1 files changed, 298 insertions, 107 deletions

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 98b3195347ab..0023182078c7 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -30,7 +30,6 @@
 #include <net/netlabel.h>
 #include <net/cipso_ipv4.h>
 #include <linux/audit.h>
-
 #include "smack.h"
 
 #define task_security(task)     (task_cred_xxx((task), security))
@@ -103,14 +102,24 @@ struct inode_smack *new_inode_smack(char *smack)
 static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode)
 {
         int rc;
+        struct smk_audit_info ad;
+        char *sp, *tsp;
 
         rc = cap_ptrace_may_access(ctp, mode);
         if (rc != 0)
                 return rc;
 
-        rc = smk_access(current_security(), task_security(ctp), MAY_READWRITE);
+        sp = current_security();
+        tsp = task_security(ctp);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, ctp);
+
+        /* we won't log here, because rc can be overriden */
+        rc = smk_access(sp, tsp, MAY_READWRITE, NULL);
         if (rc != 0 && capable(CAP_MAC_OVERRIDE))
-                return 0;
+                rc = 0;
+
+        smack_log(sp, tsp, MAY_READWRITE, rc, &ad);
         return rc;
 }
 
@@ -125,14 +134,24 @@ static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode)
 static int smack_ptrace_traceme(struct task_struct *ptp)
 {
         int rc;
+        struct smk_audit_info ad;
+        char *sp, *tsp;
 
         rc = cap_ptrace_traceme(ptp);
         if (rc != 0)
                 return rc;
 
-        rc = smk_access(task_security(ptp), current_security(), MAY_READWRITE);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, ptp);
+
+        sp = current_security();
+        tsp = task_security(ptp);
+        /* we won't log here, because rc can be overriden */
+        rc = smk_access(tsp, sp, MAY_READWRITE, NULL);
         if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE))
-                return 0;
+                rc = 0;
+
+        smack_log(tsp, sp, MAY_READWRITE, rc, &ad);
         return rc;
 }
 
@@ -327,8 +346,14 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
 static int smack_sb_statfs(struct dentry *dentry)
 {
         struct superblock_smack *sbp = dentry->d_sb->s_security;
+        int rc;
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
-        return smk_curacc(sbp->smk_floor, MAY_READ);
+        rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
+        return rc;
 }
 
 /**
@@ -346,8 +371,12 @@ static int smack_sb_mount(char *dev_name, struct path *path,
                           char *type, unsigned long flags, void *data)
 {
         struct superblock_smack *sbp = path->mnt->mnt_sb->s_security;
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path(&ad, *path);
 
-        return smk_curacc(sbp->smk_floor, MAY_WRITE);
+        return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
 }
 
 /**
@@ -361,10 +390,14 @@ static int smack_sb_mount(char *dev_name, struct path *path,
 static int smack_sb_umount(struct vfsmount *mnt, int flags)
 {
         struct superblock_smack *sbp;
+        struct smk_audit_info ad;
 
-        sbp = mnt->mnt_sb->s_security;
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, mnt->mnt_mountpoint);
+        smk_ad_setfield_u_fs_path_mnt(&ad, mnt);
 
-        return smk_curacc(sbp->smk_floor, MAY_WRITE);
+        sbp = mnt->mnt_sb->s_security;
+        return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
 }
 
 /*
@@ -441,15 +474,20 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
 static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
                             struct dentry *new_dentry)
 {
-        int rc;
         char *isp;
+        struct smk_audit_info ad;
+        int rc;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
 
         isp = smk_of_inode(old_dentry->d_inode);
-        rc = smk_curacc(isp, MAY_WRITE);
+        rc = smk_curacc(isp, MAY_WRITE, &ad);
 
         if (rc == 0 && new_dentry->d_inode != NULL) {
                 isp = smk_of_inode(new_dentry->d_inode);
-                rc = smk_curacc(isp, MAY_WRITE);
+                smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
+                rc = smk_curacc(isp, MAY_WRITE, &ad);
         }
 
         return rc;
@@ -466,18 +504,24 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
 static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
 {
         struct inode *ip = dentry->d_inode;
+        struct smk_audit_info ad;
         int rc;
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+
         /*
          * You need write access to the thing you're unlinking
          */
-        rc = smk_curacc(smk_of_inode(ip), MAY_WRITE);
-        if (rc == 0)
+        rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
+        if (rc == 0) {
                 /*
                  * You also need write access to the containing directory
                  */
-                rc = smk_curacc(smk_of_inode(dir), MAY_WRITE);
-
+                smk_ad_setfield_u_fs_path_dentry(&ad, NULL);
+                smk_ad_setfield_u_fs_inode(&ad, dir);
+                rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
+        }
         return rc;
 }
 
@@ -491,17 +535,24 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
  */
 static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
 {
+        struct smk_audit_info ad;
         int rc;
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+
         /*
          * You need write access to the thing you're removing
          */
-        rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
-        if (rc == 0)
+        rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
+        if (rc == 0) {
                 /*
                  * You also need write access to the containing directory
                  */
-                rc = smk_curacc(smk_of_inode(dir), MAY_WRITE);
+                smk_ad_setfield_u_fs_path_dentry(&ad, NULL);
+                smk_ad_setfield_u_fs_inode(&ad, dir);
+                rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
+        }
 
         return rc;
 }
@@ -525,15 +576,19 @@ static int smack_inode_rename(struct inode *old_inode,
 {
         int rc;
         char *isp;
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, old_dentry);
 
         isp = smk_of_inode(old_dentry->d_inode);
-        rc = smk_curacc(isp, MAY_READWRITE);
+        rc = smk_curacc(isp, MAY_READWRITE, &ad);
 
         if (rc == 0 && new_dentry->d_inode != NULL) {
                 isp = smk_of_inode(new_dentry->d_inode);
-                rc = smk_curacc(isp, MAY_READWRITE);
+                smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
+                rc = smk_curacc(isp, MAY_READWRITE, &ad);
         }
-
         return rc;
 }
 
@@ -548,13 +603,15 @@ static int smack_inode_rename(struct inode *old_inode,
  */
 static int smack_inode_permission(struct inode *inode, int mask)
 {
+        struct smk_audit_info ad;
         /*
          * No permission to check. Existence test. Yup, it's there.
          */
         if (mask == 0)
                 return 0;
-
-        return smk_curacc(smk_of_inode(inode), mask);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_inode(&ad, inode);
+        return smk_curacc(smk_of_inode(inode), mask, &ad);
 }
 
 /**
@@ -566,13 +623,16 @@ static int smack_inode_permission(struct inode *inode, int mask)
  */
 static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
 {
+        struct smk_audit_info ad;
         /*
          * Need to allow for clearing the setuid bit.
          */
         if (iattr->ia_valid & ATTR_FORCE)
                 return 0;
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
 
-        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
 }
 
 /**
@@ -584,7 +644,12 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
  */
 static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 {
-        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ);
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+        smk_ad_setfield_u_fs_path_mnt(&ad, mnt);
+        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
 }
 
 /**
@@ -602,6 +667,7 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
 static int smack_inode_setxattr(struct dentry *dentry, const char *name,
                                 const void *value, size_t size, int flags)
 {
+        struct smk_audit_info ad;
         int rc = 0;
 
         if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
@@ -619,8 +685,11 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
         } else
                 rc = cap_inode_setxattr(dentry, name, value, size, flags);
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+
         if (rc == 0)
-                rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+                rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
 
         return rc;
 }
@@ -672,7 +741,12 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
  */
 static int smack_inode_getxattr(struct dentry *dentry, const char *name)
 {
-        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ);
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
+
+        return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
 }
 
 /*
@@ -686,6 +760,7 @@ static int smack_inode_getxattr(struct dentry *dentry, const char *name)
  */
 static int smack_inode_removexattr(struct dentry *dentry, const char *name)
 {
+        struct smk_audit_info ad;
         int rc = 0;
 
         if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
@@ -696,8 +771,10 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
         } else
                 rc = cap_inode_removexattr(dentry, name);
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
         if (rc == 0)
-                rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
+                rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
 
         return rc;
 }
@@ -856,12 +933,16 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
                             unsigned long arg)
 {
         int rc = 0;
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path(&ad, file->f_path);
 
         if (_IOC_DIR(cmd) & _IOC_WRITE)
-                rc = smk_curacc(file->f_security, MAY_WRITE);
+                rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
 
         if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ))
-                rc = smk_curacc(file->f_security, MAY_READ);
+                rc = smk_curacc(file->f_security, MAY_READ, &ad);
 
         return rc;
 }
@@ -875,7 +956,11 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
  */
 static int smack_file_lock(struct file *file, unsigned int cmd)
 {
-        return smk_curacc(file->f_security, MAY_WRITE);
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path_dentry(&ad, file->f_path.dentry);
+        return smk_curacc(file->f_security, MAY_WRITE, &ad);
 }
 
 /**
@@ -889,8 +974,12 @@ static int smack_file_lock(struct file *file, unsigned int cmd)
 static int smack_file_fcntl(struct file *file, unsigned int cmd,
                             unsigned long arg)
 {
+        struct smk_audit_info ad;
         int rc;
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_FS);
+        smk_ad_setfield_u_fs_path(&ad, file->f_path);
+
         switch (cmd) {
         case F_DUPFD:
         case F_GETFD:
@@ -898,7 +987,7 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
         case F_GETLK:
         case F_GETOWN:
         case F_GETSIG:
-                rc = smk_curacc(file->f_security, MAY_READ);
+                rc = smk_curacc(file->f_security, MAY_READ, &ad);
                 break;
         case F_SETFD:
         case F_SETFL:
@@ -906,10 +995,10 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
         case F_SETLKW:
         case F_SETOWN:
         case F_SETSIG:
-                rc = smk_curacc(file->f_security, MAY_WRITE);
+                rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
                 break;
         default:
-                rc = smk_curacc(file->f_security, MAY_READWRITE);
+                rc = smk_curacc(file->f_security, MAY_READWRITE, &ad);
         }
 
         return rc;
@@ -944,14 +1033,21 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
 {
         struct file *file;
         int rc;
+        char *tsp = tsk->cred->security;
+        struct smk_audit_info ad;
 
         /*
          * struct fown_struct is never outside the context of a struct file
          */
         file = container_of(fown, struct file, f_owner);
-        rc = smk_access(file->f_security, tsk->cred->security, MAY_WRITE);
+        /* we don't log here as rc can be overriden */
+        rc = smk_access(file->f_security, tsp, MAY_WRITE, NULL);
         if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
-                return 0;
+                rc = 0;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, tsk);
+        smack_log(file->f_security, tsp, MAY_WRITE, rc, &ad);
         return rc;
 }
 
@@ -964,7 +1060,10 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
 static int smack_file_receive(struct file *file)
 {
         int may = 0;
+        struct smk_audit_info ad;
 
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_fs_path(&ad, file->f_path);
         /*
          * This code relies on bitmasks.
          */
@@ -973,7 +1072,7 @@ static int smack_file_receive(struct file *file)
         if (file->f_mode & FMODE_WRITE)
                 may |= MAY_WRITE;
 
-        return smk_curacc(file->f_security, may);
+        return smk_curacc(file->f_security, may, &ad);
 }
 
 /*
@@ -1053,6 +1152,22 @@ static int smack_kernel_create_files_as(struct cred *new,
 }
 
 /**
+ * smk_curacc_on_task - helper to log task related access
+ * @p: the task object
+ * @access : the access requested
+ *
+ * Return 0 if access is permitted
+ */
+static int smk_curacc_on_task(struct task_struct *p, int access)
+{
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, p);
+        return smk_curacc(task_security(p), access, &ad);
+}
+
+/**
  * smack_task_setpgid - Smack check on setting pgid
  * @p: the task object
  * @pgid: unused
@@ -1061,7 +1176,7 @@ static int smack_kernel_create_files_as(struct cred *new,
  */
 static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
 {
-        return smk_curacc(task_security(p), MAY_WRITE);
+        return smk_curacc_on_task(p, MAY_WRITE);
 }
 
 /**
@@ -1072,7 +1187,7 @@ static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
  */
 static int smack_task_getpgid(struct task_struct *p)
 {
-        return smk_curacc(task_security(p), MAY_READ);
+        return smk_curacc_on_task(p, MAY_READ);
 }
 
 /**
@@ -1083,7 +1198,7 @@ static int smack_task_getpgid(struct task_struct *p)
  */
 static int smack_task_getsid(struct task_struct *p)
 {
-        return smk_curacc(task_security(p), MAY_READ);
+        return smk_curacc_on_task(p, MAY_READ);
 }
 
 /**
@@ -1111,7 +1226,7 @@ static int smack_task_setnice(struct task_struct *p, int nice)
 
         rc = cap_task_setnice(p, nice);
         if (rc == 0)
-                rc = smk_curacc(task_security(p), MAY_WRITE);
+                rc = smk_curacc_on_task(p, MAY_WRITE);
         return rc;
 }
 
@@ -1128,7 +1243,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio)
 
         rc = cap_task_setioprio(p, ioprio);
         if (rc == 0)
-                rc = smk_curacc(task_security(p), MAY_WRITE);
+                rc = smk_curacc_on_task(p, MAY_WRITE);
         return rc;
 }
 
@@ -1140,7 +1255,7 @@ static int smack_task_setioprio(struct task_struct *p, int ioprio)
  */
 static int smack_task_getioprio(struct task_struct *p)
 {
-        return smk_curacc(task_security(p), MAY_READ);
+        return smk_curacc_on_task(p, MAY_READ);
 }
 
 /**
@@ -1158,7 +1273,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy,
 
         rc = cap_task_setscheduler(p, policy, lp);
         if (rc == 0)
-                rc = smk_curacc(task_security(p), MAY_WRITE);
+                rc = smk_curacc_on_task(p, MAY_WRITE);
         return rc;
 }
 
@@ -1170,7 +1285,7 @@ static int smack_task_setscheduler(struct task_struct *p, int policy,
  */
 static int smack_task_getscheduler(struct task_struct *p)
 {
-        return smk_curacc(task_security(p), MAY_READ);
+        return smk_curacc_on_task(p, MAY_READ);
 }
 
 /**
@@ -1181,7 +1296,7 @@ static int smack_task_getscheduler(struct task_struct *p)
  */
 static int smack_task_movememory(struct task_struct *p)
 {
-        return smk_curacc(task_security(p), MAY_WRITE);
+        return smk_curacc_on_task(p, MAY_WRITE);
 }
 
 /**
@@ -1199,18 +1314,23 @@ static int smack_task_movememory(struct task_struct *p)
 static int smack_task_kill(struct task_struct *p, struct siginfo *info,
                            int sig, u32 secid)
 {
+        struct smk_audit_info ad;
+
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, p);
         /*
          * Sending a signal requires that the sender
          * can write the receiver.
          */
         if (secid == 0)
-                return smk_curacc(task_security(p), MAY_WRITE);
+                return smk_curacc(task_security(p), MAY_WRITE, &ad);
         /*
          * If the secid isn't 0 we're dealing with some USB IO
          * specific behavior. This is not clean. For one thing
          * we can't take privilege into account.
          */
-        return smk_access(smack_from_secid(secid), task_security(p), MAY_WRITE);
+        return smk_access(smack_from_secid(secid), task_security(p),
+                          MAY_WRITE, &ad);
 }
 
 /**
@@ -1221,11 +1341,15 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
  */
 static int smack_task_wait(struct task_struct *p)
 {
+        struct smk_audit_info ad;
+        char *sp = current_security();
+        char *tsp = task_security(p);
         int rc;
 
-        rc = smk_access(current_security(), task_security(p), MAY_WRITE);
+        /* we don't log here, we can be overriden */
+        rc = smk_access(sp, tsp, MAY_WRITE, NULL);
         if (rc == 0)
-                return 0;
+                goto out_log;
 
         /*
          * Allow the operation to succeed if either task
@@ -1239,8 +1363,12 @@ static int smack_task_wait(struct task_struct *p)
          * the smack value.
          */
         if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE))
-                return 0;
-
+                rc = 0;
+        /* we log only if we didn't get overriden */
+ out_log:
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+        smk_ad_setfield_u_tsk(&ad, p);
+        smack_log(sp, tsp, MAY_WRITE, rc, &ad);
         return rc;
 }
 
@@ -1456,12 +1584,19 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
         int sk_lbl;
         char *hostsp;
         struct socket_smack *ssp = sk->sk_security;
+        struct smk_audit_info ad;
 
         rcu_read_lock();
         hostsp = smack_host_label(sap);
         if (hostsp != NULL) {
                 sk_lbl = SMACK_UNLABELED_SOCKET;
-                rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE);
+#ifdef CONFIG_AUDIT
+                smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+                ad.a.u.net.family = sap->sin_family;
+                ad.a.u.net.dport = sap->sin_port;
+                ad.a.u.net.v4info.daddr = sap->sin_addr.s_addr;
+#endif
+                rc = smk_access(ssp->smk_out, hostsp, MAY_WRITE, &ad);
         } else {
                 sk_lbl = SMACK_CIPSO_SOCKET;
                 rc = 0;
@@ -1657,6 +1792,25 @@ static void smack_shm_free_security(struct shmid_kernel *shp)
 }
 
 /**
+ * smk_curacc_shm : check if current has access on shm
+ * @shp : the object
+ * @access : access requested
+ *
+ * Returns 0 if current has the requested access, error code otherwise
+ */
+static int smk_curacc_shm(struct shmid_kernel *shp, int access)
+{
+        char *ssp = smack_of_shm(shp);
+        struct smk_audit_info ad;
+
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
+        ad.a.u.ipc_id = shp->shm_perm.id;
+#endif
+        return smk_curacc(ssp, access, &ad);
+}
+
+/**
  * smack_shm_associate - Smack access check for shm
  * @shp: the object
  * @shmflg: access requested
@@ -1665,11 +1819,10 @@ static void smack_shm_free_security(struct shmid_kernel *shp)
  */
 static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
 {
-        char *ssp = smack_of_shm(shp);
         int may;
 
         may = smack_flags_to_may(shmflg);
-        return smk_curacc(ssp, may);
+        return smk_curacc_shm(shp, may);
 }
 
 /**
@@ -1681,7 +1834,6 @@ static int smack_shm_associate(struct shmid_kernel *shp, int shmflg)
  */
 static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
 {
-        char *ssp;
         int may;
 
         switch (cmd) {
@@ -1704,9 +1856,7 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
         default:
                 return -EINVAL;
         }
-
-        ssp = smack_of_shm(shp);
-        return smk_curacc(ssp, may);
+        return smk_curacc_shm(shp, may);
 }
 
 /**
@@ -1720,11 +1870,10 @@ static int smack_shm_shmctl(struct shmid_kernel *shp, int cmd)
 static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
                            int shmflg)
 {
-        char *ssp = smack_of_shm(shp);
         int may;
 
         may = smack_flags_to_may(shmflg);
-        return smk_curacc(ssp, may);
+        return smk_curacc_shm(shp, may);
 }
 
 /**
@@ -1766,6 +1915,25 @@ static void smack_sem_free_security(struct sem_array *sma)
 }
 
 /**
+ * smk_curacc_sem : check if current has access on sem
+ * @sma : the object
+ * @access : access requested
+ *
+ * Returns 0 if current has the requested access, error code otherwise
+ */
+static int smk_curacc_sem(struct sem_array *sma, int access)
+{
+        char *ssp = smack_of_sem(sma);
+        struct smk_audit_info ad;
+
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
+        ad.a.u.ipc_id = sma->sem_perm.id;
+#endif
+        return smk_curacc(ssp, access, &ad);
+}
+
+/**
  * smack_sem_associate - Smack access check for sem
  * @sma: the object
  * @semflg: access requested
@@ -1774,11 +1942,10 @@ static void smack_sem_free_security(struct sem_array *sma)
  */
 static int smack_sem_associate(struct sem_array *sma, int semflg)
 {
-        char *ssp = smack_of_sem(sma);
         int may;
 
         may = smack_flags_to_may(semflg);
-        return smk_curacc(ssp, may);
+        return smk_curacc_sem(sma, may);
 }
 
 /**
@@ -1790,7 +1957,6 @@ static int smack_sem_associate(struct sem_array *sma, int semflg)
  */
 static int smack_sem_semctl(struct sem_array *sma, int cmd)
 {
-        char *ssp;
         int may;
 
         switch (cmd) {
@@ -1819,8 +1985,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd)
                 return -EINVAL;
         }
 
-        ssp = smack_of_sem(sma);
-        return smk_curacc(ssp, may);
+        return smk_curacc_sem(sma, may);
 }
 
 /**
@@ -1837,9 +2002,7 @@ static int smack_sem_semctl(struct sem_array *sma, int cmd)
 static int smack_sem_semop(struct sem_array *sma, struct sembuf *sops,
                            unsigned nsops, int alter)
 {
-        char *ssp = smack_of_sem(sma);
-
-        return smk_curacc(ssp, MAY_READWRITE);
+        return smk_curacc_sem(sma, MAY_READWRITE);
 }
 
 /**
@@ -1881,6 +2044,25 @@ static char *smack_of_msq(struct msg_queue *msq)
 }
 
 /**
+ * smk_curacc_msq : helper to check if current has access on msq
+ * @msq : the msq
+ * @access : access requested
+ *
+ * return 0 if current has access, error otherwise
+ */
+static int smk_curacc_msq(struct msg_queue *msq, int access)
+{
+        char *msp = smack_of_msq(msq);
+        struct smk_audit_info ad;
+
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
+        ad.a.u.ipc_id = msq->q_perm.id;
+#endif
+        return smk_curacc(msp, access, &ad);
+}
+
+/**
  * smack_msg_queue_associate - Smack access check for msg_queue
  * @msq: the object
  * @msqflg: access requested
@@ -1889,11 +2071,10 @@ static char *smack_of_msq(struct msg_queue *msq)
  */
 static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
 {
-        char *msp = smack_of_msq(msq);
         int may;
 
         may = smack_flags_to_may(msqflg);
-        return smk_curacc(msp, may);
+        return smk_curacc_msq(msq, may);
 }
 
 /**
@@ -1905,7 +2086,6 @@ static int smack_msg_queue_associate(struct msg_queue *msq, int msqflg)
  */
 static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
 {
-        char *msp;
         int may;
 
         switch (cmd) {
@@ -1927,8 +2107,7 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
                 return -EINVAL;
         }
 
-        msp = smack_of_msq(msq);
-        return smk_curacc(msp, may);
+        return smk_curacc_msq(msq, may);
 }
 
 /**
@@ -1942,11 +2121,10 @@ static int smack_msg_queue_msgctl(struct msg_queue *msq, int cmd)
 static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
                                   int msqflg)
 {
-        char *msp = smack_of_msq(msq);
-        int rc;
+        int may;
 
-        rc = smack_flags_to_may(msqflg);
-        return smk_curacc(msp, rc);
+        may = smack_flags_to_may(msqflg);
+        return smk_curacc_msq(msq, may);
 }
 
 /**
@@ -1962,9 +2140,7 @@ static int smack_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg,
 static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
                         struct task_struct *target, long type, int mode)
 {
-        char *msp = smack_of_msq(msq);
-
-        return smk_curacc(msp, MAY_READWRITE);
+        return smk_curacc_msq(msq, MAY_READWRITE);
 }
 
 /**
@@ -1977,10 +2153,14 @@ static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
 static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
 {
         char *isp = ipp->security;
-        int may;
+        int may = smack_flags_to_may(flag);
+        struct smk_audit_info ad;
 
-        may = smack_flags_to_may(flag);
-        return smk_curacc(isp, may);
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
+        ad.a.u.ipc_id = ipp->id;
+#endif
+        return smk_curacc(isp, may, &ad);
 }
 
 /**
@@ -2239,8 +2419,12 @@ static int smack_unix_stream_connect(struct socket *sock,
 {
         struct inode *sp = SOCK_INODE(sock);
         struct inode *op = SOCK_INODE(other);
+        struct smk_audit_info ad;
 
-        return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_READWRITE);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        smk_ad_setfield_u_net_sk(&ad, other->sk);
+        return smk_access(smk_of_inode(sp), smk_of_inode(op),
+                                 MAY_READWRITE, &ad);
 }
 
 /**
@@ -2255,8 +2439,11 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
 {
         struct inode *sp = SOCK_INODE(sock);
         struct inode *op = SOCK_INODE(other);
+        struct smk_audit_info ad;
 
-        return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_WRITE);
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        smk_ad_setfield_u_net_sk(&ad, other->sk);
+        return smk_access(smk_of_inode(sp), smk_of_inode(op), MAY_WRITE, &ad);
 }
 
 /**
@@ -2371,7 +2558,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
         char smack[SMK_LABELLEN];
         char *csp;
         int rc;
-
+        struct smk_audit_info ad;
         if (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)
                 return 0;
 
@@ -2389,13 +2576,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         netlbl_secattr_destroy(&secattr);
 
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        ad.a.u.net.family = sk->sk_family;
+        ad.a.u.net.netif = skb->iif;
+        ipv4_skb_to_auditdata(skb, &ad.a, NULL);
+#endif
         /*
          * Receiving a packet requires that the other end
          * be able to write here. Read access is not required.
          * This is the simplist possible security model
          * for networking.
          */
-        rc = smk_access(csp, ssp->smk_in, MAY_WRITE);
+        rc = smk_access(csp, ssp->smk_in, MAY_WRITE, &ad);
         if (rc != 0)
                 netlbl_skbuff_err(skb, rc, 0);
         return rc;
@@ -2524,6 +2717,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
         struct iphdr *hdr;
         char smack[SMK_LABELLEN];
         int rc;
+        struct smk_audit_info ad;
 
         /* handle mapped IPv4 packets arriving via IPv6 sockets */
         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
@@ -2537,11 +2731,17 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
                 strncpy(smack, smack_known_huh.smk_known, SMK_MAXLEN);
         netlbl_secattr_destroy(&secattr);
 
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NET);
+        ad.a.u.net.family = family;
+        ad.a.u.net.netif = skb->iif;
+        ipv4_skb_to_auditdata(skb, &ad.a, NULL);
+#endif
         /*
          * Receiving a packet requires that the other end be able to write
          * here. Read access is not required.
          */
-        rc = smk_access(smack, ssp->smk_in, MAY_WRITE);
+        rc = smk_access(smack, ssp->smk_in, MAY_WRITE, &ad);
         if (rc != 0)
                 return rc;
 
@@ -2643,6 +2843,7 @@ static int smack_key_permission(key_ref_t key_ref,
                                 const struct cred *cred, key_perm_t perm)
 {
         struct key *keyp;
+        struct smk_audit_info ad;
 
         keyp = key_ref_to_ptr(key_ref);
         if (keyp == NULL)
@@ -2658,8 +2859,13 @@ static int smack_key_permission(key_ref_t key_ref,
          */
         if (cred->security == NULL)
                 return -EACCES;
-
-        return smk_access(cred->security, keyp->security, MAY_READWRITE);
+#ifdef CONFIG_AUDIT
+        smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_KEY);
+        ad.a.u.key_struct.key = keyp->serial;
+        ad.a.u.key_struct.key_desc = keyp->description;
+#endif
+        return smk_access(cred->security, keyp->security,
+                                 MAY_READWRITE, &ad);
 }
 #endif /* CONFIG_KEYS */
 
@@ -2828,15 +3034,7 @@ struct security_operations smack_ops = {
 
         .ptrace_may_access =            smack_ptrace_may_access,
         .ptrace_traceme =               smack_ptrace_traceme,
-        .capget =                       cap_capget,
-        .capset =                       cap_capset,
-        .capable =                      cap_capable,
         .syslog =                       smack_syslog,
-        .settime =                      cap_settime,
-        .vm_enough_memory =             cap_vm_enough_memory,
-
-        .bprm_set_creds =               cap_bprm_set_creds,
-        .bprm_secureexec =              cap_bprm_secureexec,
 
         .sb_alloc_security =            smack_sb_alloc_security,
         .sb_free_security =             smack_sb_free_security,
@@ -2860,8 +3058,6 @@ struct security_operations smack_ops = {
         .inode_post_setxattr =          smack_inode_post_setxattr,
         .inode_getxattr =               smack_inode_getxattr,
         .inode_removexattr =            smack_inode_removexattr,
-        .inode_need_killpriv =          cap_inode_need_killpriv,
-        .inode_killpriv =               cap_inode_killpriv,
         .inode_getsecurity =            smack_inode_getsecurity,
         .inode_setsecurity =            smack_inode_setsecurity,
         .inode_listsecurity =           smack_inode_listsecurity,
@@ -2882,7 +3078,6 @@ struct security_operations smack_ops = {
         .cred_commit =                  smack_cred_commit,
         .kernel_act_as =                smack_kernel_act_as,
         .kernel_create_files_as =       smack_kernel_create_files_as,
-        .task_fix_setuid =              cap_task_fix_setuid,
         .task_setpgid =                 smack_task_setpgid,
         .task_getpgid =                 smack_task_getpgid,
         .task_getsid =                  smack_task_getsid,
@@ -2896,7 +3091,6 @@ struct security_operations smack_ops = {
         .task_kill =                    smack_task_kill,
         .task_wait =                    smack_task_wait,
         .task_to_inode =                smack_task_to_inode,
-        .task_prctl =                   cap_task_prctl,
 
         .ipc_permission =               smack_ipc_permission,
         .ipc_getsecid =                 smack_ipc_getsecid,
@@ -2923,9 +3117,6 @@ struct security_operations smack_ops = {
         .sem_semctl =                   smack_sem_semctl,
         .sem_semop =                    smack_sem_semop,
 
-        .netlink_send =                 cap_netlink_send,
-        .netlink_recv =                 cap_netlink_recv,
-
         .d_instantiate =                smack_d_instantiate,
 
         .getprocattr =                  smack_getprocattr,