Subject: [PATCH] Smack: mmap controls for library containment

  In the embedded world there are often situations
  where libraries are updated from a variety of sources,
  for a variety of reasons, and with any number of
  security characteristics. These differences
  might include privilege required for a given library
  provided interface to function properly, as occurs
  from time to time in graphics libraries. There are
  also cases where it is important to limit use of
  libraries based on the provider of the library and
  the security aware application may make choices
  based on that criteria.

  These issues are addressed by providing an additional
  Smack label that may optionally be assigned to an object,
  the SMACK64MMAP attribute. An mmap operation is allowed
  if there is no such attribute.

  If there is a SMACK64MMAP attribute the mmap is permitted
  only if a subject with that label has all of the access
  permitted a subject with the current task label.

  Security aware applications may from time to time
  wish to reduce their "privilege" to avoid accidental use
  of privilege. One case where this arises is the
  environment in which multiple sources provide libraries
  to perform the same functions. An application may know
  that it should eschew services made available from a
  particular vendor, or of a particular version.

  In support of this a secondary list of Smack rules has
  been added that is local to the task. This list is
  consulted only in the case where the global list has
  approved access. It can only further restrict access.
  Unlike the global last, if no entry is found on the
  local list access is granted. An application can add
  entries to its own list by writing to /smack/load-self.

  The changes appear large as they involve refactoring
  the list handling to accomodate there being more
  than one rule list.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>

1 files changed, 34 insertions, 18 deletions

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 7ba8478f599e..86453db4333d 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -70,10 +70,11 @@ int log_policy = SMACK_AUDIT_DENIED;
  * smk_access_entry - look up matching access rule
  * @subject_label: a pointer to the subject's Smack label
  * @object_label: a pointer to the object's Smack label
+ * @rule_list: the list of rules to search
  *
  * This function looks up the subject/object pair in the
- * access rule list and returns pointer to the matching rule if found,
- * NULL otherwise.
+ * access rule list and returns the access mode. If no
+ * entry is found returns -ENOENT.
  *
  * NOTE:
  * Even though Smack labels are usually shared on smack_list
@@ -85,13 +86,13 @@ int log_policy = SMACK_AUDIT_DENIED;
  * will be on the list, so checking the pointers may be a worthwhile
  * optimization.
  */
-int smk_access_entry(char *subject_label, char *object_label)
+int smk_access_entry(char *subject_label, char *object_label,
+                        struct list_head *rule_list)
 {
-        u32 may = MAY_NOT;
+        int may = -ENOENT;
         struct smack_rule *srp;
 
-        rcu_read_lock();
-        list_for_each_entry_rcu(srp, &smack_rule_list, list) {
+        list_for_each_entry_rcu(srp, rule_list, list) {
                 if (srp->smk_subject == subject_label ||
                     strcmp(srp->smk_subject, subject_label) == 0) {
                         if (srp->smk_object == object_label ||
@@ -101,7 +102,6 @@ int smk_access_entry(char *subject_label, char *object_label)
                         }
                 }
         }
-        rcu_read_unlock();
 
         return may;
 }
@@ -129,7 +129,7 @@ int smk_access_entry(char *subject_label, char *object_label)
 int smk_access(char *subject_label, char *object_label, int request,
                struct smk_audit_info *a)
 {
-        u32 may = MAY_NOT;
+        int may = MAY_NOT;
         int rc = 0;
 
         /*
@@ -181,13 +181,14 @@ int smk_access(char *subject_label, char *object_label, int request,
          * Beyond here an explicit relationship is required.
          * If the requested access is contained in the available
          * access (e.g. read is included in readwrite) it's
-         * good.
-         */
-        may = smk_access_entry(subject_label, object_label);
-        /*
-         * This is a bit map operation.
+         * good. A negative response from smk_access_entry()
+         * indicates there is no entry for this pair.
          */
-        if ((request & may) == request)
+        rcu_read_lock();
+        may = smk_access_entry(subject_label, object_label, &smack_rule_list);
+        rcu_read_unlock();
+
+        if (may > 0 && (request & may) == request)
                 goto out_audit;
 
         rc = -EACCES;
@@ -212,12 +213,27 @@ out_audit:
  */
 int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
 {
+        struct task_smack *tsp = current_security();
+        char *sp = smk_of_task(tsp);
+        int may;
         int rc;
-        char *sp = smk_of_current();
 
+        /*
+         * Check the global rule list
+         */
         rc = smk_access(sp, obj_label, mode, NULL);
-        if (rc == 0)
-                goto out_audit;
+        if (rc == 0) {
+                /*
+                 * If there is an entry in the task's rule list
+                 * it can further restrict access.
+                 */
+                may = smk_access_entry(sp, obj_label, &tsp->smk_rules);
+                if (may < 0)
+                        goto out_audit;
+                if ((mode & may) == mode)
+                        goto out_audit;
+                rc = -EACCES;
+        }
 
         /*
          * Return if a specific label has been designated as the
@@ -228,7 +244,7 @@ int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a)
                 goto out_audit;
 
         if (capable(CAP_MAC_OVERRIDE))
-                return 0;
+                rc = 0;
 
 out_audit:
 #ifdef CONFIG_AUDIT