2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <linux/slab.h>
24 #include <net/net_namespace.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
32 * smackfs pseudo filesystem.
37 SMK_LOAD = 3, /* load policy */
38 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
39 SMK_DOI = 5, /* CIPSO DOI */
40 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
41 SMK_AMBIENT = 7, /* internet ambient label */
42 SMK_NETLBLADDR = 8, /* single label hosts */
43 SMK_ONLYCAP = 9, /* the only "capable" label */
44 SMK_LOGGING = 10, /* logging */
45 SMK_LOAD_SELF = 11, /* task specific rules */
46 SMK_ACCESSES = 12, /* access policy */
47 SMK_MAPPED = 13, /* CIPSO level indicating mapped label */
48 SMK_LOAD2 = 14, /* load policy with long labels */
49 SMK_LOAD_SELF2 = 15, /* load task specific rules with long labels */
50 SMK_ACCESS2 = 16, /* make an access check with long labels */
51 SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
52 SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
53 SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
59 static DEFINE_MUTEX(smack_cipso_lock);
60 static DEFINE_MUTEX(smack_ambient_lock);
61 static DEFINE_MUTEX(smk_netlbladdr_lock);
64 * This is the "ambient" label for network traffic.
65 * If it isn't somehow marked, use this.
66 * It can be reset via smackfs/ambient
68 char *smack_net_ambient;
71 * This is the level in a CIPSO header that indicates a
72 * smack label is contained directly in the category set.
73 * It can be reset via smackfs/direct
75 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
78 * This is the level in a CIPSO header that indicates a
79 * secid is contained directly in the category set.
80 * It can be reset via smackfs/mapped
82 int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
85 * Unless a process is running with this label even
86 * having CAP_MAC_OVERRIDE isn't enough to grant
87 * privilege to violate MAC policy. If no label is
88 * designated (the NULL case) capabilities apply to
89 * everyone. It is expected that the hat (^) label
90 * will be used if any label is used.
95 * Certain IP addresses may be designated as single label hosts.
96 * Packets are sent there unlabeled, but only from tasks that
97 * can write to the specified label.
100 LIST_HEAD(smk_netlbladdr_list);
103 * Rule lists are maintained for each label.
104 * This master list is just for reading /smack/load and /smack/load2.
106 struct smack_master_list {
107 struct list_head list;
108 struct smack_rule *smk_rule;
111 LIST_HEAD(smack_rule_list);
113 struct smack_parsed_rule {
120 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
122 const char *smack_cipso_option = SMACK_CIPSO_OPTION;
125 * Values for parsing cipso rules
126 * SMK_DIGITLEN: Length of a digit field in a rule.
127 * SMK_CIPSOMIN: Minimum possible cipso rule length.
128 * SMK_CIPSOMAX: Maximum possible cipso rule length.
130 #define SMK_DIGITLEN 4
131 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
132 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
135 * Values for parsing MAC rules
136 * SMK_ACCESS: Maximum possible combination of access permissions
137 * SMK_ACCESSLEN: Maximum length for a rule access field
138 * SMK_LOADLEN: Smack rule length
140 #define SMK_OACCESS "rwxa"
141 #define SMK_ACCESS "rwxat"
142 #define SMK_OACCESSLEN (sizeof(SMK_OACCESS) - 1)
143 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
144 #define SMK_OLOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_OACCESSLEN)
145 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
148 * Stricly for CIPSO level manipulation.
149 * Set the category bit number in a smack label sized buffer.
151 static inline void smack_catset_bit(unsigned int cat, char *catsetp)
153 if (cat == 0 || cat > (SMK_CIPSOLEN * 8))
156 catsetp[(cat - 1) / 8] |= 0x80 >> ((cat - 1) % 8);
160 * smk_netlabel_audit_set - fill a netlbl_audit struct
161 * @nap: structure to fill
163 static void smk_netlabel_audit_set(struct netlbl_audit *nap)
165 nap->loginuid = audit_get_loginuid(current);
166 nap->sessionid = audit_get_sessionid(current);
167 nap->secid = smack_to_secid(smk_of_current());
171 * Value for parsing single label host rules
174 #define SMK_NETLBLADDRMIN 9
177 * smk_set_access - add a rule to the rule list or replace an old rule
178 * @srp: the rule to add or replace
179 * @rule_list: the list of rules
180 * @rule_lock: the rule list lock
181 * @global: if non-zero, indicates a global rule
183 * Looks through the current subject/object/access list for
184 * the subject/object pair and replaces the access that was
185 * there. If the pair isn't found add it with the specified
188 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
189 * during the allocation of the new pair to add.
191 static int smk_set_access(struct smack_parsed_rule *srp,
192 struct list_head *rule_list,
193 struct mutex *rule_lock, int global)
195 struct smack_rule *sp;
196 struct smack_master_list *smlp;
200 mutex_lock(rule_lock);
203 * Because the object label is less likely to match
204 * than the subject label check it first
206 list_for_each_entry_rcu(sp, rule_list, list) {
207 if (sp->smk_object == srp->smk_object &&
208 sp->smk_subject == srp->smk_subject) {
210 sp->smk_access |= srp->smk_access1;
211 sp->smk_access &= ~srp->smk_access2;
217 sp = kzalloc(sizeof(*sp), GFP_KERNEL);
223 sp->smk_subject = srp->smk_subject;
224 sp->smk_object = srp->smk_object;
225 sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
227 list_add_rcu(&sp->list, rule_list);
229 * If this is a global as opposed to self and a new rule
230 * it needs to get added for reporting.
233 smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
236 list_add_rcu(&smlp->list, &smack_rule_list);
243 mutex_unlock(rule_lock);
248 * smk_perm_from_str - parse smack accesses from a text string
249 * @string: a text string that contains a Smack accesses code
251 * Returns an integer with respective bits set for specified accesses.
253 static int smk_perm_from_str(const char *string)
258 for (cp = string; ; cp++)
280 perm |= MAY_TRANSMUTE;
288 * smk_fill_rule - Fill Smack rule from strings
289 * @subject: subject label string
290 * @object: object label string
291 * @access1: access string
292 * @access2: string with permissions to be removed
294 * @import: if non-zero, import labels
295 * @len: label length limit
297 * Returns 0 on success, -1 on failure
299 static int smk_fill_rule(const char *subject, const char *object,
300 const char *access1, const char *access2,
301 struct smack_parsed_rule *rule, int import,
305 struct smack_known *skp;
308 rule->smk_subject = smk_import(subject, len);
309 if (rule->smk_subject == NULL)
312 rule->smk_object = smk_import(object, len);
313 if (rule->smk_object == NULL)
316 cp = smk_parse_smack(subject, len);
319 skp = smk_find_entry(cp);
323 rule->smk_subject = skp->smk_known;
325 cp = smk_parse_smack(object, len);
328 skp = smk_find_entry(cp);
332 rule->smk_object = skp->smk_known;
335 rule->smk_access1 = smk_perm_from_str(access1);
337 rule->smk_access2 = smk_perm_from_str(access2);
339 rule->smk_access2 = ~rule->smk_access1;
345 * smk_parse_rule - parse Smack rule from load string
346 * @data: string to be parsed whose size is SMK_LOADLEN
348 * @import: if non-zero, import labels
350 * Returns 0 on success, -1 on errors.
352 static int smk_parse_rule(const char *data, struct smack_parsed_rule *rule,
357 rc = smk_fill_rule(data, data + SMK_LABELLEN,
358 data + SMK_LABELLEN + SMK_LABELLEN, NULL, rule,
359 import, SMK_LABELLEN);
364 * smk_parse_long_rule - parse Smack rule from rule string
365 * @data: string to be parsed, null terminated
366 * @rule: Will be filled with Smack parsed rule
367 * @import: if non-zero, import labels
368 * @change: if non-zero, data is from /smack/change-rule
370 * Returns 0 on success, -1 on failure
372 static int smk_parse_long_rule(const char *data, struct smack_parsed_rule *rule,
373 int import, int change)
382 /* This is inefficient */
383 datalen = strlen(data);
385 /* Our first element can be 64 + \0 with no spaces */
386 subject = kzalloc(datalen + 1, GFP_KERNEL);
389 object = kzalloc(datalen, GFP_KERNEL);
392 access1 = kzalloc(datalen, GFP_KERNEL);
395 access2 = kzalloc(datalen, GFP_KERNEL);
400 if (sscanf(data, "%s %s %s %s",
401 subject, object, access1, access2) == 4)
402 rc = smk_fill_rule(subject, object, access1, access2,
405 if (sscanf(data, "%s %s %s", subject, object, access1) == 3)
406 rc = smk_fill_rule(subject, object, access1, NULL,
420 #define SMK_FIXED24_FMT 0 /* Fixed 24byte label format */
421 #define SMK_LONG_FMT 1 /* Variable long label format */
422 #define SMK_CHANGE_FMT 2 /* Rule modification format */
424 * smk_write_rules_list - write() for any /smack rule file
425 * @file: file pointer, not actually used
426 * @buf: where to get the data from
428 * @ppos: where to start - must be 0
429 * @rule_list: the list of rules to write to
430 * @rule_lock: lock for the rule list
431 * @format: /smack/load or /smack/load2 or /smack/change-rule format.
433 * Get one smack access rule from above.
434 * The format for SMK_LONG_FMT is:
435 * "subject<whitespace>object<whitespace>access[<whitespace>...]"
436 * The format for SMK_FIXED24_FMT is exactly:
437 * "subject object rwxat"
438 * The format for SMK_CHANGE_FMT is:
439 * "subject<whitespace>object<whitespace>
440 * acc_enable<whitespace>acc_disable[<whitespace>...]"
442 static ssize_t smk_write_rules_list(struct file *file, const char __user *buf,
443 size_t count, loff_t *ppos,
444 struct list_head *rule_list,
445 struct mutex *rule_lock, int format)
447 struct smack_known *skp;
448 struct smack_parsed_rule *rule;
456 * Enough data must be present.
461 if (format == SMK_FIXED24_FMT) {
463 * Minor hack for backward compatibility
465 if (count != SMK_OLOADLEN && count != SMK_LOADLEN)
467 datalen = SMK_LOADLEN;
471 data = kzalloc(datalen, GFP_KERNEL);
475 if (copy_from_user(data, buf, count) != 0) {
480 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
486 if (format == SMK_LONG_FMT) {
488 * Be sure the data string is terminated.
491 if (smk_parse_long_rule(data, rule, 1, 0))
493 } else if (format == SMK_CHANGE_FMT) {
495 if (smk_parse_long_rule(data, rule, 1, 1))
499 * More on the minor hack for backward compatibility
501 if (count == (SMK_OLOADLEN))
502 data[SMK_OLOADLEN] = '-';
503 if (smk_parse_rule(data, rule, 1))
508 if (rule_list == NULL) {
510 skp = smk_find_entry(rule->smk_subject);
511 rule_list = &skp->smk_rules;
512 rule_lock = &skp->smk_rules_lock;
515 rc = smk_set_access(rule, rule_list, rule_lock, load);
529 * Core logic for smackfs seq list operations.
532 static void *smk_seq_start(struct seq_file *s, loff_t *pos,
533 struct list_head *head)
535 struct list_head *list;
538 * This is 0 the first time through.
543 if (s->private == NULL)
547 if (list_empty(list))
555 static void *smk_seq_next(struct seq_file *s, void *v, loff_t *pos,
556 struct list_head *head)
558 struct list_head *list = v;
560 if (list_is_last(list, head)) {
564 s->private = list->next;
568 static void smk_seq_stop(struct seq_file *s, void *v)
573 static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
576 * Don't show any rules with label names too long for
577 * interface file (/smack/load or /smack/load2)
578 * because you should expect to be able to write
579 * anything you read back.
581 if (strlen(srp->smk_subject) >= max || strlen(srp->smk_object) >= max)
584 if (srp->smk_access == 0)
587 seq_printf(s, "%s %s", srp->smk_subject, srp->smk_object);
591 if (srp->smk_access & MAY_READ)
593 if (srp->smk_access & MAY_WRITE)
595 if (srp->smk_access & MAY_EXEC)
597 if (srp->smk_access & MAY_APPEND)
599 if (srp->smk_access & MAY_TRANSMUTE)
606 * Seq_file read operations for /smack/load
609 static void *load2_seq_start(struct seq_file *s, loff_t *pos)
611 return smk_seq_start(s, pos, &smack_rule_list);
614 static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
616 return smk_seq_next(s, v, pos, &smack_rule_list);
619 static int load_seq_show(struct seq_file *s, void *v)
621 struct list_head *list = v;
622 struct smack_master_list *smlp =
623 list_entry(list, struct smack_master_list, list);
625 smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
630 static const struct seq_operations load_seq_ops = {
631 .start = load2_seq_start,
632 .next = load2_seq_next,
633 .show = load_seq_show,
634 .stop = smk_seq_stop,
638 * smk_open_load - open() for /smack/load
639 * @inode: inode structure representing file
640 * @file: "load" file pointer
642 * For reading, use load_seq_* seq_file reading operations.
644 static int smk_open_load(struct inode *inode, struct file *file)
646 return seq_open(file, &load_seq_ops);
650 * smk_write_load - write() for /smack/load
651 * @file: file pointer, not actually used
652 * @buf: where to get the data from
654 * @ppos: where to start - must be 0
657 static ssize_t smk_write_load(struct file *file, const char __user *buf,
658 size_t count, loff_t *ppos)
661 * Must have privilege.
663 * Enough data must be present.
665 if (!smack_privileged(CAP_MAC_ADMIN))
668 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
672 static const struct file_operations smk_load_ops = {
673 .open = smk_open_load,
676 .write = smk_write_load,
677 .release = seq_release,
681 * smk_cipso_doi - initialize the CIPSO domain
683 static void smk_cipso_doi(void)
686 struct cipso_v4_doi *doip;
687 struct netlbl_audit nai;
689 smk_netlabel_audit_set(&nai);
691 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
693 printk(KERN_WARNING "%s:%d remove rc = %d\n",
694 __func__, __LINE__, rc);
696 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
698 panic("smack: Failed to initialize cipso DOI.\n");
699 doip->map.std = NULL;
700 doip->doi = smk_cipso_doi_value;
701 doip->type = CIPSO_V4_MAP_PASS;
702 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
703 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
704 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
706 rc = netlbl_cfg_cipsov4_add(doip, &nai);
708 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
709 __func__, __LINE__, rc);
713 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
715 printk(KERN_WARNING "%s:%d map add rc = %d\n",
716 __func__, __LINE__, rc);
723 * smk_unlbl_ambient - initialize the unlabeled domain
724 * @oldambient: previous domain string
726 static void smk_unlbl_ambient(char *oldambient)
729 struct netlbl_audit nai;
731 smk_netlabel_audit_set(&nai);
733 if (oldambient != NULL) {
734 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
736 printk(KERN_WARNING "%s:%d remove rc = %d\n",
737 __func__, __LINE__, rc);
739 if (smack_net_ambient == NULL)
740 smack_net_ambient = smack_known_floor.smk_known;
742 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET,
745 printk(KERN_WARNING "%s:%d add rc = %d\n",
746 __func__, __LINE__, rc);
750 * Seq_file read operations for /smack/cipso
753 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
755 return smk_seq_start(s, pos, &smack_known_list);
758 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
760 return smk_seq_next(s, v, pos, &smack_known_list);
764 * Print cipso labels in format:
765 * label level[/cat[,cat]]
767 static int cipso_seq_show(struct seq_file *s, void *v)
769 struct list_head *list = v;
770 struct smack_known *skp =
771 list_entry(list, struct smack_known, list);
772 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
777 * Don't show a label that could not have been set using
778 * /smack/cipso. This is in support of the notion that
779 * anything read from /smack/cipso ought to be writeable
782 * /smack/cipso2 should be used instead.
784 if (strlen(skp->smk_known) >= SMK_LABELLEN)
787 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
789 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
790 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
791 seq_printf(s, "%c%d", sep, i);
800 static const struct seq_operations cipso_seq_ops = {
801 .start = cipso_seq_start,
802 .next = cipso_seq_next,
803 .show = cipso_seq_show,
804 .stop = smk_seq_stop,
808 * smk_open_cipso - open() for /smack/cipso
809 * @inode: inode structure representing file
810 * @file: "cipso" file pointer
812 * Connect our cipso_seq_* operations with /smack/cipso
815 static int smk_open_cipso(struct inode *inode, struct file *file)
817 return seq_open(file, &cipso_seq_ops);
821 * smk_set_cipso - do the work for write() for cipso and cipso2
822 * @file: file pointer, not actually used
823 * @buf: where to get the data from
825 * @ppos: where to start
826 * @format: /smack/cipso or /smack/cipso2
828 * Accepts only one cipso rule per write call.
829 * Returns number of bytes written or error code, as appropriate
831 static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
832 size_t count, loff_t *ppos, int format)
834 struct smack_known *skp;
835 struct netlbl_lsm_secattr ncats;
836 char mapcatset[SMK_CIPSOLEN];
840 ssize_t rc = -EINVAL;
847 * Must have privilege.
849 * Enough data must be present.
851 if (!smack_privileged(CAP_MAC_ADMIN))
855 if (format == SMK_FIXED24_FMT &&
856 (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX))
859 data = kzalloc(count + 1, GFP_KERNEL);
863 if (copy_from_user(data, buf, count) != 0) {
871 * Only allow one writer at a time. Writes should be
872 * quite rare and small in any case.
874 mutex_lock(&smack_cipso_lock);
876 skp = smk_import_entry(rule, 0);
880 if (format == SMK_FIXED24_FMT)
881 rule += SMK_LABELLEN;
883 rule += strlen(skp->smk_known);
885 ret = sscanf(rule, "%d", &maplevel);
886 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
889 rule += SMK_DIGITLEN;
890 ret = sscanf(rule, "%d", &catlen);
891 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
894 if (format == SMK_FIXED24_FMT &&
895 count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
898 memset(mapcatset, 0, sizeof(mapcatset));
900 for (i = 0; i < catlen; i++) {
901 rule += SMK_DIGITLEN;
902 ret = sscanf(rule, "%u", &cat);
903 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
906 smack_catset_bit(cat, mapcatset);
909 rc = smk_netlbl_mls(maplevel, mapcatset, &ncats, SMK_CIPSOLEN);
911 netlbl_secattr_catmap_free(skp->smk_netlabel.attr.mls.cat);
912 skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat;
913 skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;
918 mutex_unlock(&smack_cipso_lock);
925 * smk_write_cipso - write() for /smack/cipso
926 * @file: file pointer, not actually used
927 * @buf: where to get the data from
929 * @ppos: where to start
931 * Accepts only one cipso rule per write call.
932 * Returns number of bytes written or error code, as appropriate
934 static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
935 size_t count, loff_t *ppos)
937 return smk_set_cipso(file, buf, count, ppos, SMK_FIXED24_FMT);
940 static const struct file_operations smk_cipso_ops = {
941 .open = smk_open_cipso,
944 .write = smk_write_cipso,
945 .release = seq_release,
949 * Seq_file read operations for /smack/cipso2
953 * Print cipso labels in format:
954 * label level[/cat[,cat]]
956 static int cipso2_seq_show(struct seq_file *s, void *v)
958 struct list_head *list = v;
959 struct smack_known *skp =
960 list_entry(list, struct smack_known, list);
961 struct netlbl_lsm_secattr_catmap *cmp = skp->smk_netlabel.attr.mls.cat;
965 seq_printf(s, "%s %3d", skp->smk_known, skp->smk_netlabel.attr.mls.lvl);
967 for (i = netlbl_secattr_catmap_walk(cmp, 0); i >= 0;
968 i = netlbl_secattr_catmap_walk(cmp, i + 1)) {
969 seq_printf(s, "%c%d", sep, i);
978 static const struct seq_operations cipso2_seq_ops = {
979 .start = cipso_seq_start,
980 .next = cipso_seq_next,
981 .show = cipso2_seq_show,
982 .stop = smk_seq_stop,
986 * smk_open_cipso2 - open() for /smack/cipso2
987 * @inode: inode structure representing file
988 * @file: "cipso2" file pointer
990 * Connect our cipso_seq_* operations with /smack/cipso2
993 static int smk_open_cipso2(struct inode *inode, struct file *file)
995 return seq_open(file, &cipso2_seq_ops);
999 * smk_write_cipso2 - write() for /smack/cipso2
1000 * @file: file pointer, not actually used
1001 * @buf: where to get the data from
1002 * @count: bytes sent
1003 * @ppos: where to start
1005 * Accepts only one cipso rule per write call.
1006 * Returns number of bytes written or error code, as appropriate
1008 static ssize_t smk_write_cipso2(struct file *file, const char __user *buf,
1009 size_t count, loff_t *ppos)
1011 return smk_set_cipso(file, buf, count, ppos, SMK_LONG_FMT);
1014 static const struct file_operations smk_cipso2_ops = {
1015 .open = smk_open_cipso2,
1017 .llseek = seq_lseek,
1018 .write = smk_write_cipso2,
1019 .release = seq_release,
1023 * Seq_file read operations for /smack/netlabel
1026 static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
1028 return smk_seq_start(s, pos, &smk_netlbladdr_list);
1031 static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
1033 return smk_seq_next(s, v, pos, &smk_netlbladdr_list);
1035 #define BEBITS (sizeof(__be32) * 8)
1038 * Print host/label pairs
1040 static int netlbladdr_seq_show(struct seq_file *s, void *v)
1042 struct list_head *list = v;
1043 struct smk_netlbladdr *skp =
1044 list_entry(list, struct smk_netlbladdr, list);
1045 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
1047 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
1049 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
1051 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1052 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
1057 static const struct seq_operations netlbladdr_seq_ops = {
1058 .start = netlbladdr_seq_start,
1059 .next = netlbladdr_seq_next,
1060 .show = netlbladdr_seq_show,
1061 .stop = smk_seq_stop,
1065 * smk_open_netlbladdr - open() for /smack/netlabel
1066 * @inode: inode structure representing file
1067 * @file: "netlabel" file pointer
1069 * Connect our netlbladdr_seq_* operations with /smack/netlabel
1072 static int smk_open_netlbladdr(struct inode *inode, struct file *file)
1074 return seq_open(file, &netlbladdr_seq_ops);
1078 * smk_netlbladdr_insert
1079 * @new : netlabel to insert
1081 * This helper insert netlabel in the smack_netlbladdrs list
1082 * sorted by netmask length (longest to smallest)
1083 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
1086 static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1088 struct smk_netlbladdr *m, *m_next;
1090 if (list_empty(&smk_netlbladdr_list)) {
1091 list_add_rcu(&new->list, &smk_netlbladdr_list);
1095 m = list_entry_rcu(smk_netlbladdr_list.next,
1096 struct smk_netlbladdr, list);
1098 /* the comparison '>' is a bit hacky, but works */
1099 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
1100 list_add_rcu(&new->list, &smk_netlbladdr_list);
1104 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
1105 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
1106 list_add_rcu(&new->list, &m->list);
1109 m_next = list_entry_rcu(m->list.next,
1110 struct smk_netlbladdr, list);
1111 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
1112 list_add_rcu(&new->list, &m->list);
1120 * smk_write_netlbladdr - write() for /smack/netlabel
1121 * @file: file pointer, not actually used
1122 * @buf: where to get the data from
1123 * @count: bytes sent
1124 * @ppos: where to start
1126 * Accepts only one netlbladdr per write call.
1127 * Returns number of bytes written or error code, as appropriate
1129 static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1130 size_t count, loff_t *ppos)
1132 struct smk_netlbladdr *skp;
1133 struct sockaddr_in newname;
1137 char *host = (char *)&newname.sin_addr.s_addr;
1139 struct netlbl_audit audit_info;
1140 struct in_addr mask;
1143 u32 mask_bits = (1<<31);
1148 * Must have privilege.
1149 * No partial writes.
1150 * Enough data must be present.
1151 * "<addr/mask, as a.b.c.d/e><space><label>"
1152 * "<addr, as a.b.c.d><space><label>"
1154 if (!smack_privileged(CAP_MAC_ADMIN))
1158 if (count < SMK_NETLBLADDRMIN)
1161 data = kzalloc(count + 1, GFP_KERNEL);
1165 if (copy_from_user(data, buf, count) != 0) {
1170 smack = kzalloc(count + 1, GFP_KERNEL);
1171 if (smack == NULL) {
1178 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
1179 &host[0], &host[1], &host[2], &host[3], &m, smack);
1181 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
1182 &host[0], &host[1], &host[2], &host[3], smack);
1195 * If smack begins with '-', it is an option, don't import it
1197 if (smack[0] != '-') {
1198 sp = smk_import(smack, 0);
1204 /* check known options */
1205 if (strcmp(smack, smack_cipso_option) == 0)
1206 sp = (char *)smack_cipso_option;
1213 for (temp_mask = 0; m > 0; m--) {
1214 temp_mask |= mask_bits;
1217 mask.s_addr = cpu_to_be32(temp_mask);
1219 newname.sin_addr.s_addr &= mask.s_addr;
1221 * Only allow one writer at a time. Writes should be
1222 * quite rare and small in any case.
1224 mutex_lock(&smk_netlbladdr_lock);
1226 nsa = newname.sin_addr.s_addr;
1227 /* try to find if the prefix is already in the list */
1229 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
1230 if (skp->smk_host.sin_addr.s_addr == nsa &&
1231 skp->smk_mask.s_addr == mask.s_addr) {
1236 smk_netlabel_audit_set(&audit_info);
1239 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
1244 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1245 skp->smk_mask.s_addr = mask.s_addr;
1246 skp->smk_label = sp;
1247 smk_netlbladdr_insert(skp);
1250 /* we delete the unlabeled entry, only if the previous label
1251 * wasn't the special CIPSO option */
1252 if (skp->smk_label != smack_cipso_option)
1253 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1254 &skp->smk_host.sin_addr, &skp->smk_mask,
1255 PF_INET, &audit_info);
1258 skp->smk_label = sp;
1262 * Now tell netlabel about the single label nature of
1263 * this host so that incoming packets get labeled.
1264 * but only if we didn't get the special CIPSO option
1266 if (rc == 0 && sp != smack_cipso_option)
1267 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1268 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
1269 smack_to_secid(skp->smk_label), &audit_info);
1274 mutex_unlock(&smk_netlbladdr_lock);
1284 static const struct file_operations smk_netlbladdr_ops = {
1285 .open = smk_open_netlbladdr,
1287 .llseek = seq_lseek,
1288 .write = smk_write_netlbladdr,
1289 .release = seq_release,
1293 * smk_read_doi - read() for /smack/doi
1294 * @filp: file pointer, not actually used
1295 * @buf: where to put the result
1296 * @count: maximum to send along
1297 * @ppos: where to start
1299 * Returns number of bytes read or error code, as appropriate
1301 static ssize_t smk_read_doi(struct file *filp, char __user *buf,
1302 size_t count, loff_t *ppos)
1310 sprintf(temp, "%d", smk_cipso_doi_value);
1311 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1317 * smk_write_doi - write() for /smack/doi
1318 * @file: file pointer, not actually used
1319 * @buf: where to get the data from
1320 * @count: bytes sent
1321 * @ppos: where to start
1323 * Returns number of bytes written or error code, as appropriate
1325 static ssize_t smk_write_doi(struct file *file, const char __user *buf,
1326 size_t count, loff_t *ppos)
1331 if (!smack_privileged(CAP_MAC_ADMIN))
1334 if (count >= sizeof(temp) || count == 0)
1337 if (copy_from_user(temp, buf, count) != 0)
1342 if (sscanf(temp, "%d", &i) != 1)
1345 smk_cipso_doi_value = i;
1352 static const struct file_operations smk_doi_ops = {
1353 .read = smk_read_doi,
1354 .write = smk_write_doi,
1355 .llseek = default_llseek,
1359 * smk_read_direct - read() for /smack/direct
1360 * @filp: file pointer, not actually used
1361 * @buf: where to put the result
1362 * @count: maximum to send along
1363 * @ppos: where to start
1365 * Returns number of bytes read or error code, as appropriate
1367 static ssize_t smk_read_direct(struct file *filp, char __user *buf,
1368 size_t count, loff_t *ppos)
1376 sprintf(temp, "%d", smack_cipso_direct);
1377 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1383 * smk_write_direct - write() for /smack/direct
1384 * @file: file pointer, not actually used
1385 * @buf: where to get the data from
1386 * @count: bytes sent
1387 * @ppos: where to start
1389 * Returns number of bytes written or error code, as appropriate
1391 static ssize_t smk_write_direct(struct file *file, const char __user *buf,
1392 size_t count, loff_t *ppos)
1394 struct smack_known *skp;
1398 if (!smack_privileged(CAP_MAC_ADMIN))
1401 if (count >= sizeof(temp) || count == 0)
1404 if (copy_from_user(temp, buf, count) != 0)
1409 if (sscanf(temp, "%d", &i) != 1)
1413 * Don't do anything if the value hasn't actually changed.
1414 * If it is changing reset the level on entries that were
1415 * set up to be direct when they were created.
1417 if (smack_cipso_direct != i) {
1418 mutex_lock(&smack_known_lock);
1419 list_for_each_entry_rcu(skp, &smack_known_list, list)
1420 if (skp->smk_netlabel.attr.mls.lvl ==
1422 skp->smk_netlabel.attr.mls.lvl = i;
1423 smack_cipso_direct = i;
1424 mutex_unlock(&smack_known_lock);
1430 static const struct file_operations smk_direct_ops = {
1431 .read = smk_read_direct,
1432 .write = smk_write_direct,
1433 .llseek = default_llseek,
1437 * smk_read_mapped - read() for /smack/mapped
1438 * @filp: file pointer, not actually used
1439 * @buf: where to put the result
1440 * @count: maximum to send along
1441 * @ppos: where to start
1443 * Returns number of bytes read or error code, as appropriate
1445 static ssize_t smk_read_mapped(struct file *filp, char __user *buf,
1446 size_t count, loff_t *ppos)
1454 sprintf(temp, "%d", smack_cipso_mapped);
1455 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1461 * smk_write_mapped - write() for /smack/mapped
1462 * @file: file pointer, not actually used
1463 * @buf: where to get the data from
1464 * @count: bytes sent
1465 * @ppos: where to start
1467 * Returns number of bytes written or error code, as appropriate
1469 static ssize_t smk_write_mapped(struct file *file, const char __user *buf,
1470 size_t count, loff_t *ppos)
1472 struct smack_known *skp;
1476 if (!smack_privileged(CAP_MAC_ADMIN))
1479 if (count >= sizeof(temp) || count == 0)
1482 if (copy_from_user(temp, buf, count) != 0)
1487 if (sscanf(temp, "%d", &i) != 1)
1491 * Don't do anything if the value hasn't actually changed.
1492 * If it is changing reset the level on entries that were
1493 * set up to be mapped when they were created.
1495 if (smack_cipso_mapped != i) {
1496 mutex_lock(&smack_known_lock);
1497 list_for_each_entry_rcu(skp, &smack_known_list, list)
1498 if (skp->smk_netlabel.attr.mls.lvl ==
1500 skp->smk_netlabel.attr.mls.lvl = i;
1501 smack_cipso_mapped = i;
1502 mutex_unlock(&smack_known_lock);
1508 static const struct file_operations smk_mapped_ops = {
1509 .read = smk_read_mapped,
1510 .write = smk_write_mapped,
1511 .llseek = default_llseek,
1515 * smk_read_ambient - read() for /smack/ambient
1516 * @filp: file pointer, not actually used
1517 * @buf: where to put the result
1518 * @cn: maximum to send along
1519 * @ppos: where to start
1521 * Returns number of bytes read or error code, as appropriate
1523 static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1524 size_t cn, loff_t *ppos)
1532 * Being careful to avoid a problem in the case where
1533 * smack_net_ambient gets changed in midstream.
1535 mutex_lock(&smack_ambient_lock);
1537 asize = strlen(smack_net_ambient) + 1;
1540 rc = simple_read_from_buffer(buf, cn, ppos,
1541 smack_net_ambient, asize);
1545 mutex_unlock(&smack_ambient_lock);
1551 * smk_write_ambient - write() for /smack/ambient
1552 * @file: file pointer, not actually used
1553 * @buf: where to get the data from
1554 * @count: bytes sent
1555 * @ppos: where to start
1557 * Returns number of bytes written or error code, as appropriate
1559 static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1560 size_t count, loff_t *ppos)
1567 if (!smack_privileged(CAP_MAC_ADMIN))
1570 data = kzalloc(count + 1, GFP_KERNEL);
1574 if (copy_from_user(data, buf, count) != 0) {
1579 smack = smk_import(data, count);
1580 if (smack == NULL) {
1585 mutex_lock(&smack_ambient_lock);
1587 oldambient = smack_net_ambient;
1588 smack_net_ambient = smack;
1589 smk_unlbl_ambient(oldambient);
1591 mutex_unlock(&smack_ambient_lock);
1598 static const struct file_operations smk_ambient_ops = {
1599 .read = smk_read_ambient,
1600 .write = smk_write_ambient,
1601 .llseek = default_llseek,
1605 * smk_read_onlycap - read() for /smack/onlycap
1606 * @filp: file pointer, not actually used
1607 * @buf: where to put the result
1608 * @cn: maximum to send along
1609 * @ppos: where to start
1611 * Returns number of bytes read or error code, as appropriate
1613 static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1614 size_t cn, loff_t *ppos)
1617 ssize_t rc = -EINVAL;
1623 if (smack_onlycap != NULL)
1624 smack = smack_onlycap;
1626 asize = strlen(smack) + 1;
1629 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1635 * smk_write_onlycap - write() for /smack/onlycap
1636 * @file: file pointer, not actually used
1637 * @buf: where to get the data from
1638 * @count: bytes sent
1639 * @ppos: where to start
1641 * Returns number of bytes written or error code, as appropriate
1643 static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1644 size_t count, loff_t *ppos)
1647 char *sp = smk_of_task(current->cred->security);
1650 if (!smack_privileged(CAP_MAC_ADMIN))
1654 * This can be done using smk_access() but is done
1655 * explicitly for clarity. The smk_access() implementation
1656 * would use smk_access(smack_onlycap, MAY_WRITE)
1658 if (smack_onlycap != NULL && smack_onlycap != sp)
1661 data = kzalloc(count, GFP_KERNEL);
1666 * Should the null string be passed in unset the onlycap value.
1667 * This seems like something to be careful with as usually
1668 * smk_import only expects to return NULL for errors. It
1669 * is usually the case that a nullstring or "\n" would be
1670 * bad to pass to smk_import but in fact this is useful here.
1672 * smk_import will also reject a label beginning with '-',
1673 * so "-usecapabilities" will also work.
1675 if (copy_from_user(data, buf, count) != 0)
1678 smack_onlycap = smk_import(data, count);
1684 static const struct file_operations smk_onlycap_ops = {
1685 .read = smk_read_onlycap,
1686 .write = smk_write_onlycap,
1687 .llseek = default_llseek,
1691 * smk_read_logging - read() for /smack/logging
1692 * @filp: file pointer, not actually used
1693 * @buf: where to put the result
1694 * @cn: maximum to send along
1695 * @ppos: where to start
1697 * Returns number of bytes read or error code, as appropriate
1699 static ssize_t smk_read_logging(struct file *filp, char __user *buf,
1700 size_t count, loff_t *ppos)
1708 sprintf(temp, "%d\n", log_policy);
1709 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
1714 * smk_write_logging - write() for /smack/logging
1715 * @file: file pointer, not actually used
1716 * @buf: where to get the data from
1717 * @count: bytes sent
1718 * @ppos: where to start
1720 * Returns number of bytes written or error code, as appropriate
1722 static ssize_t smk_write_logging(struct file *file, const char __user *buf,
1723 size_t count, loff_t *ppos)
1728 if (!smack_privileged(CAP_MAC_ADMIN))
1731 if (count >= sizeof(temp) || count == 0)
1734 if (copy_from_user(temp, buf, count) != 0)
1739 if (sscanf(temp, "%d", &i) != 1)
1749 static const struct file_operations smk_logging_ops = {
1750 .read = smk_read_logging,
1751 .write = smk_write_logging,
1752 .llseek = default_llseek,
1756 * Seq_file read operations for /smack/load-self
1759 static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
1761 struct task_smack *tsp = current_security();
1763 return smk_seq_start(s, pos, &tsp->smk_rules);
1766 static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
1768 struct task_smack *tsp = current_security();
1770 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1773 static int load_self_seq_show(struct seq_file *s, void *v)
1775 struct list_head *list = v;
1776 struct smack_rule *srp =
1777 list_entry(list, struct smack_rule, list);
1779 smk_rule_show(s, srp, SMK_LABELLEN);
1784 static const struct seq_operations load_self_seq_ops = {
1785 .start = load_self_seq_start,
1786 .next = load_self_seq_next,
1787 .show = load_self_seq_show,
1788 .stop = smk_seq_stop,
1793 * smk_open_load_self - open() for /smack/load-self2
1794 * @inode: inode structure representing file
1795 * @file: "load" file pointer
1797 * For reading, use load_seq_* seq_file reading operations.
1799 static int smk_open_load_self(struct inode *inode, struct file *file)
1801 return seq_open(file, &load_self_seq_ops);
1805 * smk_write_load_self - write() for /smack/load-self
1806 * @file: file pointer, not actually used
1807 * @buf: where to get the data from
1808 * @count: bytes sent
1809 * @ppos: where to start - must be 0
1812 static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
1813 size_t count, loff_t *ppos)
1815 struct task_smack *tsp = current_security();
1817 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
1818 &tsp->smk_rules_lock, SMK_FIXED24_FMT);
1821 static const struct file_operations smk_load_self_ops = {
1822 .open = smk_open_load_self,
1824 .llseek = seq_lseek,
1825 .write = smk_write_load_self,
1826 .release = seq_release,
1830 * smk_user_access - handle access check transaction
1831 * @file: file pointer
1832 * @buf: data from user space
1833 * @count: bytes sent
1834 * @ppos: where to start - must be 0
1836 static ssize_t smk_user_access(struct file *file, const char __user *buf,
1837 size_t count, loff_t *ppos, int format)
1839 struct smack_parsed_rule rule;
1844 data = simple_transaction_get(file, buf, count);
1846 return PTR_ERR(data);
1848 if (format == SMK_FIXED24_FMT) {
1849 if (count < SMK_LOADLEN)
1851 res = smk_parse_rule(data, &rule, 0);
1854 * Copy the data to make sure the string is terminated.
1856 cod = kzalloc(count + 1, GFP_KERNEL);
1859 memcpy(cod, data, count);
1861 res = smk_parse_long_rule(cod, &rule, 0, 0);
1868 res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access1,
1870 data[0] = res == 0 ? '1' : '0';
1873 simple_transaction_set(file, 2);
1875 if (format == SMK_FIXED24_FMT)
1881 * smk_write_access - handle access check transaction
1882 * @file: file pointer
1883 * @buf: data from user space
1884 * @count: bytes sent
1885 * @ppos: where to start - must be 0
1887 static ssize_t smk_write_access(struct file *file, const char __user *buf,
1888 size_t count, loff_t *ppos)
1890 return smk_user_access(file, buf, count, ppos, SMK_FIXED24_FMT);
1893 static const struct file_operations smk_access_ops = {
1894 .write = smk_write_access,
1895 .read = simple_transaction_read,
1896 .release = simple_transaction_release,
1897 .llseek = generic_file_llseek,
1902 * Seq_file read operations for /smack/load2
1905 static int load2_seq_show(struct seq_file *s, void *v)
1907 struct list_head *list = v;
1908 struct smack_master_list *smlp =
1909 list_entry(list, struct smack_master_list, list);
1911 smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
1916 static const struct seq_operations load2_seq_ops = {
1917 .start = load2_seq_start,
1918 .next = load2_seq_next,
1919 .show = load2_seq_show,
1920 .stop = smk_seq_stop,
1924 * smk_open_load2 - open() for /smack/load2
1925 * @inode: inode structure representing file
1926 * @file: "load2" file pointer
1928 * For reading, use load2_seq_* seq_file reading operations.
1930 static int smk_open_load2(struct inode *inode, struct file *file)
1932 return seq_open(file, &load2_seq_ops);
1936 * smk_write_load2 - write() for /smack/load2
1937 * @file: file pointer, not actually used
1938 * @buf: where to get the data from
1939 * @count: bytes sent
1940 * @ppos: where to start - must be 0
1943 static ssize_t smk_write_load2(struct file *file, const char __user *buf,
1944 size_t count, loff_t *ppos)
1947 * Must have privilege.
1949 if (!smack_privileged(CAP_MAC_ADMIN))
1952 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
1956 static const struct file_operations smk_load2_ops = {
1957 .open = smk_open_load2,
1959 .llseek = seq_lseek,
1960 .write = smk_write_load2,
1961 .release = seq_release,
1965 * Seq_file read operations for /smack/load-self2
1968 static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
1970 struct task_smack *tsp = current_security();
1972 return smk_seq_start(s, pos, &tsp->smk_rules);
1975 static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
1977 struct task_smack *tsp = current_security();
1979 return smk_seq_next(s, v, pos, &tsp->smk_rules);
1982 static int load_self2_seq_show(struct seq_file *s, void *v)
1984 struct list_head *list = v;
1985 struct smack_rule *srp =
1986 list_entry(list, struct smack_rule, list);
1988 smk_rule_show(s, srp, SMK_LONGLABEL);
1993 static const struct seq_operations load_self2_seq_ops = {
1994 .start = load_self2_seq_start,
1995 .next = load_self2_seq_next,
1996 .show = load_self2_seq_show,
1997 .stop = smk_seq_stop,
2001 * smk_open_load_self2 - open() for /smack/load-self2
2002 * @inode: inode structure representing file
2003 * @file: "load" file pointer
2005 * For reading, use load_seq_* seq_file reading operations.
2007 static int smk_open_load_self2(struct inode *inode, struct file *file)
2009 return seq_open(file, &load_self2_seq_ops);
2013 * smk_write_load_self2 - write() for /smack/load-self2
2014 * @file: file pointer, not actually used
2015 * @buf: where to get the data from
2016 * @count: bytes sent
2017 * @ppos: where to start - must be 0
2020 static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
2021 size_t count, loff_t *ppos)
2023 struct task_smack *tsp = current_security();
2025 return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
2026 &tsp->smk_rules_lock, SMK_LONG_FMT);
2029 static const struct file_operations smk_load_self2_ops = {
2030 .open = smk_open_load_self2,
2032 .llseek = seq_lseek,
2033 .write = smk_write_load_self2,
2034 .release = seq_release,
2038 * smk_write_access2 - handle access check transaction
2039 * @file: file pointer
2040 * @buf: data from user space
2041 * @count: bytes sent
2042 * @ppos: where to start - must be 0
2044 static ssize_t smk_write_access2(struct file *file, const char __user *buf,
2045 size_t count, loff_t *ppos)
2047 return smk_user_access(file, buf, count, ppos, SMK_LONG_FMT);
2050 static const struct file_operations smk_access2_ops = {
2051 .write = smk_write_access2,
2052 .read = simple_transaction_read,
2053 .release = simple_transaction_release,
2054 .llseek = generic_file_llseek,
2058 * smk_write_revoke_subj - write() for /smack/revoke-subject
2059 * @file: file pointer
2060 * @buf: data from user space
2061 * @count: bytes sent
2062 * @ppos: where to start - must be 0
2064 static ssize_t smk_write_revoke_subj(struct file *file, const char __user *buf,
2065 size_t count, loff_t *ppos)
2068 const char *cp = NULL;
2069 struct smack_known *skp;
2070 struct smack_rule *sp;
2071 struct list_head *rule_list;
2072 struct mutex *rule_lock;
2078 if (!smack_privileged(CAP_MAC_ADMIN))
2081 if (count == 0 || count > SMK_LONGLABEL)
2084 data = kzalloc(count, GFP_KERNEL);
2088 if (copy_from_user(data, buf, count) != 0) {
2093 cp = smk_parse_smack(data, count);
2099 skp = smk_find_entry(cp);
2103 rule_list = &skp->smk_rules;
2104 rule_lock = &skp->smk_rules_lock;
2106 mutex_lock(rule_lock);
2108 list_for_each_entry_rcu(sp, rule_list, list)
2111 mutex_unlock(rule_lock);
2119 static const struct file_operations smk_revoke_subj_ops = {
2120 .write = smk_write_revoke_subj,
2121 .read = simple_transaction_read,
2122 .release = simple_transaction_release,
2123 .llseek = generic_file_llseek,
2126 static struct kset *smackfs_kset;
2128 * smk_init_sysfs - initialize /sys/fs/smackfs
2131 static int smk_init_sysfs(void)
2133 smackfs_kset = kset_create_and_add("smackfs", NULL, fs_kobj);
2140 * smk_write_change_rule - write() for /smack/change-rule
2141 * @file: file pointer
2142 * @buf: data from user space
2143 * @count: bytes sent
2144 * @ppos: where to start - must be 0
2146 static ssize_t smk_write_change_rule(struct file *file, const char __user *buf,
2147 size_t count, loff_t *ppos)
2150 * Must have privilege.
2152 if (!capable(CAP_MAC_ADMIN))
2155 return smk_write_rules_list(file, buf, count, ppos, NULL, NULL,
2159 static const struct file_operations smk_change_rule_ops = {
2160 .write = smk_write_change_rule,
2161 .read = simple_transaction_read,
2162 .release = simple_transaction_release,
2163 .llseek = generic_file_llseek,
2167 * smk_fill_super - fill the /smackfs superblock
2168 * @sb: the empty superblock
2172 * Fill in the well known entries for /smack
2174 * Returns 0 on success, an error code on failure
2176 static int smk_fill_super(struct super_block *sb, void *data, int silent)
2179 struct inode *root_inode;
2181 static struct tree_descr smack_files[] = {
2183 "load", &smk_load_ops, S_IRUGO|S_IWUSR},
2185 "cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
2187 "doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
2189 "direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
2191 "ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
2192 [SMK_NETLBLADDR] = {
2193 "netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
2195 "onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
2197 "logging", &smk_logging_ops, S_IRUGO|S_IWUSR},
2199 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
2201 "access", &smk_access_ops, S_IRUGO|S_IWUGO},
2203 "mapped", &smk_mapped_ops, S_IRUGO|S_IWUSR},
2205 "load2", &smk_load2_ops, S_IRUGO|S_IWUSR},
2206 [SMK_LOAD_SELF2] = {
2207 "load-self2", &smk_load_self2_ops, S_IRUGO|S_IWUGO},
2209 "access2", &smk_access2_ops, S_IRUGO|S_IWUGO},
2211 "cipso2", &smk_cipso2_ops, S_IRUGO|S_IWUSR},
2212 [SMK_REVOKE_SUBJ] = {
2213 "revoke-subject", &smk_revoke_subj_ops,
2215 [SMK_CHANGE_RULE] = {
2216 "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
2221 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
2223 printk(KERN_ERR "%s failed %d while creating inodes\n",
2228 root_inode = sb->s_root->d_inode;
2234 * smk_mount - get the smackfs superblock
2235 * @fs_type: passed along without comment
2236 * @flags: passed along without comment
2237 * @dev_name: passed along without comment
2238 * @data: passed along without comment
2240 * Just passes everything along.
2242 * Returns what the lower level code does.
2244 static struct dentry *smk_mount(struct file_system_type *fs_type,
2245 int flags, const char *dev_name, void *data)
2247 return mount_single(fs_type, flags, data, smk_fill_super);
2250 static struct file_system_type smk_fs_type = {
2253 .kill_sb = kill_litter_super,
2256 static struct vfsmount *smackfs_mount;
2258 static int __init smk_preset_netlabel(struct smack_known *skp)
2260 skp->smk_netlabel.domain = skp->smk_known;
2261 skp->smk_netlabel.flags =
2262 NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2263 return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2264 &skp->smk_netlabel, strlen(skp->smk_known));
2268 * init_smk_fs - get the smackfs superblock
2270 * register the smackfs
2272 * Do not register smackfs if Smack wasn't enabled
2273 * on boot. We can not put this method normally under the
2274 * smack_init() code path since the security subsystem get
2275 * initialized before the vfs caches.
2277 * Returns true if we were not chosen on boot or if
2278 * we were chosen and filesystem registration succeeded.
2280 static int __init init_smk_fs(void)
2285 if (!security_module_enable(&smack_ops))
2288 err = smk_init_sysfs();
2290 printk(KERN_ERR "smackfs: sysfs mountpoint problem.\n");
2292 err = register_filesystem(&smk_fs_type);
2294 smackfs_mount = kern_mount(&smk_fs_type);
2295 if (IS_ERR(smackfs_mount)) {
2296 printk(KERN_ERR "smackfs: could not mount!\n");
2297 err = PTR_ERR(smackfs_mount);
2298 smackfs_mount = NULL;
2303 smk_unlbl_ambient(NULL);
2305 rc = smk_preset_netlabel(&smack_known_floor);
2306 if (err == 0 && rc < 0)
2308 rc = smk_preset_netlabel(&smack_known_hat);
2309 if (err == 0 && rc < 0)
2311 rc = smk_preset_netlabel(&smack_known_huh);
2312 if (err == 0 && rc < 0)
2314 rc = smk_preset_netlabel(&smack_known_invalid);
2315 if (err == 0 && rc < 0)
2317 rc = smk_preset_netlabel(&smack_known_star);
2318 if (err == 0 && rc < 0)
2320 rc = smk_preset_netlabel(&smack_known_web);
2321 if (err == 0 && rc < 0)
2327 __initcall(init_smk_fs);