1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
4  *
5  * Author:
6  *      Casey Schaufler <casey@schaufler-ca.com>
7  */
8 
9 #ifndef _SECURITY_SMACK_H
10 #define _SECURITY_SMACK_H
11 
12 #include <linux/capability.h>
13 #include <linux/spinlock.h>
14 #include <linux/lsm_hooks.h>
15 #include <linux/in.h>
16 #if IS_ENABLED(CONFIG_IPV6)
17 #include <linux/in6.h>
18 #endif /* CONFIG_IPV6 */
19 #include <net/netlabel.h>
20 #include <linux/list.h>
21 #include <linux/rculist.h>
22 #include <linux/lsm_audit.h>
23 #include <linux/msg.h>
24 
25 /*
26  * Use IPv6 port labeling if IPv6 is enabled and secmarks
27  * are not being used.
28  */
29 #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
30 #define SMACK_IPV6_PORT_LABELING 1
31 #endif
32 
33 #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
34 #define SMACK_IPV6_SECMARK_LABELING 1
35 #endif
36 
37 /*
38  * Smack labels were limited to 23 characters for a long time.
39  */
40 #define SMK_LABELLEN	24
41 #define SMK_LONGLABEL	256
42 
43 /*
44  * This is the repository for labels seen so that it is
45  * not necessary to keep allocating tiny chunks of memory
46  * and so that they can be shared.
47  *
48  * Labels are never modified in place. Anytime a label
49  * is imported (e.g. xattrset on a file) the list is checked
50  * for it and it is added if it doesn't exist. The address
51  * is passed out in either case. Entries are added, but
52  * never deleted.
53  *
54  * Since labels are hanging around anyway it doesn't
55  * hurt to maintain a secid for those awkward situations
56  * where kernel components that ought to use LSM independent
57  * interfaces don't. The secid should go away when all of
58  * these components have been repaired.
59  *
60  * The cipso value associated with the label gets stored here, too.
61  *
62  * Keep the access rules for this subject label here so that
63  * the entire set of rules does not need to be examined every
64  * time.
65  */
66 struct smack_known {
67 	struct list_head		list;
68 	struct hlist_node		smk_hashed;
69 	char				*smk_known;
70 	u32				smk_secid;
71 	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
72 	struct list_head		smk_rules;	/* access rules */
73 	struct mutex			smk_rules_lock;	/* lock for rules */
74 };
75 
76 /*
77  * Maximum number of bytes for the levels in a CIPSO IP option.
78  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
79  * bigger than can be used, and 24 is the next lower multiple
80  * of 8, and there are too many issues if there isn't space set
81  * aside for the terminating null byte.
82  */
83 #define SMK_CIPSOLEN	24
84 
85 struct superblock_smack {
86 	struct smack_known	*smk_root;
87 	struct smack_known	*smk_floor;
88 	struct smack_known	*smk_hat;
89 	struct smack_known	*smk_default;
90 	int			smk_flags;
91 };
92 
93 /*
94  * Superblock flags
95  */
96 #define SMK_SB_INITIALIZED	0x01
97 #define SMK_SB_UNTRUSTED	0x02
98 
99 struct socket_smack {
100 	struct smack_known	*smk_out;	/* outbound label */
101 	struct smack_known	*smk_in;	/* inbound label */
102 	struct smack_known	*smk_packet;	/* TCP peer label */
103 	int			smk_state;	/* netlabel socket states */
104 };
105 #define	SMK_NETLBL_UNSET	0
106 #define	SMK_NETLBL_UNLABELED	1
107 #define	SMK_NETLBL_LABELED	2
108 #define	SMK_NETLBL_REQSKB	3
109 
110 /*
111  * Inode smack data
112  */
113 struct inode_smack {
114 	struct smack_known	*smk_inode;	/* label of the fso */
115 	struct smack_known	*smk_task;	/* label of the task */
116 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
117 	int			smk_flags;	/* smack inode flags */
118 };
119 
120 struct task_smack {
121 	struct smack_known	*smk_task;	/* label for access control */
122 	struct smack_known	*smk_forked;	/* label when forked */
123 	struct smack_known	*smk_transmuted;/* label when transmuted */
124 	struct list_head	smk_rules;	/* per task access rules */
125 	struct mutex		smk_rules_lock;	/* lock for the rules */
126 	struct list_head	smk_relabel;	/* transit allowed labels */
127 };
128 
129 #define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
130 #define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
131 #define	SMK_INODE_CHANGED	0x04	/* smack was transmuted (unused) */
132 #define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
133 
134 /*
135  * A label access rule.
136  */
137 struct smack_rule {
138 	struct list_head	list;
139 	struct smack_known	*smk_subject;
140 	struct smack_known	*smk_object;
141 	int			smk_access;
142 };
143 
144 /*
145  * An entry in the table identifying IPv4 hosts.
146  */
147 struct smk_net4addr {
148 	struct list_head	list;
149 	struct in_addr		smk_host;	/* network address */
150 	struct in_addr		smk_mask;	/* network mask */
151 	int			smk_masks;	/* mask size */
152 	struct smack_known	*smk_label;	/* label */
153 };
154 
155 #if IS_ENABLED(CONFIG_IPV6)
156 /*
157  * An entry in the table identifying IPv6 hosts.
158  */
159 struct smk_net6addr {
160 	struct list_head	list;
161 	struct in6_addr		smk_host;	/* network address */
162 	struct in6_addr		smk_mask;	/* network mask */
163 	int			smk_masks;	/* mask size */
164 	struct smack_known	*smk_label;	/* label */
165 };
166 #endif /* CONFIG_IPV6 */
167 
168 #ifdef SMACK_IPV6_PORT_LABELING
169 /*
170  * An entry in the table identifying ports.
171  */
172 struct smk_port_label {
173 	struct list_head	list;
174 	struct sock		*smk_sock;	/* socket initialized on */
175 	unsigned short		smk_port;	/* the port number */
176 	struct smack_known	*smk_in;	/* inbound label */
177 	struct smack_known	*smk_out;	/* outgoing label */
178 	short			smk_sock_type;	/* Socket type */
179 	short			smk_can_reuse;
180 };
181 #endif /* SMACK_IPV6_PORT_LABELING */
182 
183 struct smack_known_list_elem {
184 	struct list_head	list;
185 	struct smack_known	*smk_label;
186 };
187 
188 enum {
189 	Opt_error = -1,
190 	Opt_fsdefault = 0,
191 	Opt_fsfloor = 1,
192 	Opt_fshat = 2,
193 	Opt_fsroot = 3,
194 	Opt_fstransmute = 4,
195 };
196 
197 #define SMACK_DELETE_OPTION	"-DELETE"
198 #define SMACK_CIPSO_OPTION 	"-CIPSO"
199 
200 /*
201  * CIPSO defaults.
202  */
203 #define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
204 #define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
205 #define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
206 #define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
207 #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
208 /*
209  * CIPSO 2.2 standard is 239, but Smack wants to use the
210  * categories in a structured way that limits the value to
211  * the bits in 23 bytes, hence the unusual number.
212  */
213 #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
214 
215 /*
216  * Ptrace rules
217  */
218 #define SMACK_PTRACE_DEFAULT	0
219 #define SMACK_PTRACE_EXACT	1
220 #define SMACK_PTRACE_DRACONIAN	2
221 #define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
222 
223 /*
224  * Flags for untraditional access modes.
225  * It shouldn't be necessary to avoid conflicts with definitions
226  * in fs.h, but do so anyway.
227  */
228 #define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
229 #define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
230 #define MAY_BRINGUP	0x00004000	/* Report use of this rule */
231 
232 /*
233  * The policy for delivering signals is configurable.
234  * It is usually "write", but can be "append".
235  */
236 #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
237 #define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
238 #else
239 #define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
240 #endif
241 
242 #define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
243 #define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
244 #define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
245 
246 /*
247  * Just to make the common cases easier to deal with
248  */
249 #define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
250 #define MAY_READWRITE	(MAY_READ | MAY_WRITE)
251 #define MAY_NOT		0
252 
253 /*
254  * Number of access types used by Smack (rwxatlb)
255  */
256 #define SMK_NUM_ACCESS_TYPE 7
257 
258 /* SMACK data */
259 struct smack_audit_data {
260 	const char *function;
261 	char *subject;
262 	char *object;
263 	char *request;
264 	int result;
265 };
266 
267 /*
268  * Smack audit data; is empty if CONFIG_AUDIT not set
269  * to save some stack
270  */
271 struct smk_audit_info {
272 #ifdef CONFIG_AUDIT
273 	struct common_audit_data a;
274 	struct smack_audit_data sad;
275 #endif
276 };
277 
278 /*
279  * These functions are in smack_access.c
280  */
281 int smk_access_entry(char *, char *, struct list_head *);
282 int smk_access(struct smack_known *, struct smack_known *,
283 	       int, struct smk_audit_info *);
284 int smk_tskacc(struct task_smack *, struct smack_known *,
285 	       u32, struct smk_audit_info *);
286 int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
287 int smack_str_from_perm(char *string, int access);
288 struct smack_known *smack_from_secid(const u32);
289 char *smk_parse_smack(const char *string, int len);
290 int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
291 struct smack_known *smk_import_entry(const char *, int);
292 void smk_insert_entry(struct smack_known *skp);
293 struct smack_known *smk_find_entry(const char *);
294 bool smack_privileged(int cap);
295 bool smack_privileged_cred(int cap, const struct cred *cred);
296 void smk_destroy_label_list(struct list_head *list);
297 int smack_populate_secattr(struct smack_known *skp);
298 
299 /*
300  * Shared data.
301  */
302 extern int smack_enabled __initdata;
303 extern int smack_cipso_direct;
304 extern int smack_cipso_mapped;
305 extern struct smack_known *smack_net_ambient;
306 extern struct smack_known *smack_syslog_label;
307 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
308 extern struct smack_known *smack_unconfined;
309 #endif
310 extern int smack_ptrace_rule;
311 extern struct lsm_blob_sizes smack_blob_sizes;
312 
313 extern struct smack_known smack_known_floor;
314 extern struct smack_known smack_known_hat;
315 extern struct smack_known smack_known_huh;
316 extern struct smack_known smack_known_star;
317 extern struct smack_known smack_known_web;
318 
319 extern struct mutex	smack_known_lock;
320 extern struct list_head smack_known_list;
321 extern struct list_head smk_net4addr_list;
322 #if IS_ENABLED(CONFIG_IPV6)
323 extern struct list_head smk_net6addr_list;
324 #endif /* CONFIG_IPV6 */
325 
326 extern struct mutex     smack_onlycap_lock;
327 extern struct list_head smack_onlycap_list;
328 
329 #define SMACK_HASH_SLOTS 16
330 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
331 extern struct kmem_cache *smack_rule_cache;
332 
333 static inline struct task_smack *smack_cred(const struct cred *cred)
334 {
335 	return cred->security + smack_blob_sizes.lbs_cred;
336 }
337 
338 static inline struct smack_known **smack_file(const struct file *file)
339 {
340 	return (struct smack_known **)(file->f_security +
341 				       smack_blob_sizes.lbs_file);
342 }
343 
344 static inline struct inode_smack *smack_inode(const struct inode *inode)
345 {
346 	return inode->i_security + smack_blob_sizes.lbs_inode;
347 }
348 
349 static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
350 {
351 	return msg->security + smack_blob_sizes.lbs_msg_msg;
352 }
353 
354 static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
355 {
356 	return ipc->security + smack_blob_sizes.lbs_ipc;
357 }
358 
359 static inline struct superblock_smack *smack_superblock(
360 					const struct super_block *superblock)
361 {
362 	return superblock->s_security + smack_blob_sizes.lbs_superblock;
363 }
364 
365 static inline struct socket_smack *smack_sock(const struct sock *sock)
366 {
367 	return sock->sk_security + smack_blob_sizes.lbs_sock;
368 }
369 
370 #ifdef CONFIG_KEYS
371 static inline struct smack_known **smack_key(const struct key *key)
372 {
373 	return key->security + smack_blob_sizes.lbs_key;
374 }
375 #endif /* CONFIG_KEYS */
376 
377 /*
378  * Is the directory transmuting?
379  */
380 static inline int smk_inode_transmutable(const struct inode *isp)
381 {
382 	struct inode_smack *sip = smack_inode(isp);
383 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
384 }
385 
386 /*
387  * Present a pointer to the smack label entry in an inode blob.
388  */
389 static inline struct smack_known *smk_of_inode(const struct inode *isp)
390 {
391 	struct inode_smack *sip = smack_inode(isp);
392 	return sip->smk_inode;
393 }
394 
395 /*
396  * Present a pointer to the smack label entry in an task blob.
397  */
398 static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
399 {
400 	return tsp->smk_task;
401 }
402 
403 static inline struct smack_known *smk_of_task_struct_obj(
404 						const struct task_struct *t)
405 {
406 	struct smack_known *skp;
407 	const struct cred *cred;
408 
409 	rcu_read_lock();
410 
411 	cred = __task_cred(t);
412 	skp = smk_of_task(smack_cred(cred));
413 
414 	rcu_read_unlock();
415 
416 	return skp;
417 }
418 
419 /*
420  * Present a pointer to the forked smack label entry in an task blob.
421  */
422 static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
423 {
424 	return tsp->smk_forked;
425 }
426 
427 /*
428  * Present a pointer to the smack label in the current task blob.
429  */
430 static inline struct smack_known *smk_of_current(void)
431 {
432 	return smk_of_task(smack_cred(current_cred()));
433 }
434 
435 void smack_log(char *subject_label, char *object_label,
436 		int request,
437 		int result, struct smk_audit_info *auditdata);
438 
439 #ifdef CONFIG_AUDIT
440 
441 /*
442  * logging functions
443  */
444 #define SMACK_AUDIT_DENIED 0x1
445 #define SMACK_AUDIT_ACCEPT 0x2
446 extern int log_policy;
447 
448 /*
449  * some inline functions to set up audit data
450  * they do nothing if CONFIG_AUDIT is not set
451  *
452  */
453 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
454 			       char type)
455 {
456 	memset(&a->sad, 0, sizeof(a->sad));
457 	a->a.type = type;
458 	a->a.smack_audit_data = &a->sad;
459 	a->a.smack_audit_data->function = func;
460 }
461 
462 static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
463 				   char type, struct lsm_network_audit *net)
464 {
465 	smk_ad_init(a, func, type);
466 	memset(net, 0, sizeof(*net));
467 	a->a.u.net = net;
468 }
469 
470 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
471 					 struct task_struct *t)
472 {
473 	a->a.u.tsk = t;
474 }
475 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
476 						    struct dentry *d)
477 {
478 	a->a.u.dentry = d;
479 }
480 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
481 					      struct inode *i)
482 {
483 	a->a.u.inode = i;
484 }
485 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
486 					     struct path p)
487 {
488 	a->a.u.path = p;
489 }
490 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
491 					    struct sock *sk)
492 {
493 	a->a.u.net->sk = sk;
494 }
495 
496 #else /* no AUDIT */
497 
498 static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
499 			       char type)
500 {
501 }
502 static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
503 					 struct task_struct *t)
504 {
505 }
506 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
507 						    struct dentry *d)
508 {
509 }
510 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
511 					      struct inode *i)
512 {
513 }
514 static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
515 					     struct path p)
516 {
517 }
518 static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
519 					    struct sock *sk)
520 {
521 }
522 #endif
523 
524 #endif  /* _SECURITY_SMACK_H */
525