2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
12 * Special thanks to the authors of selinuxfs.
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <net/net_namespace.h>
24 #include <net/netlabel.h>
25 #include <net/cipso_ipv4.h>
26 #include <linux/seq_file.h>
27 #include <linux/ctype.h>
28 #include <linux/audit.h>
32 * smackfs pseudo filesystem.
37 SMK_LOAD = 3, /* load policy */
38 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
39 SMK_DOI = 5, /* CIPSO DOI */
40 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
41 SMK_AMBIENT = 7, /* internet ambient label */
42 SMK_NETLBLADDR = 8, /* single label hosts */
43 SMK_ONLYCAP = 9, /* the only "capable" label */
49 static DEFINE_MUTEX(smack_list_lock);
50 static DEFINE_MUTEX(smack_cipso_lock);
51 static DEFINE_MUTEX(smack_ambient_lock);
52 static DEFINE_MUTEX(smk_netlbladdr_lock);
55 * This is the "ambient" label for network traffic.
56 * If it isn't somehow marked, use this.
57 * It can be reset via smackfs/ambient
59 char *smack_net_ambient = smack_known_floor.smk_known;
62 * This is the level in a CIPSO header that indicates a
63 * smack label is contained directly in the category set.
64 * It can be reset via smackfs/direct
66 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
69 * Unless a process is running with this label even
70 * having CAP_MAC_OVERRIDE isn't enough to grant
71 * privilege to violate MAC policy. If no label is
72 * designated (the NULL case) capabilities apply to
73 * everyone. It is expected that the hat (^) label
74 * will be used if any label is used.
79 * Certain IP addresses may be designated as single label hosts.
80 * Packets are sent there unlabeled, but only from tasks that
81 * can write to the specified label.
84 LIST_HEAD(smk_netlbladdr_list);
85 LIST_HEAD(smack_rule_list);
87 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
89 #define SEQ_READ_FINISHED 1
92 * Values for parsing cipso rules
93 * SMK_DIGITLEN: Length of a digit field in a rule.
94 * SMK_CIPSOMIN: Minimum possible cipso rule length.
95 * SMK_CIPSOMAX: Maximum possible cipso rule length.
97 #define SMK_DIGITLEN 4
98 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
99 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
102 * Values for parsing MAC rules
103 * SMK_ACCESS: Maximum possible combination of access permissions
104 * SMK_ACCESSLEN: Maximum length for a rule access field
105 * SMK_LOADLEN: Smack rule length
107 #define SMK_ACCESS "rwxa"
108 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
109 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
112 * smk_netlabel_audit_set - fill a netlbl_audit struct
113 * @nap: structure to fill
115 static void smk_netlabel_audit_set(struct netlbl_audit *nap)
117 nap->loginuid = audit_get_loginuid(current);
118 nap->sessionid = audit_get_sessionid(current);
119 nap->secid = smack_to_secid(current_security());
123 * Values for parsing single label host rules
125 * "192.168.138.129/32 abcdefghijklmnopqrstuvw"
127 #define SMK_NETLBLADDRMIN 9
128 #define SMK_NETLBLADDRMAX 42
131 * Seq_file read operations for /smack/load
134 static void *load_seq_start(struct seq_file *s, loff_t *pos)
136 if (*pos == SEQ_READ_FINISHED)
138 if (list_empty(&smack_rule_list))
140 return smack_rule_list.next;
143 static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
145 struct list_head *list = v;
147 if (list_is_last(list, &smack_rule_list)) {
148 *pos = SEQ_READ_FINISHED;
154 static int load_seq_show(struct seq_file *s, void *v)
156 struct list_head *list = v;
157 struct smack_rule *srp =
158 list_entry(list, struct smack_rule, list);
160 seq_printf(s, "%s %s", (char *)srp->smk_subject,
161 (char *)srp->smk_object);
165 if (srp->smk_access & MAY_READ)
167 if (srp->smk_access & MAY_WRITE)
169 if (srp->smk_access & MAY_EXEC)
171 if (srp->smk_access & MAY_APPEND)
173 if (srp->smk_access == 0)
181 static void load_seq_stop(struct seq_file *s, void *v)
186 static struct seq_operations load_seq_ops = {
187 .start = load_seq_start,
188 .next = load_seq_next,
189 .show = load_seq_show,
190 .stop = load_seq_stop,
194 * smk_open_load - open() for /smack/load
195 * @inode: inode structure representing file
196 * @file: "load" file pointer
198 * For reading, use load_seq_* seq_file reading operations.
200 static int smk_open_load(struct inode *inode, struct file *file)
202 return seq_open(file, &load_seq_ops);
206 * smk_set_access - add a rule to the rule list
207 * @srp: the new rule to add
209 * Looks through the current subject/object/access list for
210 * the subject/object pair and replaces the access that was
211 * there. If the pair isn't found add it with the specified
214 * Returns 0 if nothing goes wrong or -ENOMEM if it fails
215 * during the allocation of the new pair to add.
217 static int smk_set_access(struct smack_rule *srp)
219 struct smack_rule *sp;
222 mutex_lock(&smack_list_lock);
225 list_for_each_entry_rcu(sp, &smack_rule_list, list) {
226 if (sp->smk_subject == srp->smk_subject &&
227 sp->smk_object == srp->smk_object) {
229 sp->smk_access = srp->smk_access;
234 list_add_rcu(&srp->list, &smack_rule_list);
236 mutex_unlock(&smack_list_lock);
242 * smk_write_load - write() for /smack/load
243 * @file: file pointer, not actually used
244 * @buf: where to get the data from
246 * @ppos: where to start - must be 0
248 * Get one smack access rule from above.
249 * The format is exactly:
250 * char subject[SMK_LABELLEN]
251 * char object[SMK_LABELLEN]
252 * char access[SMK_ACCESSLEN]
254 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
256 static ssize_t smk_write_load(struct file *file, const char __user *buf,
257 size_t count, loff_t *ppos)
259 struct smack_rule *rule;
264 * Must have privilege.
266 * Enough data must be present.
268 if (!capable(CAP_MAC_ADMIN))
271 if (*ppos != 0 || count != SMK_LOADLEN)
274 data = kzalloc(count, GFP_KERNEL);
278 if (copy_from_user(data, buf, count) != 0) {
283 rule = kzalloc(sizeof(*rule), GFP_KERNEL);
289 rule->smk_subject = smk_import(data, 0);
290 if (rule->smk_subject == NULL)
293 rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
294 if (rule->smk_object == NULL)
297 rule->smk_access = 0;
299 switch (data[SMK_LABELLEN + SMK_LABELLEN]) {
304 rule->smk_access |= MAY_READ;
310 switch (data[SMK_LABELLEN + SMK_LABELLEN + 1]) {
315 rule->smk_access |= MAY_WRITE;
321 switch (data[SMK_LABELLEN + SMK_LABELLEN + 2]) {
326 rule->smk_access |= MAY_EXEC;
332 switch (data[SMK_LABELLEN + SMK_LABELLEN + 3]) {
337 rule->smk_access |= MAY_APPEND;
343 rc = smk_set_access(rule);
356 static const struct file_operations smk_load_ops = {
357 .open = smk_open_load,
360 .write = smk_write_load,
361 .release = seq_release,
365 * smk_cipso_doi - initialize the CIPSO domain
367 static void smk_cipso_doi(void)
370 struct cipso_v4_doi *doip;
371 struct netlbl_audit nai;
373 smk_netlabel_audit_set(&nai);
375 rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
377 printk(KERN_WARNING "%s:%d remove rc = %d\n",
378 __func__, __LINE__, rc);
380 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
382 panic("smack: Failed to initialize cipso DOI.\n");
383 doip->map.std = NULL;
384 doip->doi = smk_cipso_doi_value;
385 doip->type = CIPSO_V4_MAP_PASS;
386 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
387 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
388 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
390 rc = netlbl_cfg_cipsov4_add(doip, &nai);
392 printk(KERN_WARNING "%s:%d cipso add rc = %d\n",
393 __func__, __LINE__, rc);
397 rc = netlbl_cfg_cipsov4_map_add(doip->doi, NULL, NULL, NULL, &nai);
399 printk(KERN_WARNING "%s:%d map add rc = %d\n",
400 __func__, __LINE__, rc);
407 * smk_unlbl_ambient - initialize the unlabeled domain
408 * @oldambient: previous domain string
410 static void smk_unlbl_ambient(char *oldambient)
413 struct netlbl_audit nai;
415 smk_netlabel_audit_set(&nai);
417 if (oldambient != NULL) {
418 rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
420 printk(KERN_WARNING "%s:%d remove rc = %d\n",
421 __func__, __LINE__, rc);
424 rc = netlbl_cfg_unlbl_map_add(smack_net_ambient, PF_INET,
427 printk(KERN_WARNING "%s:%d add rc = %d\n",
428 __func__, __LINE__, rc);
432 * Seq_file read operations for /smack/cipso
435 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
437 if (*pos == SEQ_READ_FINISHED)
439 if (list_empty(&smack_known_list))
442 return smack_known_list.next;
445 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
447 struct list_head *list = v;
450 * labels with no associated cipso value wont be printed
453 if (list_is_last(list, &smack_known_list)) {
454 *pos = SEQ_READ_FINISHED;
462 * Print cipso labels in format:
463 * label level[/cat[,cat]]
465 static int cipso_seq_show(struct seq_file *s, void *v)
467 struct list_head *list = v;
468 struct smack_known *skp =
469 list_entry(list, struct smack_known, list);
470 struct smack_cipso *scp = skp->smk_cipso;
480 seq_printf(s, "%s %3d", (char *)&skp->smk_known, scp->smk_level);
482 cbp = scp->smk_catset;
483 for (i = 0; i < SMK_LABELLEN; i++)
484 for (m = 0x80; m != 0; m >>= 1) {
486 seq_printf(s, "%c%d", sep, cat);
497 static void cipso_seq_stop(struct seq_file *s, void *v)
502 static struct seq_operations cipso_seq_ops = {
503 .start = cipso_seq_start,
504 .stop = cipso_seq_stop,
505 .next = cipso_seq_next,
506 .show = cipso_seq_show,
510 * smk_open_cipso - open() for /smack/cipso
511 * @inode: inode structure representing file
512 * @file: "cipso" file pointer
514 * Connect our cipso_seq_* operations with /smack/cipso
517 static int smk_open_cipso(struct inode *inode, struct file *file)
519 return seq_open(file, &cipso_seq_ops);
523 * smk_write_cipso - write() for /smack/cipso
524 * @file: file pointer, not actually used
525 * @buf: where to get the data from
527 * @ppos: where to start
529 * Accepts only one cipso rule per write call.
530 * Returns number of bytes written or error code, as appropriate
532 static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
533 size_t count, loff_t *ppos)
535 struct smack_known *skp;
536 struct smack_cipso *scp = NULL;
537 char mapcatset[SMK_LABELLEN];
541 ssize_t rc = -EINVAL;
548 * Must have privilege.
550 * Enough data must be present.
552 if (!capable(CAP_MAC_ADMIN))
556 if (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)
559 data = kzalloc(count + 1, GFP_KERNEL);
563 if (copy_from_user(data, buf, count) != 0) {
571 * Only allow one writer at a time. Writes should be
572 * quite rare and small in any case.
574 mutex_lock(&smack_cipso_lock);
576 skp = smk_import_entry(rule, 0);
580 rule += SMK_LABELLEN;
581 ret = sscanf(rule, "%d", &maplevel);
582 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
585 rule += SMK_DIGITLEN;
586 ret = sscanf(rule, "%d", &catlen);
587 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
590 if (count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
593 memset(mapcatset, 0, sizeof(mapcatset));
595 for (i = 0; i < catlen; i++) {
596 rule += SMK_DIGITLEN;
597 ret = sscanf(rule, "%d", &cat);
598 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
601 smack_catset_bit(cat, mapcatset);
604 if (skp->smk_cipso == NULL) {
605 scp = kzalloc(sizeof(struct smack_cipso), GFP_KERNEL);
612 spin_lock_bh(&skp->smk_cipsolock);
615 scp = skp->smk_cipso;
617 skp->smk_cipso = scp;
619 scp->smk_level = maplevel;
620 memcpy(scp->smk_catset, mapcatset, sizeof(mapcatset));
622 spin_unlock_bh(&skp->smk_cipsolock);
626 mutex_unlock(&smack_cipso_lock);
632 static const struct file_operations smk_cipso_ops = {
633 .open = smk_open_cipso,
636 .write = smk_write_cipso,
637 .release = seq_release,
641 * Seq_file read operations for /smack/netlabel
644 static void *netlbladdr_seq_start(struct seq_file *s, loff_t *pos)
646 if (*pos == SEQ_READ_FINISHED)
648 if (list_empty(&smk_netlbladdr_list))
650 return smk_netlbladdr_list.next;
653 static void *netlbladdr_seq_next(struct seq_file *s, void *v, loff_t *pos)
655 struct list_head *list = v;
657 if (list_is_last(list, &smk_netlbladdr_list)) {
658 *pos = SEQ_READ_FINISHED;
664 #define BEBITS (sizeof(__be32) * 8)
667 * Print host/label pairs
669 static int netlbladdr_seq_show(struct seq_file *s, void *v)
671 struct list_head *list = v;
672 struct smk_netlbladdr *skp =
673 list_entry(list, struct smk_netlbladdr, list);
674 unsigned char *hp = (char *) &skp->smk_host.sin_addr.s_addr;
676 u32 temp_mask = be32_to_cpu(skp->smk_mask.s_addr);
678 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
680 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
681 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label);
686 static void netlbladdr_seq_stop(struct seq_file *s, void *v)
691 static struct seq_operations netlbladdr_seq_ops = {
692 .start = netlbladdr_seq_start,
693 .stop = netlbladdr_seq_stop,
694 .next = netlbladdr_seq_next,
695 .show = netlbladdr_seq_show,
699 * smk_open_netlbladdr - open() for /smack/netlabel
700 * @inode: inode structure representing file
701 * @file: "netlabel" file pointer
703 * Connect our netlbladdr_seq_* operations with /smack/netlabel
706 static int smk_open_netlbladdr(struct inode *inode, struct file *file)
708 return seq_open(file, &netlbladdr_seq_ops);
712 * smk_netlbladdr_insert
713 * @new : netlabel to insert
715 * This helper insert netlabel in the smack_netlbladdrs list
716 * sorted by netmask length (longest to smallest)
717 * locked by &smk_netlbladdr_lock in smk_write_netlbladdr
720 static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
722 struct smk_netlbladdr *m, *m_next;
724 if (list_empty(&smk_netlbladdr_list)) {
725 list_add_rcu(&new->list, &smk_netlbladdr_list);
729 m = list_entry(rcu_dereference(smk_netlbladdr_list.next),
730 struct smk_netlbladdr, list);
732 /* the comparison '>' is a bit hacky, but works */
733 if (new->smk_mask.s_addr > m->smk_mask.s_addr) {
734 list_add_rcu(&new->list, &smk_netlbladdr_list);
738 list_for_each_entry_rcu(m, &smk_netlbladdr_list, list) {
739 if (list_is_last(&m->list, &smk_netlbladdr_list)) {
740 list_add_rcu(&new->list, &m->list);
743 m_next = list_entry(rcu_dereference(m->list.next),
744 struct smk_netlbladdr, list);
745 if (new->smk_mask.s_addr > m_next->smk_mask.s_addr) {
746 list_add_rcu(&new->list, &m->list);
754 * smk_write_netlbladdr - write() for /smack/netlabel
755 * @file: file pointer, not actually used
756 * @buf: where to get the data from
758 * @ppos: where to start
760 * Accepts only one netlbladdr per write call.
761 * Returns number of bytes written or error code, as appropriate
763 static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
764 size_t count, loff_t *ppos)
766 struct smk_netlbladdr *skp;
767 struct sockaddr_in newname;
768 char smack[SMK_LABELLEN];
770 char data[SMK_NETLBLADDRMAX];
771 char *host = (char *)&newname.sin_addr.s_addr;
773 struct netlbl_audit audit_info;
777 u32 mask_bits = (1<<31);
782 * Must have privilege.
784 * Enough data must be present.
785 * "<addr/mask, as a.b.c.d/e><space><label>"
786 * "<addr, as a.b.c.d><space><label>"
788 if (!capable(CAP_MAC_ADMIN))
792 if (count < SMK_NETLBLADDRMIN || count > SMK_NETLBLADDRMAX)
794 if (copy_from_user(data, buf, count) != 0)
799 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd/%d %s",
800 &host[0], &host[1], &host[2], &host[3], &m, smack);
802 rc = sscanf(data, "%hhd.%hhd.%hhd.%hhd %s",
803 &host[0], &host[1], &host[2], &host[3], smack);
811 sp = smk_import(smack, 0);
815 for (temp_mask = 0; m > 0; m--) {
816 temp_mask |= mask_bits;
819 mask.s_addr = cpu_to_be32(temp_mask);
821 newname.sin_addr.s_addr &= mask.s_addr;
823 * Only allow one writer at a time. Writes should be
824 * quite rare and small in any case.
826 mutex_lock(&smk_netlbladdr_lock);
828 nsa = newname.sin_addr.s_addr;
829 /* try to find if the prefix is already in the list */
831 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) {
832 if (skp->smk_host.sin_addr.s_addr == nsa &&
833 skp->smk_mask.s_addr == mask.s_addr) {
838 smk_netlabel_audit_set(&audit_info);
841 skp = kzalloc(sizeof(*skp), GFP_KERNEL);
846 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
847 skp->smk_mask.s_addr = mask.s_addr;
849 smk_netlbladdr_insert(skp);
852 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
853 &skp->smk_host.sin_addr, &skp->smk_mask,
854 PF_INET, &audit_info);
859 * Now tell netlabel about the single label nature of
860 * this host so that incoming packets get labeled.
864 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
865 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET,
866 smack_to_secid(skp->smk_label), &audit_info);
871 mutex_unlock(&smk_netlbladdr_lock);
876 static const struct file_operations smk_netlbladdr_ops = {
877 .open = smk_open_netlbladdr,
880 .write = smk_write_netlbladdr,
881 .release = seq_release,
885 * smk_read_doi - read() for /smack/doi
886 * @filp: file pointer, not actually used
887 * @buf: where to put the result
888 * @count: maximum to send along
889 * @ppos: where to start
891 * Returns number of bytes read or error code, as appropriate
893 static ssize_t smk_read_doi(struct file *filp, char __user *buf,
894 size_t count, loff_t *ppos)
902 sprintf(temp, "%d", smk_cipso_doi_value);
903 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
909 * smk_write_doi - write() for /smack/doi
910 * @file: file pointer, not actually used
911 * @buf: where to get the data from
913 * @ppos: where to start
915 * Returns number of bytes written or error code, as appropriate
917 static ssize_t smk_write_doi(struct file *file, const char __user *buf,
918 size_t count, loff_t *ppos)
923 if (!capable(CAP_MAC_ADMIN))
926 if (count >= sizeof(temp) || count == 0)
929 if (copy_from_user(temp, buf, count) != 0)
934 if (sscanf(temp, "%d", &i) != 1)
937 smk_cipso_doi_value = i;
944 static const struct file_operations smk_doi_ops = {
945 .read = smk_read_doi,
946 .write = smk_write_doi,
950 * smk_read_direct - read() for /smack/direct
951 * @filp: file pointer, not actually used
952 * @buf: where to put the result
953 * @count: maximum to send along
954 * @ppos: where to start
956 * Returns number of bytes read or error code, as appropriate
958 static ssize_t smk_read_direct(struct file *filp, char __user *buf,
959 size_t count, loff_t *ppos)
967 sprintf(temp, "%d", smack_cipso_direct);
968 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
974 * smk_write_direct - write() for /smack/direct
975 * @file: file pointer, not actually used
976 * @buf: where to get the data from
978 * @ppos: where to start
980 * Returns number of bytes written or error code, as appropriate
982 static ssize_t smk_write_direct(struct file *file, const char __user *buf,
983 size_t count, loff_t *ppos)
988 if (!capable(CAP_MAC_ADMIN))
991 if (count >= sizeof(temp) || count == 0)
994 if (copy_from_user(temp, buf, count) != 0)
999 if (sscanf(temp, "%d", &i) != 1)
1002 smack_cipso_direct = i;
1007 static const struct file_operations smk_direct_ops = {
1008 .read = smk_read_direct,
1009 .write = smk_write_direct,
1013 * smk_read_ambient - read() for /smack/ambient
1014 * @filp: file pointer, not actually used
1015 * @buf: where to put the result
1016 * @cn: maximum to send along
1017 * @ppos: where to start
1019 * Returns number of bytes read or error code, as appropriate
1021 static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
1022 size_t cn, loff_t *ppos)
1030 * Being careful to avoid a problem in the case where
1031 * smack_net_ambient gets changed in midstream.
1033 mutex_lock(&smack_ambient_lock);
1035 asize = strlen(smack_net_ambient) + 1;
1038 rc = simple_read_from_buffer(buf, cn, ppos,
1039 smack_net_ambient, asize);
1043 mutex_unlock(&smack_ambient_lock);
1049 * smk_write_ambient - write() for /smack/ambient
1050 * @file: file pointer, not actually used
1051 * @buf: where to get the data from
1052 * @count: bytes sent
1053 * @ppos: where to start
1055 * Returns number of bytes written or error code, as appropriate
1057 static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
1058 size_t count, loff_t *ppos)
1060 char in[SMK_LABELLEN];
1064 if (!capable(CAP_MAC_ADMIN))
1067 if (count >= SMK_LABELLEN)
1070 if (copy_from_user(in, buf, count) != 0)
1073 smack = smk_import(in, count);
1077 mutex_lock(&smack_ambient_lock);
1079 oldambient = smack_net_ambient;
1080 smack_net_ambient = smack;
1081 smk_unlbl_ambient(oldambient);
1083 mutex_unlock(&smack_ambient_lock);
1088 static const struct file_operations smk_ambient_ops = {
1089 .read = smk_read_ambient,
1090 .write = smk_write_ambient,
1094 * smk_read_onlycap - read() for /smack/onlycap
1095 * @filp: file pointer, not actually used
1096 * @buf: where to put the result
1097 * @cn: maximum to send along
1098 * @ppos: where to start
1100 * Returns number of bytes read or error code, as appropriate
1102 static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
1103 size_t cn, loff_t *ppos)
1106 ssize_t rc = -EINVAL;
1112 if (smack_onlycap != NULL)
1113 smack = smack_onlycap;
1115 asize = strlen(smack) + 1;
1118 rc = simple_read_from_buffer(buf, cn, ppos, smack, asize);
1124 * smk_write_onlycap - write() for /smack/onlycap
1125 * @file: file pointer, not actually used
1126 * @buf: where to get the data from
1127 * @count: bytes sent
1128 * @ppos: where to start
1130 * Returns number of bytes written or error code, as appropriate
1132 static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1133 size_t count, loff_t *ppos)
1135 char in[SMK_LABELLEN];
1136 char *sp = current->cred->security;
1138 if (!capable(CAP_MAC_ADMIN))
1142 * This can be done using smk_access() but is done
1143 * explicitly for clarity. The smk_access() implementation
1144 * would use smk_access(smack_onlycap, MAY_WRITE)
1146 if (smack_onlycap != NULL && smack_onlycap != sp)
1149 if (count >= SMK_LABELLEN)
1152 if (copy_from_user(in, buf, count) != 0)
1156 * Should the null string be passed in unset the onlycap value.
1157 * This seems like something to be careful with as usually
1158 * smk_import only expects to return NULL for errors. It
1159 * is usually the case that a nullstring or "\n" would be
1160 * bad to pass to smk_import but in fact this is useful here.
1162 smack_onlycap = smk_import(in, count);
1167 static const struct file_operations smk_onlycap_ops = {
1168 .read = smk_read_onlycap,
1169 .write = smk_write_onlycap,
1173 * smk_fill_super - fill the /smackfs superblock
1174 * @sb: the empty superblock
1178 * Fill in the well known entries for /smack
1180 * Returns 0 on success, an error code on failure
1182 static int smk_fill_super(struct super_block *sb, void *data, int silent)
1185 struct inode *root_inode;
1187 static struct tree_descr smack_files[] = {
1189 {"load", &smk_load_ops, S_IRUGO|S_IWUSR},
1191 {"cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
1193 {"doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
1195 {"direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
1197 {"ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
1199 {"netlabel", &smk_netlbladdr_ops, S_IRUGO|S_IWUSR},
1201 {"onlycap", &smk_onlycap_ops, S_IRUGO|S_IWUSR},
1205 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
1207 printk(KERN_ERR "%s failed %d while creating inodes\n",
1212 root_inode = sb->s_root->d_inode;
1213 root_inode->i_security = new_inode_smack(smack_known_floor.smk_known);
1219 * smk_get_sb - get the smackfs superblock
1220 * @fs_type: passed along without comment
1221 * @flags: passed along without comment
1222 * @dev_name: passed along without comment
1223 * @data: passed along without comment
1224 * @mnt: passed along without comment
1226 * Just passes everything along.
1228 * Returns what the lower level code does.
1230 static int smk_get_sb(struct file_system_type *fs_type,
1231 int flags, const char *dev_name, void *data,
1232 struct vfsmount *mnt)
1234 return get_sb_single(fs_type, flags, data, smk_fill_super, mnt);
1237 static struct file_system_type smk_fs_type = {
1239 .get_sb = smk_get_sb,
1240 .kill_sb = kill_litter_super,
1243 static struct vfsmount *smackfs_mount;
1246 * init_smk_fs - get the smackfs superblock
1248 * register the smackfs
1250 * Do not register smackfs if Smack wasn't enabled
1251 * on boot. We can not put this method normally under the
1252 * smack_init() code path since the security subsystem get
1253 * initialized before the vfs caches.
1255 * Returns true if we were not chosen on boot or if
1256 * we were chosen and filesystem registration succeeded.
1258 static int __init init_smk_fs(void)
1262 if (!security_module_enable(&smack_ops))
1265 err = register_filesystem(&smk_fs_type);
1267 smackfs_mount = kern_mount(&smk_fs_type);
1268 if (IS_ERR(smackfs_mount)) {
1269 printk(KERN_ERR "smackfs: could not mount!\n");
1270 err = PTR_ERR(smackfs_mount);
1271 smackfs_mount = NULL;
1276 smk_unlbl_ambient(NULL);
1281 __initcall(init_smk_fs);