![Casey Schaufler](/assets/img/avatar_default.png)
Add support for unlabeled network hosts and networks. Relies heavily on Paul Moore's netlabel support. Creates a new entry in /smack called netlabel. Writes to /smack/netlabel take the form: A.B.C.D LABEL or A.B.C.D/N LABEL where A.B.C.D is a network address, N is an integer between 0-32, and LABEL is the Smack label to be used. If /N is omitted /32 is assumed. N designates the netmask for the address. Entries are matched by the most specific address/mask pair. 0.0.0.0/0 will match everything, while 192.168.1.117/32 will match exactly one host. A new system label "@", pronounced "web", is defined. Processes can not be assigned the web label. An address assigned the web label can be written to by any process, and packets coming from a web address can be written to any socket. Use of the web label is a violation of any strict MAC policy, but the web label has been requested many times. The nltype entry has been removed from /smack. It did not work right and the netlabel interface can be used to specify that all hosts be treated as unlabeled. CIPSO labels on incoming packets will be honored, even from designated single label hosts. Single label hosts can only be written to by processes with labels that can write to the label of the host. Packets sent to single label hosts will always be unlabeled. Once added a single label designation cannot be removed, however the label may be changed. The behavior of the ambient label remains unchanged. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul.moore@hp.com>
375 lines
9.6 KiB
C
375 lines
9.6 KiB
C
/*
|
|
* Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, version 2.
|
|
*
|
|
* Author:
|
|
* Casey Schaufler <casey@schaufler-ca.com>
|
|
*
|
|
*/
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/sched.h>
|
|
#include "smack.h"
|
|
|
|
struct smack_known smack_known_huh = {
|
|
.smk_next = NULL,
|
|
.smk_known = "?",
|
|
.smk_secid = 2,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known smack_known_hat = {
|
|
.smk_next = &smack_known_huh,
|
|
.smk_known = "^",
|
|
.smk_secid = 3,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known smack_known_star = {
|
|
.smk_next = &smack_known_hat,
|
|
.smk_known = "*",
|
|
.smk_secid = 4,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known smack_known_floor = {
|
|
.smk_next = &smack_known_star,
|
|
.smk_known = "_",
|
|
.smk_secid = 5,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known smack_known_invalid = {
|
|
.smk_next = &smack_known_floor,
|
|
.smk_known = "",
|
|
.smk_secid = 6,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known smack_known_web = {
|
|
.smk_next = &smack_known_invalid,
|
|
.smk_known = "@",
|
|
.smk_secid = 7,
|
|
.smk_cipso = NULL,
|
|
};
|
|
|
|
struct smack_known *smack_known = &smack_known_web;
|
|
|
|
/*
|
|
* The initial value needs to be bigger than any of the
|
|
* known values above.
|
|
*/
|
|
static u32 smack_next_secid = 10;
|
|
|
|
/**
|
|
* smk_access - determine if a subject has a specific access to an object
|
|
* @subject_label: a pointer to the subject's Smack label
|
|
* @object_label: a pointer to the object's Smack label
|
|
* @request: the access requested, in "MAY" format
|
|
*
|
|
* This function looks up the subject/object pair in the
|
|
* access rule list and returns 0 if the access is permitted,
|
|
* non zero otherwise.
|
|
*
|
|
* Even though Smack labels are usually shared on smack_list
|
|
* labels that come in off the network can't be imported
|
|
* and added to the list for locking reasons.
|
|
*
|
|
* Therefore, it is necessary to check the contents of the labels,
|
|
* not just the pointer values. Of course, in most cases the labels
|
|
* will be on the list, so checking the pointers may be a worthwhile
|
|
* optimization.
|
|
*/
|
|
int smk_access(char *subject_label, char *object_label, int request)
|
|
{
|
|
u32 may = MAY_NOT;
|
|
struct smk_list_entry *sp;
|
|
struct smack_rule *srp;
|
|
|
|
/*
|
|
* Hardcoded comparisons.
|
|
*
|
|
* A star subject can't access any object.
|
|
*/
|
|
if (subject_label == smack_known_star.smk_known ||
|
|
strcmp(subject_label, smack_known_star.smk_known) == 0)
|
|
return -EACCES;
|
|
/*
|
|
* An internet object can be accessed by any subject.
|
|
* Tasks cannot be assigned the internet label.
|
|
* An internet subject can access any object.
|
|
*/
|
|
if (object_label == smack_known_web.smk_known ||
|
|
subject_label == smack_known_web.smk_known ||
|
|
strcmp(object_label, smack_known_web.smk_known) == 0 ||
|
|
strcmp(subject_label, smack_known_web.smk_known) == 0)
|
|
return 0;
|
|
/*
|
|
* A star object can be accessed by any subject.
|
|
*/
|
|
if (object_label == smack_known_star.smk_known ||
|
|
strcmp(object_label, smack_known_star.smk_known) == 0)
|
|
return 0;
|
|
/*
|
|
* An object can be accessed in any way by a subject
|
|
* with the same label.
|
|
*/
|
|
if (subject_label == object_label ||
|
|
strcmp(subject_label, object_label) == 0)
|
|
return 0;
|
|
/*
|
|
* A hat subject can read any object.
|
|
* A floor object can be read by any subject.
|
|
*/
|
|
if ((request & MAY_ANYREAD) == request) {
|
|
if (object_label == smack_known_floor.smk_known ||
|
|
strcmp(object_label, smack_known_floor.smk_known) == 0)
|
|
return 0;
|
|
if (subject_label == smack_known_hat.smk_known ||
|
|
strcmp(subject_label, smack_known_hat.smk_known) == 0)
|
|
return 0;
|
|
}
|
|
/*
|
|
* Beyond here an explicit relationship is required.
|
|
* If the requested access is contained in the available
|
|
* access (e.g. read is included in readwrite) it's
|
|
* good.
|
|
*/
|
|
for (sp = smack_list; sp != NULL; sp = sp->smk_next) {
|
|
srp = &sp->smk_rule;
|
|
|
|
if (srp->smk_subject == subject_label ||
|
|
strcmp(srp->smk_subject, subject_label) == 0) {
|
|
if (srp->smk_object == object_label ||
|
|
strcmp(srp->smk_object, object_label) == 0) {
|
|
may = srp->smk_access;
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
/*
|
|
* This is a bit map operation.
|
|
*/
|
|
if ((request & may) == request)
|
|
return 0;
|
|
|
|
return -EACCES;
|
|
}
|
|
|
|
/**
|
|
* smk_curacc - determine if current has a specific access to an object
|
|
* @object_label: a pointer to the object's Smack label
|
|
* @request: the access requested, in "MAY" format
|
|
*
|
|
* This function checks the current subject label/object label pair
|
|
* in the access rule list and returns 0 if the access is permitted,
|
|
* non zero otherwise. It allows that current may have the capability
|
|
* to override the rules.
|
|
*/
|
|
int smk_curacc(char *obj_label, u32 mode)
|
|
{
|
|
int rc;
|
|
|
|
rc = smk_access(current_security(), obj_label, mode);
|
|
if (rc == 0)
|
|
return 0;
|
|
|
|
/*
|
|
* Return if a specific label has been designated as the
|
|
* only one that gets privilege and current does not
|
|
* have that label.
|
|
*/
|
|
if (smack_onlycap != NULL && smack_onlycap != current->cred->security)
|
|
return rc;
|
|
|
|
if (capable(CAP_MAC_OVERRIDE))
|
|
return 0;
|
|
|
|
return rc;
|
|
}
|
|
|
|
static DEFINE_MUTEX(smack_known_lock);
|
|
|
|
/**
|
|
* smk_import_entry - import a label, return the list entry
|
|
* @string: a text string that might be a Smack label
|
|
* @len: the maximum size, or zero if it is NULL terminated.
|
|
*
|
|
* Returns a pointer to the entry in the label list that
|
|
* matches the passed string, adding it if necessary.
|
|
*/
|
|
struct smack_known *smk_import_entry(const char *string, int len)
|
|
{
|
|
struct smack_known *skp;
|
|
char smack[SMK_LABELLEN];
|
|
int found;
|
|
int i;
|
|
|
|
if (len <= 0 || len > SMK_MAXLEN)
|
|
len = SMK_MAXLEN;
|
|
|
|
for (i = 0, found = 0; i < SMK_LABELLEN; i++) {
|
|
if (found)
|
|
smack[i] = '\0';
|
|
else if (i >= len || string[i] > '~' || string[i] <= ' ' ||
|
|
string[i] == '/') {
|
|
smack[i] = '\0';
|
|
found = 1;
|
|
} else
|
|
smack[i] = string[i];
|
|
}
|
|
|
|
if (smack[0] == '\0')
|
|
return NULL;
|
|
|
|
mutex_lock(&smack_known_lock);
|
|
|
|
for (skp = smack_known; skp != NULL; skp = skp->smk_next)
|
|
if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0)
|
|
break;
|
|
|
|
if (skp == NULL) {
|
|
skp = kzalloc(sizeof(struct smack_known), GFP_KERNEL);
|
|
if (skp != NULL) {
|
|
skp->smk_next = smack_known;
|
|
strncpy(skp->smk_known, smack, SMK_MAXLEN);
|
|
skp->smk_secid = smack_next_secid++;
|
|
skp->smk_cipso = NULL;
|
|
spin_lock_init(&skp->smk_cipsolock);
|
|
/*
|
|
* Make sure that the entry is actually
|
|
* filled before putting it on the list.
|
|
*/
|
|
smp_mb();
|
|
smack_known = skp;
|
|
}
|
|
}
|
|
|
|
mutex_unlock(&smack_known_lock);
|
|
|
|
return skp;
|
|
}
|
|
|
|
/**
|
|
* smk_import - import a smack label
|
|
* @string: a text string that might be a Smack label
|
|
* @len: the maximum size, or zero if it is NULL terminated.
|
|
*
|
|
* Returns a pointer to the label in the label list that
|
|
* matches the passed string, adding it if necessary.
|
|
*/
|
|
char *smk_import(const char *string, int len)
|
|
{
|
|
struct smack_known *skp;
|
|
|
|
skp = smk_import_entry(string, len);
|
|
if (skp == NULL)
|
|
return NULL;
|
|
return skp->smk_known;
|
|
}
|
|
|
|
/**
|
|
* smack_from_secid - find the Smack label associated with a secid
|
|
* @secid: an integer that might be associated with a Smack label
|
|
*
|
|
* Returns a pointer to the appropraite Smack label if there is one,
|
|
* otherwise a pointer to the invalid Smack label.
|
|
*/
|
|
char *smack_from_secid(const u32 secid)
|
|
{
|
|
struct smack_known *skp;
|
|
|
|
for (skp = smack_known; skp != NULL; skp = skp->smk_next)
|
|
if (skp->smk_secid == secid)
|
|
return skp->smk_known;
|
|
|
|
/*
|
|
* If we got this far someone asked for the translation
|
|
* of a secid that is not on the list.
|
|
*/
|
|
return smack_known_invalid.smk_known;
|
|
}
|
|
|
|
/**
|
|
* smack_to_secid - find the secid associated with a Smack label
|
|
* @smack: the Smack label
|
|
*
|
|
* Returns the appropriate secid if there is one,
|
|
* otherwise 0
|
|
*/
|
|
u32 smack_to_secid(const char *smack)
|
|
{
|
|
struct smack_known *skp;
|
|
|
|
for (skp = smack_known; skp != NULL; skp = skp->smk_next)
|
|
if (strncmp(skp->smk_known, smack, SMK_MAXLEN) == 0)
|
|
return skp->smk_secid;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* smack_from_cipso - find the Smack label associated with a CIPSO option
|
|
* @level: Bell & LaPadula level from the network
|
|
* @cp: Bell & LaPadula categories from the network
|
|
* @result: where to put the Smack value
|
|
*
|
|
* This is a simple lookup in the label table.
|
|
*
|
|
* This is an odd duck as far as smack handling goes in that
|
|
* it sends back a copy of the smack label rather than a pointer
|
|
* to the master list. This is done because it is possible for
|
|
* a foreign host to send a smack label that is new to this
|
|
* machine and hence not on the list. That would not be an
|
|
* issue except that adding an entry to the master list can't
|
|
* be done at that point.
|
|
*/
|
|
void smack_from_cipso(u32 level, char *cp, char *result)
|
|
{
|
|
struct smack_known *kp;
|
|
char *final = NULL;
|
|
|
|
for (kp = smack_known; final == NULL && kp != NULL; kp = kp->smk_next) {
|
|
if (kp->smk_cipso == NULL)
|
|
continue;
|
|
|
|
spin_lock_bh(&kp->smk_cipsolock);
|
|
|
|
if (kp->smk_cipso->smk_level == level &&
|
|
memcmp(kp->smk_cipso->smk_catset, cp, SMK_LABELLEN) == 0)
|
|
final = kp->smk_known;
|
|
|
|
spin_unlock_bh(&kp->smk_cipsolock);
|
|
}
|
|
if (final == NULL)
|
|
final = smack_known_huh.smk_known;
|
|
strncpy(result, final, SMK_MAXLEN);
|
|
return;
|
|
}
|
|
|
|
/**
|
|
* smack_to_cipso - find the CIPSO option to go with a Smack label
|
|
* @smack: a pointer to the smack label in question
|
|
* @cp: where to put the result
|
|
*
|
|
* Returns zero if a value is available, non-zero otherwise.
|
|
*/
|
|
int smack_to_cipso(const char *smack, struct smack_cipso *cp)
|
|
{
|
|
struct smack_known *kp;
|
|
|
|
for (kp = smack_known; kp != NULL; kp = kp->smk_next)
|
|
if (kp->smk_known == smack ||
|
|
strcmp(kp->smk_known, smack) == 0)
|
|
break;
|
|
|
|
if (kp == NULL || kp->smk_cipso == NULL)
|
|
return -ENOENT;
|
|
|
|
memcpy(cp, kp->smk_cipso, sizeof(struct smack_cipso));
|
|
return 0;
|
|
}
|