aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorJames Morris <james.l.morris@oracle.com>2014-09-18 09:52:46 -0400
committerJames Morris <james.l.morris@oracle.com>2014-09-18 09:52:46 -0400
commit6f98e892884c32b9273ecce1332b849bcad3b8b1 (patch)
tree400e8ae29e555753e0ec085bf452f7206eb8c159 /security
parentac60ab4b4968b54fb5af20eac9dd78e36ad910c1 (diff)
parent21c7eae21a2100a89cfb8cebaf7b770271f32c6e (diff)
Merge branch 'smack-for-3.18' of git://git.gitorious.org/smack-next/kernel into next
Diffstat (limited to 'security')
-rw-r--r--security/smack/Kconfig16
-rw-r--r--security/smack/smack.h39
-rw-r--r--security/smack/smack_access.c118
-rw-r--r--security/smack/smack_lsm.c545
-rw-r--r--security/smack/smackfs.c76
5 files changed, 520 insertions, 274 deletions
diff --git a/security/smack/Kconfig b/security/smack/Kconfig
index e69de9c642b7..b065f9789418 100644
--- a/security/smack/Kconfig
+++ b/security/smack/Kconfig
@@ -12,3 +12,19 @@ config SECURITY_SMACK
12 of other mandatory security schemes. 12 of other mandatory security schemes.
13 If you are unsure how to answer this question, answer N. 13 If you are unsure how to answer this question, answer N.
14 14
15config SECURITY_SMACK_BRINGUP
16 bool "Reporting on access granted by Smack rules"
17 depends on SECURITY_SMACK
18 default n
19 help
20 Enable the bring-up ("b") access mode in Smack rules.
21 When access is granted by a rule with the "b" mode a
22 message about the access requested is generated. The
23 intention is that a process can be granted a wide set
24 of access initially with the bringup mode set on the
25 rules. The developer can use the information to
26 identify which rules are necessary and what accesses
27 may be inappropriate. The developer can reduce the
28 access rule set once the behavior is well understood.
29 This is a superior mechanism to the oft abused
30 "permissive" mode of other systems.
diff --git a/security/smack/smack.h b/security/smack/smack.h
index 020307ef0972..b828a379377c 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -71,11 +71,11 @@ struct smack_known {
71#define SMK_CIPSOLEN 24 71#define SMK_CIPSOLEN 24
72 72
73struct superblock_smack { 73struct superblock_smack {
74 char *smk_root; 74 struct smack_known *smk_root;
75 char *smk_floor; 75 struct smack_known *smk_floor;
76 char *smk_hat; 76 struct smack_known *smk_hat;
77 char *smk_default; 77 struct smack_known *smk_default;
78 int smk_initialized; 78 int smk_initialized;
79}; 79};
80 80
81struct socket_smack { 81struct socket_smack {
@@ -88,7 +88,7 @@ struct socket_smack {
88 * Inode smack data 88 * Inode smack data
89 */ 89 */
90struct inode_smack { 90struct inode_smack {
91 char *smk_inode; /* label of the fso */ 91 struct smack_known *smk_inode; /* label of the fso */
92 struct smack_known *smk_task; /* label of the task */ 92 struct smack_known *smk_task; /* label of the task */
93 struct smack_known *smk_mmap; /* label of the mmap domain */ 93 struct smack_known *smk_mmap; /* label of the mmap domain */
94 struct mutex smk_lock; /* initialization lock */ 94 struct mutex smk_lock; /* initialization lock */
@@ -112,7 +112,7 @@ struct task_smack {
112struct smack_rule { 112struct smack_rule {
113 struct list_head list; 113 struct list_head list;
114 struct smack_known *smk_subject; 114 struct smack_known *smk_subject;
115 char *smk_object; 115 struct smack_known *smk_object;
116 int smk_access; 116 int smk_access;
117}; 117};
118 118
@@ -123,7 +123,7 @@ struct smk_netlbladdr {
123 struct list_head list; 123 struct list_head list;
124 struct sockaddr_in smk_host; /* network address */ 124 struct sockaddr_in smk_host; /* network address */
125 struct in_addr smk_mask; /* network mask */ 125 struct in_addr smk_mask; /* network mask */
126 char *smk_label; /* label */ 126 struct smack_known *smk_label; /* label */
127}; 127};
128 128
129/* 129/*
@@ -191,6 +191,7 @@ struct smk_port_label {
191 */ 191 */
192#define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */ 192#define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */
193#define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */ 193#define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */
194#define MAY_BRINGUP 0x00004000 /* Report use of this rule */
194 195
195/* 196/*
196 * Just to make the common cases easier to deal with 197 * Just to make the common cases easier to deal with
@@ -200,9 +201,9 @@ struct smk_port_label {
200#define MAY_NOT 0 201#define MAY_NOT 0
201 202
202/* 203/*
203 * Number of access types used by Smack (rwxatl) 204 * Number of access types used by Smack (rwxatlb)
204 */ 205 */
205#define SMK_NUM_ACCESS_TYPE 6 206#define SMK_NUM_ACCESS_TYPE 7
206 207
207/* SMACK data */ 208/* SMACK data */
208struct smack_audit_data { 209struct smack_audit_data {
@@ -226,23 +227,23 @@ struct smk_audit_info {
226/* 227/*
227 * These functions are in smack_lsm.c 228 * These functions are in smack_lsm.c
228 */ 229 */
229struct inode_smack *new_inode_smack(char *); 230struct inode_smack *new_inode_smack(struct smack_known *);
230 231
231/* 232/*
232 * These functions are in smack_access.c 233 * These functions are in smack_access.c
233 */ 234 */
234int smk_access_entry(char *, char *, struct list_head *); 235int smk_access_entry(char *, char *, struct list_head *);
235int smk_access(struct smack_known *, char *, int, struct smk_audit_info *); 236int smk_access(struct smack_known *, struct smack_known *,
236int smk_tskacc(struct task_smack *, char *, u32, struct smk_audit_info *); 237 int, struct smk_audit_info *);
237int smk_curacc(char *, u32, struct smk_audit_info *); 238int smk_tskacc(struct task_smack *, struct smack_known *,
239 u32, struct smk_audit_info *);
240int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
238struct smack_known *smack_from_secid(const u32); 241struct smack_known *smack_from_secid(const u32);
239char *smk_parse_smack(const char *string, int len); 242char *smk_parse_smack(const char *string, int len);
240int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int); 243int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
241char *smk_import(const char *, int);
242struct smack_known *smk_import_entry(const char *, int); 244struct smack_known *smk_import_entry(const char *, int);
243void smk_insert_entry(struct smack_known *skp); 245void smk_insert_entry(struct smack_known *skp);
244struct smack_known *smk_find_entry(const char *); 246struct smack_known *smk_find_entry(const char *);
245u32 smack_to_secid(const char *);
246 247
247/* 248/*
248 * Shared data. 249 * Shared data.
@@ -252,7 +253,7 @@ extern int smack_cipso_mapped;
252extern struct smack_known *smack_net_ambient; 253extern struct smack_known *smack_net_ambient;
253extern struct smack_known *smack_onlycap; 254extern struct smack_known *smack_onlycap;
254extern struct smack_known *smack_syslog_label; 255extern struct smack_known *smack_syslog_label;
255extern const char *smack_cipso_option; 256extern struct smack_known smack_cipso_option;
256extern int smack_ptrace_rule; 257extern int smack_ptrace_rule;
257 258
258extern struct smack_known smack_known_floor; 259extern struct smack_known smack_known_floor;
@@ -281,9 +282,9 @@ static inline int smk_inode_transmutable(const struct inode *isp)
281} 282}
282 283
283/* 284/*
284 * Present a pointer to the smack label in an inode blob. 285 * Present a pointer to the smack label entry in an inode blob.
285 */ 286 */
286static inline char *smk_of_inode(const struct inode *isp) 287static inline struct smack_known *smk_of_inode(const struct inode *isp)
287{ 288{
288 struct inode_smack *sip = isp->i_security; 289 struct inode_smack *sip = isp->i_security;
289 return sip->smk_inode; 290 return sip->smk_inode;
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index f97d0842e621..5b970ffde024 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -94,7 +94,7 @@ int smk_access_entry(char *subject_label, char *object_label,
94 struct smack_rule *srp; 94 struct smack_rule *srp;
95 95
96 list_for_each_entry_rcu(srp, rule_list, list) { 96 list_for_each_entry_rcu(srp, rule_list, list) {
97 if (srp->smk_object == object_label && 97 if (srp->smk_object->smk_known == object_label &&
98 srp->smk_subject->smk_known == subject_label) { 98 srp->smk_subject->smk_known == subject_label) {
99 may = srp->smk_access; 99 may = srp->smk_access;
100 break; 100 break;
@@ -111,8 +111,8 @@ int smk_access_entry(char *subject_label, char *object_label,
111 111
112/** 112/**
113 * smk_access - determine if a subject has a specific access to an object 113 * smk_access - determine if a subject has a specific access to an object
114 * @subject_known: a pointer to the subject's Smack label entry 114 * @subject: a pointer to the subject's Smack label entry
115 * @object_label: a pointer to the object's Smack label 115 * @object: a pointer to the object's Smack label entry
116 * @request: the access requested, in "MAY" format 116 * @request: the access requested, in "MAY" format
117 * @a : a pointer to the audit data 117 * @a : a pointer to the audit data
118 * 118 *
@@ -122,8 +122,8 @@ int smk_access_entry(char *subject_label, char *object_label,
122 * 122 *
123 * Smack labels are shared on smack_list 123 * Smack labels are shared on smack_list
124 */ 124 */
125int smk_access(struct smack_known *subject_known, char *object_label, 125int smk_access(struct smack_known *subject, struct smack_known *object,
126 int request, struct smk_audit_info *a) 126 int request, struct smk_audit_info *a)
127{ 127{
128 int may = MAY_NOT; 128 int may = MAY_NOT;
129 int rc = 0; 129 int rc = 0;
@@ -133,7 +133,7 @@ int smk_access(struct smack_known *subject_known, char *object_label,
133 * 133 *
134 * A star subject can't access any object. 134 * A star subject can't access any object.
135 */ 135 */
136 if (subject_known == &smack_known_star) { 136 if (subject == &smack_known_star) {
137 rc = -EACCES; 137 rc = -EACCES;
138 goto out_audit; 138 goto out_audit;
139 } 139 }
@@ -142,28 +142,28 @@ int smk_access(struct smack_known *subject_known, char *object_label,
142 * Tasks cannot be assigned the internet label. 142 * Tasks cannot be assigned the internet label.
143 * An internet subject can access any object. 143 * An internet subject can access any object.
144 */ 144 */
145 if (object_label == smack_known_web.smk_known || 145 if (object == &smack_known_web ||
146 subject_known == &smack_known_web) 146 subject == &smack_known_web)
147 goto out_audit; 147 goto out_audit;
148 /* 148 /*
149 * A star object can be accessed by any subject. 149 * A star object can be accessed by any subject.
150 */ 150 */
151 if (object_label == smack_known_star.smk_known) 151 if (object == &smack_known_star)
152 goto out_audit; 152 goto out_audit;
153 /* 153 /*
154 * An object can be accessed in any way by a subject 154 * An object can be accessed in any way by a subject
155 * with the same label. 155 * with the same label.
156 */ 156 */
157 if (subject_known->smk_known == object_label) 157 if (subject->smk_known == object->smk_known)
158 goto out_audit; 158 goto out_audit;
159 /* 159 /*
160 * A hat subject can read any object. 160 * A hat subject can read any object.
161 * A floor object can be read by any subject. 161 * A floor object can be read by any subject.
162 */ 162 */
163 if ((request & MAY_ANYREAD) == request) { 163 if ((request & MAY_ANYREAD) == request) {
164 if (object_label == smack_known_floor.smk_known) 164 if (object == &smack_known_floor)
165 goto out_audit; 165 goto out_audit;
166 if (subject_known == &smack_known_hat) 166 if (subject == &smack_known_hat)
167 goto out_audit; 167 goto out_audit;
168 } 168 }
169 /* 169 /*
@@ -174,27 +174,38 @@ int smk_access(struct smack_known *subject_known, char *object_label,
174 * indicates there is no entry for this pair. 174 * indicates there is no entry for this pair.
175 */ 175 */
176 rcu_read_lock(); 176 rcu_read_lock();
177 may = smk_access_entry(subject_known->smk_known, object_label, 177 may = smk_access_entry(subject->smk_known, object->smk_known,
178 &subject_known->smk_rules); 178 &subject->smk_rules);
179 rcu_read_unlock(); 179 rcu_read_unlock();
180 180
181 if (may > 0 && (request & may) == request) 181 if (may <= 0 || (request & may) != request) {
182 rc = -EACCES;
182 goto out_audit; 183 goto out_audit;
184 }
185#ifdef CONFIG_SECURITY_SMACK_BRINGUP
186 /*
187 * Return a positive value if using bringup mode.
188 * This allows the hooks to identify checks that
189 * succeed because of "b" rules.
190 */
191 if (may & MAY_BRINGUP)
192 rc = MAY_BRINGUP;
193#endif
183 194
184 rc = -EACCES;
185out_audit: 195out_audit:
186#ifdef CONFIG_AUDIT 196#ifdef CONFIG_AUDIT
187 if (a) 197 if (a)
188 smack_log(subject_known->smk_known, object_label, request, 198 smack_log(subject->smk_known, object->smk_known,
189 rc, a); 199 request, rc, a);
190#endif 200#endif
201
191 return rc; 202 return rc;
192} 203}
193 204
194/** 205/**
195 * smk_tskacc - determine if a task has a specific access to an object 206 * smk_tskacc - determine if a task has a specific access to an object
196 * @tsp: a pointer to the subject task 207 * @tsp: a pointer to the subject's task
197 * @obj_label: a pointer to the object's Smack label 208 * @obj_known: a pointer to the object's label entry
198 * @mode: the access requested, in "MAY" format 209 * @mode: the access requested, in "MAY" format
199 * @a : common audit data 210 * @a : common audit data
200 * 211 *
@@ -203,24 +214,25 @@ out_audit:
203 * non zero otherwise. It allows that the task may have the capability 214 * non zero otherwise. It allows that the task may have the capability
204 * to override the rules. 215 * to override the rules.
205 */ 216 */
206int smk_tskacc(struct task_smack *subject, char *obj_label, 217int smk_tskacc(struct task_smack *tsp, struct smack_known *obj_known,
207 u32 mode, struct smk_audit_info *a) 218 u32 mode, struct smk_audit_info *a)
208{ 219{
209 struct smack_known *skp = smk_of_task(subject); 220 struct smack_known *sbj_known = smk_of_task(tsp);
210 int may; 221 int may;
211 int rc; 222 int rc;
212 223
213 /* 224 /*
214 * Check the global rule list 225 * Check the global rule list
215 */ 226 */
216 rc = smk_access(skp, obj_label, mode, NULL); 227 rc = smk_access(sbj_known, obj_known, mode, NULL);
217 if (rc == 0) { 228 if (rc >= 0) {
218 /* 229 /*
219 * If there is an entry in the task's rule list 230 * If there is an entry in the task's rule list
220 * it can further restrict access. 231 * it can further restrict access.
221 */ 232 */
222 may = smk_access_entry(skp->smk_known, obj_label, 233 may = smk_access_entry(sbj_known->smk_known,
223 &subject->smk_rules); 234 obj_known->smk_known,
235 &tsp->smk_rules);
224 if (may < 0) 236 if (may < 0)
225 goto out_audit; 237 goto out_audit;
226 if ((mode & may) == mode) 238 if ((mode & may) == mode)
@@ -237,14 +249,15 @@ int smk_tskacc(struct task_smack *subject, char *obj_label,
237out_audit: 249out_audit:
238#ifdef CONFIG_AUDIT 250#ifdef CONFIG_AUDIT
239 if (a) 251 if (a)
240 smack_log(skp->smk_known, obj_label, mode, rc, a); 252 smack_log(sbj_known->smk_known, obj_known->smk_known,
253 mode, rc, a);
241#endif 254#endif
242 return rc; 255 return rc;
243} 256}
244 257
245/** 258/**
246 * smk_curacc - determine if current has a specific access to an object 259 * smk_curacc - determine if current has a specific access to an object
247 * @obj_label: a pointer to the object's Smack label 260 * @obj_known: a pointer to the object's Smack label entry
248 * @mode: the access requested, in "MAY" format 261 * @mode: the access requested, in "MAY" format
249 * @a : common audit data 262 * @a : common audit data
250 * 263 *
@@ -253,11 +266,12 @@ out_audit:
253 * non zero otherwise. It allows that current may have the capability 266 * non zero otherwise. It allows that current may have the capability
254 * to override the rules. 267 * to override the rules.
255 */ 268 */
256int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a) 269int smk_curacc(struct smack_known *obj_known,
270 u32 mode, struct smk_audit_info *a)
257{ 271{
258 struct task_smack *tsp = current_security(); 272 struct task_smack *tsp = current_security();
259 273
260 return smk_tskacc(tsp, obj_label, mode, a); 274 return smk_tskacc(tsp, obj_known, mode, a);
261} 275}
262 276
263#ifdef CONFIG_AUDIT 277#ifdef CONFIG_AUDIT
@@ -328,6 +342,13 @@ void smack_log(char *subject_label, char *object_label, int request,
328 struct smack_audit_data *sad; 342 struct smack_audit_data *sad;
329 struct common_audit_data *a = &ad->a; 343 struct common_audit_data *a = &ad->a;
330 344
345#ifdef CONFIG_SECURITY_SMACK_BRINGUP
346 /*
347 * The result may be positive in bringup mode.
348 */
349 if (result > 0)
350 result = 0;
351#endif
331 /* check if we have to log the current event */ 352 /* check if we have to log the current event */
332 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0) 353 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
333 return; 354 return;
@@ -544,27 +565,6 @@ unlockout:
544} 565}
545 566
546/** 567/**
547 * smk_import - import a smack label
548 * @string: a text string that might be a Smack label
549 * @len: the maximum size, or zero if it is NULL terminated.
550 *
551 * Returns a pointer to the label in the label list that
552 * matches the passed string, adding it if necessary.
553 */
554char *smk_import(const char *string, int len)
555{
556 struct smack_known *skp;
557
558 /* labels cannot begin with a '-' */
559 if (string[0] == '-')
560 return NULL;
561 skp = smk_import_entry(string, len);
562 if (skp == NULL)
563 return NULL;
564 return skp->smk_known;
565}
566
567/**
568 * smack_from_secid - find the Smack label associated with a secid 568 * smack_from_secid - find the Smack label associated with a secid
569 * @secid: an integer that might be associated with a Smack label 569 * @secid: an integer that might be associated with a Smack label
570 * 570 *
@@ -590,19 +590,3 @@ struct smack_known *smack_from_secid(const u32 secid)
590 rcu_read_unlock(); 590 rcu_read_unlock();
591 return &smack_known_invalid; 591 return &smack_known_invalid;
592} 592}
593
594/**
595 * smack_to_secid - find the secid associated with a Smack label
596 * @smack: the Smack label
597 *
598 * Returns the appropriate secid if there is one,
599 * otherwise 0
600 */
601u32 smack_to_secid(const char *smack)
602{
603 struct smack_known *skp = smk_find_entry(smack);
604
605 if (skp == NULL)
606 return 0;
607 return skp->smk_secid;
608}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e6ab307ce86e..93dc876734a4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -54,6 +54,151 @@
54 54
55LIST_HEAD(smk_ipv6_port_list); 55LIST_HEAD(smk_ipv6_port_list);
56 56
57#ifdef CONFIG_SECURITY_SMACK_BRINGUP
58static void smk_bu_mode(int mode, char *s)
59{
60 int i = 0;
61
62 if (mode & MAY_READ)
63 s[i++] = 'r';
64 if (mode & MAY_WRITE)
65 s[i++] = 'w';
66 if (mode & MAY_EXEC)
67 s[i++] = 'x';
68 if (mode & MAY_APPEND)
69 s[i++] = 'a';
70 if (mode & MAY_TRANSMUTE)
71 s[i++] = 't';
72 if (mode & MAY_LOCK)
73 s[i++] = 'l';
74 if (i == 0)
75 s[i++] = '-';
76 s[i] = '\0';
77}
78#endif
79
80#ifdef CONFIG_SECURITY_SMACK_BRINGUP
81static int smk_bu_note(char *note, struct smack_known *sskp,
82 struct smack_known *oskp, int mode, int rc)
83{
84 char acc[SMK_NUM_ACCESS_TYPE + 1];
85
86 if (rc <= 0)
87 return rc;
88
89 smk_bu_mode(mode, acc);
90 pr_info("Smack Bringup: (%s %s %s) %s\n",
91 sskp->smk_known, oskp->smk_known, acc, note);
92 return 0;
93}
94#else
95#define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
96#endif
97
98#ifdef CONFIG_SECURITY_SMACK_BRINGUP
99static int smk_bu_current(char *note, struct smack_known *oskp,
100 int mode, int rc)
101{
102 struct task_smack *tsp = current_security();
103 char acc[SMK_NUM_ACCESS_TYPE + 1];
104
105 if (rc <= 0)
106 return rc;
107
108 smk_bu_mode(mode, acc);
109 pr_info("Smack Bringup: (%s %s %s) %s %s\n",
110 tsp->smk_task->smk_known, oskp->smk_known,
111 acc, current->comm, note);
112 return 0;
113}
114#else
115#define smk_bu_current(note, oskp, mode, RC) (RC)
116#endif
117
118#ifdef CONFIG_SECURITY_SMACK_BRINGUP
119static int smk_bu_task(struct task_struct *otp, int mode, int rc)
120{
121 struct task_smack *tsp = current_security();
122 struct task_smack *otsp = task_security(otp);
123 char acc[SMK_NUM_ACCESS_TYPE + 1];
124
125 if (rc <= 0)
126 return rc;
127
128 smk_bu_mode(mode, acc);
129 pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
130 tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
131 current->comm, otp->comm);
132 return 0;
133}
134#else
135#define smk_bu_task(otp, mode, RC) (RC)
136#endif
137
138#ifdef CONFIG_SECURITY_SMACK_BRINGUP
139static int smk_bu_inode(struct inode *inode, int mode, int rc)
140{
141 struct task_smack *tsp = current_security();
142 char acc[SMK_NUM_ACCESS_TYPE + 1];
143
144 if (rc <= 0)
145 return rc;
146
147 smk_bu_mode(mode, acc);
148 pr_info("Smack Bringup: (%s %s %s) inode=(%s %ld) %s\n",
149 tsp->smk_task->smk_known, smk_of_inode(inode)->smk_known, acc,
150 inode->i_sb->s_id, inode->i_ino, current->comm);
151 return 0;
152}
153#else
154#define smk_bu_inode(inode, mode, RC) (RC)
155#endif
156
157#ifdef CONFIG_SECURITY_SMACK_BRINGUP
158static int smk_bu_file(struct file *file, int mode, int rc)
159{
160 struct task_smack *tsp = current_security();
161 struct smack_known *sskp = tsp->smk_task;
162 struct inode *inode = file->f_inode;
163 char acc[SMK_NUM_ACCESS_TYPE + 1];
164
165 if (rc <= 0)
166 return rc;
167
168 smk_bu_mode(mode, acc);
169 pr_info("Smack Bringup: (%s %s %s) file=(%s %ld %s) %s\n",
170 sskp->smk_known, (char *)file->f_security, acc,
171 inode->i_sb->s_id, inode->i_ino, file->f_dentry->d_name.name,
172 current->comm);
173 return 0;
174}
175#else
176#define smk_bu_file(file, mode, RC) (RC)
177#endif
178
179#ifdef CONFIG_SECURITY_SMACK_BRINGUP
180static int smk_bu_credfile(const struct cred *cred, struct file *file,
181 int mode, int rc)
182{
183 struct task_smack *tsp = cred->security;
184 struct smack_known *sskp = tsp->smk_task;
185 struct inode *inode = file->f_inode;
186 char acc[SMK_NUM_ACCESS_TYPE + 1];
187
188 if (rc <= 0)
189 return rc;
190
191 smk_bu_mode(mode, acc);
192 pr_info("Smack Bringup: (%s %s %s) file=(%s %ld %s) %s\n",
193 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
194 inode->i_sb->s_id, inode->i_ino, file->f_dentry->d_name.name,
195 current->comm);
196 return 0;
197}
198#else
199#define smk_bu_credfile(cred, file, mode, RC) (RC)
200#endif
201
57/** 202/**
58 * smk_fetch - Fetch the smack label from a file. 203 * smk_fetch - Fetch the smack label from a file.
59 * @ip: a pointer to the inode 204 * @ip: a pointer to the inode
@@ -87,11 +232,11 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip,
87 232
88/** 233/**
89 * new_inode_smack - allocate an inode security blob 234 * new_inode_smack - allocate an inode security blob
90 * @smack: a pointer to the Smack label to use in the blob 235 * @skp: a pointer to the Smack label entry to use in the blob
91 * 236 *
92 * Returns the new blob or NULL if there's no memory available 237 * Returns the new blob or NULL if there's no memory available
93 */ 238 */
94struct inode_smack *new_inode_smack(char *smack) 239struct inode_smack *new_inode_smack(struct smack_known *skp)
95{ 240{
96 struct inode_smack *isp; 241 struct inode_smack *isp;
97 242
@@ -99,7 +244,7 @@ struct inode_smack *new_inode_smack(char *smack)
99 if (isp == NULL) 244 if (isp == NULL)
100 return NULL; 245 return NULL;
101 246
102 isp->smk_inode = smack; 247 isp->smk_inode = skp;
103 isp->smk_flags = 0; 248 isp->smk_flags = 0;
104 mutex_init(&isp->smk_lock); 249 mutex_init(&isp->smk_lock);
105 250
@@ -178,20 +323,20 @@ static inline unsigned int smk_ptrace_mode(unsigned int mode)
178/** 323/**
179 * smk_ptrace_rule_check - helper for ptrace access 324 * smk_ptrace_rule_check - helper for ptrace access
180 * @tracer: tracer process 325 * @tracer: tracer process
181 * @tracee_label: label of the process that's about to be traced, 326 * @tracee_known: label entry of the process that's about to be traced
182 * the pointer must originate from smack structures
183 * @mode: ptrace attachment mode (PTRACE_MODE_*) 327 * @mode: ptrace attachment mode (PTRACE_MODE_*)
184 * @func: name of the function that called us, used for audit 328 * @func: name of the function that called us, used for audit
185 * 329 *
186 * Returns 0 on access granted, -error on error 330 * Returns 0 on access granted, -error on error
187 */ 331 */
188static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label, 332static int smk_ptrace_rule_check(struct task_struct *tracer,
333 struct smack_known *tracee_known,
189 unsigned int mode, const char *func) 334 unsigned int mode, const char *func)
190{ 335{
191 int rc; 336 int rc;
192 struct smk_audit_info ad, *saip = NULL; 337 struct smk_audit_info ad, *saip = NULL;
193 struct task_smack *tsp; 338 struct task_smack *tsp;
194 struct smack_known *skp; 339 struct smack_known *tracer_known;
195 340
196 if ((mode & PTRACE_MODE_NOAUDIT) == 0) { 341 if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
197 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); 342 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
@@ -200,12 +345,12 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label,
200 } 345 }
201 346
202 tsp = task_security(tracer); 347 tsp = task_security(tracer);
203 skp = smk_of_task(tsp); 348 tracer_known = smk_of_task(tsp);
204 349
205 if ((mode & PTRACE_MODE_ATTACH) && 350 if ((mode & PTRACE_MODE_ATTACH) &&
206 (smack_ptrace_rule == SMACK_PTRACE_EXACT || 351 (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
207 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) { 352 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
208 if (skp->smk_known == tracee_label) 353 if (tracer_known->smk_known == tracee_known->smk_known)
209 rc = 0; 354 rc = 0;
210 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) 355 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
211 rc = -EACCES; 356 rc = -EACCES;
@@ -215,13 +360,15 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label,
215 rc = -EACCES; 360 rc = -EACCES;
216 361
217 if (saip) 362 if (saip)
218 smack_log(skp->smk_known, tracee_label, 0, rc, saip); 363 smack_log(tracer_known->smk_known,
364 tracee_known->smk_known,
365 0, rc, saip);
219 366
220 return rc; 367 return rc;
221 } 368 }
222 369
223 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ 370 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
224 rc = smk_tskacc(tsp, tracee_label, smk_ptrace_mode(mode), saip); 371 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
225 return rc; 372 return rc;
226} 373}
227 374
@@ -250,7 +397,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
250 397
251 skp = smk_of_task(task_security(ctp)); 398 skp = smk_of_task(task_security(ctp));
252 399
253 rc = smk_ptrace_rule_check(current, skp->smk_known, mode, __func__); 400 rc = smk_ptrace_rule_check(current, skp, mode, __func__);
254 return rc; 401 return rc;
255} 402}
256 403
@@ -273,8 +420,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
273 420
274 skp = smk_of_task(current_security()); 421 skp = smk_of_task(current_security());
275 422
276 rc = smk_ptrace_rule_check(ptp, skp->smk_known, 423 rc = smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
277 PTRACE_MODE_ATTACH, __func__);
278 return rc; 424 return rc;
279} 425}
280 426
@@ -318,10 +464,10 @@ static int smack_sb_alloc_security(struct super_block *sb)
318 if (sbsp == NULL) 464 if (sbsp == NULL)
319 return -ENOMEM; 465 return -ENOMEM;
320 466
321 sbsp->smk_root = smack_known_floor.smk_known; 467 sbsp->smk_root = &smack_known_floor;
322 sbsp->smk_default = smack_known_floor.smk_known; 468 sbsp->smk_default = &smack_known_floor;
323 sbsp->smk_floor = smack_known_floor.smk_known; 469 sbsp->smk_floor = &smack_known_floor;
324 sbsp->smk_hat = smack_known_hat.smk_known; 470 sbsp->smk_hat = &smack_known_hat;
325 /* 471 /*
326 * smk_initialized will be zero from kzalloc. 472 * smk_initialized will be zero from kzalloc.
327 */ 473 */
@@ -405,7 +551,6 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
405 struct smack_known *skp; 551 struct smack_known *skp;
406 char *op; 552 char *op;
407 char *commap; 553 char *commap;
408 char *nsp;
409 int transmute = 0; 554 int transmute = 0;
410 int specified = 0; 555 int specified = 0;
411 556
@@ -421,38 +566,38 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
421 566
422 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) { 567 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) {
423 op += strlen(SMK_FSHAT); 568 op += strlen(SMK_FSHAT);
424 nsp = smk_import(op, 0); 569 skp = smk_import_entry(op, 0);
425 if (nsp != NULL) { 570 if (skp != NULL) {
426 sp->smk_hat = nsp; 571 sp->smk_hat = skp;
427 specified = 1; 572 specified = 1;
428 } 573 }
429 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) { 574 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) {
430 op += strlen(SMK_FSFLOOR); 575 op += strlen(SMK_FSFLOOR);
431 nsp = smk_import(op, 0); 576 skp = smk_import_entry(op, 0);
432 if (nsp != NULL) { 577 if (skp != NULL) {
433 sp->smk_floor = nsp; 578 sp->smk_floor = skp;
434 specified = 1; 579 specified = 1;
435 } 580 }
436 } else if (strncmp(op, SMK_FSDEFAULT, 581 } else if (strncmp(op, SMK_FSDEFAULT,
437 strlen(SMK_FSDEFAULT)) == 0) { 582 strlen(SMK_FSDEFAULT)) == 0) {
438 op += strlen(SMK_FSDEFAULT); 583 op += strlen(SMK_FSDEFAULT);
439 nsp = smk_import(op, 0); 584 skp = smk_import_entry(op, 0);
440 if (nsp != NULL) { 585 if (skp != NULL) {
441 sp->smk_default = nsp; 586 sp->smk_default = skp;
442 specified = 1; 587 specified = 1;
443 } 588 }
444 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) { 589 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) {
445 op += strlen(SMK_FSROOT); 590 op += strlen(SMK_FSROOT);
446 nsp = smk_import(op, 0); 591 skp = smk_import_entry(op, 0);
447 if (nsp != NULL) { 592 if (skp != NULL) {
448 sp->smk_root = nsp; 593 sp->smk_root = skp;
449 specified = 1; 594 specified = 1;
450 } 595 }
451 } else if (strncmp(op, SMK_FSTRANS, strlen(SMK_FSTRANS)) == 0) { 596 } else if (strncmp(op, SMK_FSTRANS, strlen(SMK_FSTRANS)) == 0) {
452 op += strlen(SMK_FSTRANS); 597 op += strlen(SMK_FSTRANS);
453 nsp = smk_import(op, 0); 598 skp = smk_import_entry(op, 0);
454 if (nsp != NULL) { 599 if (skp != NULL) {
455 sp->smk_root = nsp; 600 sp->smk_root = skp;
456 transmute = 1; 601 transmute = 1;
457 specified = 1; 602 specified = 1;
458 } 603 }
@@ -469,8 +614,8 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
469 * Unprivileged mounts get root and default from the caller. 614 * Unprivileged mounts get root and default from the caller.
470 */ 615 */
471 skp = smk_of_current(); 616 skp = smk_of_current();
472 sp->smk_root = skp->smk_known; 617 sp->smk_root = skp;
473 sp->smk_default = skp->smk_known; 618 sp->smk_default = skp;
474 } 619 }
475 /* 620 /*
476 * Initialize the root inode. 621 * Initialize the root inode.
@@ -507,6 +652,7 @@ static int smack_sb_statfs(struct dentry *dentry)
507 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 652 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
508 653
509 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 654 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
655 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
510 return rc; 656 return rc;
511} 657}
512 658
@@ -546,7 +692,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
546 tracer = ptrace_parent(current); 692 tracer = ptrace_parent(current);
547 if (likely(tracer != NULL)) 693 if (likely(tracer != NULL))
548 rc = smk_ptrace_rule_check(tracer, 694 rc = smk_ptrace_rule_check(tracer,
549 isp->smk_task->smk_known, 695 isp->smk_task,
550 PTRACE_MODE_ATTACH, 696 PTRACE_MODE_ATTACH,
551 __func__); 697 __func__);
552 rcu_read_unlock(); 698 rcu_read_unlock();
@@ -607,7 +753,7 @@ static int smack_inode_alloc_security(struct inode *inode)
607{ 753{
608 struct smack_known *skp = smk_of_current(); 754 struct smack_known *skp = smk_of_current();
609 755
610 inode->i_security = new_inode_smack(skp->smk_known); 756 inode->i_security = new_inode_smack(skp);
611 if (inode->i_security == NULL) 757 if (inode->i_security == NULL)
612 return -ENOMEM; 758 return -ENOMEM;
613 return 0; 759 return 0;
@@ -627,8 +773,8 @@ static void smack_inode_free_security(struct inode *inode)
627 773
628/** 774/**
629 * smack_inode_init_security - copy out the smack from an inode 775 * smack_inode_init_security - copy out the smack from an inode
630 * @inode: the inode 776 * @inode: the newly created inode
631 * @dir: unused 777 * @dir: containing directory object
632 * @qstr: unused 778 * @qstr: unused
633 * @name: where to put the attribute name 779 * @name: where to put the attribute name
634 * @value: where to put the attribute value 780 * @value: where to put the attribute value
@@ -642,8 +788,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
642{ 788{
643 struct inode_smack *issp = inode->i_security; 789 struct inode_smack *issp = inode->i_security;
644 struct smack_known *skp = smk_of_current(); 790 struct smack_known *skp = smk_of_current();
645 char *isp = smk_of_inode(inode); 791 struct smack_known *isp = smk_of_inode(inode);
646 char *dsp = smk_of_inode(dir); 792 struct smack_known *dsp = smk_of_inode(dir);
647 int may; 793 int may;
648 794
649 if (name) 795 if (name)
@@ -651,7 +797,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
651 797
652 if (value) { 798 if (value) {
653 rcu_read_lock(); 799 rcu_read_lock();
654 may = smk_access_entry(skp->smk_known, dsp, &skp->smk_rules); 800 may = smk_access_entry(skp->smk_known, dsp->smk_known,
801 &skp->smk_rules);
655 rcu_read_unlock(); 802 rcu_read_unlock();
656 803
657 /* 804 /*
@@ -666,13 +813,13 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
666 issp->smk_flags |= SMK_INODE_CHANGED; 813 issp->smk_flags |= SMK_INODE_CHANGED;
667 } 814 }
668 815
669 *value = kstrdup(isp, GFP_NOFS); 816 *value = kstrdup(isp->smk_known, GFP_NOFS);
670 if (*value == NULL) 817 if (*value == NULL)
671 return -ENOMEM; 818 return -ENOMEM;
672 } 819 }
673 820
674 if (len) 821 if (len)
675 *len = strlen(isp) + 1; 822 *len = strlen(isp->smk_known);
676 823
677 return 0; 824 return 0;
678} 825}
@@ -688,7 +835,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
688static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, 835static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
689 struct dentry *new_dentry) 836 struct dentry *new_dentry)
690{ 837{
691 char *isp; 838 struct smack_known *isp;
692 struct smk_audit_info ad; 839 struct smk_audit_info ad;
693 int rc; 840 int rc;
694 841
@@ -697,11 +844,13 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
697 844
698 isp = smk_of_inode(old_dentry->d_inode); 845 isp = smk_of_inode(old_dentry->d_inode);
699 rc = smk_curacc(isp, MAY_WRITE, &ad); 846 rc = smk_curacc(isp, MAY_WRITE, &ad);
847 rc = smk_bu_inode(old_dentry->d_inode, MAY_WRITE, rc);
700 848
701 if (rc == 0 && new_dentry->d_inode != NULL) { 849 if (rc == 0 && new_dentry->d_inode != NULL) {
702 isp = smk_of_inode(new_dentry->d_inode); 850 isp = smk_of_inode(new_dentry->d_inode);
703 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 851 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
704 rc = smk_curacc(isp, MAY_WRITE, &ad); 852 rc = smk_curacc(isp, MAY_WRITE, &ad);
853 rc = smk_bu_inode(new_dentry->d_inode, MAY_WRITE, rc);
705 } 854 }
706 855
707 return rc; 856 return rc;
@@ -728,6 +877,7 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
728 * You need write access to the thing you're unlinking 877 * You need write access to the thing you're unlinking
729 */ 878 */
730 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 879 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
880 rc = smk_bu_inode(ip, MAY_WRITE, rc);
731 if (rc == 0) { 881 if (rc == 0) {
732 /* 882 /*
733 * You also need write access to the containing directory 883 * You also need write access to the containing directory
@@ -735,6 +885,7 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
735 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 885 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
736 smk_ad_setfield_u_fs_inode(&ad, dir); 886 smk_ad_setfield_u_fs_inode(&ad, dir);
737 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 887 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
888 rc = smk_bu_inode(dir, MAY_WRITE, rc);
738 } 889 }
739 return rc; 890 return rc;
740} 891}
@@ -759,6 +910,7 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
759 * You need write access to the thing you're removing 910 * You need write access to the thing you're removing
760 */ 911 */
761 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 912 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
913 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
762 if (rc == 0) { 914 if (rc == 0) {
763 /* 915 /*
764 * You also need write access to the containing directory 916 * You also need write access to the containing directory
@@ -766,6 +918,7 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
766 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 918 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
767 smk_ad_setfield_u_fs_inode(&ad, dir); 919 smk_ad_setfield_u_fs_inode(&ad, dir);
768 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 920 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
921 rc = smk_bu_inode(dir, MAY_WRITE, rc);
769 } 922 }
770 923
771 return rc; 924 return rc;
@@ -773,10 +926,10 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
773 926
774/** 927/**
775 * smack_inode_rename - Smack check on rename 928 * smack_inode_rename - Smack check on rename
776 * @old_inode: the old directory 929 * @old_inode: unused
777 * @old_dentry: unused 930 * @old_dentry: the old object
778 * @new_inode: the new directory 931 * @new_inode: unused
779 * @new_dentry: unused 932 * @new_dentry: the new object
780 * 933 *
781 * Read and write access is required on both the old and 934 * Read and write access is required on both the old and
782 * new directories. 935 * new directories.
@@ -789,7 +942,7 @@ static int smack_inode_rename(struct inode *old_inode,
789 struct dentry *new_dentry) 942 struct dentry *new_dentry)
790{ 943{
791 int rc; 944 int rc;
792 char *isp; 945 struct smack_known *isp;
793 struct smk_audit_info ad; 946 struct smk_audit_info ad;
794 947
795 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 948 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
@@ -797,11 +950,13 @@ static int smack_inode_rename(struct inode *old_inode,
797 950
798 isp = smk_of_inode(old_dentry->d_inode); 951 isp = smk_of_inode(old_dentry->d_inode);
799 rc = smk_curacc(isp, MAY_READWRITE, &ad); 952 rc = smk_curacc(isp, MAY_READWRITE, &ad);
953 rc = smk_bu_inode(old_dentry->d_inode, MAY_READWRITE, rc);
800 954
801 if (rc == 0 && new_dentry->d_inode != NULL) { 955 if (rc == 0 && new_dentry->d_inode != NULL) {
802 isp = smk_of_inode(new_dentry->d_inode); 956 isp = smk_of_inode(new_dentry->d_inode);
803 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 957 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
804 rc = smk_curacc(isp, MAY_READWRITE, &ad); 958 rc = smk_curacc(isp, MAY_READWRITE, &ad);
959 rc = smk_bu_inode(new_dentry->d_inode, MAY_READWRITE, rc);
805 } 960 }
806 return rc; 961 return rc;
807} 962}
@@ -819,6 +974,7 @@ static int smack_inode_permission(struct inode *inode, int mask)
819{ 974{
820 struct smk_audit_info ad; 975 struct smk_audit_info ad;
821 int no_block = mask & MAY_NOT_BLOCK; 976 int no_block = mask & MAY_NOT_BLOCK;
977 int rc;
822 978
823 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 979 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
824 /* 980 /*
@@ -832,7 +988,9 @@ static int smack_inode_permission(struct inode *inode, int mask)
832 return -ECHILD; 988 return -ECHILD;
833 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 989 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
834 smk_ad_setfield_u_fs_inode(&ad, inode); 990 smk_ad_setfield_u_fs_inode(&ad, inode);
835 return smk_curacc(smk_of_inode(inode), mask, &ad); 991 rc = smk_curacc(smk_of_inode(inode), mask, &ad);
992 rc = smk_bu_inode(inode, mask, rc);
993 return rc;
836} 994}
837 995
838/** 996/**
@@ -845,6 +1003,8 @@ static int smack_inode_permission(struct inode *inode, int mask)
845static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) 1003static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
846{ 1004{
847 struct smk_audit_info ad; 1005 struct smk_audit_info ad;
1006 int rc;
1007
848 /* 1008 /*
849 * Need to allow for clearing the setuid bit. 1009 * Need to allow for clearing the setuid bit.
850 */ 1010 */
@@ -853,12 +1013,14 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
853 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1013 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
854 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1014 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
855 1015
856 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1016 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1017 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1018 return rc;
857} 1019}
858 1020
859/** 1021/**
860 * smack_inode_getattr - Smack check for getting attributes 1022 * smack_inode_getattr - Smack check for getting attributes
861 * @mnt: unused 1023 * @mnt: vfsmount of the object
862 * @dentry: the object 1024 * @dentry: the object
863 * 1025 *
864 * Returns 0 if access is permitted, an error code otherwise 1026 * Returns 0 if access is permitted, an error code otherwise
@@ -867,21 +1029,24 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
867{ 1029{
868 struct smk_audit_info ad; 1030 struct smk_audit_info ad;
869 struct path path; 1031 struct path path;
1032 int rc;
870 1033
871 path.dentry = dentry; 1034 path.dentry = dentry;
872 path.mnt = mnt; 1035 path.mnt = mnt;
873 1036
874 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1037 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
875 smk_ad_setfield_u_fs_path(&ad, path); 1038 smk_ad_setfield_u_fs_path(&ad, path);
876 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 1039 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
1040 rc = smk_bu_inode(dentry->d_inode, MAY_READ, rc);
1041 return rc;
877} 1042}
878 1043
879/** 1044/**
880 * smack_inode_setxattr - Smack check for setting xattrs 1045 * smack_inode_setxattr - Smack check for setting xattrs
881 * @dentry: the object 1046 * @dentry: the object
882 * @name: name of the attribute 1047 * @name: name of the attribute
883 * @value: unused 1048 * @value: value of the attribute
884 * @size: unused 1049 * @size: size of the value
885 * @flags: unused 1050 * @flags: unused
886 * 1051 *
887 * This protects the Smack attribute explicitly. 1052 * This protects the Smack attribute explicitly.
@@ -923,7 +1088,7 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
923 rc = -EPERM; 1088 rc = -EPERM;
924 1089
925 if (rc == 0 && check_import) { 1090 if (rc == 0 && check_import) {
926 skp = smk_import_entry(value, size); 1091 skp = size ? smk_import_entry(value, size) : NULL;
927 if (skp == NULL || (check_star && 1092 if (skp == NULL || (check_star &&
928 (skp == &smack_known_star || skp == &smack_known_web))) 1093 (skp == &smack_known_star || skp == &smack_known_web)))
929 rc = -EINVAL; 1094 rc = -EINVAL;
@@ -932,8 +1097,10 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
932 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1097 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
933 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1098 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
934 1099
935 if (rc == 0) 1100 if (rc == 0) {
936 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1101 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1102 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1103 }
937 1104
938 return rc; 1105 return rc;
939} 1106}
@@ -963,9 +1130,9 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
963 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1130 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
964 skp = smk_import_entry(value, size); 1131 skp = smk_import_entry(value, size);
965 if (skp != NULL) 1132 if (skp != NULL)
966 isp->smk_inode = skp->smk_known; 1133 isp->smk_inode = skp;
967 else 1134 else
968 isp->smk_inode = smack_known_invalid.smk_known; 1135 isp->smk_inode = &smack_known_invalid;
969 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 1136 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
970 skp = smk_import_entry(value, size); 1137 skp = smk_import_entry(value, size);
971 if (skp != NULL) 1138 if (skp != NULL)
@@ -993,11 +1160,14 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
993static int smack_inode_getxattr(struct dentry *dentry, const char *name) 1160static int smack_inode_getxattr(struct dentry *dentry, const char *name)
994{ 1161{
995 struct smk_audit_info ad; 1162 struct smk_audit_info ad;
1163 int rc;
996 1164
997 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1165 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
998 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1166 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
999 1167
1000 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 1168 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
1169 rc = smk_bu_inode(dentry->d_inode, MAY_READ, rc);
1170 return rc;
1001} 1171}
1002 1172
1003/** 1173/**
@@ -1033,6 +1203,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
1033 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1203 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1034 1204
1035 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1205 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1206 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1036 if (rc != 0) 1207 if (rc != 0)
1037 return rc; 1208 return rc;
1038 1209
@@ -1070,14 +1241,14 @@ static int smack_inode_getsecurity(const struct inode *inode,
1070 struct socket *sock; 1241 struct socket *sock;
1071 struct super_block *sbp; 1242 struct super_block *sbp;
1072 struct inode *ip = (struct inode *)inode; 1243 struct inode *ip = (struct inode *)inode;
1073 char *isp; 1244 struct smack_known *isp;
1074 int ilen; 1245 int ilen;
1075 int rc = 0; 1246 int rc = 0;
1076 1247
1077 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 1248 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
1078 isp = smk_of_inode(inode); 1249 isp = smk_of_inode(inode);
1079 ilen = strlen(isp) + 1; 1250 ilen = strlen(isp->smk_known);
1080 *buffer = isp; 1251 *buffer = isp->smk_known;
1081 return ilen; 1252 return ilen;
1082 } 1253 }
1083 1254
@@ -1095,15 +1266,15 @@ static int smack_inode_getsecurity(const struct inode *inode,
1095 ssp = sock->sk->sk_security; 1266 ssp = sock->sk->sk_security;
1096 1267
1097 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1268 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1098 isp = ssp->smk_in->smk_known; 1269 isp = ssp->smk_in;
1099 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 1270 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1100 isp = ssp->smk_out->smk_known; 1271 isp = ssp->smk_out;
1101 else 1272 else
1102 return -EOPNOTSUPP; 1273 return -EOPNOTSUPP;
1103 1274
1104 ilen = strlen(isp) + 1; 1275 ilen = strlen(isp->smk_known);
1105 if (rc == 0) { 1276 if (rc == 0) {
1106 *buffer = isp; 1277 *buffer = isp->smk_known;
1107 rc = ilen; 1278 rc = ilen;
1108 } 1279 }
1109 1280
@@ -1122,13 +1293,12 @@ static int smack_inode_getsecurity(const struct inode *inode,
1122static int smack_inode_listsecurity(struct inode *inode, char *buffer, 1293static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1123 size_t buffer_size) 1294 size_t buffer_size)
1124{ 1295{
1125 int len = strlen(XATTR_NAME_SMACK); 1296 int len = sizeof(XATTR_NAME_SMACK);
1126 1297
1127 if (buffer != NULL && len <= buffer_size) { 1298 if (buffer != NULL && len <= buffer_size)
1128 memcpy(buffer, XATTR_NAME_SMACK, len); 1299 memcpy(buffer, XATTR_NAME_SMACK, len);
1129 return len; 1300
1130 } 1301 return len;
1131 return -EINVAL;
1132} 1302}
1133 1303
1134/** 1304/**
@@ -1140,7 +1310,7 @@ static void smack_inode_getsecid(const struct inode *inode, u32 *secid)
1140{ 1310{
1141 struct inode_smack *isp = inode->i_security; 1311 struct inode_smack *isp = inode->i_security;
1142 1312
1143 *secid = smack_to_secid(isp->smk_inode); 1313 *secid = isp->smk_inode->smk_secid;
1144} 1314}
1145 1315
1146/* 1316/*
@@ -1179,7 +1349,7 @@ static int smack_file_alloc_security(struct file *file)
1179{ 1349{
1180 struct smack_known *skp = smk_of_current(); 1350 struct smack_known *skp = smk_of_current();
1181 1351
1182 file->f_security = skp->smk_known; 1352 file->f_security = skp;
1183 return 0; 1353 return 0;
1184} 1354}
1185 1355
@@ -1214,11 +1384,15 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
1214 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1384 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1215 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1385 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1216 1386
1217 if (_IOC_DIR(cmd) & _IOC_WRITE) 1387 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1218 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1388 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1389 rc = smk_bu_file(file, MAY_WRITE, rc);
1390 }
1219 1391
1220 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) 1392 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1221 rc = smk_curacc(file->f_security, MAY_READ, &ad); 1393 rc = smk_curacc(file->f_security, MAY_READ, &ad);
1394 rc = smk_bu_file(file, MAY_READ, rc);
1395 }
1222 1396
1223 return rc; 1397 return rc;
1224} 1398}
@@ -1233,10 +1407,13 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
1233static int smack_file_lock(struct file *file, unsigned int cmd) 1407static int smack_file_lock(struct file *file, unsigned int cmd)
1234{ 1408{
1235 struct smk_audit_info ad; 1409 struct smk_audit_info ad;
1410 int rc;
1236 1411
1237 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1412 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1238 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1413 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1239 return smk_curacc(file->f_security, MAY_LOCK, &ad); 1414 rc = smk_curacc(file->f_security, MAY_LOCK, &ad);
1415 rc = smk_bu_file(file, MAY_LOCK, rc);
1416 return rc;
1240} 1417}
1241 1418
1242/** 1419/**
@@ -1266,12 +1443,14 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
1266 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1443 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1267 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1444 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1268 rc = smk_curacc(file->f_security, MAY_LOCK, &ad); 1445 rc = smk_curacc(file->f_security, MAY_LOCK, &ad);
1446 rc = smk_bu_file(file, MAY_LOCK, rc);
1269 break; 1447 break;
1270 case F_SETOWN: 1448 case F_SETOWN:
1271 case F_SETSIG: 1449 case F_SETSIG:
1272 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1450 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1273 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1451 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1274 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1452 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1453 rc = smk_bu_file(file, MAY_WRITE, rc);
1275 break; 1454 break;
1276 default: 1455 default:
1277 break; 1456 break;
@@ -1298,7 +1477,7 @@ static int smack_mmap_file(struct file *file,
1298 struct smack_known *mkp; 1477 struct smack_known *mkp;
1299 struct smack_rule *srp; 1478 struct smack_rule *srp;
1300 struct task_smack *tsp; 1479 struct task_smack *tsp;
1301 char *osmack; 1480 struct smack_known *okp;
1302 struct inode_smack *isp; 1481 struct inode_smack *isp;
1303 int may; 1482 int may;
1304 int mmay; 1483 int mmay;
@@ -1324,18 +1503,19 @@ static int smack_mmap_file(struct file *file,
1324 * to that rule's object label. 1503 * to that rule's object label.
1325 */ 1504 */
1326 list_for_each_entry_rcu(srp, &skp->smk_rules, list) { 1505 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1327 osmack = srp->smk_object; 1506 okp = srp->smk_object;
1328 /* 1507 /*
1329 * Matching labels always allows access. 1508 * Matching labels always allows access.
1330 */ 1509 */
1331 if (mkp->smk_known == osmack) 1510 if (mkp->smk_known == okp->smk_known)
1332 continue; 1511 continue;
1333 /* 1512 /*
1334 * If there is a matching local rule take 1513 * If there is a matching local rule take
1335 * that into account as well. 1514 * that into account as well.
1336 */ 1515 */
1337 may = smk_access_entry(srp->smk_subject->smk_known, osmack, 1516 may = smk_access_entry(srp->smk_subject->smk_known,
1338 &tsp->smk_rules); 1517 okp->smk_known,
1518 &tsp->smk_rules);
1339 if (may == -ENOENT) 1519 if (may == -ENOENT)
1340 may = srp->smk_access; 1520 may = srp->smk_access;
1341 else 1521 else
@@ -1352,8 +1532,8 @@ static int smack_mmap_file(struct file *file,
1352 * If there isn't one a SMACK64MMAP subject 1532 * If there isn't one a SMACK64MMAP subject
1353 * can't have as much access as current. 1533 * can't have as much access as current.
1354 */ 1534 */
1355 mmay = smk_access_entry(mkp->smk_known, osmack, 1535 mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1356 &mkp->smk_rules); 1536 &mkp->smk_rules);
1357 if (mmay == -ENOENT) { 1537 if (mmay == -ENOENT) {
1358 rc = -EACCES; 1538 rc = -EACCES;
1359 break; 1539 break;
@@ -1362,8 +1542,8 @@ static int smack_mmap_file(struct file *file,
1362 * If there is a local entry it modifies the 1542 * If there is a local entry it modifies the
1363 * potential access, too. 1543 * potential access, too.
1364 */ 1544 */
1365 tmay = smk_access_entry(mkp->smk_known, osmack, 1545 tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1366 &tsp->smk_rules); 1546 &tsp->smk_rules);
1367 if (tmay != -ENOENT) 1547 if (tmay != -ENOENT)
1368 mmay &= tmay; 1548 mmay &= tmay;
1369 1549
@@ -1394,7 +1574,7 @@ static int smack_file_set_fowner(struct file *file)
1394{ 1574{
1395 struct smack_known *skp = smk_of_current(); 1575 struct smack_known *skp = smk_of_current();
1396 1576
1397 file->f_security = skp->smk_known; 1577 file->f_security = skp;
1398 return 0; 1578 return 0;
1399} 1579}
1400 1580
@@ -1424,14 +1604,15 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
1424 file = container_of(fown, struct file, f_owner); 1604 file = container_of(fown, struct file, f_owner);
1425 1605
1426 /* we don't log here as rc can be overriden */ 1606 /* we don't log here as rc can be overriden */
1427 skp = smk_find_entry(file->f_security); 1607 skp = file->f_security;
1428 rc = smk_access(skp, tkp->smk_known, MAY_WRITE, NULL); 1608 rc = smk_access(skp, tkp, MAY_WRITE, NULL);
1609 rc = smk_bu_note("sigiotask", skp, tkp, MAY_WRITE, rc);
1429 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) 1610 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
1430 rc = 0; 1611 rc = 0;
1431 1612
1432 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1613 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1433 smk_ad_setfield_u_tsk(&ad, tsk); 1614 smk_ad_setfield_u_tsk(&ad, tsk);
1434 smack_log(file->f_security, tkp->smk_known, MAY_WRITE, rc, &ad); 1615 smack_log(skp->smk_known, tkp->smk_known, MAY_WRITE, rc, &ad);
1435 return rc; 1616 return rc;
1436} 1617}
1437 1618
@@ -1443,6 +1624,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
1443 */ 1624 */
1444static int smack_file_receive(struct file *file) 1625static int smack_file_receive(struct file *file)
1445{ 1626{
1627 int rc;
1446 int may = 0; 1628 int may = 0;
1447 struct smk_audit_info ad; 1629 struct smk_audit_info ad;
1448 1630
@@ -1456,7 +1638,9 @@ static int smack_file_receive(struct file *file)
1456 if (file->f_mode & FMODE_WRITE) 1638 if (file->f_mode & FMODE_WRITE)
1457 may |= MAY_WRITE; 1639 may |= MAY_WRITE;
1458 1640
1459 return smk_curacc(file->f_security, may, &ad); 1641 rc = smk_curacc(file->f_security, may, &ad);
1642 rc = smk_bu_file(file, may, rc);
1643 return rc;
1460} 1644}
1461 1645
1462/** 1646/**
@@ -1478,12 +1662,15 @@ static int smack_file_open(struct file *file, const struct cred *cred)
1478 struct smk_audit_info ad; 1662 struct smk_audit_info ad;
1479 int rc; 1663 int rc;
1480 1664
1481 if (smack_privileged(CAP_MAC_OVERRIDE)) 1665 if (smack_privileged(CAP_MAC_OVERRIDE)) {
1666 file->f_security = isp->smk_inode;
1482 return 0; 1667 return 0;
1668 }
1483 1669
1484 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1670 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1485 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1671 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1486 rc = smk_access(tsp->smk_task, isp->smk_inode, MAY_READ, &ad); 1672 rc = smk_access(tsp->smk_task, isp->smk_inode, MAY_READ, &ad);
1673 rc = smk_bu_credfile(cred, file, MAY_READ, rc);
1487 if (rc == 0) 1674 if (rc == 0)
1488 file->f_security = isp->smk_inode; 1675 file->f_security = isp->smk_inode;
1489 1676
@@ -1622,7 +1809,7 @@ static int smack_kernel_create_files_as(struct cred *new,
1622 struct inode_smack *isp = inode->i_security; 1809 struct inode_smack *isp = inode->i_security;
1623 struct task_smack *tsp = new->security; 1810 struct task_smack *tsp = new->security;
1624 1811
1625 tsp->smk_forked = smk_find_entry(isp->smk_inode); 1812 tsp->smk_forked = isp->smk_inode;
1626 tsp->smk_task = tsp->smk_forked; 1813 tsp->smk_task = tsp->smk_forked;
1627 return 0; 1814 return 0;
1628} 1815}
@@ -1640,10 +1827,13 @@ static int smk_curacc_on_task(struct task_struct *p, int access,
1640{ 1827{
1641 struct smk_audit_info ad; 1828 struct smk_audit_info ad;
1642 struct smack_known *skp = smk_of_task(task_security(p)); 1829 struct smack_known *skp = smk_of_task(task_security(p));
1830 int rc;
1643 1831
1644 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); 1832 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
1645 smk_ad_setfield_u_tsk(&ad, p); 1833 smk_ad_setfield_u_tsk(&ad, p);
1646 return smk_curacc(skp->smk_known, access, &ad); 1834 rc = smk_curacc(skp, access, &ad);
1835 rc = smk_bu_task(p, access, rc);
1836 return rc;
1647} 1837}
1648 1838
1649/** 1839/**
@@ -1797,6 +1987,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
1797 struct smk_audit_info ad; 1987 struct smk_audit_info ad;
1798 struct smack_known *skp; 1988 struct smack_known *skp;
1799 struct smack_known *tkp = smk_of_task(task_security(p)); 1989 struct smack_known *tkp = smk_of_task(task_security(p));
1990 int rc;
1800 1991
1801 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1992 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1802 smk_ad_setfield_u_tsk(&ad, p); 1993 smk_ad_setfield_u_tsk(&ad, p);
@@ -1804,15 +1995,20 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
1804 * Sending a signal requires that the sender 1995 * Sending a signal requires that the sender
1805 * can write the receiver. 1996 * can write the receiver.
1806 */ 1997 */
1807 if (secid == 0) 1998 if (secid == 0) {
1808 return smk_curacc(tkp->smk_known, MAY_WRITE, &ad); 1999 rc = smk_curacc(tkp, MAY_WRITE, &ad);
2000 rc = smk_bu_task(p, MAY_WRITE, rc);
2001 return rc;
2002 }
1809 /* 2003 /*
1810 * If the secid isn't 0 we're dealing with some USB IO 2004 * If the secid isn't 0 we're dealing with some USB IO
1811 * specific behavior. This is not clean. For one thing 2005 * specific behavior. This is not clean. For one thing
1812 * we can't take privilege into account. 2006 * we can't take privilege into account.
1813 */ 2007 */
1814 skp = smack_from_secid(secid); 2008 skp = smack_from_secid(secid);
1815 return smk_access(skp, tkp->smk_known, MAY_WRITE, &ad); 2009 rc = smk_access(skp, tkp, MAY_WRITE, &ad);
2010 rc = smk_bu_note("USB signal", skp, tkp, MAY_WRITE, rc);
2011 return rc;
1816} 2012}
1817 2013
1818/** 2014/**
@@ -1846,7 +2042,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
1846 struct inode_smack *isp = inode->i_security; 2042 struct inode_smack *isp = inode->i_security;
1847 struct smack_known *skp = smk_of_task(task_security(p)); 2043 struct smack_known *skp = smk_of_task(task_security(p));
1848 2044
1849 isp->smk_inode = skp->smk_known; 2045 isp->smk_inode = skp;
1850} 2046}
1851 2047
1852/* 2048/*
@@ -1904,7 +2100,7 @@ static void smack_sk_free_security(struct sock *sk)
1904* 2100*
1905* Returns the label of the far end or NULL if it's not special. 2101* Returns the label of the far end or NULL if it's not special.
1906*/ 2102*/
1907static char *smack_host_label(struct sockaddr_in *sip) 2103static struct smack_known *smack_host_label(struct sockaddr_in *sip)
1908{ 2104{
1909 struct smk_netlbladdr *snp; 2105 struct smk_netlbladdr *snp;
1910 struct in_addr *siap = &sip->sin_addr; 2106 struct in_addr *siap = &sip->sin_addr;
@@ -1921,7 +2117,7 @@ static char *smack_host_label(struct sockaddr_in *sip)
1921 if ((&snp->smk_host.sin_addr)->s_addr == 2117 if ((&snp->smk_host.sin_addr)->s_addr ==
1922 (siap->s_addr & (&snp->smk_mask)->s_addr)) { 2118 (siap->s_addr & (&snp->smk_mask)->s_addr)) {
1923 /* we have found the special CIPSO option */ 2119 /* we have found the special CIPSO option */
1924 if (snp->smk_label == smack_cipso_option) 2120 if (snp->smk_label == &smack_cipso_option)
1925 return NULL; 2121 return NULL;
1926 return snp->smk_label; 2122 return snp->smk_label;
1927 } 2123 }
@@ -1986,13 +2182,13 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
1986 struct smack_known *skp; 2182 struct smack_known *skp;
1987 int rc; 2183 int rc;
1988 int sk_lbl; 2184 int sk_lbl;
1989 char *hostsp; 2185 struct smack_known *hkp;
1990 struct socket_smack *ssp = sk->sk_security; 2186 struct socket_smack *ssp = sk->sk_security;
1991 struct smk_audit_info ad; 2187 struct smk_audit_info ad;
1992 2188
1993 rcu_read_lock(); 2189 rcu_read_lock();
1994 hostsp = smack_host_label(sap); 2190 hkp = smack_host_label(sap);
1995 if (hostsp != NULL) { 2191 if (hkp != NULL) {
1996#ifdef CONFIG_AUDIT 2192#ifdef CONFIG_AUDIT
1997 struct lsm_network_audit net; 2193 struct lsm_network_audit net;
1998 2194
@@ -2003,7 +2199,8 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
2003#endif 2199#endif
2004 sk_lbl = SMACK_UNLABELED_SOCKET; 2200 sk_lbl = SMACK_UNLABELED_SOCKET;
2005 skp = ssp->smk_out; 2201 skp = ssp->smk_out;
2006 rc = smk_access(skp, hostsp, MAY_WRITE, &ad); 2202 rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2203 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2007 } else { 2204 } else {
2008 sk_lbl = SMACK_CIPSO_SOCKET; 2205 sk_lbl = SMACK_CIPSO_SOCKET;
2009 rc = 0; 2206 rc = 0;
@@ -2104,18 +2301,19 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2104 struct socket_smack *ssp = sk->sk_security; 2301 struct socket_smack *ssp = sk->sk_security;
2105 struct smack_known *skp; 2302 struct smack_known *skp;
2106 unsigned short port = 0; 2303 unsigned short port = 0;
2107 char *object; 2304 struct smack_known *object;
2108 struct smk_audit_info ad; 2305 struct smk_audit_info ad;
2306 int rc;
2109#ifdef CONFIG_AUDIT 2307#ifdef CONFIG_AUDIT
2110 struct lsm_network_audit net; 2308 struct lsm_network_audit net;
2111#endif 2309#endif
2112 2310
2113 if (act == SMK_RECEIVING) { 2311 if (act == SMK_RECEIVING) {
2114 skp = smack_net_ambient; 2312 skp = smack_net_ambient;
2115 object = ssp->smk_in->smk_known; 2313 object = ssp->smk_in;
2116 } else { 2314 } else {
2117 skp = ssp->smk_out; 2315 skp = ssp->smk_out;
2118 object = smack_net_ambient->smk_known; 2316 object = smack_net_ambient;
2119 } 2317 }
2120 2318
2121 /* 2319 /*
@@ -2142,7 +2340,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2142 list_for_each_entry(spp, &smk_ipv6_port_list, list) { 2340 list_for_each_entry(spp, &smk_ipv6_port_list, list) {
2143 if (spp->smk_port != port) 2341 if (spp->smk_port != port)
2144 continue; 2342 continue;
2145 object = spp->smk_in->smk_known; 2343 object = spp->smk_in;
2146 if (act == SMK_CONNECTING) 2344 if (act == SMK_CONNECTING)
2147 ssp->smk_packet = spp->smk_out; 2345 ssp->smk_packet = spp->smk_out;
2148 break; 2346 break;
@@ -2159,7 +2357,9 @@ auditout:
2159 else 2357 else
2160 ad.a.u.net->v6info.daddr = address->sin6_addr; 2358 ad.a.u.net->v6info.daddr = address->sin6_addr;
2161#endif 2359#endif
2162 return smk_access(skp, object, MAY_WRITE, &ad); 2360 rc = smk_access(skp, object, MAY_WRITE, &ad);
2361 rc = smk_bu_note("IPv6 port check", skp, object, MAY_WRITE, rc);
2362 return rc;
2163} 2363}
2164 2364
2165/** 2365/**
@@ -2191,7 +2391,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
2191 return -EINVAL; 2391 return -EINVAL;
2192 2392
2193 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 2393 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2194 nsp->smk_inode = skp->smk_known; 2394 nsp->smk_inode = skp;
2195 nsp->smk_flags |= SMK_INODE_INSTANT; 2395 nsp->smk_flags |= SMK_INODE_INSTANT;
2196 return 0; 2396 return 0;
2197 } 2397 }
@@ -2333,7 +2533,7 @@ static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2333{ 2533{
2334 struct smack_known *skp = smk_of_current(); 2534 struct smack_known *skp = smk_of_current();
2335 2535
2336 msg->security = skp->smk_known; 2536 msg->security = skp;
2337 return 0; 2537 return 0;
2338} 2538}
2339 2539
@@ -2354,9 +2554,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg)
2354 * 2554 *
2355 * Returns a pointer to the smack value 2555 * Returns a pointer to the smack value
2356 */ 2556 */
2357static char *smack_of_shm(struct shmid_kernel *shp) 2557static struct smack_known *smack_of_shm(struct shmid_kernel *shp)
2358{ 2558{
2359 return (char *)shp->shm_perm.security; 2559 return (struct smack_known *)shp->shm_perm.security;
2360} 2560}
2361 2561
2362/** 2562/**
@@ -2370,7 +2570,7 @@ static int smack_shm_alloc_security(struct shmid_kernel *shp)
2370 struct kern_ipc_perm *isp = &shp->shm_perm; 2570 struct kern_ipc_perm *isp = &shp->shm_perm;
2371 struct smack_known *skp = smk_of_current(); 2571 struct smack_known *skp = smk_of_current();
2372 2572
2373 isp->security = skp->smk_known; 2573 isp->security = skp;
2374 return 0; 2574 return 0;
2375} 2575}
2376 2576
@@ -2396,14 +2596,17 @@ static void smack_shm_free_security(struct shmid_kernel *shp)
2396 */ 2596 */
2397static int smk_curacc_shm(struct shmid_kernel *shp, int access) 2597static int smk_curacc_shm(struct shmid_kernel *shp, int access)
2398{ 2598{
2399 char *ssp = smack_of_shm(shp); 2599 struct smack_known *ssp = smack_of_shm(shp);
2400 struct smk_audit_info ad; 2600 struct smk_audit_info ad;
2601 int rc;
2401 2602
2402#ifdef CONFIG_AUDIT 2603#ifdef CONFIG_AUDIT
2403 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2604 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2404 ad.a.u.ipc_id = shp->shm_perm.id; 2605 ad.a.u.ipc_id = shp->shm_perm.id;
2405#endif 2606#endif
2406 return smk_curacc(ssp, access, &ad); 2607 rc = smk_curacc(ssp, access, &ad);
2608 rc = smk_bu_current("shm", ssp, access, rc);
2609 return rc;
2407} 2610}
2408 2611
2409/** 2612/**
@@ -2478,9 +2681,9 @@ static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
2478 * 2681 *
2479 * Returns a pointer to the smack value 2682 * Returns a pointer to the smack value
2480 */ 2683 */
2481static char *smack_of_sem(struct sem_array *sma) 2684static struct smack_known *smack_of_sem(struct sem_array *sma)
2482{ 2685{
2483 return (char *)sma->sem_perm.security; 2686 return (struct smack_known *)sma->sem_perm.security;
2484} 2687}
2485 2688
2486/** 2689/**
@@ -2494,7 +2697,7 @@ static int smack_sem_alloc_security(struct sem_array *sma)
2494 struct kern_ipc_perm *isp = &sma->sem_perm; 2697 struct kern_ipc_perm *isp = &sma->sem_perm;
2495 struct smack_known *skp = smk_of_current(); 2698 struct smack_known *skp = smk_of_current();
2496 2699
2497 isp->security = skp->smk_known; 2700 isp->security = skp;
2498 return 0; 2701 return 0;
2499} 2702}
2500 2703
@@ -2520,14 +2723,17 @@ static void smack_sem_free_security(struct sem_array *sma)
2520 */ 2723 */
2521static int smk_curacc_sem(struct sem_array *sma, int access) 2724static int smk_curacc_sem(struct sem_array *sma, int access)
2522{ 2725{
2523 char *ssp = smack_of_sem(sma); 2726 struct smack_known *ssp = smack_of_sem(sma);
2524 struct smk_audit_info ad; 2727 struct smk_audit_info ad;
2728 int rc;
2525 2729
2526#ifdef CONFIG_AUDIT 2730#ifdef CONFIG_AUDIT
2527 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2731 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2528 ad.a.u.ipc_id = sma->sem_perm.id; 2732 ad.a.u.ipc_id = sma->sem_perm.id;
2529#endif 2733#endif
2530 return smk_curacc(ssp, access, &ad); 2734 rc = smk_curacc(ssp, access, &ad);
2735 rc = smk_bu_current("sem", ssp, access, rc);
2736 return rc;
2531} 2737}
2532 2738
2533/** 2739/**
@@ -2613,7 +2819,7 @@ static int smack_msg_queue_alloc_security(struct msg_queue *msq)
2613 struct kern_ipc_perm *kisp = &msq->q_perm; 2819 struct kern_ipc_perm *kisp = &msq->q_perm;
2614 struct smack_known *skp = smk_of_current(); 2820 struct smack_known *skp = smk_of_current();
2615 2821
2616 kisp->security = skp->smk_known; 2822 kisp->security = skp;
2617 return 0; 2823 return 0;
2618} 2824}
2619 2825
@@ -2634,11 +2840,11 @@ static void smack_msg_queue_free_security(struct msg_queue *msq)
2634 * smack_of_msq - the smack pointer for the msq 2840 * smack_of_msq - the smack pointer for the msq
2635 * @msq: the object 2841 * @msq: the object
2636 * 2842 *
2637 * Returns a pointer to the smack value 2843 * Returns a pointer to the smack label entry
2638 */ 2844 */
2639static char *smack_of_msq(struct msg_queue *msq) 2845static struct smack_known *smack_of_msq(struct msg_queue *msq)
2640{ 2846{
2641 return (char *)msq->q_perm.security; 2847 return (struct smack_known *)msq->q_perm.security;
2642} 2848}
2643 2849
2644/** 2850/**
@@ -2650,14 +2856,17 @@ static char *smack_of_msq(struct msg_queue *msq)
2650 */ 2856 */
2651static int smk_curacc_msq(struct msg_queue *msq, int access) 2857static int smk_curacc_msq(struct msg_queue *msq, int access)
2652{ 2858{
2653 char *msp = smack_of_msq(msq); 2859 struct smack_known *msp = smack_of_msq(msq);
2654 struct smk_audit_info ad; 2860 struct smk_audit_info ad;
2861 int rc;
2655 2862
2656#ifdef CONFIG_AUDIT 2863#ifdef CONFIG_AUDIT
2657 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2864 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2658 ad.a.u.ipc_id = msq->q_perm.id; 2865 ad.a.u.ipc_id = msq->q_perm.id;
2659#endif 2866#endif
2660 return smk_curacc(msp, access, &ad); 2867 rc = smk_curacc(msp, access, &ad);
2868 rc = smk_bu_current("msq", msp, access, rc);
2869 return rc;
2661} 2870}
2662 2871
2663/** 2872/**
@@ -2750,15 +2959,18 @@ static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
2750 */ 2959 */
2751static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 2960static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
2752{ 2961{
2753 char *isp = ipp->security; 2962 struct smack_known *iskp = ipp->security;
2754 int may = smack_flags_to_may(flag); 2963 int may = smack_flags_to_may(flag);
2755 struct smk_audit_info ad; 2964 struct smk_audit_info ad;
2965 int rc;
2756 2966
2757#ifdef CONFIG_AUDIT 2967#ifdef CONFIG_AUDIT
2758 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2968 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2759 ad.a.u.ipc_id = ipp->id; 2969 ad.a.u.ipc_id = ipp->id;
2760#endif 2970#endif
2761 return smk_curacc(isp, may, &ad); 2971 rc = smk_curacc(iskp, may, &ad);
2972 rc = smk_bu_current("svipc", iskp, may, rc);
2973 return rc;
2762} 2974}
2763 2975
2764/** 2976/**
@@ -2768,9 +2980,9 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
2768 */ 2980 */
2769static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid) 2981static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
2770{ 2982{
2771 char *smack = ipp->security; 2983 struct smack_known *iskp = ipp->security;
2772 2984
2773 *secid = smack_to_secid(smack); 2985 *secid = iskp->smk_secid;
2774} 2986}
2775 2987
2776/** 2988/**
@@ -2787,7 +2999,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2787 struct inode_smack *isp; 2999 struct inode_smack *isp;
2788 struct smack_known *skp; 3000 struct smack_known *skp;
2789 struct smack_known *ckp = smk_of_current(); 3001 struct smack_known *ckp = smk_of_current();
2790 char *final; 3002 struct smack_known *final;
2791 char trattr[TRANS_TRUE_SIZE]; 3003 char trattr[TRANS_TRUE_SIZE];
2792 int transflag = 0; 3004 int transflag = 0;
2793 int rc; 3005 int rc;
@@ -2827,8 +3039,8 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2827 * so there's no opportunity to set the mount 3039 * so there's no opportunity to set the mount
2828 * options. 3040 * options.
2829 */ 3041 */
2830 sbsp->smk_root = smack_known_star.smk_known; 3042 sbsp->smk_root = &smack_known_star;
2831 sbsp->smk_default = smack_known_star.smk_known; 3043 sbsp->smk_default = &smack_known_star;
2832 } 3044 }
2833 isp->smk_inode = sbsp->smk_root; 3045 isp->smk_inode = sbsp->smk_root;
2834 isp->smk_flags |= SMK_INODE_INSTANT; 3046 isp->smk_flags |= SMK_INODE_INSTANT;
@@ -2858,7 +3070,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2858 * 3070 *
2859 * Cgroupfs is special 3071 * Cgroupfs is special
2860 */ 3072 */
2861 final = smack_known_star.smk_known; 3073 final = &smack_known_star;
2862 break; 3074 break;
2863 case DEVPTS_SUPER_MAGIC: 3075 case DEVPTS_SUPER_MAGIC:
2864 /* 3076 /*
@@ -2866,7 +3078,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2866 * Programs that change smack have to treat the 3078 * Programs that change smack have to treat the
2867 * pty with respect. 3079 * pty with respect.
2868 */ 3080 */
2869 final = ckp->smk_known; 3081 final = ckp;
2870 break; 3082 break;
2871 case PROC_SUPER_MAGIC: 3083 case PROC_SUPER_MAGIC:
2872 /* 3084 /*
@@ -2880,7 +3092,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2880 * but watch out, because they're volitile, 3092 * but watch out, because they're volitile,
2881 * getting recreated on every reboot. 3093 * getting recreated on every reboot.
2882 */ 3094 */
2883 final = smack_known_star.smk_known; 3095 final = &smack_known_star;
2884 /* 3096 /*
2885 * No break. 3097 * No break.
2886 * 3098 *
@@ -2899,7 +3111,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2899 * UNIX domain sockets use lower level socket data. 3111 * UNIX domain sockets use lower level socket data.
2900 */ 3112 */
2901 if (S_ISSOCK(inode->i_mode)) { 3113 if (S_ISSOCK(inode->i_mode)) {
2902 final = smack_known_star.smk_known; 3114 final = &smack_known_star;
2903 break; 3115 break;
2904 } 3116 }
2905 /* 3117 /*
@@ -2916,7 +3128,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2916 dp = dget(opt_dentry); 3128 dp = dget(opt_dentry);
2917 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp); 3129 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
2918 if (skp != NULL) 3130 if (skp != NULL)
2919 final = skp->smk_known; 3131 final = skp;
2920 3132
2921 /* 3133 /*
2922 * Transmuting directory 3134 * Transmuting directory
@@ -2965,7 +3177,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2965 } 3177 }
2966 3178
2967 if (final == NULL) 3179 if (final == NULL)
2968 isp->smk_inode = ckp->smk_known; 3180 isp->smk_inode = ckp;
2969 else 3181 else
2970 isp->smk_inode = final; 3182 isp->smk_inode = final;
2971 3183
@@ -3090,9 +3302,13 @@ static int smack_unix_stream_connect(struct sock *sock,
3090 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3302 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3091 smk_ad_setfield_u_net_sk(&ad, other); 3303 smk_ad_setfield_u_net_sk(&ad, other);
3092#endif 3304#endif
3093 rc = smk_access(skp, okp->smk_known, MAY_WRITE, &ad); 3305 rc = smk_access(skp, okp, MAY_WRITE, &ad);
3094 if (rc == 0) 3306 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3095 rc = smk_access(okp, okp->smk_known, MAY_WRITE, NULL); 3307 if (rc == 0) {
3308 rc = smk_access(okp, skp, MAY_WRITE, NULL);
3309 rc = smk_bu_note("UDS connect", okp, skp,
3310 MAY_WRITE, rc);
3311 }
3096 } 3312 }
3097 3313
3098 /* 3314 /*
@@ -3118,8 +3334,8 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
3118{ 3334{
3119 struct socket_smack *ssp = sock->sk->sk_security; 3335 struct socket_smack *ssp = sock->sk->sk_security;
3120 struct socket_smack *osp = other->sk->sk_security; 3336 struct socket_smack *osp = other->sk->sk_security;
3121 struct smack_known *skp;
3122 struct smk_audit_info ad; 3337 struct smk_audit_info ad;
3338 int rc;
3123 3339
3124#ifdef CONFIG_AUDIT 3340#ifdef CONFIG_AUDIT
3125 struct lsm_network_audit net; 3341 struct lsm_network_audit net;
@@ -3131,8 +3347,9 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
3131 if (smack_privileged(CAP_MAC_OVERRIDE)) 3347 if (smack_privileged(CAP_MAC_OVERRIDE))
3132 return 0; 3348 return 0;
3133 3349
3134 skp = ssp->smk_out; 3350 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3135 return smk_access(skp, osp->smk_in->smk_known, MAY_WRITE, &ad); 3351 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3352 return rc;
3136} 3353}
3137 3354
3138/** 3355/**
@@ -3346,7 +3563,9 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3346 * This is the simplist possible security model 3563 * This is the simplist possible security model
3347 * for networking. 3564 * for networking.
3348 */ 3565 */
3349 rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad); 3566 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3567 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
3568 MAY_WRITE, rc);
3350 if (rc != 0) 3569 if (rc != 0)
3351 netlbl_skbuff_err(skb, rc, 0); 3570 netlbl_skbuff_err(skb, rc, 0);
3352 break; 3571 break;
@@ -3489,7 +3708,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3489 struct netlbl_lsm_secattr secattr; 3708 struct netlbl_lsm_secattr secattr;
3490 struct sockaddr_in addr; 3709 struct sockaddr_in addr;
3491 struct iphdr *hdr; 3710 struct iphdr *hdr;
3492 char *hsp; 3711 struct smack_known *hskp;
3493 int rc; 3712 int rc;
3494 struct smk_audit_info ad; 3713 struct smk_audit_info ad;
3495#ifdef CONFIG_AUDIT 3714#ifdef CONFIG_AUDIT
@@ -3526,7 +3745,8 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3526 * Receiving a packet requires that the other end be able to write 3745 * Receiving a packet requires that the other end be able to write
3527 * here. Read access is not required. 3746 * here. Read access is not required.
3528 */ 3747 */
3529 rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad); 3748 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3749 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
3530 if (rc != 0) 3750 if (rc != 0)
3531 return rc; 3751 return rc;
3532 3752
@@ -3544,10 +3764,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3544 hdr = ip_hdr(skb); 3764 hdr = ip_hdr(skb);
3545 addr.sin_addr.s_addr = hdr->saddr; 3765 addr.sin_addr.s_addr = hdr->saddr;
3546 rcu_read_lock(); 3766 rcu_read_lock();
3547 hsp = smack_host_label(&addr); 3767 hskp = smack_host_label(&addr);
3548 rcu_read_unlock(); 3768 rcu_read_unlock();
3549 3769
3550 if (hsp == NULL) 3770 if (hskp == NULL)
3551 rc = netlbl_req_setattr(req, &skp->smk_netlabel); 3771 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
3552 else 3772 else
3553 netlbl_req_delattr(req); 3773 netlbl_req_delattr(req);
@@ -3599,7 +3819,7 @@ static int smack_key_alloc(struct key *key, const struct cred *cred,
3599{ 3819{
3600 struct smack_known *skp = smk_of_task(cred->security); 3820 struct smack_known *skp = smk_of_task(cred->security);
3601 3821
3602 key->security = skp->smk_known; 3822 key->security = skp;
3603 return 0; 3823 return 0;
3604} 3824}
3605 3825
@@ -3630,6 +3850,7 @@ static int smack_key_permission(key_ref_t key_ref,
3630 struct smk_audit_info ad; 3850 struct smk_audit_info ad;
3631 struct smack_known *tkp = smk_of_task(cred->security); 3851 struct smack_known *tkp = smk_of_task(cred->security);
3632 int request = 0; 3852 int request = 0;
3853 int rc;
3633 3854
3634 keyp = key_ref_to_ptr(key_ref); 3855 keyp = key_ref_to_ptr(key_ref);
3635 if (keyp == NULL) 3856 if (keyp == NULL)
@@ -3654,7 +3875,9 @@ static int smack_key_permission(key_ref_t key_ref,
3654 request = MAY_READ; 3875 request = MAY_READ;
3655 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) 3876 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
3656 request = MAY_WRITE; 3877 request = MAY_WRITE;
3657 return smk_access(tkp, keyp->security, request, &ad); 3878 rc = smk_access(tkp, keyp->security, request, &ad);
3879 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
3880 return rc;
3658} 3881}
3659#endif /* CONFIG_KEYS */ 3882#endif /* CONFIG_KEYS */
3660 3883
@@ -3685,6 +3908,7 @@ static int smack_key_permission(key_ref_t key_ref,
3685 */ 3908 */
3686static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3909static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3687{ 3910{
3911 struct smack_known *skp;
3688 char **rule = (char **)vrule; 3912 char **rule = (char **)vrule;
3689 *rule = NULL; 3913 *rule = NULL;
3690 3914
@@ -3694,7 +3918,9 @@ static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3694 if (op != Audit_equal && op != Audit_not_equal) 3918 if (op != Audit_equal && op != Audit_not_equal)
3695 return -EINVAL; 3919 return -EINVAL;
3696 3920
3697 *rule = smk_import(rulestr, 0); 3921 skp = smk_import_entry(rulestr, 0);
3922 if (skp)
3923 *rule = skp->smk_known;
3698 3924
3699 return 0; 3925 return 0;
3700} 3926}
@@ -3813,7 +4039,12 @@ static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
3813 */ 4039 */
3814static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 4040static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
3815{ 4041{
3816 *secid = smack_to_secid(secdata); 4042 struct smack_known *skp = smk_find_entry(secdata);
4043
4044 if (skp)
4045 *secid = skp->smk_secid;
4046 else
4047 *secid = 0;
3817 return 0; 4048 return 0;
3818} 4049}
3819 4050
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 3c720ff10591..bce4e8f1b267 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -131,14 +131,17 @@ LIST_HEAD(smack_rule_list);
131 131
132struct smack_parsed_rule { 132struct smack_parsed_rule {
133 struct smack_known *smk_subject; 133 struct smack_known *smk_subject;
134 char *smk_object; 134 struct smack_known *smk_object;
135 int smk_access1; 135 int smk_access1;
136 int smk_access2; 136 int smk_access2;
137}; 137};
138 138
139static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT; 139static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
140 140
141const char *smack_cipso_option = SMACK_CIPSO_OPTION; 141struct smack_known smack_cipso_option = {
142 .smk_known = SMACK_CIPSO_OPTION,
143 .smk_secid = 0,
144};
142 145
143/* 146/*
144 * Values for parsing cipso rules 147 * Values for parsing cipso rules
@@ -304,6 +307,10 @@ static int smk_perm_from_str(const char *string)
304 case 'L': 307 case 'L':
305 perm |= MAY_LOCK; 308 perm |= MAY_LOCK;
306 break; 309 break;
310 case 'b':
311 case 'B':
312 perm |= MAY_BRINGUP;
313 break;
307 default: 314 default:
308 return perm; 315 return perm;
309 } 316 }
@@ -335,7 +342,7 @@ static int smk_fill_rule(const char *subject, const char *object,
335 if (rule->smk_subject == NULL) 342 if (rule->smk_subject == NULL)
336 return -EINVAL; 343 return -EINVAL;
337 344
338 rule->smk_object = smk_import(object, len); 345 rule->smk_object = smk_import_entry(object, len);
339 if (rule->smk_object == NULL) 346 if (rule->smk_object == NULL)
340 return -EINVAL; 347 return -EINVAL;
341 } else { 348 } else {
@@ -355,7 +362,7 @@ static int smk_fill_rule(const char *subject, const char *object,
355 kfree(cp); 362 kfree(cp);
356 if (skp == NULL) 363 if (skp == NULL)
357 return -ENOENT; 364 return -ENOENT;
358 rule->smk_object = skp->smk_known; 365 rule->smk_object = skp;
359 } 366 }
360 367
361 rule->smk_access1 = smk_perm_from_str(access1); 368 rule->smk_access1 = smk_perm_from_str(access1);
@@ -594,13 +601,15 @@ static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
594 * anything you read back. 601 * anything you read back.
595 */ 602 */
596 if (strlen(srp->smk_subject->smk_known) >= max || 603 if (strlen(srp->smk_subject->smk_known) >= max ||
597 strlen(srp->smk_object) >= max) 604 strlen(srp->smk_object->smk_known) >= max)
598 return; 605 return;
599 606
600 if (srp->smk_access == 0) 607 if (srp->smk_access == 0)
601 return; 608 return;
602 609
603 seq_printf(s, "%s %s", srp->smk_subject->smk_known, srp->smk_object); 610 seq_printf(s, "%s %s",
611 srp->smk_subject->smk_known,
612 srp->smk_object->smk_known);
604 613
605 seq_putc(s, ' '); 614 seq_putc(s, ' ');
606 615
@@ -616,6 +625,8 @@ static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
616 seq_putc(s, 't'); 625 seq_putc(s, 't');
617 if (srp->smk_access & MAY_LOCK) 626 if (srp->smk_access & MAY_LOCK)
618 seq_putc(s, 'l'); 627 seq_putc(s, 'l');
628 if (srp->smk_access & MAY_BRINGUP)
629 seq_putc(s, 'b');
619 630
620 seq_putc(s, '\n'); 631 seq_putc(s, '\n');
621} 632}
@@ -1067,7 +1078,7 @@ static int netlbladdr_seq_show(struct seq_file *s, void *v)
1067 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++); 1078 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
1068 1079
1069 seq_printf(s, "%u.%u.%u.%u/%d %s\n", 1080 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1070 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label); 1081 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label->smk_known);
1071 1082
1072 return 0; 1083 return 0;
1073} 1084}
@@ -1147,10 +1158,10 @@ static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1147static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf, 1158static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1148 size_t count, loff_t *ppos) 1159 size_t count, loff_t *ppos)
1149{ 1160{
1150 struct smk_netlbladdr *skp; 1161 struct smk_netlbladdr *snp;
1151 struct sockaddr_in newname; 1162 struct sockaddr_in newname;
1152 char *smack; 1163 char *smack;
1153 char *sp; 1164 struct smack_known *skp;
1154 char *data; 1165 char *data;
1155 char *host = (char *)&newname.sin_addr.s_addr; 1166 char *host = (char *)&newname.sin_addr.s_addr;
1156 int rc; 1167 int rc;
@@ -1213,15 +1224,15 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1213 * If smack begins with '-', it is an option, don't import it 1224 * If smack begins with '-', it is an option, don't import it
1214 */ 1225 */
1215 if (smack[0] != '-') { 1226 if (smack[0] != '-') {
1216 sp = smk_import(smack, 0); 1227 skp = smk_import_entry(smack, 0);
1217 if (sp == NULL) { 1228 if (skp == NULL) {
1218 rc = -EINVAL; 1229 rc = -EINVAL;
1219 goto free_out; 1230 goto free_out;
1220 } 1231 }
1221 } else { 1232 } else {
1222 /* check known options */ 1233 /* check known options */
1223 if (strcmp(smack, smack_cipso_option) == 0) 1234 if (strcmp(smack, smack_cipso_option.smk_known) == 0)
1224 sp = (char *)smack_cipso_option; 1235 skp = &smack_cipso_option;
1225 else { 1236 else {
1226 rc = -EINVAL; 1237 rc = -EINVAL;
1227 goto free_out; 1238 goto free_out;
@@ -1244,9 +1255,9 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1244 nsa = newname.sin_addr.s_addr; 1255 nsa = newname.sin_addr.s_addr;
1245 /* try to find if the prefix is already in the list */ 1256 /* try to find if the prefix is already in the list */
1246 found = 0; 1257 found = 0;
1247 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) { 1258 list_for_each_entry_rcu(snp, &smk_netlbladdr_list, list) {
1248 if (skp->smk_host.sin_addr.s_addr == nsa && 1259 if (snp->smk_host.sin_addr.s_addr == nsa &&
1249 skp->smk_mask.s_addr == mask.s_addr) { 1260 snp->smk_mask.s_addr == mask.s_addr) {
1250 found = 1; 1261 found = 1;
1251 break; 1262 break;
1252 } 1263 }
@@ -1254,26 +1265,26 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1254 smk_netlabel_audit_set(&audit_info); 1265 smk_netlabel_audit_set(&audit_info);
1255 1266
1256 if (found == 0) { 1267 if (found == 0) {
1257 skp = kzalloc(sizeof(*skp), GFP_KERNEL); 1268 snp = kzalloc(sizeof(*snp), GFP_KERNEL);
1258 if (skp == NULL) 1269 if (snp == NULL)
1259 rc = -ENOMEM; 1270 rc = -ENOMEM;
1260 else { 1271 else {
1261 rc = 0; 1272 rc = 0;
1262 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr; 1273 snp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1263 skp->smk_mask.s_addr = mask.s_addr; 1274 snp->smk_mask.s_addr = mask.s_addr;
1264 skp->smk_label = sp; 1275 snp->smk_label = skp;
1265 smk_netlbladdr_insert(skp); 1276 smk_netlbladdr_insert(snp);
1266 } 1277 }
1267 } else { 1278 } else {
1268 /* we delete the unlabeled entry, only if the previous label 1279 /* we delete the unlabeled entry, only if the previous label
1269 * wasn't the special CIPSO option */ 1280 * wasn't the special CIPSO option */
1270 if (skp->smk_label != smack_cipso_option) 1281 if (snp->smk_label != &smack_cipso_option)
1271 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL, 1282 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1272 &skp->smk_host.sin_addr, &skp->smk_mask, 1283 &snp->smk_host.sin_addr, &snp->smk_mask,
1273 PF_INET, &audit_info); 1284 PF_INET, &audit_info);
1274 else 1285 else
1275 rc = 0; 1286 rc = 0;
1276 skp->smk_label = sp; 1287 snp->smk_label = skp;
1277 } 1288 }
1278 1289
1279 /* 1290 /*
@@ -1281,10 +1292,10 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1281 * this host so that incoming packets get labeled. 1292 * this host so that incoming packets get labeled.
1282 * but only if we didn't get the special CIPSO option 1293 * but only if we didn't get the special CIPSO option
1283 */ 1294 */
1284 if (rc == 0 && sp != smack_cipso_option) 1295 if (rc == 0 && skp != &smack_cipso_option)
1285 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL, 1296 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1286 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET, 1297 &snp->smk_host.sin_addr, &snp->smk_mask, PF_INET,
1287 smack_to_secid(skp->smk_label), &audit_info); 1298 snp->smk_label->smk_secid, &audit_info);
1288 1299
1289 if (rc == 0) 1300 if (rc == 0)
1290 rc = count; 1301 rc = count;
@@ -1677,7 +1688,7 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1677 if (smack_onlycap != NULL && smack_onlycap != skp) 1688 if (smack_onlycap != NULL && smack_onlycap != skp)
1678 return -EPERM; 1689 return -EPERM;
1679 1690
1680 data = kzalloc(count, GFP_KERNEL); 1691 data = kzalloc(count + 1, GFP_KERNEL);
1681 if (data == NULL) 1692 if (data == NULL)
1682 return -ENOMEM; 1693 return -ENOMEM;
1683 1694
@@ -1880,7 +1891,10 @@ static ssize_t smk_user_access(struct file *file, const char __user *buf,
1880 else if (res != -ENOENT) 1891 else if (res != -ENOENT)
1881 return -EINVAL; 1892 return -EINVAL;
1882 1893
1883 data[0] = res == 0 ? '1' : '0'; 1894 /*
1895 * smk_access() can return a value > 0 in the "bringup" case.
1896 */
1897 data[0] = res >= 0 ? '1' : '0';
1884 data[1] = '\0'; 1898 data[1] = '\0';
1885 1899
1886 simple_transaction_set(file, 2); 1900 simple_transaction_set(file, 2);
@@ -2228,7 +2242,7 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
2228 if (!smack_privileged(CAP_MAC_ADMIN)) 2242 if (!smack_privileged(CAP_MAC_ADMIN))
2229 return -EPERM; 2243 return -EPERM;
2230 2244
2231 data = kzalloc(count, GFP_KERNEL); 2245 data = kzalloc(count + 1, GFP_KERNEL);
2232 if (data == NULL) 2246 if (data == NULL)
2233 return -ENOMEM; 2247 return -ENOMEM;
2234 2248