc_perm * ipp,short flag)3237 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
3238 {
3239 	struct smack_known **blob = smack_ipc(ipp);
3240 	struct smack_known *iskp = *blob;
3241 	int may = smack_flags_to_may(flag);
3242 	struct smk_audit_info ad;
3243 	int rc;
3244 
3245 #ifdef CONFIG_AUDIT
3246 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
3247 	ad.a.u.ipc_id = ipp->id;
3248 #endif
3249 	rc = smk_curacc(iskp, may, &ad);
3250 	rc = smk_bu_current("svipc", iskp, may, rc);
3251 	return rc;
3252 }
3253 
3254 /**
3255  * smack_ipc_getsecid - Extract smack security id
3256  * @ipp: the object permissions
3257  * @secid: where result will be saved
3258  */
smack_ipc_getsecid(struct kern_ipc_perm * ipp,u32 * secid)3259 static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
3260 {
3261 	struct smack_known **blob = smack_ipc(ipp);
3262 	struct smack_known *iskp = *blob;
3263 
3264 	*secid = iskp->smk_secid;
3265 }
3266 
3267 /**
3268  * smack_d_instantiate - Make sure the blob is correct on an inode
3269  * @opt_dentry: dentry where inode will be attached
3270  * @inode: the object
3271  *
3272  * Set the inode's security blob if it hasn't been done already.
3273  */
smack_d_instantiate(struct dentry * opt_dentry,struct inode * inode)3274 static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
3275 {
3276 	struct super_block *sbp;
3277 	struct superblock_smack *sbsp;
3278 	struct inode_smack *isp;
3279 	struct smack_known *skp;
3280 	struct smack_known *ckp = smk_of_current();
3281 	struct smack_known *final;
3282 	char trattr[TRANS_TRUE_SIZE];
3283 	int transflag = 0;
3284 	int rc;
3285 	struct dentry *dp;
3286 
3287 	if (inode == NULL)
3288 		return;
3289 
3290 	isp = smack_inode(inode);
3291 
3292 	/*
3293 	 * If the inode is already instantiated
3294 	 * take the quick way out
3295 	 */
3296 	if (isp->smk_flags & SMK_INODE_INSTANT)
3297 		return;
3298 
3299 	sbp = inode->i_sb;
3300 	sbsp = smack_superblock(sbp);
3301 	/*
3302 	 * We're going to use the superblock default label
3303 	 * if there's no label on the file.
3304 	 */
3305 	final = sbsp->smk_default;
3306 
3307 	/*
3308 	 * If this is the root inode the superblock
3309 	 * may be in the process of initialization.
3310 	 * If that is the case use the root value out
3311 	 * of the superblock.
3312 	 */
3313 	if (opt_dentry->d_parent == opt_dentry) {
3314 		switch (sbp->s_magic) {
3315 		case CGROUP_SUPER_MAGIC:
3316 		case CGROUP2_SUPER_MAGIC:
3317 			/*
3318 			 * The cgroup filesystem is never mounted,
3319 			 * so there's no opportunity to set the mount
3320 			 * options.
3321 			 */
3322 			sbsp->smk_root = &smack_known_star;
3323 			sbsp->smk_default = &smack_known_star;
3324 			isp->smk_inode = sbsp->smk_root;
3325 			break;
3326 		case TMPFS_MAGIC:
3327 			/*
3328 			 * What about shmem/tmpfs anonymous files with dentry
3329 			 * obtained from d_alloc_pseudo()?
3330 			 */
3331 			isp->smk_inode = smk_of_current();
3332 			break;
3333 		case PIPEFS_MAGIC:
3334 			isp->smk_inode = smk_of_current();
3335 			break;
3336 		case SOCKFS_MAGIC:
3337 			/*
3338 			 * Socket access is controlled by the socket
3339 			 * structures associated with the task involved.
3340 			 */
3341 			isp->smk_inode = &smack_known_star;
3342 			break;
3343 		default:
3344 			isp->smk_inode = sbsp->smk_root;
3345 			break;
3346 		}
3347 		isp->smk_flags |= SMK_INODE_INSTANT;
3348 		return;
3349 	}
3350 
3351 	/*
3352 	 * This is pretty hackish.
3353 	 * Casey says that we shouldn't have to do
3354 	 * file system specific code, but it does help
3355 	 * with keeping it simple.
3356 	 */
3357 	switch (sbp->s_magic) {
3358 	case SMACK_MAGIC:
3359 	case CGROUP_SUPER_MAGIC:
3360 	case CGROUP2_SUPER_MAGIC:
3361 		/*
3362 		 * Casey says that it's a little embarrassing
3363 		 * that the smack file system doesn't do
3364 		 * extended attributes.
3365 		 *
3366 		 * Cgroupfs is special
3367 		 */
3368 		final = &smack_known_star;
3369 		break;
3370 	case DEVPTS_SUPER_MAGIC:
3371 		/*
3372 		 * devpts seems content with the label of the task.
3373 		 * Programs that change smack have to treat the
3374 		 * pty with respect.
3375 		 */
3376 		final = ckp;
3377 		break;
3378 	case PROC_SUPER_MAGIC:
3379 		/*
3380 		 * Casey says procfs appears not to care.
3381 		 * The superblock default suffices.
3382 		 */
3383 		break;
3384 	case TMPFS_MAGIC:
3385 		/*
3386 		 * Device labels should come from the filesystem,
3387 		 * but watch out, because they're volitile,
3388 		 * getting recreated on every reboot.
3389 		 */
3390 		final = &smack_known_star;
3391 		/*
3392 		 * If a smack value has been set we want to use it,
3393 		 * but since tmpfs isn't giving us the opportunity
3394 		 * to set mount options simulate setting the
3395 		 * superblock default.
3396 		 */
3397 		fallthrough;
3398 	default:
3399 		/*
3400 		 * This isn't an understood special case.
3401 		 * Get the value from the xattr.
3402 		 */
3403 
3404 		/*
3405 		 * UNIX domain sockets use lower level socket data.
3406 		 */
3407 		if (S_ISSOCK(inode->i_mode)) {
3408 			final = &smack_known_star;
3409 			break;
3410 		}
3411 		/*
3412 		 * No xattr support means, alas, no SMACK label.
3413 		 * Use the aforeapplied default.
3414 		 * It would be curious if the label of the task
3415 		 * does not match that assigned.
3416 		 */
3417 		if (!(inode->i_opflags & IOP_XATTR))
3418 		        break;
3419 		/*
3420 		 * Get the dentry for xattr.
3421 		 */
3422 		dp = dget(opt_dentry);
3423 		skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
3424 		if (!IS_ERR_OR_NULL(skp))
3425 			final = skp;
3426 
3427 		/*
3428 		 * Transmuting directory
3429 		 */
3430 		if (S_ISDIR(inode->i_mode)) {
3431 			/*
3432 			 * If this is a new directory and the label was
3433 			 * transmuted when the inode was initialized
3434 			 * set the transmute attribute on the directory
3435 			 * and mark the inode.
3436 			 *
3437 			 * If there is a transmute attribute on the
3438 			 * directory mark the inode.
3439 			 */
3440 			if (isp->smk_flags & SMK_INODE_CHANGED) {
3441 				isp->smk_flags &= ~SMK_INODE_CHANGED;
3442 				rc = __vfs_setxattr(&init_user_ns, dp, inode,
3443 					XATTR_NAME_SMACKTRANSMUTE,
3444 					TRANS_TRUE, TRANS_TRUE_SIZE,
3445 					0);
3446 			} else {
3447 				rc = __vfs_getxattr(dp, inode,
3448 					XATTR_NAME_SMACKTRANSMUTE, trattr,
3449 					TRANS_TRUE_SIZE);
3450 				if (rc >= 0 && strncmp(trattr, TRANS_TRUE,
3451 						       TRANS_TRUE_SIZE) != 0)
3452 					rc = -EINVAL;
3453 			}
3454 			if (rc >= 0)
3455 				transflag = SMK_INODE_TRANSMUTE;
3456 		}
3457 		/*
3458 		 * Don't let the exec or mmap label be "*" or "@".
3459 		 */
3460 		skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
3461 		if (IS_ERR(skp) || skp == &smack_known_star ||
3462 		    skp == &smack_known_web)
3463 			skp = NULL;
3464 		isp->smk_task = skp;
3465 
3466 		skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
3467 		if (IS_ERR(skp) || skp == &smack_known_star ||
3468 		    skp == &smack_known_web)
3469 			skp = NULL;
3470 		isp->smk_mmap = skp;
3471 
3472 		dput(dp);
3473 		break;
3474 	}
3475 
3476 	if (final == NULL)
3477 		isp->smk_inode = ckp;
3478 	else
3479 		isp->smk_inode = final;
3480 
3481 	isp->smk_flags |= (SMK_INODE_INSTANT | transflag);
3482 
3483 	return;
3484 }
3485 
3486 /**
3487  * smack_getprocattr - Smack process attribute access
3488  * @p: the object task
3489  * @name: the name of the attribute in /proc/.../attr
3490  * @value: where to put the result
3491  *
3492  * Places a copy of the task Smack into value
3493  *
3494  * Returns the length of the smack label or an error code
3495  */
smack_getprocattr(struct task_struct * p,const char * name,char ** value)3496 static int smack_getprocattr(struct task_struct *p, const char *name, char **value)
3497 {
3498 	struct smack_known *skp = smk_of_task_struct_obj(p);
3499 	char *cp;
3500 	int slen;
3501 
3502 	if (strcmp(name, "current") != 0)
3503 		return -EINVAL;
3504 
3505 	cp = kstrdup(skp->smk_known, GFP_KERNEL);
3506 	if (cp == NULL)
3507 		return -ENOMEM;
3508 
3509 	slen = strlen(cp);
3510 	*value = cp;
3511 	return slen;
3512 }
3513 
3514 /**
3515  * smack_setprocattr - Smack process attribute setting
3516  * @name: the name of the attribute in /proc/.../attr
3517  * @value: the value to set
3518  * @size: the size of the value
3519  *
3520  * Sets the Smack value of the task. Only setting self
3521  * is permitted and only with privilege
3522  *
3523  * Returns the length of the smack label or an error code
3524  */
smack_setprocattr(const char * name,void * value,size_t size)3525 static int smack_setprocattr(const char *name, void *value, size_t size)
3526 {
3527 	struct task_smack *tsp = smack_cred(current_cred());
3528 	struct cred *new;
3529 	struct smack_known *skp;
3530 	struct smack_known_list_elem *sklep;
3531 	int rc;
3532 
3533 	if (!smack_privileged(CAP_MAC_ADMIN) && list_empty(&tsp->smk_relabel))
3534 		return -EPERM;
3535 
3536 	if (value == NULL || size == 0 || size >= SMK_LONGLABEL)
3537 		return -EINVAL;
3538 
3539 	if (strcmp(name, "current") != 0)
3540 		return -EINVAL;
3541 
3542 	skp = smk_import_entry(value, size);
3543 	if (IS_ERR(skp))
3544 		return PTR_ERR(skp);
3545 
3546 	/*
3547 	 * No process is ever allowed the web ("@") label
3548 	 * and the star ("*") label.
3549 	 */
3550 	if (skp == &smack_known_web || skp == &smack_known_star)
3551 		return -EINVAL;
3552 
3553 	if (!smack_privileged(CAP_MAC_ADMIN)) {
3554 		rc = -EPERM;
3555 		list_for_each_entry(sklep, &tsp->smk_relabel, list)
3556 			if (sklep->smk_label == skp) {
3557 				rc = 0;
3558 				break;
3559 			}
3560 		if (rc)
3561 			return rc;
3562 	}
3563 
3564 	new = prepare_creds();
3565 	if (new == NULL)
3566 		return -ENOMEM;
3567 
3568 	tsp = smack_cred(new);
3569 	tsp->smk_task = skp;
3570 	/*
3571 	 * process can change its label only once
3572 	 */
3573 	smk_destroy_label_list(&tsp->smk_relabel);
3574 
3575 	commit_creds(new);
3576 	return size;
3577 }
3578 
3579 /**
3580  * smack_unix_stream_connect - Smack access on UDS
3581  * @sock: one sock
3582  * @other: the other sock
3583  * @newsk: unused
3584  *
3585  * Return 0 if a subject with the smack of sock could access
3586  * an object with the smack of other, otherwise an error code
3587  */
smack_unix_stream_connect(struct sock * sock,struct sock * other,struct sock * newsk)3588 static int smack_unix_stream_connect(struct sock *sock,
3589 				     struct sock *other, struct sock *newsk)
3590 {
3591 	struct smack_known *skp;
3592 	struct smack_known *okp;
3593 	struct socket_smack *ssp = sock->sk_security;
3594 	struct socket_smack *osp = other->sk_security;
3595 	struct socket_smack *nsp = newsk->sk_security;
3596 	struct smk_audit_info ad;
3597 	int rc = 0;
3598 #ifdef CONFIG_AUDIT
3599 	struct lsm_network_audit net;
3600 #endif
3601 
3602 	if (!smack_privileged(CAP_MAC_OVERRIDE)) {
3603 		skp = ssp->smk_out;
3604 		okp = osp->smk_in;
3605 #ifdef CONFIG_AUDIT
3606 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3607 		smk_ad_setfield_u_net_sk(&ad, other);
3608 #endif
3609 		rc = smk_access(skp, okp, MAY_WRITE, &ad);
3610 		rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3611 		if (rc == 0) {
3612 			okp = osp->smk_out;
3613 			skp = ssp->smk_in;
3614 			rc = smk_access(okp, skp, MAY_WRITE, &ad);
3615 			rc = smk_bu_note("UDS connect", okp, skp,
3616 						MAY_WRITE, rc);
3617 		}
3618 	}
3619 
3620 	/*
3621 	 * Cross reference the peer labels for SO_PEERSEC.
3622 	 */
3623 	if (rc == 0) {
3624 		nsp->smk_packet = ssp->smk_out;
3625 		ssp->smk_packet = osp->smk_out;
3626 	}
3627 
3628 	return rc;
3629 }
3630 
3631 /**
3632  * smack_unix_may_send - Smack access on UDS
3633  * @sock: one socket
3634  * @other: the other socket
3635  *
3636  * Return 0 if a subject with the smack of sock could access
3637  * an object with the smack of other, otherwise an error code
3638  */
smack_unix_may_send(struct socket * sock,struct socket * other)3639 static int smack_unix_may_send(struct socket *sock, struct socket *other)
3640 {
3641 	struct socket_smack *ssp = sock->sk->sk_security;
3642 	struct socket_smack *osp = other->sk->sk_security;
3643 	struct smk_audit_info ad;
3644 	int rc;
3645 
3646 #ifdef CONFIG_AUDIT
3647 	struct lsm_network_audit net;
3648 
3649 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3650 	smk_ad_setfield_u_net_sk(&ad, other->sk);
3651 #endif
3652 
3653 	if (smack_privileged(CAP_MAC_OVERRIDE))
3654 		return 0;
3655 
3656 	rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3657 	rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3658 	return rc;
3659 }
3660 
3661 /**
3662  * smack_socket_sendmsg - Smack check based on destination host
3663  * @sock: the socket
3664  * @msg: the message
3665  * @size: the size of the message
3666  *
3667  * Return 0 if the current subject can write to the destination host.
3668  * For IPv4 this is only a question if the destination is a single label host.
3669  * For IPv6 this is a check against the label of the port.
3670  */
smack_socket_sendmsg(struct socket * sock,struct msghdr * msg,int size)3671 static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3672 				int size)
3673 {
3674 	struct sockaddr_in *sip = (struct sockaddr_in *) msg->msg_name;
3675 #if IS_ENABLED(CONFIG_IPV6)
3676 	struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name;
3677 #endif
3678 #ifdef SMACK_IPV6_SECMARK_LABELING
3679 	struct socket_smack *ssp = sock->sk->sk_security;
3680 	struct smack_known *rsp;
3681 #endif
3682 	int rc = 0;
3683 
3684 	/*
3685 	 * Perfectly reasonable for this to be NULL
3686 	 */
3687 	if (sip == NULL)
3688 		return 0;
3689 
3690 	switch (sock->sk->sk_family) {
3691 	case AF_INET:
3692 		if (msg->msg_namelen < sizeof(struct sockaddr_in) ||
3693 		    sip->sin_family != AF_INET)
3694 			return -EINVAL;
3695 		rc = smk_ipv4_check(sock->sk, sip);
3696 		break;
3697 #if IS_ENABLED(CONFIG_IPV6)
3698 	case AF_INET6:
3699 		if (msg->msg_namelen < SIN6_LEN_RFC2133 ||
3700 		    sap->sin6_family != AF_INET6)
3701 			return -EINVAL;
3702 #ifdef SMACK_IPV6_SECMARK_LABELING
3703 		rsp = smack_ipv6host_label(sap);
3704 		if (rsp != NULL)
3705 			rc = smk_ipv6_check(ssp->smk_out, rsp, sap,
3706 						SMK_CONNECTING);
3707 #endif
3708 #ifdef SMACK_IPV6_PORT_LABELING
3709 		rc = smk_ipv6_port_check(sock->sk, sap, SMK_SENDING);
3710 #endif
3711 #endif /* IS_ENABLED(CONFIG_IPV6) */
3712 		break;
3713 	}
3714 	return rc;
3715 }
3716 
3717 /**
3718  * smack_from_secattr - Convert a netlabel attr.mls.lvl/attr.mls.cat pair to smack
3719  * @sap: netlabel secattr
3720  * @ssp: socket security information
3721  *
3722  * Returns a pointer to a Smack label entry found on the label list.
3723  */
smack_from_secattr(struct netlbl_lsm_secattr * sap,struct socket_smack * ssp)3724 static struct smack_known *smack_from_secattr(struct netlbl_lsm_secattr *sap,
3725 						struct socket_smack *ssp)
3726 {
3727 	struct smack_known *skp;
3728 	int found = 0;
3729 	int acat;
3730 	int kcat;
3731 
3732 	/*
3733 	 * Netlabel found it in the cache.
3734 	 */
3735 	if ((sap->flags & NETLBL_SECATTR_CACHE) != 0)
3736 		return (struct smack_known *)sap->cache->data;
3737 
3738 	if ((sap->flags & NETLBL_SECATTR_SECID) != 0)
3739 		/*
3740 		 * Looks like a fallback, which gives us a secid.
3741 		 */
3742 		return smack_from_secid(sap->attr.secid);
3743 
3744 	if ((sap->flags & NETLBL_SECATTR_MLS_LVL) != 0) {
3745 		/*
3746 		 * Looks like a CIPSO packet.
3747 		 * If there are flags but no level netlabel isn't
3748 		 * behaving the way we expect it to.
3749 		 *
3750 		 * Look it up in the label table
3751 		 * Without guidance regarding the smack value
3752 		 * for the packet fall back on the network
3753 		 * ambient value.
3754 		 */
3755 		rcu_read_lock();
3756 		list_for_each_entry_rcu(skp, &smack_known_list, list) {
3757 			if (sap->attr.mls.lvl != skp->smk_netlabel.attr.mls.lvl)
3758 				continue;
3759 			/*
3760 			 * Compare the catsets. Use the netlbl APIs.
3761 			 */
3762 			if ((sap->flags & NETLBL_SECATTR_MLS_CAT) == 0) {
3763 				if ((skp->smk_netlabel.flags &
3764 				     NETLBL_SECATTR_MLS_CAT) == 0)
3765 					found = 1;
3766 				break;
3767 			}
3768 			for (acat = -1, kcat = -1; acat == kcat; ) {
3769 				acat = netlbl_catmap_walk(sap->attr.mls.cat,
3770 							  acat + 1);
3771 				kcat = netlbl_catmap_walk(
3772 					skp->smk_netlabel.attr.mls.cat,
3773 					kcat + 1);
3774 				if (acat < 0 || kcat < 0)
3775 					break;
3776 			}
3777 			if (acat == kcat) {
3778 				found = 1;
3779 				break;
3780 			}
3781 		}
3782 		rcu_read_unlock();
3783 
3784 		if (found)
3785 			return skp;
3786 
3787 		if (ssp != NULL && ssp->smk_in == &smack_known_star)
3788 			return &smack_known_web;
3789 		return &smack_known_star;
3790 	}
3791 	/*
3792 	 * Without guidance regarding the smack value
3793 	 * for the packet fall back on the network
3794 	 * ambient value.
3795 	 */
3796 	return smack_net_ambient;
3797 }
3798 
3799 #if IS_ENABLED(CONFIG_IPV6)
smk_skb_to_addr_ipv6(struct sk_buff * skb,struct sockaddr_in6 * sip)3800 static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip)
3801 {
3802 	u8 nexthdr;
3803 	int offset;
3804 	int proto = -EINVAL;
3805 	struct ipv6hdr _ipv6h;
3806 	struct ipv6hdr *ip6;
3807 	__be16 frag_off;
3808 	struct tcphdr _tcph, *th;
3809 	struct udphdr _udph, *uh;
3810 	struct dccp_hdr _dccph, *dh;
3811 
3812 	sip->sin6_port = 0;
3813 
3814 	offset = skb_network_offset(skb);
3815 	ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3816 	if (ip6 == NULL)
3817 		return -EINVAL;
3818 	sip->sin6_addr = ip6->saddr;
3819 
3820 	nexthdr = ip6->nexthdr;
3821 	offset += sizeof(_ipv6h);
3822 	offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3823 	if (offset < 0)
3824 		return -EINVAL;
3825 
3826 	proto = nexthdr;
3827 	switch (proto) {
3828 	case IPPROTO_TCP:
3829 		th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3830 		if (th != NULL)
3831 			sip->sin6_port = th->source;
3832 		break;
3833 	case IPPROTO_UDP:
3834 	case IPPROTO_UDPLITE:
3835 		uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3836 		if (uh != NULL)
3837 			sip->sin6_port = uh->source;
3838 		break;
3839 	case IPPROTO_DCCP:
3840 		dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3841 		if (dh != NULL)
3842 			sip->sin6_port = dh->dccph_sport;
3843 		break;
3844 	}
3845 	return proto;
3846 }
3847 #endif /* CONFIG_IPV6 */
3848 
3849 /**
3850  * smack_from_skb - Smack data from the secmark in an skb
3851  * @skb: packet
3852  *
3853  * Returns smack_known of the secmark or NULL if that won't work.
3854  */
3855 #ifdef CONFIG_NETWORK_SECMARK
smack_from_skb(struct sk_buff * skb)3856 static struct smack_known *smack_from_skb(struct sk_buff *skb)
3857 {
3858 	if (skb == NULL || skb->secmark == 0)
3859 		return NULL;
3860 
3861 	return smack_from_secid(skb->secmark);
3862 }
3863 #else
smack_from_skb(struct sk_buff * skb)3864 static inline struct smack_known *smack_from_skb(struct sk_buff *skb)
3865 {
3866 	return NULL;
3867 }
3868 #endif
3869 
3870 /**
3871  * smack_from_netlbl - Smack data from the IP options in an skb
3872  * @sk: socket data came in on
3873  * @family: address family
3874  * @skb: packet
3875  *
3876  * Find the Smack label in the IP options. If it hasn't been
3877  * added to the netlabel cache, add it here.
3878  *
3879  * Returns smack_known of the IP options or NULL if that won't work.
3880  */
smack_from_netlbl(const struct sock * sk,u16 family,struct sk_buff * skb)3881 static struct smack_known *smack_from_netlbl(const struct sock *sk, u16 family,
3882 					     struct sk_buff *skb)
3883 {
3884 	struct netlbl_lsm_secattr secattr;
3885 	struct socket_smack *ssp = NULL;
3886 	struct smack_known *skp = NULL;
3887 
3888 	netlbl_secattr_init(&secattr);
3889 
3890 	if (sk)
3891 		ssp = sk->sk_security;
3892 
3893 	if (netlbl_skbuff_getattr(skb, family, &secattr) == 0) {
3894 		skp = smack_from_secattr(&secattr, ssp);
3895 		if (secattr.flags & NETLBL_SECATTR_CACHEABLE)
3896 			netlbl_cache_add(skb, family, &skp->smk_netlabel);
3897 	}
3898 
3899 	netlbl_secattr_destroy(&secattr);
3900 
3901 	return skp;
3902 }
3903 
3904 /**
3905  * smack_socket_sock_rcv_skb - Smack packet delivery access check
3906  * @sk: socket
3907  * @skb: packet
3908  *
3909  * Returns 0 if the packet should be delivered, an error code otherwise
3910  */
smack_socket_sock_rcv_skb(struct sock * sk,struct sk_buff * skb)3911 static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3912 {
3913 	struct socket_smack *ssp = sk->sk_security;
3914 	struct smack_known *skp = NULL;
3915 	int rc = 0;
3916 	struct smk_audit_info ad;
3917 	u16 family = sk->sk_family;
3918 #ifdef CONFIG_AUDIT
3919 	struct lsm_network_audit net;
3920 #endif
3921 #if IS_ENABLED(CONFIG_IPV6)
3922 	struct sockaddr_in6 sadd;
3923 	int proto;
3924 
3925 	if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3926 		family = PF_INET;
3927 #endif /* CONFIG_IPV6 */
3928 
3929 	switch (family) {
3930 	case PF_INET:
3931 		/*
3932 		 * If there is a secmark use it rather than the CIPSO label.
3933 		 * If there is no secmark fall back to CIPSO.
3934 		 * The secmark is assumed to reflect policy better.
3935 		 */
3936 		skp = smack_from_skb(skb);
3937 		if (skp == NULL) {
3938 			skp = smack_from_netlbl(sk, family, skb);
3939 			if (skp == NULL)
3940 				skp = smack_net_ambient;
3941 		}
3942 
3943 #ifdef CONFIG_AUDIT
3944 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3945 		ad.a.u.net->family = family;
3946 		ad.a.u.net->netif = skb->skb_iif;
3947 		ipv4_skb_to_auditdata(skb, &ad.a, NULL);
3948 #endif
3949 		/*
3950 		 * Receiving a packet requires that the other end
3951 		 * be able to write here. Read access is not required.
3952 		 * This is the simplist possible security model
3953 		 * for networking.
3954 		 */
3955 		rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3956 		rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
3957 					MAY_WRITE, rc);
3958 		if (rc != 0)
3959 			netlbl_skbuff_err(skb, family, rc, 0);
3960 		break;
3961 #if IS_ENABLED(CONFIG_IPV6)
3962 	case PF_INET6:
3963 		proto = smk_skb_to_addr_ipv6(skb, &sadd);
3964 		if (proto != IPPROTO_UDP && proto != IPPROTO_UDPLITE &&
3965 		    proto != IPPROTO_TCP && proto != IPPROTO_DCCP)
3966 			break;
3967 #ifdef SMACK_IPV6_SECMARK_LABELING
3968 		skp = smack_from_skb(skb);
3969 		if (skp == NULL) {
3970 			if (smk_ipv6_localhost(&sadd))
3971 				break;
3972 			skp = smack_ipv6host_label(&sadd);
3973 			if (skp == NULL)
3974 				skp = smack_net_ambient;
3975 		}
3976 #ifdef CONFIG_AUDIT
3977 		smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3978 		ad.a.u.net->family = family;
3979 		ad.a.u.net->netif = skb->skb_iif;
3980 		ipv6_skb_to_auditdata(skb, &ad.a, NULL);
3981 #endif /* CONFIG_AUDIT */
3982 		rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3983 		rc = smk_bu_note("IPv6 delivery", skp, ssp->smk_in,
3984 					MAY_WRITE, rc);
3985 #endif /* SMACK_IPV6_SECMARK_LABELING */
3986 #ifdef SMACK_IPV6_PORT_LABELING
3987 		rc = smk_ipv6_port_check(sk, &sadd, SMK_RECEIVING);
3988 #endif /* SMACK_IPV6_PORT_LABELING */
3989 		if (rc != 0)
3990 			icmpv6_send(skb, ICMPV6_DEST_UNREACH,
3991 					ICMPV6_ADM_PROHIBITED, 0);
3992 		break;
3993 #endif /* CONFIG_IPV6 */
3994 	}
3995 
3996 	return rc;
3997 }
3998 
3999 /**
4000  * smack_socket_getpeersec_stream - pull in packet label
4001  * @sock: the socket
4002  * @optval: user's destination
4003  * @optlen: size thereof
4004  * @len: max thereof
4005  *
4006  * returns zero on success, an error code otherwise
4007  */
smack_socket_getpeersec_stream(struct socket * sock,char __user * optval,int __user * optlen,unsigned len)4008 static int smack_socket_getpeersec_stream(struct socket *sock,
4009 					  char __user *optval,
4010 					  int __user *optlen, unsigned len)
4011 {
4012 	struct socket_smack *ssp;
4013 	char *rcp = "";
4014 	int slen = 1;
4015 	int rc = 0;
4016 
4017 	ssp = sock->sk->sk_security;
4018 	if (ssp->smk_packet != NULL) {
4019 		rcp = ssp->smk_packet->smk_known;
4020 		slen = strlen(rcp) + 1;
4021 	}
4022 
4023 	if (slen > len)
4024 		rc = -ERANGE;
4025 	else if (copy_to_user(optval, rcp, slen) != 0)
4026 		rc = -EFAULT;
4027 
4028 	if (put_user(slen, optlen) != 0)
4029 		rc = -EFAULT;
4030 
4031 	return rc;
4032 }
4033 
4034 
4035 /**
4036  * smack_socket_getpeersec_dgram - pull in packet label
4037  * @sock: the peer socket
4038  * @skb: packet data
4039  * @secid: pointer to where to put the secid of the packet
4040  *
4041  * Sets the netlabel socket state on sk from parent
4042  */
smack_socket_getpeersec_dgram(struct socket * sock,struct sk_buff * skb,u32 * secid)4043 static int smack_socket_getpeersec_dgram(struct socket *sock,
4044 					 struct sk_buff *skb, u32 *secid)
4045 
4046 {
4047 	struct socket_smack *ssp = NULL;
4048 	struct smack_known *skp;
4049 	struct sock *sk = NULL;
4050 	int family = PF_UNSPEC;
4051 	u32 s = 0;	/* 0 is the invalid secid */
4052 
4053 	if (skb != NULL) {
4054 		if (skb->protocol == htons(ETH_P_IP))
4055 			family = PF_INET;
4056 #if IS_ENABLED(CONFIG_IPV6)
4057 		else if (skb->protocol == htons(ETH_P_IPV6))
4058 			family = PF_INET6;
4059 #endif /* CONFIG_IPV6 */
4060 	}
4061 	if (family == PF_UNSPEC && sock != NULL)
4062 		family = sock->sk->sk_family;
4063 
4064 	switch (family) {
4065 	case PF_UNIX:
4066 		ssp = sock->sk->sk_security;
4067 		s = ssp->smk_out->smk_secid;
4068 		break;
4069 	case PF_INET:
4070 		skp = smack_from_skb(skb);
4071 		if (skp) {
4072 			s = skp->smk_secid;
4073 			break;
4074 		}
4075 		/*
4076 		 * Translate what netlabel gave us.
4077 		 */
4078 		if (sock != NULL)
4079 			sk = sock->sk;
4080 		skp = smack_from_netlbl(sk, family, skb);
4081 		if (skp != NULL)
4082 			s = skp->smk_secid;
4083 		break;
4084 	case PF_INET6:
4085 #ifdef SMACK_IPV6_SECMARK_LABELING
4086 		skp = smack_from_skb(skb);
4087 		if (skp)
4088 			s = skp->smk_secid;
4089 #endif
4090 		break;
4091 	}
4092 	*secid = s;
4093 	if (s == 0)
4094 		return -EINVAL;
4095 	return 0;
4096 }
4097 
4098 /**
4099  * smack_sock_graft - Initialize a newly created socket with an existing sock
4100  * @sk: child sock
4101  * @parent: parent socket
4102  *
4103  * Set the smk_{in,out} state of an existing sock based on the process that
4104  * is creating the new socket.
4105  */
smack_sock_graft(struct sock * sk,struct socket * parent)4106 static void smack_sock_graft(struct sock *sk, struct socket *parent)
4107 {
4108 	struct socket_smack *ssp;
4109 	struct smack_known *skp = smk_of_current();
4110 
4111 	if (sk == NULL ||
4112 	    (sk->sk_family != PF_INET && sk->sk_family != PF_INET6))
4113 		return;
4114 
4115 	ssp = sk->sk_security;
4116 	ssp->smk_in = skp;
4117 	ssp->smk_out = skp;
4118 	/* cssp->smk_packet is already set in smack_inet_csk_clone() */
4119 }
4120 
4121 /**
4122  * smack_inet_conn_request - Smack access check on connect
4123  * @sk: socket involved
4124  * @skb: packet
4125  * @req: unused
4126  *
4127  * Returns 0 if a task with the packet label could write to
4128  * the socket, otherwise an error code
4129  */
smack_inet_conn_request(const struct sock * sk,struct sk_buff * skb,struct request_sock * req)4130 static int smack_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
4131 				   struct request_sock *req)
4132 {
4133 	u16 family = sk->sk_family;
4134 	struct smack_known *skp;
4135 	struct socket_smack *ssp = sk->sk_security;
4136 	struct sockaddr_in addr;
4137 	struct iphdr *hdr;
4138 	struct smack_known *hskp;
4139 	int rc;
4140 	struct smk_audit_info ad;
4141 #ifdef CONFIG_AUDIT
4142 	struct lsm_network_audit net;
4143 #endif
4144 
4145 #if IS_ENABLED(CONFIG_IPV6)
4146 	if (family == PF_INET6) {
4147 		/*
4148 		 * Handle mapped IPv4 packets arriving
4149 		 * via IPv6 sockets. Don't set up netlabel
4150 		 * processing on IPv6.
4151 		 */
4152 		if (skb->protocol == htons(ETH_P_IP))
4153 			family = PF_INET;
4154 		else
4155 			return 0;
4156 	}
4157 #endif /* CONFIG_IPV6 */
4158 
4159 	/*
4160 	 * If there is a secmark use it rather than the CIPSO label.
4161 	 * If there is no secmark fall back to CIPSO.
4162 	 * The secmark is assumed to reflect policy better.
4163 	 */
4164 	skp = smack_from_skb(skb);
4165 	if (skp == NULL) {
4166 		skp = smack_from_netlbl(sk, family, skb);
4167 		if (skp == NULL)
4168 			skp = &smack_known_huh;
4169 	}
4170 
4171 #ifdef CONFIG_AUDIT
4172 	smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
4173 	ad.a.u.net->family = family;
4174 	ad.a.u.net->netif = skb->skb_iif;
4175 	ipv4_skb_to_auditdata(skb, &ad.a, NULL);
4176 #endif
4177 	/*
4178 	 * Receiving a packet requires that the other end be able to write
4179 	 * here. Read access is not required.
4180 	 */
4181 	rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
4182 	rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
4183 	if (rc != 0)
4184 		return rc;
4185 
4186 	/*
4187 	 * Save the peer's label in the request_sock so we can later setup
4188 	 * smk_packet in the child socket so that SO_PEERCRED can report it.
4189 	 */
4190 	req->peer_secid = skp->smk_secid;
4191 
4192 	/*
4193 	 * We need to decide if we want to label the incoming connection here
4194 	 * if we do we only need to label the request_sock and the stack will
4195 	 * propagate the wire-label to the sock when it is created.
4196 	 */
4197 	hdr = ip_hdr(skb);
4198 	addr.sin_addr.s_addr = hdr->saddr;
4199 	rcu_read_lock();
4200 	hskp = smack_ipv4host_label(&addr);
4201 	rcu_read_unlock();
4202 
4203 	if (hskp == NULL)
4204 		rc = netlbl_req_setattr(req, &skp->smk_netlabel);
4205 	else
4206 		netlbl_req_delattr(req);
4207 
4208 	return rc;
4209 }
4210 
4211 /**
4212  * smack_inet_csk_clone - Copy the connection information to the new socket
4213  * @sk: the new socket
4214  * @req: the connection's request_sock
4215  *
4216  * Transfer the connection's peer label to the newly created socket.
4217  */
smack_inet_csk_clone(struct sock * sk,const struct request_sock * req)4218 static void smack_inet_csk_clone(struct sock *sk,
4219 				 const struct request_sock *req)
4220 {
4221 	struct socket_smack *ssp = sk->sk_security;
4222 	struct smack_known *skp;
4223 
4224 	if (req->peer_secid != 0) {
4225 		skp = smack_from_secid(req->peer_secid);
4226 		ssp->smk_packet = skp;
4227 	} else
4228 		ssp->smk_packet = NULL;
4229 }
4230 
4231 /*
4232  * Key management security hooks
4233  *
4234  * Casey has not tested key support very heavily.
4235  * The permission check is most likely too restrictive.
4236  * If you care about keys please have a look.
4237  */
4238 #ifdef CONFIG_KEYS
4239 
4240 /**
4241  * smack_key_alloc - Set the key security blob
4242  * @key: object
4243  * @cred: the credentials to use
4244  * @flags: unused
4245  *
4246  * No allocation required
4247  *
4248  * Returns 0
4249  */
smack_key_alloc(struct key * key,const struct cred * cred,unsigned long flags)4250 static int smack_key_alloc(struct key *key, const struct cred *cred,
4251 			   unsigned long flags)
4252 {
4253 	struct smack_known *skp = smk_of_task(smack_cred(cred));
4254 
4255 	key->security = skp;
4256 	return 0;
4257 }
4258 
4259 /**
4260  * smack_key_free - Clear the key security blob
4261  * @key: the object
4262  *
4263  * Clear the blob pointer
4264  */
smack_key_free(struct key * key)4265 static void smack_key_free(struct key *key)
4266 {
4267 	key->security = NULL;
4268 }
4269 
4270 /**
4271  * smack_key_permission - Smack access on a key
4272  * @key_ref: gets to the object
4273  * @cred: the credentials to use
4274  * @need_perm: requested key permission
4275  *
4276  * Return 0 if the task has read and write to the object,
4277  * an error code otherwise
4278  */
smack_key_permission(key_ref_t key_ref,const struct cred * cred,enum key_need_perm need_perm)4279 static int smack_key_permission(key_ref_t key_ref,
4280 				const struct cred *cred,
4281 				enum key_need_perm need_perm)
4282 {
4283 	struct key *keyp;
4284 	struct smk_audit_info ad;
4285 	struct smack_known *tkp = smk_of_task(smack_cred(cred));
4286 	int request = 0;
4287 	int rc;
4288 
4289 	/*
4290 	 * Validate requested permissions
4291 	 */
4292 	switch (need_perm) {
4293 	case KEY_NEED_READ:
4294 	case KEY_NEED_SEARCH:
4295 	case KEY_NEED_VIEW:
4296 		request |= MAY_READ;
4297 		break;
4298 	case KEY_NEED_WRITE:
4299 	case KEY_NEED_LINK:
4300 	case KEY_NEED_SETATTR:
4301 		request |= MAY_WRITE;
4302 		break;
4303 	case KEY_NEED_UNSPECIFIED:
4304 	case KEY_NEED_UNLINK:
4305 	case KEY_SYSADMIN_OVERRIDE:
4306 	case KEY_AUTHTOKEN_OVERRIDE:
4307 	case KEY_DEFER_PERM_CHECK:
4308 		return 0;
4309 	default:
4310 		return -EINVAL;
4311 	}
4312 
4313 	keyp = key_ref_to_ptr(key_ref);
4314 	if (keyp == NULL)
4315 		return -EINVAL;
4316 	/*
4317 	 * If the key hasn't been initialized give it access so that
4318 	 * it may do so.
4319 	 */
4320 	if (keyp->security == NULL)
4321 		return 0;
4322 	/*
4323 	 * This should not occur
4324 	 */
4325 	if (tkp == NULL)
4326 		return -EACCES;
4327 
4328 	if (smack_privileged(CAP_MAC_OVERRIDE))
4329 		return 0;
4330 
4331 #ifdef CONFIG_AUDIT
4332 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4333 	ad.a.u.key_struct.key = keyp->serial;
4334 	ad.a.u.key_struct.key_desc = keyp->description;
4335 #endif
4336 	rc = smk_access(tkp, keyp->security, request, &ad);
4337 	rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
4338 	return rc;
4339 }
4340 
4341 /*
4342  * smack_key_getsecurity - Smack label tagging the key
4343  * @key points to the key to be queried
4344  * @_buffer points to a pointer that should be set to point to the
4345  * resulting string (if no label or an error occurs).
4346  * Return the length of the string (including terminating NUL) or -ve if
4347  * an error.
4348  * May also return 0 (and a NULL buffer pointer) if there is no label.
4349  */
smack_key_getsecurity(struct key * key,char ** _buffer)4350 static int smack_key_getsecurity(struct key *key, char **_buffer)
4351 {
4352 	struct smack_known *skp = key->security;
4353 	size_t length;
4354 	char *copy;
4355 
4356 	if (key->security == NULL) {
4357 		*_buffer = NULL;
4358 		return 0;
4359 	}
4360 
4361 	copy = kstrdup(skp->smk_known, GFP_KERNEL);
4362 	if (copy == NULL)
4363 		return -ENOMEM;
4364 	length = strlen(copy) + 1;
4365 
4366 	*_buffer = copy;
4367 	return length;
4368 }
4369 
4370 
4371 #ifdef CONFIG_KEY_NOTIFICATIONS
4372 /**
4373  * smack_watch_key - Smack access to watch a key for notifications.
4374  * @key: The key to be watched
4375  *
4376  * Return 0 if the @watch->cred has permission to read from the key object and
4377  * an error otherwise.
4378  */
smack_watch_key(struct key * key)4379 static int smack_watch_key(struct key *key)
4380 {
4381 	struct smk_audit_info ad;
4382 	struct smack_known *tkp = smk_of_current();
4383 	int rc;
4384 
4385 	if (key == NULL)
4386 		return -EINVAL;
4387 	/*
4388 	 * If the key hasn't been initialized give it access so that
4389 	 * it may do so.
4390 	 */
4391 	if (key->security == NULL)
4392 		return 0;
4393 	/*
4394 	 * This should not occur
4395 	 */
4396 	if (tkp == NULL)
4397 		return -EACCES;
4398 
4399 	if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))
4400 		return 0;
4401 
4402 #ifdef CONFIG_AUDIT
4403 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
4404 	ad.a.u.key_struct.key = key->serial;
4405 	ad.a.u.key_struct.key_desc = key->description;
4406 #endif
4407 	rc = smk_access(tkp, key->security, MAY_READ, &ad);
4408 	rc = smk_bu_note("key watch", tkp, key->security, MAY_READ, rc);
4409 	return rc;
4410 }
4411 #endif /* CONFIG_KEY_NOTIFICATIONS */
4412 #endif /* CONFIG_KEYS */
4413 
4414 #ifdef CONFIG_WATCH_QUEUE
4415 /**
4416  * smack_post_notification - Smack access to post a notification to a queue
4417  * @w_cred: The credentials of the watcher.
4418  * @cred: The credentials of the event source (may be NULL).
4419  * @n: The notification message to be posted.
4420  */
smack_post_notification(const struct cred * w_cred,const struct cred * cred,struct watch_notification * n)4421 static int smack_post_notification(const struct cred *w_cred,
4422 				   const struct cred *cred,
4423 				   struct watch_notification *n)
4424 {
4425 	struct smk_audit_info ad;
4426 	struct smack_known *subj, *obj;
4427 	int rc;
4428 
4429 	/* Always let maintenance notifications through. */
4430 	if (n->type == WATCH_TYPE_META)
4431 		return 0;
4432 
4433 	if (!cred)
4434 		return 0;
4435 	subj = smk_of_task(smack_cred(cred));
4436 	obj = smk_of_task(smack_cred(w_cred));
4437 
4438 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NOTIFICATION);
4439 	rc = smk_access(subj, obj, MAY_WRITE, &ad);
4440 	rc = smk_bu_note("notification", subj, obj, MAY_WRITE, rc);
4441 	return rc;
4442 }
4443 #endif /* CONFIG_WATCH_QUEUE */
4444 
4445 /*
4446  * Smack Audit hooks
4447  *
4448  * Audit requires a unique representation of each Smack specific
4449  * rule. This unique representation is used to distinguish the
4450  * object to be audited from remaining kernel objects and also
4451  * works as a glue between the audit hooks.
4452  *
4453  * Since repository entries are added but never deleted, we'll use
4454  * the smack_known label address related to the given audit rule as
4455  * the needed unique representation. This also better fits the smack
4456  * model where nearly everything is a label.
4457  */
4458 #ifdef CONFIG_AUDIT
4459 
4460 /**
4461  * smack_audit_rule_init - Initialize a smack audit rule
4462  * @field: audit rule fields given from user-space (audit.h)
4463  * @op: required testing operator (=, !=, >, <, ...)
4464  * @rulestr: smack label to be audited
4465  * @vrule: pointer to save our own audit rule representation
4466  *
4467  * Prepare to audit cases where (@field @op @rulestr) is true.
4468  * The label to be audited is created if necessay.
4469  */
smack_audit_rule_init(u32 field,u32 op,char * rulestr,void ** vrule)4470 static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
4471 {
4472 	struct smack_known *skp;
4473 	char **rule = (char **)vrule;
4474 	*rule = NULL;
4475 
4476 	if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4477 		return -EINVAL;
4478 
4479 	if (op != Audit_equal && op != Audit_not_equal)
4480 		return -EINVAL;
4481 
4482 	skp = smk_import_entry(rulestr, 0);
4483 	if (IS_ERR(skp))
4484 		return PTR_ERR(skp);
4485 
4486 	*rule = skp->smk_known;
4487 
4488 	return 0;
4489 }
4490 
4491 /**
4492  * smack_audit_rule_known - Distinguish Smack audit rules
4493  * @krule: rule of interest, in Audit kernel representation format
4494  *
4495  * This is used to filter Smack rules from remaining Audit ones.
4496  * If it's proved that this rule belongs to us, the
4497  * audit_rule_match hook will be called to do the final judgement.
4498  */
smack_audit_rule_known(struct audit_krule * krule)4499 static int smack_audit_rule_known(struct audit_krule *krule)
4500 {
4501 	struct audit_field *f;
4502 	int i;
4503 
4504 	for (i = 0; i < krule->field_count; i++) {
4505 		f = &krule->fields[i];
4506 
4507 		if (f->type == AUDIT_SUBJ_USER || f->type == AUDIT_OBJ_USER)
4508 			return 1;
4509 	}
4510 
4511 	return 0;
4512 }
4513 
4514 /**
4515  * smack_audit_rule_match - Audit given object ?
4516  * @secid: security id for identifying the object to test
4517  * @field: audit rule flags given from user-space
4518  * @op: required testing operator
4519  * @vrule: smack internal rule presentation
4520  *
4521  * The core Audit hook. It's used to take the decision of
4522  * whether to audit or not to audit a given object.
4523  */
smack_audit_rule_match(u32 secid,u32 field,u32 op,void * vrule)4524 static int smack_audit_rule_match(u32 secid, u32 field, u32 op, void *vrule)
4525 {
4526 	struct smack_known *skp;
4527 	char *rule = vrule;
4528 
4529 	if (unlikely(!rule)) {
4530 		WARN_ONCE(1, "Smack: missing rule\n");
4531 		return -ENOENT;
4532 	}
4533 
4534 	if (field != AUDIT_SUBJ_USER && field != AUDIT_OBJ_USER)
4535 		return 0;
4536 
4537 	skp = smack_from_secid(secid);
4538 
4539 	/*
4540 	 * No need to do string comparisons. If a match occurs,
4541 	 * both pointers will point to the same smack_known
4542 	 * label.
4543 	 */
4544 	if (op == Audit_equal)
4545 		return (rule == skp->smk_known);
4546 	if (op == Audit_not_equal)
4547 		return (rule != skp->smk_known);
4548 
4549 	return 0;
4550 }
4551 
4552 /*
4553  * There is no need for a smack_audit_rule_free hook.
4554  * No memory was allocated.
4555  */
4556 
4557 #endif /* CONFIG_AUDIT */
4558 
4559 /**
4560  * smack_ismaclabel - check if xattr @name references a smack MAC label
4561  * @name: Full xattr name to check.
4562  */
smack_ismaclabel(const char * name)4563 static int smack_ismaclabel(const char *name)
4564 {
4565 	return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
4566 }
4567 
4568 
4569 /**
4570  * smack_secid_to_secctx - return the smack label for a secid
4571  * @secid: incoming integer
4572  * @secdata: destination
4573  * @seclen: how long it is
4574  *
4575  * Exists for networking code.
4576  */
smack_secid_to_secctx(u32 secid,char ** secdata,u32 * seclen)4577 static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4578 {
4579 	struct smack_known *skp = smack_from_secid(secid);
4580 
4581 	if (secdata)
4582 		*secdata = skp->smk_known;
4583 	*seclen = strlen(skp->smk_known);
4584 	return 0;
4585 }
4586 
4587 /**
4588  * smack_secctx_to_secid - return the secid for a smack label
4589  * @secdata: smack label
4590  * @seclen: how long result is
4591  * @secid: outgoing integer
4592  *
4593  * Exists for audit and networking code.
4594  */
smack_secctx_to_secid(const char * secdata,u32 seclen,u32 * secid)4595 static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
4596 {
4597 	struct smack_known *skp = smk_find_entry(secdata);
4598 
4599 	if (skp)
4600 		*secid = skp->smk_secid;
4601 	else
4602 		*secid = 0;
4603 	return 0;
4604 }
4605 
4606 /*
4607  * There used to be a smack_release_secctx hook
4608  * that did nothing back when hooks were in a vector.
4609  * Now that there's a list such a hook adds cost.
4610  */
4611 
smack_inode_notifysecctx(struct inode * inode,void * ctx,u32 ctxlen)4612 static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
4613 {
4614 	return smack_inode_setsecurity(inode, XATTR_SMACK_SUFFIX, ctx,
4615 				       ctxlen, 0);
4616 }
4617 
smack_inode_setsecctx(struct dentry * dentry,void * ctx,u32 ctxlen)4618 static int smack_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
4619 {
4620 	return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SMACK,
4621 				     ctx, ctxlen, 0);
4622 }
4623 
smack_inode_getsecctx(struct inode * inode,void ** ctx,u32 * ctxlen)4624 static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
4625 {
4626 	struct smack_known *skp = smk_of_inode(inode);
4627 
4628 	*ctx = skp->smk_known;
4629 	*ctxlen = strlen(skp->smk_known);
4630 	return 0;
4631 }
4632 
smack_inode_copy_up(struct dentry * dentry,struct cred ** new)4633 static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
4634 {
4635 
4636 	struct task_smack *tsp;
4637 	struct smack_known *skp;
4638 	struct inode_smack *isp;
4639 	struct cred *new_creds = *new;
4640 
4641 	if (new_creds == NULL) {
4642 		new_creds = prepare_creds();
4643 		if (new_creds == NULL)
4644 			return -ENOMEM;
4645 	}
4646 
4647 	tsp = smack_cred(new_creds);
4648 
4649 	/*
4650 	 * Get label from overlay inode and set it in create_sid
4651 	 */
4652 	isp = smack_inode(d_inode(dentry));
4653 	skp = isp->smk_inode;
4654 	tsp->smk_task = skp;
4655 	*new = new_creds;
4656 	return 0;
4657 }
4658 
smack_inode_copy_up_xattr(const char * name)4659 static int smack_inode_copy_up_xattr(const char *name)
4660 {
4661 	/*
4662 	 * Return 1 if this is the smack access Smack attribute.
4663 	 */
4664 	if (strcmp(name, XATTR_NAME_SMACK) == 0)
4665 		return 1;
4666 
4667 	return -EOPNOTSUPP;
4668 }
4669 
smack_dentry_create_files_as(struct dentry * dentry,int mode,struct qstr * name,const struct cred * old,struct cred * new)4670 static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
4671 					struct qstr *name,
4672 					const struct cred *old,
4673 					struct cred *new)
4674 {
4675 	struct task_smack *otsp = smack_cred(old);
4676 	struct task_smack *ntsp = smack_cred(new);
4677 	struct inode_smack *isp;
4678 	int may;
4679 
4680 	/*
4681 	 * Use the process credential unless all of
4682 	 * the transmuting criteria are met
4683 	 */
4684 	ntsp->smk_task = otsp->smk_task;
4685 
4686 	/*
4687 	 * the attribute of the containing directory
4688 	 */
4689 	isp = smack_inode(d_inode(dentry->d_parent));
4690 
4691 	if (isp->smk_flags & SMK_INODE_TRANSMUTE) {
4692 		rcu_read_lock();
4693 		may = smk_access_entry(otsp->smk_task->smk_known,
4694 				       isp->smk_inode->smk_known,
4695 				       &otsp->smk_task->smk_rules);
4696 		rcu_read_unlock();
4697 
4698 		/*
4699 		 * If the directory is transmuting and the rule
4700 		 * providing access is transmuting use the containing
4701 		 * directory label instead of the process label.
4702 		 */
4703 		if (may > 0 && (may & MAY_TRANSMUTE))
4704 			ntsp->smk_task = isp->smk_inode;
4705 	}
4706 	return 0;
4707 }
4708 
4709 #ifdef CONFIG_IO_URING
4710 /**
4711  * smack_uring_override_creds - Is io_uring cred override allowed?
4712  * @new: the target creds
4713  *
4714  * Check to see if the current task is allowed to override it's credentials
4715  * to service an io_uring operation.
4716  */
smack_uring_override_creds(const struct cred * new)4717 static int smack_uring_override_creds(const struct cred *new)
4718 {
4719 	struct task_smack *tsp = smack_cred(current_cred());
4720 	struct task_smack *nsp = smack_cred(new);
4721 
4722 	/*
4723 	 * Allow the degenerate case where the new Smack value is
4724 	 * the same as the current Smack value.
4725 	 */
4726 	if (tsp->smk_task == nsp->smk_task)
4727 		return 0;
4728 
4729 	if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))
4730 		return 0;
4731 
4732 	return -EPERM;
4733 }
4734 
4735 /**
4736  * smack_uring_sqpoll - check if a io_uring polling thread can be created
4737  *
4738  * Check to see if the current task is allowed to create a new io_uring
4739  * kernel polling thread.
4740  */
smack_uring_sqpoll(void)4741 static int smack_uring_sqpoll(void)
4742 {
4743 	if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred()))
4744 		return 0;
4745 
4746 	return -EPERM;
4747 }
4748 
4749 /**
4750  * smack_uring_cmd - check on file operations for io_uring
4751  * @ioucmd: the command in question
4752  *
4753  * Make a best guess about whether a io_uring "command" should
4754  * be allowed. Use the same logic used for determining if the
4755  * file could be opened for read in the absence of better criteria.
4756  */
smack_uring_cmd(struct io_uring_cmd * ioucmd)4757 static int smack_uring_cmd(struct io_uring_cmd *ioucmd)
4758 {
4759 	struct file *file = ioucmd->file;
4760 	struct smk_audit_info ad;
4761 	struct task_smack *tsp;
4762 	struct inode *inode;
4763 	int rc;
4764 
4765 	if (!file)
4766 		return -EINVAL;
4767 
4768 	tsp = smack_cred(file->f_cred);
4769 	inode = file_inode(file);
4770 
4771 	smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
4772 	smk_ad_setfield_u_fs_path(&ad, file->f_path);
4773 	rc = smk_tskacc(tsp, smk_of_inode(inode), MAY_READ, &ad);
4774 	rc = smk_bu_credfile(file->f_cred, file, MAY_READ, rc);
4775 
4776 	return rc;
4777 }
4778 
4779 #endif /* CONFIG_IO_URING */
4780 
4781 struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
4782 	.lbs_cred = sizeof(struct task_smack),
4783 	.lbs_file = sizeof(struct smack_known *),
4784 	.lbs_inode = sizeof(struct inode_smack),
4785 	.lbs_ipc = sizeof(struct smack_known *),
4786 	.lbs_msg_msg = sizeof(struct smack_known *),
4787 	.lbs_superblock = sizeof(struct superblock_smack),
4788 };
4789 
4790 static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
4791 	LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check),
4792 	LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme),
4793 	LSM_HOOK_INIT(syslog, smack_syslog),
4794 
4795 	LSM_HOOK_INIT(fs_context_dup, smack_fs_context_dup),
4796 	LSM_HOOK_INIT(fs_context_parse_param, smack_fs_context_parse_param),
4797 
4798 	LSM_HOOK_INIT(sb_alloc_security, smack_sb_alloc_security),
4799 	LSM_HOOK_INIT(sb_free_mnt_opts, smack_free_mnt_opts),
4800 	LSM_HOOK_INIT(sb_eat_lsm_opts, smack_sb_eat_lsm_opts),
4801 	LSM_HOOK_INIT(sb_statfs, smack_sb_statfs),
4802 	LSM_HOOK_INIT(sb_set_mnt_opts, smack_set_mnt_opts),
4803 
4804 	LSM_HOOK_INIT(bprm_creds_for_exec, smack_bprm_creds_for_exec),
4805 
4806 	LSM_HOOK_INIT(inode_alloc_security, smack_inode_alloc_security),
4807 	LSM_HOOK_INIT(inode_init_security, smack_inode_init_security),
4808 	LSM_HOOK_INIT(inode_link, smack_inode_link),
4809 	LSM_HOOK_INIT(inode_unlink, smack_inode_unlink),
4810 	LSM_HOOK_INIT(inode_rmdir, smack_inode_rmdir),
4811 	LSM_HOOK_INIT(inode_rename, smack_inode_rename),
4812 	LSM_HOOK_INIT(inode_permission, smack_inode_permission),
4813 	LSM_HOOK_INIT(inode_setattr, smack_inode_setattr),
4814 	LSM_HOOK_INIT(inode_getattr, smack_inode_getattr),
4815 	LSM_HOOK_INIT(inode_setxattr, smack_inode_setxattr),
4816 	LSM_HOOK_INIT(inode_post_setxattr, smack_inode_post_setxattr),
4817 	LSM_HOOK_INIT(inode_getxattr, smack_inode_getxattr),
4818 	LSM_HOOK_INIT(inode_removexattr, smack_inode_removexattr),
4819 	LSM_HOOK_INIT(inode_getsecurity, smack_inode_getsecurity),
4820 	LSM_HOOK_INIT(inode_setsecurity, smack_inode_setsecurity),
4821 	LSM_HOOK_INIT(inode_listsecurity, smack_inode_listsecurity),
4822 	LSM_HOOK_INIT(inode_getsecid, smack_inode_getsecid),
4823 
4824 	LSM_HOOK_INIT(file_alloc_security, smack_file_alloc_security),
4825 	LSM_HOOK_INIT(file_ioctl, smack_file_ioctl),
4826 	LSM_HOOK_INIT(file_lock, smack_file_lock),
4827 	LSM_HOOK_INIT(file_fcntl, smack_file_fcntl),
4828 	LSM_HOOK_INIT(mmap_file, smack_mmap_file),
4829 	LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
4830 	LSM_HOOK_INIT(file_set_fowner, smack_file_set_fowner),
4831 	LSM_HOOK_INIT(file_send_sigiotask, smack_file_send_sigiotask),
4832 	LSM_HOOK_INIT(file_receive, smack_file_receive),
4833 
4834 	LSM_HOOK_INIT(file_open, smack_file_open),
4835 
4836 	LSM_HOOK_INIT(cred_alloc_blank, smack_cred_alloc_blank),
4837 	LSM_HOOK_INIT(cred_free, smack_cred_free),
4838 	LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
4839 	LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
4840 	LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid),
4841 	LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
4842 	LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
4843 	LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),
4844 	LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),
4845 	LSM_HOOK_INIT(task_getsid, smack_task_getsid),
4846 	LSM_HOOK_INIT(current_getsecid_subj, smack_current_getsecid_subj),
4847 	LSM_HOOK_INIT(task_getsecid_obj, smack_task_getsecid_obj),
4848 	LSM_HOOK_INIT(task_setnice, smack_task_setnice),
4849 	LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),
4850 	LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),
4851 	LSM_HOOK_INIT(task_setscheduler, smack_task_setscheduler),
4852 	LSM_HOOK_INIT(task_getscheduler, smack_task_getscheduler),
4853 	LSM_HOOK_INIT(task_movememory, smack_task_movememory),
4854 	LSM_HOOK_INIT(task_kill, smack_task_kill),
4855 	LSM_HOOK_INIT(task_to_inode, smack_task_to_inode),
4856 
4857 	LSM_HOOK_INIT(ipc_permission, smack_ipc_permission),
4858 	LSM_HOOK_INIT(ipc_getsecid, smack_ipc_getsecid),
4859 
4860 	LSM_HOOK_INIT(msg_msg_alloc_security, smack_msg_msg_alloc_security),
4861 
4862 	LSM_HOOK_INIT(msg_queue_alloc_security, smack_ipc_alloc_security),
4863 	LSM_HOOK_INIT(msg_queue_associate, smack_msg_queue_associate),
4864 	LSM_HOOK_INIT(msg_queue_msgctl, smack_msg_queue_msgctl),
4865 	LSM_HOOK_INIT(msg_queue_msgsnd, smack_msg_queue_msgsnd),
4866 	LSM_HOOK_INIT(msg_queue_msgrcv, smack_msg_queue_msgrcv),
4867 
4868 	LSM_HOOK_INIT(shm_alloc_security, smack_ipc_alloc_security),
4869 	LSM_HOOK_INIT(shm_associate, smack_shm_associate),
4870 	LSM_HOOK_INIT(shm_shmctl, smack_shm_shmctl),
4871 	LSM_HOOK_INIT(shm_shmat, smack_shm_shmat),
4872 
4873 	LSM_HOOK_INIT(sem_alloc_security, smack_ipc_alloc_security),
4874 	LSM_HOOK_INIT(sem_associate, smack_sem_associate),
4875 	LSM_HOOK_INIT(sem_semctl, smack_sem_semctl),
4876 	LSM_HOOK_INIT(sem_semop, smack_sem_semop),
4877 
4878 	LSM_HOOK_INIT(d_instantiate, smack_d_instantiate),
4879 
4880 	LSM_HOOK_INIT(getprocattr, smack_getprocattr),
4881 	LSM_HOOK_INIT(setprocattr, smack_setprocattr),
4882 
4883 	LSM_HOOK_INIT(unix_stream_connect, smack_unix_stream_connect),
4884 	LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),
4885 
4886 	LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),
4887 	LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair),
4888 #ifdef SMACK_IPV6_PORT_LABELING
4889 	LSM_HOOK_INIT(socket_bind, smack_socket_bind),
4890 #endif
4891 	LSM_HOOK_INIT(socket_connect, smack_socket_connect),
4892 	LSM_HOOK_INIT(socket_sendmsg, smack_socket_sendmsg),
4893 	LSM_HOOK_INIT(socket_sock_rcv_skb, smack_socket_sock_rcv_skb),
4894 	LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream),
4895 	LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram),
4896 	LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security),
4897 	LSM_HOOK_INIT(sk_free_security, smack_sk_free_security),
4898 	LSM_HOOK_INIT(sk_clone_security, smack_sk_clone_security),
4899 	LSM_HOOK_INIT(sock_graft, smack_sock_graft),
4900 	LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request),
4901 	LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone),
4902 
4903  /* key management security hooks */
4904 #ifdef CONFIG_KEYS
4905 	LSM_HOOK_INIT(key_alloc, smack_key_alloc),
4906 	LSM_HOOK_INIT(key_free, smack_key_free),
4907 	LSM_HOOK_INIT(key_permission, smack_key_permission),
4908 	LSM_HOOK_INIT(key_getsecurity, smack_key_getsecurity),
4909 #ifdef CONFIG_KEY_NOTIFICATIONS
4910 	LSM_HOOK_INIT(watch_key, smack_watch_key),
4911 #endif
4912 #endif /* CONFIG_KEYS */
4913 
4914 #ifdef CONFIG_WATCH_QUEUE
4915 	LSM_HOOK_INIT(post_notification, smack_post_notification),
4916 #endif
4917 
4918  /* Audit hooks */
4919 #ifdef CONFIG_AUDIT
4920 	LSM_HOOK_INIT(audit_rule_init, smack_audit_rule_init),
4921 	LSM_HOOK_INIT(audit_rule_known, smack_audit_rule_known),
4922 	LSM_HOOK_INIT(audit_rule_match, smack_audit_rule_match),
4923 #endif /* CONFIG_AUDIT */
4924 
4925 	LSM_HOOK_INIT(ismaclabel, smack_ismaclabel),
4926 	LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx),
4927 	LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid),
4928 	LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx),
4929 	LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx),
4930 	LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),
4931 	LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up),
4932 	LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr),
4933 	LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as),
4934 #ifdef CONFIG_IO_URING
4935 	LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds),
4936 	LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll),
4937 	LSM_HOOK_INIT(uring_cmd, smack_uring_cmd),
4938 #endif
4939 };
4940 
4941 
init_smack_known_list(void)4942 static __init void init_smack_known_list(void)
4943 {
4944 	/*
4945 	 * Initialize rule list locks
4946 	 */
4947 	mutex_init(&smack_known_huh.smk_rules_lock);
4948 	mutex_init(&smack_known_hat.smk_rules_lock);
4949 	mutex_init(&smack_known_floor.smk_rules_lock);
4950 	mutex_init(&smack_known_star.smk_rules_lock);
4951 	mutex_init(&smack_known_web.smk_rules_lock);
4952 	/*
4953 	 * Initialize rule lists
4954 	 */
4955 	INIT_LIST_HEAD(&smack_known_huh.smk_rules);
4956 	INIT_LIST_HEAD(&smack_known_hat.smk_rules);
4957 	INIT_LIST_HEAD(&smack_known_star.smk_rules);
4958 	INIT_LIST_HEAD(&smack_known_floor.smk_rules);
4959 	INIT_LIST_HEAD(&smack_known_web.smk_rules);
4960 	/*
4961 	 * Create the known labels list
4962 	 */
4963 	smk_insert_entry(&smack_known_huh);
4964 	smk_insert_entry(&smack_known_hat);
4965 	smk_insert_entry(&smack_known_star);
4966 	smk_insert_entry(&smack_known_floor);
4967 	smk_insert_entry(&smack_known_web);
4968 }
4969 
4970 /**
4971  * smack_init - initialize the smack system
4972  *
4973  * Returns 0 on success, -ENOMEM is there's no memory
4974  */
smack_init(void)4975 static __init int smack_init(void)
4976 {
4977 	struct cred *cred = (struct cred *) current->cred;
4978 	struct task_smack *tsp;
4979 
4980 	smack_rule_cache = KMEM_CACHE(smack_rule, 0);
4981 	if (!smack_rule_cache)
4982 		return -ENOMEM;
4983 
4984 	/*
4985 	 * Set the security state for the initial task.
4986 	 */
4987 	tsp = smack_cred(cred);
4988 	init_task_smack(tsp, &smack_known_floor, &smack_known_floor);
4989 
4990 	/*
4991 	 * Register with LSM
4992 	 */
4993 	security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack");
4994 	smack_enabled = 1;
4995 
4996 	pr_info("Smack:  Initializing.\n");
4997 #ifdef CONFIG_SECURITY_SMACK_NETFILTER
4998 	pr_info("Smack:  Netfilter enabled.\n");
4999 #endif
5000 #ifdef SMACK_IPV6_PORT_LABELING
5001 	pr_info("Smack:  IPv6 port labeling enabled.\n");
5002 #endif
5003 #ifdef SMACK_IPV6_SECMARK_LABELING
5004 	pr_info("Smack:  IPv6 Netfilter enabled.\n");
5005 #endif
5006 
5007 	/* initialize the smack_known_list */
5008 	init_smack_known_list();
5009 
5010 	return 0;
5011 }
5012 
5013 /*
5014  * Smack requires early initialization in order to label
5015  * all processes and objects when they are created.
5016  */
5017 DEFINE_LSM(smack) = {
5018 	.name = "smack",
5019 	.flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
5020 	.blobs = &smack_blob_sizes,
5021 	.init = smack_init,
5022 };
5023