~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/smack/smack.h

Version: ~ [ linux-4.17-rc6 ] ~ [ linux-4.16.10 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.42 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.101 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.132 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.51 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.109 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.56 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.101 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.39.4 ] ~ [ linux-2.6.38.8 ] ~ [ linux-2.6.37.6 ] ~ [ linux-2.6.36.4 ] ~ [ linux-2.6.35.14 ] ~ [ linux-2.6.34.15 ] ~ [ linux-2.6.33.20 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.27.62 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
  3  *
  4  *      This program is free software; you can redistribute it and/or modify
  5  *      it under the terms of the GNU General Public License as published by
  6  *      the Free Software Foundation, version 2.
  7  *
  8  * Author:
  9  *      Casey Schaufler <casey@schaufler-ca.com>
 10  *
 11  */
 12 
 13 #ifndef _SECURITY_SMACK_H
 14 #define _SECURITY_SMACK_H
 15 
 16 #include <linux/capability.h>
 17 #include <linux/spinlock.h>
 18 #include <linux/lsm_hooks.h>
 19 #include <linux/in.h>
 20 #if IS_ENABLED(CONFIG_IPV6)
 21 #include <linux/in6.h>
 22 #endif /* CONFIG_IPV6 */
 23 #include <net/netlabel.h>
 24 #include <linux/list.h>
 25 #include <linux/rculist.h>
 26 #include <linux/lsm_audit.h>
 27 
 28 /*
 29  * Use IPv6 port labeling if IPv6 is enabled and secmarks
 30  * are not being used.
 31  */
 32 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
 33 #define SMACK_IPV6_PORT_LABELING 1
 34 #endif
 35 
 36 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
 37 #define SMACK_IPV6_SECMARK_LABELING 1
 38 #endif
 39 
 40 /*
 41  * Smack labels were limited to 23 characters for a long time.
 42  */
 43 #define SMK_LABELLEN    24
 44 #define SMK_LONGLABEL   256
 45 
 46 /*
 47  * This is the repository for labels seen so that it is
 48  * not necessary to keep allocating tiny chuncks of memory
 49  * and so that they can be shared.
 50  *
 51  * Labels are never modified in place. Anytime a label
 52  * is imported (e.g. xattrset on a file) the list is checked
 53  * for it and it is added if it doesn't exist. The address
 54  * is passed out in either case. Entries are added, but
 55  * never deleted.
 56  *
 57  * Since labels are hanging around anyway it doesn't
 58  * hurt to maintain a secid for those awkward situations
 59  * where kernel components that ought to use LSM independent
 60  * interfaces don't. The secid should go away when all of
 61  * these components have been repaired.
 62  *
 63  * The cipso value associated with the label gets stored here, too.
 64  *
 65  * Keep the access rules for this subject label here so that
 66  * the entire set of rules does not need to be examined every
 67  * time.
 68  */
 69 struct smack_known {
 70         struct list_head                list;
 71         struct hlist_node               smk_hashed;
 72         char                            *smk_known;
 73         u32                             smk_secid;
 74         struct netlbl_lsm_secattr       smk_netlabel;   /* on wire labels */
 75         struct list_head                smk_rules;      /* access rules */
 76         struct mutex                    smk_rules_lock; /* lock for rules */
 77 };
 78 
 79 /*
 80  * Maximum number of bytes for the levels in a CIPSO IP option.
 81  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
 82  * bigger than can be used, and 24 is the next lower multiple
 83  * of 8, and there are too many issues if there isn't space set
 84  * aside for the terminating null byte.
 85  */
 86 #define SMK_CIPSOLEN    24
 87 
 88 struct superblock_smack {
 89         struct smack_known      *smk_root;
 90         struct smack_known      *smk_floor;
 91         struct smack_known      *smk_hat;
 92         struct smack_known      *smk_default;
 93         int                     smk_flags;
 94 };
 95 
 96 /*
 97  * Superblock flags
 98  */
 99 #define SMK_SB_INITIALIZED      0x01
100 #define SMK_SB_UNTRUSTED        0x02
101 
102 struct socket_smack {
103         struct smack_known      *smk_out;       /* outbound label */
104         struct smack_known      *smk_in;        /* inbound label */
105         struct smack_known      *smk_packet;    /* TCP peer label */
106 };
107 
108 /*
109  * Inode smack data
110  */
111 struct inode_smack {
112         struct smack_known      *smk_inode;     /* label of the fso */
113         struct smack_known      *smk_task;      /* label of the task */
114         struct smack_known      *smk_mmap;      /* label of the mmap domain */
115         struct mutex            smk_lock;       /* initialization lock */
116         int                     smk_flags;      /* smack inode flags */
117         struct rcu_head         smk_rcu;        /* for freeing inode_smack */
118 };
119 
120 struct task_smack {
121         struct smack_known      *smk_task;      /* label for access control */
122         struct smack_known      *smk_forked;    /* label when forked */
123         struct list_head        smk_rules;      /* per task access rules */
124         struct mutex            smk_rules_lock; /* lock for the rules */
125         struct list_head        smk_relabel;    /* transit allowed labels */
126 };
127 
128 #define SMK_INODE_INSTANT       0x01    /* inode is instantiated */
129 #define SMK_INODE_TRANSMUTE     0x02    /* directory is transmuting */
130 #define SMK_INODE_CHANGED       0x04    /* smack was transmuted */
131 #define SMK_INODE_IMPURE        0x08    /* involved in an impure transaction */
132 
133 /*
134  * A label access rule.
135  */
136 struct smack_rule {
137         struct list_head        list;
138         struct smack_known      *smk_subject;
139         struct smack_known      *smk_object;
140         int                     smk_access;
141 };
142 
143 /*
144  * An entry in the table identifying IPv4 hosts.
145  */
146 struct smk_net4addr {
147         struct list_head        list;
148         struct in_addr          smk_host;       /* network address */
149         struct in_addr          smk_mask;       /* network mask */
150         int                     smk_masks;      /* mask size */
151         struct smack_known      *smk_label;     /* label */
152 };
153 
154 #if IS_ENABLED(CONFIG_IPV6)
155 /*
156  * An entry in the table identifying IPv6 hosts.
157  */
158 struct smk_net6addr {
159         struct list_head        list;
160         struct in6_addr         smk_host;       /* network address */
161         struct in6_addr         smk_mask;       /* network mask */
162         int                     smk_masks;      /* mask size */
163         struct smack_known      *smk_label;     /* label */
164 };
165 #endif /* CONFIG_IPV6 */
166 
167 #ifdef SMACK_IPV6_PORT_LABELING
168 /*
169  * An entry in the table identifying ports.
170  */
171 struct smk_port_label {
172         struct list_head        list;
173         struct sock             *smk_sock;      /* socket initialized on */
174         unsigned short          smk_port;       /* the port number */
175         struct smack_known      *smk_in;        /* inbound label */
176         struct smack_known      *smk_out;       /* outgoing label */
177         short                   smk_sock_type;  /* Socket type */
178         short                   smk_can_reuse;
179 };
180 #endif /* SMACK_IPV6_PORT_LABELING */
181 
182 struct smack_known_list_elem {
183         struct list_head        list;
184         struct smack_known      *smk_label;
185 };
186 
187 /* Super block security struct flags for mount options */
188 #define FSDEFAULT_MNT   0x01
189 #define FSFLOOR_MNT     0x02
190 #define FSHAT_MNT       0x04
191 #define FSROOT_MNT      0x08
192 #define FSTRANS_MNT     0x10
193 
194 #define NUM_SMK_MNT_OPTS        5
195 
196 enum {
197         Opt_error = -1,
198         Opt_fsdefault = 1,
199         Opt_fsfloor = 2,
200         Opt_fshat = 3,
201         Opt_fsroot = 4,
202         Opt_fstransmute = 5,
203 };
204 
205 /*
206  * Mount options
207  */
208 #define SMK_FSDEFAULT   "smackfsdef="
209 #define SMK_FSFLOOR     "smackfsfloor="
210 #define SMK_FSHAT       "smackfshat="
211 #define SMK_FSROOT      "smackfsroot="
212 #define SMK_FSTRANS     "smackfstransmute="
213 
214 #define SMACK_DELETE_OPTION     "-DELETE"
215 #define SMACK_CIPSO_OPTION      "-CIPSO"
216 
217 /*
218  * How communications on this socket are treated.
219  * Usually it's determined by the underlying netlabel code
220  * but there are certain cases, including single label hosts
221  * and potentially single label interfaces for which the
222  * treatment can not be known in advance.
223  *
224  * The possibility of additional labeling schemes being
225  * introduced in the future exists as well.
226  */
227 #define SMACK_UNLABELED_SOCKET  0
228 #define SMACK_CIPSO_SOCKET      1
229 
230 /*
231  * CIPSO defaults.
232  */
233 #define SMACK_CIPSO_DOI_DEFAULT         3       /* Historical */
234 #define SMACK_CIPSO_DOI_INVALID         -1      /* Not a DOI */
235 #define SMACK_CIPSO_DIRECT_DEFAULT      250     /* Arbitrary */
236 #define SMACK_CIPSO_MAPPED_DEFAULT      251     /* Also arbitrary */
237 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
238 /*
239  * CIPSO 2.2 standard is 239, but Smack wants to use the
240  * categories in a structured way that limits the value to
241  * the bits in 23 bytes, hence the unusual number.
242  */
243 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
244 
245 /*
246  * Ptrace rules
247  */
248 #define SMACK_PTRACE_DEFAULT    0
249 #define SMACK_PTRACE_EXACT      1
250 #define SMACK_PTRACE_DRACONIAN  2
251 #define SMACK_PTRACE_MAX        SMACK_PTRACE_DRACONIAN
252 
253 /*
254  * Flags for untraditional access modes.
255  * It shouldn't be necessary to avoid conflicts with definitions
256  * in fs.h, but do so anyway.
257  */
258 #define MAY_TRANSMUTE   0x00001000      /* Controls directory labeling */
259 #define MAY_LOCK        0x00002000      /* Locks should be writes, but ... */
260 #define MAY_BRINGUP     0x00004000      /* Report use of this rule */
261 
262 /*
263  * The policy for delivering signals is configurable.
264  * It is usually "write", but can be "append".
265  */
266 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
267 #define MAY_DELIVER     MAY_APPEND      /* Signal delivery requires append */
268 #else
269 #define MAY_DELIVER     MAY_WRITE       /* Signal delivery requires write */
270 #endif
271 
272 #define SMACK_BRINGUP_ALLOW             1       /* Allow bringup mode */
273 #define SMACK_UNCONFINED_SUBJECT        2       /* Allow unconfined label */
274 #define SMACK_UNCONFINED_OBJECT         3       /* Allow unconfined label */
275 
276 /*
277  * Just to make the common cases easier to deal with
278  */
279 #define MAY_ANYREAD     (MAY_READ | MAY_EXEC)
280 #define MAY_READWRITE   (MAY_READ | MAY_WRITE)
281 #define MAY_NOT         0
282 
283 /*
284  * Number of access types used by Smack (rwxatlb)
285  */
286 #define SMK_NUM_ACCESS_TYPE 7
287 
288 /* SMACK data */
289 struct smack_audit_data {
290         const char *function;
291         char *subject;
292         char *object;
293         char *request;
294         int result;
295 };
296 
297 /*
298  * Smack audit data; is empty if CONFIG_AUDIT not set
299  * to save some stack
300  */
301 struct smk_audit_info {
302 #ifdef CONFIG_AUDIT
303         struct common_audit_data a;
304         struct smack_audit_data sad;
305 #endif
306 };
307 
308 /*
309  * These functions are in smack_access.c
310  */
311 int smk_access_entry(char *, char *, struct list_head *);
312 int smk_access(struct smack_known *, struct smack_known *,
313                int, struct smk_audit_info *);
314 int smk_tskacc(struct task_smack *, struct smack_known *,
315                u32, struct smk_audit_info *);
316 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
317 struct smack_known *smack_from_secid(const u32);
318 char *smk_parse_smack(const char *string, int len);
319 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
320 struct smack_known *smk_import_entry(const char *, int);
321 void smk_insert_entry(struct smack_known *skp);
322 struct smack_known *smk_find_entry(const char *);
323 bool smack_privileged(int cap);
324 bool smack_privileged_cred(int cap, const struct cred *cred);
325 void smk_destroy_label_list(struct list_head *list);
326 
327 /*
328  * Shared data.
329  */
330 extern int smack_enabled;
331 extern int smack_cipso_direct;
332 extern int smack_cipso_mapped;
333 extern struct smack_known *smack_net_ambient;
334 extern struct smack_known *smack_syslog_label;
335 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
336 extern struct smack_known *smack_unconfined;
337 #endif
338 extern int smack_ptrace_rule;
339 
340 extern struct smack_known smack_known_floor;
341 extern struct smack_known smack_known_hat;
342 extern struct smack_known smack_known_huh;
343 extern struct smack_known smack_known_star;
344 extern struct smack_known smack_known_web;
345 
346 extern struct mutex     smack_known_lock;
347 extern struct list_head smack_known_list;
348 extern struct list_head smk_net4addr_list;
349 #if IS_ENABLED(CONFIG_IPV6)
350 extern struct list_head smk_net6addr_list;
351 #endif /* CONFIG_IPV6 */
352 
353 extern struct mutex     smack_onlycap_lock;
354 extern struct list_head smack_onlycap_list;
355 
356 #define SMACK_HASH_SLOTS 16
357 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
358 
359 /*
360  * Is the directory transmuting?
361  */
362 static inline int smk_inode_transmutable(const struct inode *isp)
363 {
364         struct inode_smack *sip = isp->i_security;
365         return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
366 }
367 
368 /*
369  * Present a pointer to the smack label entry in an inode blob.
370  */
371 static inline struct smack_known *smk_of_inode(const struct inode *isp)
372 {
373         struct inode_smack *sip = isp->i_security;
374         return sip->smk_inode;
375 }
376 
377 /*
378  * Present a pointer to the smack label entry in an task blob.
379  */
380 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
381 {
382         return tsp->smk_task;
383 }
384 
385 static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
386 {
387         struct smack_known *skp;
388 
389         rcu_read_lock();
390         skp = smk_of_task(__task_cred(t)->security);
391         rcu_read_unlock();
392         return skp;
393 }
394 
395 /*
396  * Present a pointer to the forked smack label entry in an task blob.
397  */
398 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
399 {
400         return tsp->smk_forked;
401 }
402 
403 /*
404  * Present a pointer to the smack label in the current task blob.
405  */
406 static inline struct smack_known *smk_of_current(void)
407 {
408         return smk_of_task(current_security());
409 }
410 
411 /*
412  * logging functions
413  */
414 #define SMACK_AUDIT_DENIED 0x1
415 #define SMACK_AUDIT_ACCEPT 0x2
416 extern int log_policy;
417 
418 void smack_log(char *subject_label, char *object_label,
419                 int request,
420                 int result, struct smk_audit_info *auditdata);
421 
422 #ifdef CONFIG_AUDIT
423 
424 /*
425  * some inline functions to set up audit data
426  * they do nothing if CONFIG_AUDIT is not set
427  *
428  */
429 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
430                                char type)
431 {
432         memset(&a->sad, 0, sizeof(a->sad));
433         a->a.type = type;
434         a->a.smack_audit_data = &a->sad;
435         a->a.smack_audit_data->function = func;
436 }
437 
438 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
439                                    char type, struct lsm_network_audit *net)
440 {
441         smk_ad_init(a, func, type);
442         memset(net, 0, sizeof(*net));
443         a->a.u.net = net;
444 }
445 
446 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
447                                          struct task_struct *t)
448 {
449         a->a.u.tsk = t;
450 }
451 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
452                                                     struct dentry *d)
453 {
454         a->a.u.dentry = d;
455 }
456 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
457                                               struct inode *i)
458 {
459         a->a.u.inode = i;
460 }
461 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
462                                              struct path p)
463 {
464         a->a.u.path = p;
465 }
466 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
467                                             struct sock *sk)
468 {
469         a->a.u.net->sk = sk;
470 }
471 
472 #else /* no AUDIT */
473 
474 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
475                                char type)
476 {
477 }
478 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
479                                          struct task_struct *t)
480 {
481 }
482 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
483                                                     struct dentry *d)
484 {
485 }
486 static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
487                                                  struct vfsmount *m)
488 {
489 }
490 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
491                                               struct inode *i)
492 {
493 }
494 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
495                                              struct path p)
496 {
497 }
498 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
499                                             struct sock *sk)
500 {
501 }
502 #endif
503 
504 #endif  /* _SECURITY_SMACK_H */
505 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp