smack.h

  1/* SPDX-License-Identifier: GPL-2.0-only */
  2/*
  3 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
  4 *
  5 * Author:
  6 *      Casey Schaufler <casey@schaufler-ca.com>
  7 */
  8
  9#ifndef _SECURITY_SMACK_H
 10#define _SECURITY_SMACK_H
 11
 12#include <linux/capability.h>
 13#include <linux/spinlock.h>
 14#include <linux/lsm_hooks.h>
 15#include <linux/in.h>
 16#if IS_ENABLED(CONFIG_IPV6)
 17#include <linux/in6.h>
 18#endif /* CONFIG_IPV6 */
 19#include <net/netlabel.h>
 20#include <linux/list.h>
 21#include <linux/rculist.h>
 22#include <linux/lsm_audit.h>
 23#include <linux/msg.h>
 24
 25/*
 26 * Use IPv6 port labeling if IPv6 is enabled and secmarks
 27 * are not being used.
 28 */
 29#if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
 30#define SMACK_IPV6_PORT_LABELING 1
 31#endif
 32
 33#if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
 34#define SMACK_IPV6_SECMARK_LABELING 1
 35#endif
 36
 37/*
 38 * Smack labels were limited to 23 characters for a long time.
 39 */
 40#define SMK_LABELLEN	24
 41#define SMK_LONGLABEL	256
 42
 43/*
 44 * This is the repository for labels seen so that it is
 45 * not necessary to keep allocating tiny chunks of memory
 46 * and so that they can be shared.
 47 *
 48 * Labels are never modified in place. Anytime a label
 49 * is imported (e.g. xattrset on a file) the list is checked
 50 * for it and it is added if it doesn't exist. The address
 51 * is passed out in either case. Entries are added, but
 52 * never deleted.
 53 *
 54 * Since labels are hanging around anyway it doesn't
 55 * hurt to maintain a secid for those awkward situations
 56 * where kernel components that ought to use LSM independent
 57 * interfaces don't. The secid should go away when all of
 58 * these components have been repaired.
 59 *
 60 * The cipso value associated with the label gets stored here, too.
 61 *
 62 * Keep the access rules for this subject label here so that
 63 * the entire set of rules does not need to be examined every
 64 * time.
 65 */
 66struct smack_known {
 67	struct list_head		list;
 68	struct hlist_node		smk_hashed;
 69	char				*smk_known;
 70	u32				smk_secid;
 71	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
 72	struct list_head		smk_rules;	/* access rules */
 73	struct mutex			smk_rules_lock;	/* lock for rules */
 74};
 75
 76/*
 77 * Maximum number of bytes for the levels in a CIPSO IP option.
 78 * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
 79 * bigger than can be used, and 24 is the next lower multiple
 80 * of 8, and there are too many issues if there isn't space set
 81 * aside for the terminating null byte.
 82 */
 83#define SMK_CIPSOLEN	24
 84
 85struct superblock_smack {
 86	struct smack_known	*smk_root;
 87	struct smack_known	*smk_floor;
 88	struct smack_known	*smk_hat;
 89	struct smack_known	*smk_default;
 90	int			smk_flags;
 91};
 92
 93/*
 94 * Superblock flags
 95 */
 96#define SMK_SB_INITIALIZED	0x01
 97#define SMK_SB_UNTRUSTED	0x02
 98
 99struct socket_smack {
100	struct smack_known	*smk_out;	/* outbound label */
101	struct smack_known	*smk_in;	/* inbound label */
102	struct smack_known	*smk_packet;	/* TCP peer label */
103	int			smk_state;	/* netlabel socket states */
104};
105#define	SMK_NETLBL_UNSET	0
106#define	SMK_NETLBL_UNLABELED	1
107#define	SMK_NETLBL_LABELED	2
108#define	SMK_NETLBL_REQSKB	3
109
110/*
111 * Inode smack data
112 */
113struct inode_smack {
114	struct smack_known	*smk_inode;	/* label of the fso */
115	struct smack_known	*smk_task;	/* label of the task */
116	struct smack_known	*smk_mmap;	/* label of the mmap domain */
117	int			smk_flags;	/* smack inode flags */
118};
119
120struct task_smack {
121	struct smack_known	*smk_task;	/* label for access control */
122	struct smack_known	*smk_forked;	/* label when forked */
123	struct smack_known	*smk_transmuted;/* label when transmuted */
124	struct list_head	smk_rules;	/* per task access rules */
125	struct mutex		smk_rules_lock;	/* lock for the rules */
126	struct list_head	smk_relabel;	/* transit allowed labels */
127};
128
129#define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
130#define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
131#define	SMK_INODE_CHANGED	0x04	/* smack was transmuted (unused) */
132#define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
133
134/*
135 * A label access rule.
136 */
137struct smack_rule {
138	struct list_head	list;
139	struct smack_known	*smk_subject;
140	struct smack_known	*smk_object;
141	int			smk_access;
142};
143
144/*
145 * An entry in the table identifying IPv4 hosts.
146 */
147struct smk_net4addr {
148	struct list_head	list;
149	struct in_addr		smk_host;	/* network address */
150	struct in_addr		smk_mask;	/* network mask */
151	int			smk_masks;	/* mask size */
152	struct smack_known	*smk_label;	/* label */
153};
154
155#if IS_ENABLED(CONFIG_IPV6)
156/*
157 * An entry in the table identifying IPv6 hosts.
158 */
159struct smk_net6addr {
160	struct list_head	list;
161	struct in6_addr		smk_host;	/* network address */
162	struct in6_addr		smk_mask;	/* network mask */
163	int			smk_masks;	/* mask size */
164	struct smack_known	*smk_label;	/* label */
165};
166#endif /* CONFIG_IPV6 */
167
168#ifdef SMACK_IPV6_PORT_LABELING
169/*
170 * An entry in the table identifying ports.
171 */
172struct smk_port_label {
173	struct list_head	list;
174	struct sock		*smk_sock;	/* socket initialized on */
175	unsigned short		smk_port;	/* the port number */
176	struct smack_known	*smk_in;	/* inbound label */
177	struct smack_known	*smk_out;	/* outgoing label */
178	short			smk_sock_type;	/* Socket type */
179	short			smk_can_reuse;
180};
181#endif /* SMACK_IPV6_PORT_LABELING */
182
183struct smack_known_list_elem {
184	struct list_head	list;
185	struct smack_known	*smk_label;
186};
187
188enum {
189	Opt_error = -1,
190	Opt_fsdefault = 0,
191	Opt_fsfloor = 1,
192	Opt_fshat = 2,
193	Opt_fsroot = 3,
194	Opt_fstransmute = 4,
195};
196
197#define SMACK_DELETE_OPTION	"-DELETE"
198#define SMACK_CIPSO_OPTION 	"-CIPSO"
199
200/*
201 * CIPSO defaults.
202 */
203#define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
204#define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
205#define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
206#define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
207#define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
208/*
209 * CIPSO 2.2 standard is 239, but Smack wants to use the
210 * categories in a structured way that limits the value to
211 * the bits in 23 bytes, hence the unusual number.
212 */
213#define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
214
215/*
216 * Ptrace rules
217 */
218#define SMACK_PTRACE_DEFAULT	0
219#define SMACK_PTRACE_EXACT	1
220#define SMACK_PTRACE_DRACONIAN	2
221#define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
222
223/*
224 * Flags for untraditional access modes.
225 * It shouldn't be necessary to avoid conflicts with definitions
226 * in fs.h, but do so anyway.
227 */
228#define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
229#define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
230#define MAY_BRINGUP	0x00004000	/* Report use of this rule */
231
232/*
233 * The policy for delivering signals is configurable.
234 * It is usually "write", but can be "append".
235 */
236#ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
237#define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
238#else
239#define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
240#endif
241
242#define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
243#define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
244#define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
245
246/*
247 * Just to make the common cases easier to deal with
248 */
249#define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
250#define MAY_READWRITE	(MAY_READ | MAY_WRITE)
251#define MAY_NOT		0
252
253/*
254 * Number of access types used by Smack (rwxatlb)
255 */
256#define SMK_NUM_ACCESS_TYPE 7
257
258/* SMACK data */
259struct smack_audit_data {
260	const char *function;
261	char *subject;
262	char *object;
263	char *request;
264	int result;
265};
266
267/*
268 * Smack audit data; is empty if CONFIG_AUDIT not set
269 * to save some stack
270 */
271struct smk_audit_info {
272#ifdef CONFIG_AUDIT
273	struct common_audit_data a;
274	struct smack_audit_data sad;
275#endif
276};
277
278/*
279 * Initialization
280 */
281#if defined(CONFIG_SECURITY_SMACK_NETFILTER)
282int smack_nf_ip_init(void);
283#else
284static inline int smack_nf_ip_init(void)
285{
286	return 0;
287}
288#endif
289int init_smk_fs(void);
290int smack_initcall(void);
291
292/*
293 * These functions are in smack_access.c
294 */
295int smk_access_entry(char *, char *, struct list_head *);
296int smk_access(struct smack_known *, struct smack_known *,
297	       int, struct smk_audit_info *);
298int smk_tskacc(struct task_smack *, struct smack_known *,
299	       u32, struct smk_audit_info *);
300int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
301int smack_str_from_perm(char *string, int access);
302struct smack_known *smack_from_secid(const u32);
303int smk_parse_label_len(const char *string, int len);
304char *smk_parse_smack(const char *string, int len);
305int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
306struct smack_known *smk_import_entry(const char *, int);
307struct smack_known *smk_import_valid_label(const char *label, int label_len,
308					   gfp_t gfp);
309void smk_insert_entry(struct smack_known *skp);
310struct smack_known *smk_find_entry(const char *);
311bool smack_privileged(int cap);
312bool smack_privileged_cred(int cap, const struct cred *cred);
313void smk_destroy_label_list(struct list_head *list);
314int smack_populate_secattr(struct smack_known *skp);
315
316/*
317 * Shared data.
318 */
319extern int smack_enabled __initdata;
320extern int smack_cipso_direct;
321extern int smack_cipso_mapped;
322extern struct smack_known *smack_net_ambient;
323extern struct smack_known *smack_syslog_label;
324#ifdef CONFIG_SECURITY_SMACK_BRINGUP
325extern struct smack_known *smack_unconfined;
326#endif
327extern int smack_ptrace_rule;
328extern struct lsm_blob_sizes smack_blob_sizes;
329
330extern struct smack_known smack_known_floor;
331extern struct smack_known smack_known_hat;
332extern struct smack_known smack_known_huh;
333extern struct smack_known smack_known_star;
334extern struct smack_known smack_known_web;
335
336extern struct mutex	smack_known_lock;
337extern struct list_head smack_known_list;
338extern struct list_head smk_net4addr_list;
339#if IS_ENABLED(CONFIG_IPV6)
340extern struct list_head smk_net6addr_list;
341#endif /* CONFIG_IPV6 */
342
343extern struct mutex     smack_onlycap_lock;
344extern struct list_head smack_onlycap_list;
345
346#define SMACK_HASH_SLOTS 16
347extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
348extern struct kmem_cache *smack_rule_cache;
349
350static inline struct task_smack *smack_cred(const struct cred *cred)
351{
352	return cred->security + smack_blob_sizes.lbs_cred;
353}
354
355static inline struct smack_known **smack_file(const struct file *file)
356{
357	return (struct smack_known **)(file->f_security +
358				       smack_blob_sizes.lbs_file);
359}
360
361static inline struct inode_smack *smack_inode(const struct inode *inode)
362{
363	return inode->i_security + smack_blob_sizes.lbs_inode;
364}
365
366static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
367{
368	return msg->security + smack_blob_sizes.lbs_msg_msg;
369}
370
371static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
372{
373	return ipc->security + smack_blob_sizes.lbs_ipc;
374}
375
376static inline struct superblock_smack *smack_superblock(
377					const struct super_block *superblock)
378{
379	return superblock->s_security + smack_blob_sizes.lbs_superblock;
380}
381
382static inline struct socket_smack *smack_sock(const struct sock *sock)
383{
384	return sock->sk_security + smack_blob_sizes.lbs_sock;
385}
386
387#ifdef CONFIG_KEYS
388static inline struct smack_known **smack_key(const struct key *key)
389{
390	return key->security + smack_blob_sizes.lbs_key;
391}
392#endif /* CONFIG_KEYS */
393
394/*
395 * Is the directory transmuting?
396 */
397static inline int smk_inode_transmutable(const struct inode *isp)
398{
399	struct inode_smack *sip = smack_inode(isp);
400	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
401}
402
403/*
404 * Present a pointer to the smack label entry in an inode blob.
405 */
406static inline struct smack_known *smk_of_inode(const struct inode *isp)
407{
408	struct inode_smack *sip = smack_inode(isp);
409	return sip->smk_inode;
410}
411
412/*
413 * Present a pointer to the smack label entry in an task blob.
414 */
415static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
416{
417	return tsp->smk_task;
418}
419
420static inline struct smack_known *smk_of_task_struct_obj(
421						const struct task_struct *t)
422{
423	struct smack_known *skp;
424	const struct cred *cred;
425
426	rcu_read_lock();
427
428	cred = __task_cred(t);
429	skp = smk_of_task(smack_cred(cred));
430
431	rcu_read_unlock();
432
433	return skp;
434}
435
436/*
437 * Present a pointer to the forked smack label entry in an task blob.
438 */
439static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
440{
441	return tsp->smk_forked;
442}
443
444/*
445 * Present a pointer to the smack label in the current task blob.
446 */
447static inline struct smack_known *smk_of_current(void)
448{
449	return smk_of_task(smack_cred(current_cred()));
450}
451
452void smack_log(char *subject_label, char *object_label,
453		int request,
454		int result, struct smk_audit_info *auditdata);
455
456#ifdef CONFIG_AUDIT
457
458/*
459 * logging functions
460 */
461#define SMACK_AUDIT_DENIED 0x1
462#define SMACK_AUDIT_ACCEPT 0x2
463extern int log_policy;
464
465/*
466 * some inline functions to set up audit data
467 * they do nothing if CONFIG_AUDIT is not set
468 *
469 */
470static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
471			       char type)
472{
473	memset(&a->sad, 0, sizeof(a->sad));
474	a->a.type = type;
475	a->a.smack_audit_data = &a->sad;
476	a->a.smack_audit_data->function = func;
477}
478
479static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
480				   char type, struct lsm_network_audit *net)
481{
482	smk_ad_init(a, func, type);
483	memset(net, 0, sizeof(*net));
484	a->a.u.net = net;
485}
486
487static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
488					 struct task_struct *t)
489{
490	a->a.u.tsk = t;
491}
492static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
493						    struct dentry *d)
494{
495	a->a.u.dentry = d;
496}
497static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
498					      struct inode *i)
499{
500	a->a.u.inode = i;
501}
502static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
503					     struct path p)
504{
505	a->a.u.path = p;
506}
507static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
508					    struct sock *sk)
509{
510	a->a.u.net->sk = sk;
511}
512
513#else /* no AUDIT */
514
515static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
516			       char type)
517{
518}
519static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
520					 struct task_struct *t)
521{
522}
523static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
524						    struct dentry *d)
525{
526}
527static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
528					      struct inode *i)
529{
530}
531static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
532					     struct path p)
533{
534}
535static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
536					    struct sock *sk)
537{
538}
539#endif
540
541#endif  /* _SECURITY_SMACK_H */