aboutsummaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
Diffstat (limited to 'security')
-rw-r--r--security/keys/big_key.c2
-rw-r--r--security/keys/encrypted-keys/encrypted.c1
-rw-r--r--security/keys/internal.h21
-rw-r--r--security/keys/key.c2
-rw-r--r--security/keys/keyctl.c2
-rw-r--r--security/keys/keyring.c58
-rw-r--r--security/keys/proc.c8
-rw-r--r--security/keys/process_keys.c13
-rw-r--r--security/keys/request_key.c21
-rw-r--r--security/keys/request_key_auth.c10
-rw-r--r--security/keys/trusted.c1
-rw-r--r--security/keys/user_defined.c14
-rw-r--r--security/selinux/hooks.c135
-rw-r--r--security/selinux/include/netif.h4
-rw-r--r--security/selinux/include/objsec.h2
-rw-r--r--security/selinux/netif.c43
-rw-r--r--security/selinux/ss/services.c14
-rw-r--r--security/smack/Kconfig16
-rw-r--r--security/smack/smack.h39
-rw-r--r--security/smack/smack_access.c118
-rw-r--r--security/smack/smack_lsm.c545
-rw-r--r--security/smack/smackfs.c76
22 files changed, 717 insertions, 428 deletions
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index c2f91a0cf889..b6adb94f6d52 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -33,11 +33,9 @@ MODULE_LICENSE("GPL");
33 */ 33 */
34struct key_type key_type_big_key = { 34struct key_type key_type_big_key = {
35 .name = "big_key", 35 .name = "big_key",
36 .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
37 .preparse = big_key_preparse, 36 .preparse = big_key_preparse,
38 .free_preparse = big_key_free_preparse, 37 .free_preparse = big_key_free_preparse,
39 .instantiate = generic_key_instantiate, 38 .instantiate = generic_key_instantiate,
40 .match = user_match,
41 .revoke = big_key_revoke, 39 .revoke = big_key_revoke,
42 .destroy = big_key_destroy, 40 .destroy = big_key_destroy,
43 .describe = big_key_describe, 41 .describe = big_key_describe,
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 5fe443d120af..db9675db1026 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -970,7 +970,6 @@ struct key_type key_type_encrypted = {
970 .name = "encrypted", 970 .name = "encrypted",
971 .instantiate = encrypted_instantiate, 971 .instantiate = encrypted_instantiate,
972 .update = encrypted_update, 972 .update = encrypted_update,
973 .match = user_match,
974 .destroy = encrypted_destroy, 973 .destroy = encrypted_destroy,
975 .describe = user_describe, 974 .describe = user_describe,
976 .read = encrypted_read, 975 .read = encrypted_read,
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 5f20da01fd8d..b8960c4959a5 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -107,20 +107,16 @@ extern int iterate_over_keyring(const struct key *keyring,
107 int (*func)(const struct key *key, void *data), 107 int (*func)(const struct key *key, void *data),
108 void *data); 108 void *data);
109 109
110typedef int (*key_match_func_t)(const struct key *, const void *);
111
112struct keyring_search_context { 110struct keyring_search_context {
113 struct keyring_index_key index_key; 111 struct keyring_index_key index_key;
114 const struct cred *cred; 112 const struct cred *cred;
115 key_match_func_t match; 113 struct key_match_data match_data;
116 const void *match_data;
117 unsigned flags; 114 unsigned flags;
118#define KEYRING_SEARCH_LOOKUP_TYPE 0x0001 /* [as type->def_lookup_type] */ 115#define KEYRING_SEARCH_NO_STATE_CHECK 0x0001 /* Skip state checks */
119#define KEYRING_SEARCH_NO_STATE_CHECK 0x0002 /* Skip state checks */ 116#define KEYRING_SEARCH_DO_STATE_CHECK 0x0002 /* Override NO_STATE_CHECK */
120#define KEYRING_SEARCH_DO_STATE_CHECK 0x0004 /* Override NO_STATE_CHECK */ 117#define KEYRING_SEARCH_NO_UPDATE_TIME 0x0004 /* Don't update times */
121#define KEYRING_SEARCH_NO_UPDATE_TIME 0x0008 /* Don't update times */ 118#define KEYRING_SEARCH_NO_CHECK_PERM 0x0008 /* Don't check permissions */
122#define KEYRING_SEARCH_NO_CHECK_PERM 0x0010 /* Don't check permissions */ 119#define KEYRING_SEARCH_DETECT_TOO_DEEP 0x0010 /* Give an error on excessive depth */
123#define KEYRING_SEARCH_DETECT_TOO_DEEP 0x0020 /* Give an error on excessive depth */
124 120
125 int (*iterator)(const void *object, void *iterator_data); 121 int (*iterator)(const void *object, void *iterator_data);
126 122
@@ -131,6 +127,8 @@ struct keyring_search_context {
131 struct timespec now; 127 struct timespec now;
132}; 128};
133 129
130extern bool key_default_cmp(const struct key *key,
131 const struct key_match_data *match_data);
134extern key_ref_t keyring_search_aux(key_ref_t keyring_ref, 132extern key_ref_t keyring_search_aux(key_ref_t keyring_ref,
135 struct keyring_search_context *ctx); 133 struct keyring_search_context *ctx);
136 134
@@ -152,7 +150,8 @@ extern struct key *request_key_and_link(struct key_type *type,
152 struct key *dest_keyring, 150 struct key *dest_keyring,
153 unsigned long flags); 151 unsigned long flags);
154 152
155extern int lookup_user_key_possessed(const struct key *key, const void *target); 153extern bool lookup_user_key_possessed(const struct key *key,
154 const struct key_match_data *match_data);
156extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags, 155extern key_ref_t lookup_user_key(key_serial_t id, unsigned long flags,
157 key_perm_t perm); 156 key_perm_t perm);
158#define KEY_LOOKUP_CREATE 0x01 157#define KEY_LOOKUP_CREATE 0x01
diff --git a/security/keys/key.c b/security/keys/key.c
index b90a68c4e2c4..8c0092ca0443 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -799,7 +799,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
799 } 799 }
800 800
801 key_ref = ERR_PTR(-EINVAL); 801 key_ref = ERR_PTR(-EINVAL);
802 if (!index_key.type->match || !index_key.type->instantiate || 802 if (!index_key.type->instantiate ||
803 (!index_key.description && !index_key.type->preparse)) 803 (!index_key.description && !index_key.type->preparse))
804 goto error_put_type; 804 goto error_put_type;
805 805
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index e26f860e5f2e..eff88a5f5d40 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -37,6 +37,8 @@ static int key_get_type_from_user(char *type,
37 return ret; 37 return ret;
38 if (ret == 0 || ret >= len) 38 if (ret == 0 || ret >= len)
39 return -EINVAL; 39 return -EINVAL;
40 if (type[0] == '.')
41 return -EPERM;
40 type[len - 1] = '\0'; 42 type[len - 1] = '\0';
41 return 0; 43 return 0;
42} 44}
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 8314a7d2104d..8177010174f7 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -89,7 +89,6 @@ struct key_type key_type_keyring = {
89 .preparse = keyring_preparse, 89 .preparse = keyring_preparse,
90 .free_preparse = keyring_free_preparse, 90 .free_preparse = keyring_free_preparse,
91 .instantiate = keyring_instantiate, 91 .instantiate = keyring_instantiate,
92 .match = user_match,
93 .revoke = keyring_revoke, 92 .revoke = keyring_revoke,
94 .destroy = keyring_destroy, 93 .destroy = keyring_destroy,
95 .describe = keyring_describe, 94 .describe = keyring_describe,
@@ -512,6 +511,15 @@ struct key *keyring_alloc(const char *description, kuid_t uid, kgid_t gid,
512EXPORT_SYMBOL(keyring_alloc); 511EXPORT_SYMBOL(keyring_alloc);
513 512
514/* 513/*
514 * By default, we keys found by getting an exact match on their descriptions.
515 */
516bool key_default_cmp(const struct key *key,
517 const struct key_match_data *match_data)
518{
519 return strcmp(key->description, match_data->raw_data) == 0;
520}
521
522/*
515 * Iteration function to consider each key found. 523 * Iteration function to consider each key found.
516 */ 524 */
517static int keyring_search_iterator(const void *object, void *iterator_data) 525static int keyring_search_iterator(const void *object, void *iterator_data)
@@ -545,7 +553,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
545 } 553 }
546 554
547 /* keys that don't match */ 555 /* keys that don't match */
548 if (!ctx->match(key, ctx->match_data)) { 556 if (!ctx->match_data.cmp(key, &ctx->match_data)) {
549 kleave(" = 0 [!match]"); 557 kleave(" = 0 [!match]");
550 return 0; 558 return 0;
551 } 559 }
@@ -585,8 +593,7 @@ skipped:
585 */ 593 */
586static int search_keyring(struct key *keyring, struct keyring_search_context *ctx) 594static int search_keyring(struct key *keyring, struct keyring_search_context *ctx)
587{ 595{
588 if ((ctx->flags & KEYRING_SEARCH_LOOKUP_TYPE) == 596 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_DIRECT) {
589 KEYRING_SEARCH_LOOKUP_DIRECT) {
590 const void *object; 597 const void *object;
591 598
592 object = assoc_array_find(&keyring->keys, 599 object = assoc_array_find(&keyring->keys,
@@ -627,7 +634,7 @@ static bool search_nested_keyrings(struct key *keyring,
627 /* Check to see if this top-level keyring is what we are looking for 634 /* Check to see if this top-level keyring is what we are looking for
628 * and whether it is valid or not. 635 * and whether it is valid or not.
629 */ 636 */
630 if (ctx->flags & KEYRING_SEARCH_LOOKUP_ITERATE || 637 if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_ITERATE ||
631 keyring_compare_object(keyring, &ctx->index_key)) { 638 keyring_compare_object(keyring, &ctx->index_key)) {
632 ctx->skipped_ret = 2; 639 ctx->skipped_ret = 2;
633 ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK; 640 ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK;
@@ -885,16 +892,25 @@ key_ref_t keyring_search(key_ref_t keyring,
885 .index_key.type = type, 892 .index_key.type = type,
886 .index_key.description = description, 893 .index_key.description = description,
887 .cred = current_cred(), 894 .cred = current_cred(),
888 .match = type->match, 895 .match_data.cmp = key_default_cmp,
889 .match_data = description, 896 .match_data.raw_data = description,
890 .flags = (type->def_lookup_type | 897 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
891 KEYRING_SEARCH_DO_STATE_CHECK), 898 .flags = KEYRING_SEARCH_DO_STATE_CHECK,
892 }; 899 };
900 key_ref_t key;
901 int ret;
893 902
894 if (!ctx.match) 903 if (type->match_preparse) {
895 return ERR_PTR(-ENOKEY); 904 ret = type->match_preparse(&ctx.match_data);
905 if (ret < 0)
906 return ERR_PTR(ret);
907 }
896 908
897 return keyring_search_aux(keyring, &ctx); 909 key = keyring_search_aux(keyring, &ctx);
910
911 if (type->match_free)
912 type->match_free(&ctx.match_data);
913 return key;
898} 914}
899EXPORT_SYMBOL(keyring_search); 915EXPORT_SYMBOL(keyring_search);
900 916
@@ -1014,7 +1030,7 @@ static int keyring_detect_cycle_iterator(const void *object,
1014 1030
1015 /* We might get a keyring with matching index-key that is nonetheless a 1031 /* We might get a keyring with matching index-key that is nonetheless a
1016 * different keyring. */ 1032 * different keyring. */
1017 if (key != ctx->match_data) 1033 if (key != ctx->match_data.raw_data)
1018 return 0; 1034 return 0;
1019 1035
1020 ctx->result = ERR_PTR(-EDEADLK); 1036 ctx->result = ERR_PTR(-EDEADLK);
@@ -1031,14 +1047,14 @@ static int keyring_detect_cycle_iterator(const void *object,
1031static int keyring_detect_cycle(struct key *A, struct key *B) 1047static int keyring_detect_cycle(struct key *A, struct key *B)
1032{ 1048{
1033 struct keyring_search_context ctx = { 1049 struct keyring_search_context ctx = {
1034 .index_key = A->index_key, 1050 .index_key = A->index_key,
1035 .match_data = A, 1051 .match_data.raw_data = A,
1036 .iterator = keyring_detect_cycle_iterator, 1052 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
1037 .flags = (KEYRING_SEARCH_LOOKUP_DIRECT | 1053 .iterator = keyring_detect_cycle_iterator,
1038 KEYRING_SEARCH_NO_STATE_CHECK | 1054 .flags = (KEYRING_SEARCH_NO_STATE_CHECK |
1039 KEYRING_SEARCH_NO_UPDATE_TIME | 1055 KEYRING_SEARCH_NO_UPDATE_TIME |
1040 KEYRING_SEARCH_NO_CHECK_PERM | 1056 KEYRING_SEARCH_NO_CHECK_PERM |
1041 KEYRING_SEARCH_DETECT_TOO_DEEP), 1057 KEYRING_SEARCH_DETECT_TOO_DEEP),
1042 }; 1058 };
1043 1059
1044 rcu_read_lock(); 1060 rcu_read_lock();
diff --git a/security/keys/proc.c b/security/keys/proc.c
index d3f6f2fd21db..972eeb336b81 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -194,10 +194,10 @@ static int proc_keys_show(struct seq_file *m, void *v)
194 .index_key.type = key->type, 194 .index_key.type = key->type,
195 .index_key.description = key->description, 195 .index_key.description = key->description,
196 .cred = current_cred(), 196 .cred = current_cred(),
197 .match = lookup_user_key_possessed, 197 .match_data.cmp = lookup_user_key_possessed,
198 .match_data = key, 198 .match_data.raw_data = key,
199 .flags = (KEYRING_SEARCH_NO_STATE_CHECK | 199 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
200 KEYRING_SEARCH_LOOKUP_DIRECT), 200 .flags = KEYRING_SEARCH_NO_STATE_CHECK,
201 }; 201 };
202 202
203 key_ref = make_key_ref(key, 0); 203 key_ref = make_key_ref(key, 0);
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 0cf8a130a267..bd536cb221e2 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -489,9 +489,10 @@ found:
489/* 489/*
490 * See if the key we're looking at is the target key. 490 * See if the key we're looking at is the target key.
491 */ 491 */
492int lookup_user_key_possessed(const struct key *key, const void *target) 492bool lookup_user_key_possessed(const struct key *key,
493 const struct key_match_data *match_data)
493{ 494{
494 return key == target; 495 return key == match_data->raw_data;
495} 496}
496 497
497/* 498/*
@@ -516,9 +517,9 @@ key_ref_t lookup_user_key(key_serial_t id, unsigned long lflags,
516 key_perm_t perm) 517 key_perm_t perm)
517{ 518{
518 struct keyring_search_context ctx = { 519 struct keyring_search_context ctx = {
519 .match = lookup_user_key_possessed, 520 .match_data.cmp = lookup_user_key_possessed,
520 .flags = (KEYRING_SEARCH_NO_STATE_CHECK | 521 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
521 KEYRING_SEARCH_LOOKUP_DIRECT), 522 .flags = KEYRING_SEARCH_NO_STATE_CHECK,
522 }; 523 };
523 struct request_key_auth *rka; 524 struct request_key_auth *rka;
524 struct key *key; 525 struct key *key;
@@ -673,7 +674,7 @@ try_again:
673 ctx.index_key.type = key->type; 674 ctx.index_key.type = key->type;
674 ctx.index_key.description = key->description; 675 ctx.index_key.description = key->description;
675 ctx.index_key.desc_len = strlen(key->description); 676 ctx.index_key.desc_len = strlen(key->description);
676 ctx.match_data = key; 677 ctx.match_data.raw_data = key;
677 kdebug("check possessed"); 678 kdebug("check possessed");
678 skey_ref = search_process_keyrings(&ctx); 679 skey_ref = search_process_keyrings(&ctx);
679 kdebug("possessed=%p", skey_ref); 680 kdebug("possessed=%p", skey_ref);
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 381411941cc1..dc6ed32b7844 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -531,9 +531,9 @@ struct key *request_key_and_link(struct key_type *type,
531 .index_key.type = type, 531 .index_key.type = type,
532 .index_key.description = description, 532 .index_key.description = description,
533 .cred = current_cred(), 533 .cred = current_cred(),
534 .match = type->match, 534 .match_data.cmp = key_default_cmp,
535 .match_data = description, 535 .match_data.raw_data = description,
536 .flags = KEYRING_SEARCH_LOOKUP_DIRECT, 536 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
537 }; 537 };
538 struct key *key; 538 struct key *key;
539 key_ref_t key_ref; 539 key_ref_t key_ref;
@@ -543,6 +543,14 @@ struct key *request_key_and_link(struct key_type *type,
543 ctx.index_key.type->name, ctx.index_key.description, 543 ctx.index_key.type->name, ctx.index_key.description,
544 callout_info, callout_len, aux, dest_keyring, flags); 544 callout_info, callout_len, aux, dest_keyring, flags);
545 545
546 if (type->match_preparse) {
547 ret = type->match_preparse(&ctx.match_data);
548 if (ret < 0) {
549 key = ERR_PTR(ret);
550 goto error;
551 }
552 }
553
546 /* search all the process keyrings for a key */ 554 /* search all the process keyrings for a key */
547 key_ref = search_process_keyrings(&ctx); 555 key_ref = search_process_keyrings(&ctx);
548 556
@@ -555,7 +563,7 @@ struct key *request_key_and_link(struct key_type *type,
555 if (ret < 0) { 563 if (ret < 0) {
556 key_put(key); 564 key_put(key);
557 key = ERR_PTR(ret); 565 key = ERR_PTR(ret);
558 goto error; 566 goto error_free;
559 } 567 }
560 } 568 }
561 } else if (PTR_ERR(key_ref) != -EAGAIN) { 569 } else if (PTR_ERR(key_ref) != -EAGAIN) {
@@ -565,12 +573,15 @@ struct key *request_key_and_link(struct key_type *type,
565 * should consult userspace if we can */ 573 * should consult userspace if we can */
566 key = ERR_PTR(-ENOKEY); 574 key = ERR_PTR(-ENOKEY);
567 if (!callout_info) 575 if (!callout_info)
568 goto error; 576 goto error_free;
569 577
570 key = construct_key_and_link(&ctx, callout_info, callout_len, 578 key = construct_key_and_link(&ctx, callout_info, callout_len,
571 aux, dest_keyring, flags); 579 aux, dest_keyring, flags);
572 } 580 }
573 581
582error_free:
583 if (type->match_free)
584 type->match_free(&ctx.match_data);
574error: 585error:
575 kleave(" = %p", key); 586 kleave(" = %p", key);
576 return key; 587 return key;
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 842e6f410d50..6639e2cb8853 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -44,12 +44,12 @@ struct key_type key_type_request_key_auth = {
44 .read = request_key_auth_read, 44 .read = request_key_auth_read,
45}; 45};
46 46
47int request_key_auth_preparse(struct key_preparsed_payload *prep) 47static int request_key_auth_preparse(struct key_preparsed_payload *prep)
48{ 48{
49 return 0; 49 return 0;
50} 50}
51 51
52void request_key_auth_free_preparse(struct key_preparsed_payload *prep) 52static void request_key_auth_free_preparse(struct key_preparsed_payload *prep)
53{ 53{
54} 54}
55 55
@@ -246,9 +246,9 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
246 .index_key.type = &key_type_request_key_auth, 246 .index_key.type = &key_type_request_key_auth,
247 .index_key.description = description, 247 .index_key.description = description,
248 .cred = current_cred(), 248 .cred = current_cred(),
249 .match = user_match, 249 .match_data.cmp = key_default_cmp,
250 .match_data = description, 250 .match_data.raw_data = description,
251 .flags = KEYRING_SEARCH_LOOKUP_DIRECT, 251 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
252 }; 252 };
253 struct key *authkey; 253 struct key *authkey;
254 key_ref_t authkey_ref; 254 key_ref_t authkey_ref;
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 6b804aa4529a..c0594cb07ada 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1096,7 +1096,6 @@ struct key_type key_type_trusted = {
1096 .name = "trusted", 1096 .name = "trusted",
1097 .instantiate = trusted_instantiate, 1097 .instantiate = trusted_instantiate,
1098 .update = trusted_update, 1098 .update = trusted_update,
1099 .match = user_match,
1100 .destroy = trusted_destroy, 1099 .destroy = trusted_destroy,
1101 .describe = user_describe, 1100 .describe = user_describe,
1102 .read = trusted_read, 1101 .read = trusted_read,
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index eee340011f2b..36b47bbd3d8c 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -26,12 +26,10 @@ static int logon_vet_description(const char *desc);
26 */ 26 */
27struct key_type key_type_user = { 27struct key_type key_type_user = {
28 .name = "user", 28 .name = "user",
29 .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
30 .preparse = user_preparse, 29 .preparse = user_preparse,
31 .free_preparse = user_free_preparse, 30 .free_preparse = user_free_preparse,
32 .instantiate = generic_key_instantiate, 31 .instantiate = generic_key_instantiate,
33 .update = user_update, 32 .update = user_update,
34 .match = user_match,
35 .revoke = user_revoke, 33 .revoke = user_revoke,
36 .destroy = user_destroy, 34 .destroy = user_destroy,
37 .describe = user_describe, 35 .describe = user_describe,
@@ -48,12 +46,10 @@ EXPORT_SYMBOL_GPL(key_type_user);
48 */ 46 */
49struct key_type key_type_logon = { 47struct key_type key_type_logon = {
50 .name = "logon", 48 .name = "logon",
51 .def_lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
52 .preparse = user_preparse, 49 .preparse = user_preparse,
53 .free_preparse = user_free_preparse, 50 .free_preparse = user_free_preparse,
54 .instantiate = generic_key_instantiate, 51 .instantiate = generic_key_instantiate,
55 .update = user_update, 52 .update = user_update,
56 .match = user_match,
57 .revoke = user_revoke, 53 .revoke = user_revoke,
58 .destroy = user_destroy, 54 .destroy = user_destroy,
59 .describe = user_describe, 55 .describe = user_describe,
@@ -139,16 +135,6 @@ error:
139EXPORT_SYMBOL_GPL(user_update); 135EXPORT_SYMBOL_GPL(user_update);
140 136
141/* 137/*
142 * match users on their name
143 */
144int user_match(const struct key *key, const void *description)
145{
146 return strcmp(key->description, description) == 0;
147}
148
149EXPORT_SYMBOL_GPL(user_match);
150
151/*
152 * dispose of the links from a revoked keyring 138 * dispose of the links from a revoked keyring
153 * - called with the key sem write-locked 139 * - called with the key sem write-locked
154 */ 140 */
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b0e940497e23..29e64d4ca099 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2097,6 +2097,41 @@ static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2097 2097
2098/* binprm security operations */ 2098/* binprm security operations */
2099 2099
2100static int check_nnp_nosuid(const struct linux_binprm *bprm,
2101 const struct task_security_struct *old_tsec,
2102 const struct task_security_struct *new_tsec)
2103{
2104 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2105 int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2106 int rc;
2107
2108 if (!nnp && !nosuid)
2109 return 0; /* neither NNP nor nosuid */
2110
2111 if (new_tsec->sid == old_tsec->sid)
2112 return 0; /* No change in credentials */
2113
2114 /*
2115 * The only transitions we permit under NNP or nosuid
2116 * are transitions to bounded SIDs, i.e. SIDs that are
2117 * guaranteed to only be allowed a subset of the permissions
2118 * of the current SID.
2119 */
2120 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2121 if (rc) {
2122 /*
2123 * On failure, preserve the errno values for NNP vs nosuid.
2124 * NNP: Operation not permitted for caller.
2125 * nosuid: Permission denied to file.
2126 */
2127 if (nnp)
2128 return -EPERM;
2129 else
2130 return -EACCES;
2131 }
2132 return 0;
2133}
2134
2100static int selinux_bprm_set_creds(struct linux_binprm *bprm) 2135static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2101{ 2136{
2102 const struct task_security_struct *old_tsec; 2137 const struct task_security_struct *old_tsec;
@@ -2133,14 +2168,10 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2133 /* Reset exec SID on execve. */ 2168 /* Reset exec SID on execve. */
2134 new_tsec->exec_sid = 0; 2169 new_tsec->exec_sid = 0;
2135 2170
2136 /* 2171 /* Fail on NNP or nosuid if not an allowed transition. */
2137 * Minimize confusion: if no_new_privs or nosuid and a 2172 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2138 * transition is explicitly requested, then fail the exec. 2173 if (rc)
2139 */ 2174 return rc;
2140 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2141 return -EPERM;
2142 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2143 return -EACCES;
2144 } else { 2175 } else {
2145 /* Check for a default transition on this program. */ 2176 /* Check for a default transition on this program. */
2146 rc = security_transition_sid(old_tsec->sid, isec->sid, 2177 rc = security_transition_sid(old_tsec->sid, isec->sid,
@@ -2148,15 +2179,19 @@ static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2148 &new_tsec->sid); 2179 &new_tsec->sid);
2149 if (rc) 2180 if (rc)
2150 return rc; 2181 return rc;
2182
2183 /*
2184 * Fallback to old SID on NNP or nosuid if not an allowed
2185 * transition.
2186 */
2187 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2188 if (rc)
2189 new_tsec->sid = old_tsec->sid;
2151 } 2190 }
2152 2191
2153 ad.type = LSM_AUDIT_DATA_PATH; 2192 ad.type = LSM_AUDIT_DATA_PATH;
2154 ad.u.path = bprm->file->f_path; 2193 ad.u.path = bprm->file->f_path;
2155 2194
2156 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2157 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2158 new_tsec->sid = old_tsec->sid;
2159
2160 if (new_tsec->sid == old_tsec->sid) { 2195 if (new_tsec->sid == old_tsec->sid) {
2161 rc = avc_has_perm(old_tsec->sid, isec->sid, 2196 rc = avc_has_perm(old_tsec->sid, isec->sid,
2162 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad); 2197 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
@@ -4272,15 +4307,15 @@ static int selinux_socket_unix_may_send(struct socket *sock,
4272 &ad); 4307 &ad);
4273} 4308}
4274 4309
4275static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family, 4310static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4276 u32 peer_sid, 4311 char *addrp, u16 family, u32 peer_sid,
4277 struct common_audit_data *ad) 4312 struct common_audit_data *ad)
4278{ 4313{
4279 int err; 4314 int err;
4280 u32 if_sid; 4315 u32 if_sid;
4281 u32 node_sid; 4316 u32 node_sid;
4282 4317
4283 err = sel_netif_sid(ifindex, &if_sid); 4318 err = sel_netif_sid(ns, ifindex, &if_sid);
4284 if (err) 4319 if (err)
4285 return err; 4320 return err;
4286 err = avc_has_perm(peer_sid, if_sid, 4321 err = avc_has_perm(peer_sid, if_sid,
@@ -4373,8 +4408,8 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4373 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid); 4408 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4374 if (err) 4409 if (err)
4375 return err; 4410 return err;
4376 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family, 4411 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4377 peer_sid, &ad); 4412 addrp, family, peer_sid, &ad);
4378 if (err) { 4413 if (err) {
4379 selinux_netlbl_err(skb, err, 0); 4414 selinux_netlbl_err(skb, err, 0);
4380 return err; 4415 return err;
@@ -4692,10 +4727,9 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4692 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm); 4727 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4693 if (err) { 4728 if (err) {
4694 if (err == -EINVAL) { 4729 if (err == -EINVAL) {
4695 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR, 4730 WARN_ONCE(1, "selinux_nlmsg_perm: unrecognized netlink message:"
4696 "SELinux: unrecognized netlink message" 4731 " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4697 " type=%hu for sclass=%hu\n", 4732 sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4698 nlh->nlmsg_type, sksec->sclass);
4699 if (!selinux_enforcing || security_get_allow_unknown()) 4733 if (!selinux_enforcing || security_get_allow_unknown())
4700 err = 0; 4734 err = 0;
4701 } 4735 }
@@ -4713,7 +4747,8 @@ out:
4713 4747
4714#ifdef CONFIG_NETFILTER 4748#ifdef CONFIG_NETFILTER
4715 4749
4716static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex, 4750static unsigned int selinux_ip_forward(struct sk_buff *skb,
4751 const struct net_device *indev,
4717 u16 family) 4752 u16 family)
4718{ 4753{
4719 int err; 4754 int err;
@@ -4739,14 +4774,14 @@ static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4739 4774
4740 ad.type = LSM_AUDIT_DATA_NET; 4775 ad.type = LSM_AUDIT_DATA_NET;
4741 ad.u.net = &net; 4776 ad.u.net = &net;
4742 ad.u.net->netif = ifindex; 4777 ad.u.net->netif = indev->ifindex;
4743 ad.u.net->family = family; 4778 ad.u.net->family = family;
4744 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0) 4779 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4745 return NF_DROP; 4780 return NF_DROP;
4746 4781
4747 if (peerlbl_active) { 4782 if (peerlbl_active) {
4748 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family, 4783 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4749 peer_sid, &ad); 4784 addrp, family, peer_sid, &ad);
4750 if (err) { 4785 if (err) {
4751 selinux_netlbl_err(skb, err, 1); 4786 selinux_netlbl_err(skb, err, 1);
4752 return NF_DROP; 4787 return NF_DROP;
@@ -4775,7 +4810,7 @@ static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4775 const struct net_device *out, 4810 const struct net_device *out,
4776 int (*okfn)(struct sk_buff *)) 4811 int (*okfn)(struct sk_buff *))
4777{ 4812{
4778 return selinux_ip_forward(skb, in->ifindex, PF_INET); 4813 return selinux_ip_forward(skb, in, PF_INET);
4779} 4814}
4780 4815
4781#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 4816#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -4785,7 +4820,7 @@ static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4785 const struct net_device *out, 4820 const struct net_device *out,
4786 int (*okfn)(struct sk_buff *)) 4821 int (*okfn)(struct sk_buff *))
4787{ 4822{
4788 return selinux_ip_forward(skb, in->ifindex, PF_INET6); 4823 return selinux_ip_forward(skb, in, PF_INET6);
4789} 4824}
4790#endif /* IPV6 */ 4825#endif /* IPV6 */
4791 4826
@@ -4873,11 +4908,13 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4873 return NF_ACCEPT; 4908 return NF_ACCEPT;
4874} 4909}
4875 4910
4876static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex, 4911static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4912 const struct net_device *outdev,
4877 u16 family) 4913 u16 family)
4878{ 4914{
4879 u32 secmark_perm; 4915 u32 secmark_perm;
4880 u32 peer_sid; 4916 u32 peer_sid;
4917 int ifindex = outdev->ifindex;
4881 struct sock *sk; 4918 struct sock *sk;
4882 struct common_audit_data ad; 4919 struct common_audit_data ad;
4883 struct lsm_network_audit net = {0,}; 4920 struct lsm_network_audit net = {0,};
@@ -4958,6 +4995,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4958 case PF_INET6: 4995 case PF_INET6:
4959 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) 4996 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4960 return NF_ACCEPT; 4997 return NF_ACCEPT;
4998 break;
4961 default: 4999 default:
4962 return NF_DROP_ERR(-ECONNREFUSED); 5000 return NF_DROP_ERR(-ECONNREFUSED);
4963 } 5001 }
@@ -4989,7 +5027,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4989 u32 if_sid; 5027 u32 if_sid;
4990 u32 node_sid; 5028 u32 node_sid;
4991 5029
4992 if (sel_netif_sid(ifindex, &if_sid)) 5030 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
4993 return NF_DROP; 5031 return NF_DROP;
4994 if (avc_has_perm(peer_sid, if_sid, 5032 if (avc_has_perm(peer_sid, if_sid,
4995 SECCLASS_NETIF, NETIF__EGRESS, &ad)) 5033 SECCLASS_NETIF, NETIF__EGRESS, &ad))
@@ -5011,7 +5049,7 @@ static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5011 const struct net_device *out, 5049 const struct net_device *out,
5012 int (*okfn)(struct sk_buff *)) 5050 int (*okfn)(struct sk_buff *))
5013{ 5051{
5014 return selinux_ip_postroute(skb, out->ifindex, PF_INET); 5052 return selinux_ip_postroute(skb, out, PF_INET);
5015} 5053}
5016 5054
5017#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 5055#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -5021,7 +5059,7 @@ static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5021 const struct net_device *out, 5059 const struct net_device *out,
5022 int (*okfn)(struct sk_buff *)) 5060 int (*okfn)(struct sk_buff *))
5023{ 5061{
5024 return selinux_ip_postroute(skb, out->ifindex, PF_INET6); 5062 return selinux_ip_postroute(skb, out, PF_INET6);
5025} 5063}
5026#endif /* IPV6 */ 5064#endif /* IPV6 */
5027 5065
@@ -6035,7 +6073,7 @@ security_initcall(selinux_init);
6035 6073
6036#if defined(CONFIG_NETFILTER) 6074#if defined(CONFIG_NETFILTER)
6037 6075
6038static struct nf_hook_ops selinux_ipv4_ops[] = { 6076static struct nf_hook_ops selinux_nf_ops[] = {
6039 { 6077 {
6040 .hook = selinux_ipv4_postroute, 6078 .hook = selinux_ipv4_postroute,
6041 .owner = THIS_MODULE, 6079 .owner = THIS_MODULE,
@@ -6056,12 +6094,8 @@ static struct nf_hook_ops selinux_ipv4_ops[] = {
6056 .pf = NFPROTO_IPV4, 6094 .pf = NFPROTO_IPV4,
6057 .hooknum = NF_INET_LOCAL_OUT, 6095 .hooknum = NF_INET_LOCAL_OUT,
6058 .priority = NF_IP_PRI_SELINUX_FIRST, 6096 .priority = NF_IP_PRI_SELINUX_FIRST,
6059 } 6097 },
6060};
6061
6062#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 6098#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6063
6064static struct nf_hook_ops selinux_ipv6_ops[] = {
6065 { 6099 {
6066 .hook = selinux_ipv6_postroute, 6100 .hook = selinux_ipv6_postroute,
6067 .owner = THIS_MODULE, 6101 .owner = THIS_MODULE,
@@ -6075,32 +6109,24 @@ static struct nf_hook_ops selinux_ipv6_ops[] = {
6075 .pf = NFPROTO_IPV6, 6109 .pf = NFPROTO_IPV6,
6076 .hooknum = NF_INET_FORWARD, 6110 .hooknum = NF_INET_FORWARD,
6077 .priority = NF_IP6_PRI_SELINUX_FIRST, 6111 .priority = NF_IP6_PRI_SELINUX_FIRST,
6078 } 6112 },
6079};
6080
6081#endif /* IPV6 */ 6113#endif /* IPV6 */
6114};
6082 6115
6083static int __init selinux_nf_ip_init(void) 6116static int __init selinux_nf_ip_init(void)
6084{ 6117{
6085 int err = 0; 6118 int err;
6086 6119
6087 if (!selinux_enabled) 6120 if (!selinux_enabled)
6088 goto out; 6121 return 0;
6089 6122
6090 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n"); 6123 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6091 6124
6092 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); 6125 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6093 if (err) 6126 if (err)
6094 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err); 6127 panic("SELinux: nf_register_hooks: error %d\n", err);
6095 6128
6096#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) 6129 return 0;
6097 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6098 if (err)
6099 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6100#endif /* IPV6 */
6101
6102out:
6103 return err;
6104} 6130}
6105 6131
6106__initcall(selinux_nf_ip_init); 6132__initcall(selinux_nf_ip_init);
@@ -6110,10 +6136,7 @@ static void selinux_nf_ip_exit(void)
6110{ 6136{
6111 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n"); 6137 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6112 6138
6113 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops)); 6139 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6114#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6115 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6116#endif /* IPV6 */
6117} 6140}
6118#endif 6141#endif
6119 6142
diff --git a/security/selinux/include/netif.h b/security/selinux/include/netif.h
index 57c6eae81eac..c72145444090 100644
--- a/security/selinux/include/netif.h
+++ b/security/selinux/include/netif.h
@@ -17,9 +17,11 @@
17#ifndef _SELINUX_NETIF_H_ 17#ifndef _SELINUX_NETIF_H_
18#define _SELINUX_NETIF_H_ 18#define _SELINUX_NETIF_H_
19 19
20#include <net/net_namespace.h>
21
20void sel_netif_flush(void); 22void sel_netif_flush(void);
21 23
22int sel_netif_sid(int ifindex, u32 *sid); 24int sel_netif_sid(struct net *ns, int ifindex, u32 *sid);
23 25
24#endif /* _SELINUX_NETIF_H_ */ 26#endif /* _SELINUX_NETIF_H_ */
25 27
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 078e553f52f2..81fa718d5cb3 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -24,6 +24,7 @@
24#include <linux/binfmts.h> 24#include <linux/binfmts.h>
25#include <linux/in.h> 25#include <linux/in.h>
26#include <linux/spinlock.h> 26#include <linux/spinlock.h>
27#include <net/net_namespace.h>
27#include "flask.h" 28#include "flask.h"
28#include "avc.h" 29#include "avc.h"
29 30
@@ -78,6 +79,7 @@ struct ipc_security_struct {
78}; 79};
79 80
80struct netif_security_struct { 81struct netif_security_struct {
82 struct net *ns; /* network namespace */
81 int ifindex; /* device index */ 83 int ifindex; /* device index */
82 u32 sid; /* SID for this interface */ 84 u32 sid; /* SID for this interface */
83}; 85};
diff --git a/security/selinux/netif.c b/security/selinux/netif.c
index 3c3de4ca0ebc..485524c477a4 100644
--- a/security/selinux/netif.c
+++ b/security/selinux/netif.c
@@ -45,6 +45,7 @@ static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE];
45 45
46/** 46/**
47 * sel_netif_hashfn - Hashing function for the interface table 47 * sel_netif_hashfn - Hashing function for the interface table
48 * @ns: the network namespace
48 * @ifindex: the network interface 49 * @ifindex: the network interface
49 * 50 *
50 * Description: 51 * Description:
@@ -52,13 +53,14 @@ static struct list_head sel_netif_hash[SEL_NETIF_HASH_SIZE];
52 * bucket number for the given interface. 53 * bucket number for the given interface.
53 * 54 *
54 */ 55 */
55static inline u32 sel_netif_hashfn(int ifindex) 56static inline u32 sel_netif_hashfn(const struct net *ns, int ifindex)
56{ 57{
57 return (ifindex & (SEL_NETIF_HASH_SIZE - 1)); 58 return (((uintptr_t)ns + ifindex) & (SEL_NETIF_HASH_SIZE - 1));
58} 59}
59 60
60/** 61/**
61 * sel_netif_find - Search for an interface record 62 * sel_netif_find - Search for an interface record
63 * @ns: the network namespace
62 * @ifindex: the network interface 64 * @ifindex: the network interface
63 * 65 *
64 * Description: 66 * Description:
@@ -66,15 +68,15 @@ static inline u32 sel_netif_hashfn(int ifindex)
66 * If an entry can not be found in the table return NULL. 68 * If an entry can not be found in the table return NULL.
67 * 69 *
68 */ 70 */
69static inline struct sel_netif *sel_netif_find(int ifindex) 71static inline struct sel_netif *sel_netif_find(const struct net *ns,
72 int ifindex)
70{ 73{
71 int idx = sel_netif_hashfn(ifindex); 74 int idx = sel_netif_hashfn(ns, ifindex);
72 struct sel_netif *netif; 75 struct sel_netif *netif;
73 76
74 list_for_each_entry_rcu(netif, &sel_netif_hash[idx], list) 77 list_for_each_entry_rcu(netif, &sel_netif_hash[idx], list)
75 /* all of the devices should normally fit in the hash, so we 78 if (net_eq(netif->nsec.ns, ns) &&
76 * optimize for that case */ 79 netif->nsec.ifindex == ifindex)
77 if (likely(netif->nsec.ifindex == ifindex))
78 return netif; 80 return netif;
79 81
80 return NULL; 82 return NULL;
@@ -96,7 +98,7 @@ static int sel_netif_insert(struct sel_netif *netif)
96 if (sel_netif_total >= SEL_NETIF_HASH_MAX) 98 if (sel_netif_total >= SEL_NETIF_HASH_MAX)
97 return -ENOSPC; 99 return -ENOSPC;
98 100
99 idx = sel_netif_hashfn(netif->nsec.ifindex); 101 idx = sel_netif_hashfn(netif->nsec.ns, netif->nsec.ifindex);
100 list_add_rcu(&netif->list, &sel_netif_hash[idx]); 102 list_add_rcu(&netif->list, &sel_netif_hash[idx]);
101 sel_netif_total++; 103 sel_netif_total++;
102 104
@@ -120,6 +122,7 @@ static void sel_netif_destroy(struct sel_netif *netif)
120 122
121/** 123/**
122 * sel_netif_sid_slow - Lookup the SID of a network interface using the policy 124 * sel_netif_sid_slow - Lookup the SID of a network interface using the policy
125 * @ns: the network namespace
123 * @ifindex: the network interface 126 * @ifindex: the network interface
124 * @sid: interface SID 127 * @sid: interface SID
125 * 128 *
@@ -130,7 +133,7 @@ static void sel_netif_destroy(struct sel_netif *netif)
130 * failure. 133 * failure.
131 * 134 *
132 */ 135 */
133static int sel_netif_sid_slow(int ifindex, u32 *sid) 136static int sel_netif_sid_slow(struct net *ns, int ifindex, u32 *sid)
134{ 137{
135 int ret; 138 int ret;
136 struct sel_netif *netif; 139 struct sel_netif *netif;
@@ -140,7 +143,7 @@ static int sel_netif_sid_slow(int ifindex, u32 *sid)
140 /* NOTE: we always use init's network namespace since we don't 143 /* NOTE: we always use init's network namespace since we don't
141 * currently support containers */ 144 * currently support containers */
142 145
143 dev = dev_get_by_index(&init_net, ifindex); 146 dev = dev_get_by_index(ns, ifindex);
144 if (unlikely(dev == NULL)) { 147 if (unlikely(dev == NULL)) {
145 printk(KERN_WARNING 148 printk(KERN_WARNING
146 "SELinux: failure in sel_netif_sid_slow()," 149 "SELinux: failure in sel_netif_sid_slow(),"
@@ -149,7 +152,7 @@ static int sel_netif_sid_slow(int ifindex, u32 *sid)
149 } 152 }
150 153
151 spin_lock_bh(&sel_netif_lock); 154 spin_lock_bh(&sel_netif_lock);
152 netif = sel_netif_find(ifindex); 155 netif = sel_netif_find(ns, ifindex);
153 if (netif != NULL) { 156 if (netif != NULL) {
154 *sid = netif->nsec.sid; 157 *sid = netif->nsec.sid;
155 ret = 0; 158 ret = 0;
@@ -163,6 +166,7 @@ static int sel_netif_sid_slow(int ifindex, u32 *sid)
163 ret = security_netif_sid(dev->name, &new->nsec.sid); 166 ret = security_netif_sid(dev->name, &new->nsec.sid);
164 if (ret != 0) 167 if (ret != 0)
165 goto out; 168 goto out;
169 new->nsec.ns = ns;
166 new->nsec.ifindex = ifindex; 170 new->nsec.ifindex = ifindex;
167 ret = sel_netif_insert(new); 171 ret = sel_netif_insert(new);
168 if (ret != 0) 172 if (ret != 0)
@@ -184,6 +188,7 @@ out:
184 188
185/** 189/**
186 * sel_netif_sid - Lookup the SID of a network interface 190 * sel_netif_sid - Lookup the SID of a network interface
191 * @ns: the network namespace
187 * @ifindex: the network interface 192 * @ifindex: the network interface
188 * @sid: interface SID 193 * @sid: interface SID
189 * 194 *
@@ -195,12 +200,12 @@ out:
195 * on failure. 200 * on failure.
196 * 201 *
197 */ 202 */
198int sel_netif_sid(int ifindex, u32 *sid) 203int sel_netif_sid(struct net *ns, int ifindex, u32 *sid)
199{ 204{
200 struct sel_netif *netif; 205 struct sel_netif *netif;
201 206
202 rcu_read_lock(); 207 rcu_read_lock();
203 netif = sel_netif_find(ifindex); 208 netif = sel_netif_find(ns, ifindex);
204 if (likely(netif != NULL)) { 209 if (likely(netif != NULL)) {
205 *sid = netif->nsec.sid; 210 *sid = netif->nsec.sid;
206 rcu_read_unlock(); 211 rcu_read_unlock();
@@ -208,11 +213,12 @@ int sel_netif_sid(int ifindex, u32 *sid)
208 } 213 }
209 rcu_read_unlock(); 214 rcu_read_unlock();
210 215
211 return sel_netif_sid_slow(ifindex, sid); 216 return sel_netif_sid_slow(ns, ifindex, sid);
212} 217}
213 218
214/** 219/**
215 * sel_netif_kill - Remove an entry from the network interface table 220 * sel_netif_kill - Remove an entry from the network interface table
221 * @ns: the network namespace
216 * @ifindex: the network interface 222 * @ifindex: the network interface
217 * 223 *
218 * Description: 224 * Description:
@@ -220,13 +226,13 @@ int sel_netif_sid(int ifindex, u32 *sid)
220 * table if it exists. 226 * table if it exists.
221 * 227 *
222 */ 228 */
223static void sel_netif_kill(int ifindex) 229static void sel_netif_kill(const struct net *ns, int ifindex)
224{ 230{
225 struct sel_netif *netif; 231 struct sel_netif *netif;
226 232
227 rcu_read_lock(); 233 rcu_read_lock();
228 spin_lock_bh(&sel_netif_lock); 234 spin_lock_bh(&sel_netif_lock);
229 netif = sel_netif_find(ifindex); 235 netif = sel_netif_find(ns, ifindex);
230 if (netif) 236 if (netif)
231 sel_netif_destroy(netif); 237 sel_netif_destroy(netif);
232 spin_unlock_bh(&sel_netif_lock); 238 spin_unlock_bh(&sel_netif_lock);
@@ -257,11 +263,8 @@ static int sel_netif_netdev_notifier_handler(struct notifier_block *this,
257{ 263{
258 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 264 struct net_device *dev = netdev_notifier_info_to_dev(ptr);
259 265
260 if (dev_net(dev) != &init_net)
261 return NOTIFY_DONE;
262
263 if (event == NETDEV_DOWN) 266 if (event == NETDEV_DOWN)
264 sel_netif_kill(dev->ifindex); 267 sel_netif_kill(dev_net(dev), dev->ifindex);
265 268
266 return NOTIFY_DONE; 269 return NOTIFY_DONE;
267} 270}
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
index 2aa9d172dc7e..a1d3944751b9 100644
--- a/security/selinux/ss/services.c
+++ b/security/selinux/ss/services.c
@@ -728,7 +728,7 @@ static int security_validtrans_handle_fail(struct context *ocontext,
728 if (context_struct_to_string(tcontext, &t, &tlen)) 728 if (context_struct_to_string(tcontext, &t, &tlen))
729 goto out; 729 goto out;
730 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 730 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
731 "security_validate_transition: denied for" 731 "op=security_validate_transition seresult=denied"
732 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s", 732 " oldcontext=%s newcontext=%s taskcontext=%s tclass=%s",
733 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 733 o, n, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
734out: 734out:
@@ -877,7 +877,7 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
877 audit_log(current->audit_context, 877 audit_log(current->audit_context,
878 GFP_ATOMIC, AUDIT_SELINUX_ERR, 878 GFP_ATOMIC, AUDIT_SELINUX_ERR,
879 "op=security_bounded_transition " 879 "op=security_bounded_transition "
880 "result=denied " 880 "seresult=denied "
881 "oldcontext=%s newcontext=%s", 881 "oldcontext=%s newcontext=%s",
882 old_name, new_name); 882 old_name, new_name);
883 } 883 }
@@ -1351,8 +1351,8 @@ static int compute_sid_handle_invalid_context(
1351 if (context_struct_to_string(newcontext, &n, &nlen)) 1351 if (context_struct_to_string(newcontext, &n, &nlen))
1352 goto out; 1352 goto out;
1353 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 1353 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR,
1354 "security_compute_sid: invalid context %s" 1354 "op=security_compute_sid invalid_context=%s"
1355 " for scontext=%s" 1355 " scontext=%s"
1356 " tcontext=%s" 1356 " tcontext=%s"
1357 " tclass=%s", 1357 " tclass=%s",
1358 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1)); 1358 n, s, t, sym_name(&policydb, SYM_CLASSES, tclass-1));
@@ -2607,8 +2607,10 @@ int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid)
2607 rc = convert_context_handle_invalid_context(&newcon); 2607 rc = convert_context_handle_invalid_context(&newcon);
2608 if (rc) { 2608 if (rc) {
2609 if (!context_struct_to_string(&newcon, &s, &len)) { 2609 if (!context_struct_to_string(&newcon, &s, &len)) {
2610 audit_log(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR, 2610 audit_log(current->audit_context,
2611 "security_sid_mls_copy: invalid context %s", s); 2611 GFP_ATOMIC, AUDIT_SELINUX_ERR,
2612 "op=security_sid_mls_copy "
2613 "invalid_context=%s", s);
2612 kfree(s); 2614 kfree(s);
2613 } 2615 }
2614 goto out_unlock; 2616 goto out_unlock;
diff --git a/security/smack/Kconfig b/security/smack/Kconfig
index e69de9c642b7..b065f9789418 100644
--- a/security/smack/Kconfig
+++ b/security/smack/Kconfig
@@ -12,3 +12,19 @@ config SECURITY_SMACK
12 of other mandatory security schemes. 12 of other mandatory security schemes.
13 If you are unsure how to answer this question, answer N. 13 If you are unsure how to answer this question, answer N.
14 14
15config SECURITY_SMACK_BRINGUP
16 bool "Reporting on access granted by Smack rules"
17 depends on SECURITY_SMACK
18 default n
19 help
20 Enable the bring-up ("b") access mode in Smack rules.
21 When access is granted by a rule with the "b" mode a
22 message about the access requested is generated. The
23 intention is that a process can be granted a wide set
24 of access initially with the bringup mode set on the
25 rules. The developer can use the information to
26 identify which rules are necessary and what accesses
27 may be inappropriate. The developer can reduce the
28 access rule set once the behavior is well understood.
29 This is a superior mechanism to the oft abused
30 "permissive" mode of other systems.
diff --git a/security/smack/smack.h b/security/smack/smack.h
index 020307ef0972..b828a379377c 100644
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -71,11 +71,11 @@ struct smack_known {
71#define SMK_CIPSOLEN 24 71#define SMK_CIPSOLEN 24
72 72
73struct superblock_smack { 73struct superblock_smack {
74 char *smk_root; 74 struct smack_known *smk_root;
75 char *smk_floor; 75 struct smack_known *smk_floor;
76 char *smk_hat; 76 struct smack_known *smk_hat;
77 char *smk_default; 77 struct smack_known *smk_default;
78 int smk_initialized; 78 int smk_initialized;
79}; 79};
80 80
81struct socket_smack { 81struct socket_smack {
@@ -88,7 +88,7 @@ struct socket_smack {
88 * Inode smack data 88 * Inode smack data
89 */ 89 */
90struct inode_smack { 90struct inode_smack {
91 char *smk_inode; /* label of the fso */ 91 struct smack_known *smk_inode; /* label of the fso */
92 struct smack_known *smk_task; /* label of the task */ 92 struct smack_known *smk_task; /* label of the task */
93 struct smack_known *smk_mmap; /* label of the mmap domain */ 93 struct smack_known *smk_mmap; /* label of the mmap domain */
94 struct mutex smk_lock; /* initialization lock */ 94 struct mutex smk_lock; /* initialization lock */
@@ -112,7 +112,7 @@ struct task_smack {
112struct smack_rule { 112struct smack_rule {
113 struct list_head list; 113 struct list_head list;
114 struct smack_known *smk_subject; 114 struct smack_known *smk_subject;
115 char *smk_object; 115 struct smack_known *smk_object;
116 int smk_access; 116 int smk_access;
117}; 117};
118 118
@@ -123,7 +123,7 @@ struct smk_netlbladdr {
123 struct list_head list; 123 struct list_head list;
124 struct sockaddr_in smk_host; /* network address */ 124 struct sockaddr_in smk_host; /* network address */
125 struct in_addr smk_mask; /* network mask */ 125 struct in_addr smk_mask; /* network mask */
126 char *smk_label; /* label */ 126 struct smack_known *smk_label; /* label */
127}; 127};
128 128
129/* 129/*
@@ -191,6 +191,7 @@ struct smk_port_label {
191 */ 191 */
192#define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */ 192#define MAY_TRANSMUTE 0x00001000 /* Controls directory labeling */
193#define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */ 193#define MAY_LOCK 0x00002000 /* Locks should be writes, but ... */
194#define MAY_BRINGUP 0x00004000 /* Report use of this rule */
194 195
195/* 196/*
196 * Just to make the common cases easier to deal with 197 * Just to make the common cases easier to deal with
@@ -200,9 +201,9 @@ struct smk_port_label {
200#define MAY_NOT 0 201#define MAY_NOT 0
201 202
202/* 203/*
203 * Number of access types used by Smack (rwxatl) 204 * Number of access types used by Smack (rwxatlb)
204 */ 205 */
205#define SMK_NUM_ACCESS_TYPE 6 206#define SMK_NUM_ACCESS_TYPE 7
206 207
207/* SMACK data */ 208/* SMACK data */
208struct smack_audit_data { 209struct smack_audit_data {
@@ -226,23 +227,23 @@ struct smk_audit_info {
226/* 227/*
227 * These functions are in smack_lsm.c 228 * These functions are in smack_lsm.c
228 */ 229 */
229struct inode_smack *new_inode_smack(char *); 230struct inode_smack *new_inode_smack(struct smack_known *);
230 231
231/* 232/*
232 * These functions are in smack_access.c 233 * These functions are in smack_access.c
233 */ 234 */
234int smk_access_entry(char *, char *, struct list_head *); 235int smk_access_entry(char *, char *, struct list_head *);
235int smk_access(struct smack_known *, char *, int, struct smk_audit_info *); 236int smk_access(struct smack_known *, struct smack_known *,
236int smk_tskacc(struct task_smack *, char *, u32, struct smk_audit_info *); 237 int, struct smk_audit_info *);
237int smk_curacc(char *, u32, struct smk_audit_info *); 238int smk_tskacc(struct task_smack *, struct smack_known *,
239 u32, struct smk_audit_info *);
240int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
238struct smack_known *smack_from_secid(const u32); 241struct smack_known *smack_from_secid(const u32);
239char *smk_parse_smack(const char *string, int len); 242char *smk_parse_smack(const char *string, int len);
240int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int); 243int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
241char *smk_import(const char *, int);
242struct smack_known *smk_import_entry(const char *, int); 244struct smack_known *smk_import_entry(const char *, int);
243void smk_insert_entry(struct smack_known *skp); 245void smk_insert_entry(struct smack_known *skp);
244struct smack_known *smk_find_entry(const char *); 246struct smack_known *smk_find_entry(const char *);
245u32 smack_to_secid(const char *);
246 247
247/* 248/*
248 * Shared data. 249 * Shared data.
@@ -252,7 +253,7 @@ extern int smack_cipso_mapped;
252extern struct smack_known *smack_net_ambient; 253extern struct smack_known *smack_net_ambient;
253extern struct smack_known *smack_onlycap; 254extern struct smack_known *smack_onlycap;
254extern struct smack_known *smack_syslog_label; 255extern struct smack_known *smack_syslog_label;
255extern const char *smack_cipso_option; 256extern struct smack_known smack_cipso_option;
256extern int smack_ptrace_rule; 257extern int smack_ptrace_rule;
257 258
258extern struct smack_known smack_known_floor; 259extern struct smack_known smack_known_floor;
@@ -281,9 +282,9 @@ static inline int smk_inode_transmutable(const struct inode *isp)
281} 282}
282 283
283/* 284/*
284 * Present a pointer to the smack label in an inode blob. 285 * Present a pointer to the smack label entry in an inode blob.
285 */ 286 */
286static inline char *smk_of_inode(const struct inode *isp) 287static inline struct smack_known *smk_of_inode(const struct inode *isp)
287{ 288{
288 struct inode_smack *sip = isp->i_security; 289 struct inode_smack *sip = isp->i_security;
289 return sip->smk_inode; 290 return sip->smk_inode;
diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index f97d0842e621..5b970ffde024 100644
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -94,7 +94,7 @@ int smk_access_entry(char *subject_label, char *object_label,
94 struct smack_rule *srp; 94 struct smack_rule *srp;
95 95
96 list_for_each_entry_rcu(srp, rule_list, list) { 96 list_for_each_entry_rcu(srp, rule_list, list) {
97 if (srp->smk_object == object_label && 97 if (srp->smk_object->smk_known == object_label &&
98 srp->smk_subject->smk_known == subject_label) { 98 srp->smk_subject->smk_known == subject_label) {
99 may = srp->smk_access; 99 may = srp->smk_access;
100 break; 100 break;
@@ -111,8 +111,8 @@ int smk_access_entry(char *subject_label, char *object_label,
111 111
112/** 112/**
113 * smk_access - determine if a subject has a specific access to an object 113 * smk_access - determine if a subject has a specific access to an object
114 * @subject_known: a pointer to the subject's Smack label entry 114 * @subject: a pointer to the subject's Smack label entry
115 * @object_label: a pointer to the object's Smack label 115 * @object: a pointer to the object's Smack label entry
116 * @request: the access requested, in "MAY" format 116 * @request: the access requested, in "MAY" format
117 * @a : a pointer to the audit data 117 * @a : a pointer to the audit data
118 * 118 *
@@ -122,8 +122,8 @@ int smk_access_entry(char *subject_label, char *object_label,
122 * 122 *
123 * Smack labels are shared on smack_list 123 * Smack labels are shared on smack_list
124 */ 124 */
125int smk_access(struct smack_known *subject_known, char *object_label, 125int smk_access(struct smack_known *subject, struct smack_known *object,
126 int request, struct smk_audit_info *a) 126 int request, struct smk_audit_info *a)
127{ 127{
128 int may = MAY_NOT; 128 int may = MAY_NOT;
129 int rc = 0; 129 int rc = 0;
@@ -133,7 +133,7 @@ int smk_access(struct smack_known *subject_known, char *object_label,
133 * 133 *
134 * A star subject can't access any object. 134 * A star subject can't access any object.
135 */ 135 */
136 if (subject_known == &smack_known_star) { 136 if (subject == &smack_known_star) {
137 rc = -EACCES; 137 rc = -EACCES;
138 goto out_audit; 138 goto out_audit;
139 } 139 }
@@ -142,28 +142,28 @@ int smk_access(struct smack_known *subject_known, char *object_label,
142 * Tasks cannot be assigned the internet label. 142 * Tasks cannot be assigned the internet label.
143 * An internet subject can access any object. 143 * An internet subject can access any object.
144 */ 144 */
145 if (object_label == smack_known_web.smk_known || 145 if (object == &smack_known_web ||
146 subject_known == &smack_known_web) 146 subject == &smack_known_web)
147 goto out_audit; 147 goto out_audit;
148 /* 148 /*
149 * A star object can be accessed by any subject. 149 * A star object can be accessed by any subject.
150 */ 150 */
151 if (object_label == smack_known_star.smk_known) 151 if (object == &smack_known_star)
152 goto out_audit; 152 goto out_audit;
153 /* 153 /*
154 * An object can be accessed in any way by a subject 154 * An object can be accessed in any way by a subject
155 * with the same label. 155 * with the same label.
156 */ 156 */
157 if (subject_known->smk_known == object_label) 157 if (subject->smk_known == object->smk_known)
158 goto out_audit; 158 goto out_audit;
159 /* 159 /*
160 * A hat subject can read any object. 160 * A hat subject can read any object.
161 * A floor object can be read by any subject. 161 * A floor object can be read by any subject.
162 */ 162 */
163 if ((request & MAY_ANYREAD) == request) { 163 if ((request & MAY_ANYREAD) == request) {
164 if (object_label == smack_known_floor.smk_known) 164 if (object == &smack_known_floor)
165 goto out_audit; 165 goto out_audit;
166 if (subject_known == &smack_known_hat) 166 if (subject == &smack_known_hat)
167 goto out_audit; 167 goto out_audit;
168 } 168 }
169 /* 169 /*
@@ -174,27 +174,38 @@ int smk_access(struct smack_known *subject_known, char *object_label,
174 * indicates there is no entry for this pair. 174 * indicates there is no entry for this pair.
175 */ 175 */
176 rcu_read_lock(); 176 rcu_read_lock();
177 may = smk_access_entry(subject_known->smk_known, object_label, 177 may = smk_access_entry(subject->smk_known, object->smk_known,
178 &subject_known->smk_rules); 178 &subject->smk_rules);
179 rcu_read_unlock(); 179 rcu_read_unlock();
180 180
181 if (may > 0 && (request & may) == request) 181 if (may <= 0 || (request & may) != request) {
182 rc = -EACCES;
182 goto out_audit; 183 goto out_audit;
184 }
185#ifdef CONFIG_SECURITY_SMACK_BRINGUP
186 /*
187 * Return a positive value if using bringup mode.
188 * This allows the hooks to identify checks that
189 * succeed because of "b" rules.
190 */
191 if (may & MAY_BRINGUP)
192 rc = MAY_BRINGUP;
193#endif
183 194
184 rc = -EACCES;
185out_audit: 195out_audit:
186#ifdef CONFIG_AUDIT 196#ifdef CONFIG_AUDIT
187 if (a) 197 if (a)
188 smack_log(subject_known->smk_known, object_label, request, 198 smack_log(subject->smk_known, object->smk_known,
189 rc, a); 199 request, rc, a);
190#endif 200#endif
201
191 return rc; 202 return rc;
192} 203}
193 204
194/** 205/**
195 * smk_tskacc - determine if a task has a specific access to an object 206 * smk_tskacc - determine if a task has a specific access to an object
196 * @tsp: a pointer to the subject task 207 * @tsp: a pointer to the subject's task
197 * @obj_label: a pointer to the object's Smack label 208 * @obj_known: a pointer to the object's label entry
198 * @mode: the access requested, in "MAY" format 209 * @mode: the access requested, in "MAY" format
199 * @a : common audit data 210 * @a : common audit data
200 * 211 *
@@ -203,24 +214,25 @@ out_audit:
203 * non zero otherwise. It allows that the task may have the capability 214 * non zero otherwise. It allows that the task may have the capability
204 * to override the rules. 215 * to override the rules.
205 */ 216 */
206int smk_tskacc(struct task_smack *subject, char *obj_label, 217int smk_tskacc(struct task_smack *tsp, struct smack_known *obj_known,
207 u32 mode, struct smk_audit_info *a) 218 u32 mode, struct smk_audit_info *a)
208{ 219{
209 struct smack_known *skp = smk_of_task(subject); 220 struct smack_known *sbj_known = smk_of_task(tsp);
210 int may; 221 int may;
211 int rc; 222 int rc;
212 223
213 /* 224 /*
214 * Check the global rule list 225 * Check the global rule list
215 */ 226 */
216 rc = smk_access(skp, obj_label, mode, NULL); 227 rc = smk_access(sbj_known, obj_known, mode, NULL);
217 if (rc == 0) { 228 if (rc >= 0) {
218 /* 229 /*
219 * If there is an entry in the task's rule list 230 * If there is an entry in the task's rule list
220 * it can further restrict access. 231 * it can further restrict access.
221 */ 232 */
222 may = smk_access_entry(skp->smk_known, obj_label, 233 may = smk_access_entry(sbj_known->smk_known,
223 &subject->smk_rules); 234 obj_known->smk_known,
235 &tsp->smk_rules);
224 if (may < 0) 236 if (may < 0)
225 goto out_audit; 237 goto out_audit;
226 if ((mode & may) == mode) 238 if ((mode & may) == mode)
@@ -237,14 +249,15 @@ int smk_tskacc(struct task_smack *subject, char *obj_label,
237out_audit: 249out_audit:
238#ifdef CONFIG_AUDIT 250#ifdef CONFIG_AUDIT
239 if (a) 251 if (a)
240 smack_log(skp->smk_known, obj_label, mode, rc, a); 252 smack_log(sbj_known->smk_known, obj_known->smk_known,
253 mode, rc, a);
241#endif 254#endif
242 return rc; 255 return rc;
243} 256}
244 257
245/** 258/**
246 * smk_curacc - determine if current has a specific access to an object 259 * smk_curacc - determine if current has a specific access to an object
247 * @obj_label: a pointer to the object's Smack label 260 * @obj_known: a pointer to the object's Smack label entry
248 * @mode: the access requested, in "MAY" format 261 * @mode: the access requested, in "MAY" format
249 * @a : common audit data 262 * @a : common audit data
250 * 263 *
@@ -253,11 +266,12 @@ out_audit:
253 * non zero otherwise. It allows that current may have the capability 266 * non zero otherwise. It allows that current may have the capability
254 * to override the rules. 267 * to override the rules.
255 */ 268 */
256int smk_curacc(char *obj_label, u32 mode, struct smk_audit_info *a) 269int smk_curacc(struct smack_known *obj_known,
270 u32 mode, struct smk_audit_info *a)
257{ 271{
258 struct task_smack *tsp = current_security(); 272 struct task_smack *tsp = current_security();
259 273
260 return smk_tskacc(tsp, obj_label, mode, a); 274 return smk_tskacc(tsp, obj_known, mode, a);
261} 275}
262 276
263#ifdef CONFIG_AUDIT 277#ifdef CONFIG_AUDIT
@@ -328,6 +342,13 @@ void smack_log(char *subject_label, char *object_label, int request,
328 struct smack_audit_data *sad; 342 struct smack_audit_data *sad;
329 struct common_audit_data *a = &ad->a; 343 struct common_audit_data *a = &ad->a;
330 344
345#ifdef CONFIG_SECURITY_SMACK_BRINGUP
346 /*
347 * The result may be positive in bringup mode.
348 */
349 if (result > 0)
350 result = 0;
351#endif
331 /* check if we have to log the current event */ 352 /* check if we have to log the current event */
332 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0) 353 if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
333 return; 354 return;
@@ -544,27 +565,6 @@ unlockout:
544} 565}
545 566
546/** 567/**
547 * smk_import - import a smack label
548 * @string: a text string that might be a Smack label
549 * @len: the maximum size, or zero if it is NULL terminated.
550 *
551 * Returns a pointer to the label in the label list that
552 * matches the passed string, adding it if necessary.
553 */
554char *smk_import(const char *string, int len)
555{
556 struct smack_known *skp;
557
558 /* labels cannot begin with a '-' */
559 if (string[0] == '-')
560 return NULL;
561 skp = smk_import_entry(string, len);
562 if (skp == NULL)
563 return NULL;
564 return skp->smk_known;
565}
566
567/**
568 * smack_from_secid - find the Smack label associated with a secid 568 * smack_from_secid - find the Smack label associated with a secid
569 * @secid: an integer that might be associated with a Smack label 569 * @secid: an integer that might be associated with a Smack label
570 * 570 *
@@ -590,19 +590,3 @@ struct smack_known *smack_from_secid(const u32 secid)
590 rcu_read_unlock(); 590 rcu_read_unlock();
591 return &smack_known_invalid; 591 return &smack_known_invalid;
592} 592}
593
594/**
595 * smack_to_secid - find the secid associated with a Smack label
596 * @smack: the Smack label
597 *
598 * Returns the appropriate secid if there is one,
599 * otherwise 0
600 */
601u32 smack_to_secid(const char *smack)
602{
603 struct smack_known *skp = smk_find_entry(smack);
604
605 if (skp == NULL)
606 return 0;
607 return skp->smk_secid;
608}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e6ab307ce86e..93dc876734a4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -54,6 +54,151 @@
54 54
55LIST_HEAD(smk_ipv6_port_list); 55LIST_HEAD(smk_ipv6_port_list);
56 56
57#ifdef CONFIG_SECURITY_SMACK_BRINGUP
58static void smk_bu_mode(int mode, char *s)
59{
60 int i = 0;
61
62 if (mode & MAY_READ)
63 s[i++] = 'r';
64 if (mode & MAY_WRITE)
65 s[i++] = 'w';
66 if (mode & MAY_EXEC)
67 s[i++] = 'x';
68 if (mode & MAY_APPEND)
69 s[i++] = 'a';
70 if (mode & MAY_TRANSMUTE)
71 s[i++] = 't';
72 if (mode & MAY_LOCK)
73 s[i++] = 'l';
74 if (i == 0)
75 s[i++] = '-';
76 s[i] = '\0';
77}
78#endif
79
80#ifdef CONFIG_SECURITY_SMACK_BRINGUP
81static int smk_bu_note(char *note, struct smack_known *sskp,
82 struct smack_known *oskp, int mode, int rc)
83{
84 char acc[SMK_NUM_ACCESS_TYPE + 1];
85
86 if (rc <= 0)
87 return rc;
88
89 smk_bu_mode(mode, acc);
90 pr_info("Smack Bringup: (%s %s %s) %s\n",
91 sskp->smk_known, oskp->smk_known, acc, note);
92 return 0;
93}
94#else
95#define smk_bu_note(note, sskp, oskp, mode, RC) (RC)
96#endif
97
98#ifdef CONFIG_SECURITY_SMACK_BRINGUP
99static int smk_bu_current(char *note, struct smack_known *oskp,
100 int mode, int rc)
101{
102 struct task_smack *tsp = current_security();
103 char acc[SMK_NUM_ACCESS_TYPE + 1];
104
105 if (rc <= 0)
106 return rc;
107
108 smk_bu_mode(mode, acc);
109 pr_info("Smack Bringup: (%s %s %s) %s %s\n",
110 tsp->smk_task->smk_known, oskp->smk_known,
111 acc, current->comm, note);
112 return 0;
113}
114#else
115#define smk_bu_current(note, oskp, mode, RC) (RC)
116#endif
117
118#ifdef CONFIG_SECURITY_SMACK_BRINGUP
119static int smk_bu_task(struct task_struct *otp, int mode, int rc)
120{
121 struct task_smack *tsp = current_security();
122 struct task_smack *otsp = task_security(otp);
123 char acc[SMK_NUM_ACCESS_TYPE + 1];
124
125 if (rc <= 0)
126 return rc;
127
128 smk_bu_mode(mode, acc);
129 pr_info("Smack Bringup: (%s %s %s) %s to %s\n",
130 tsp->smk_task->smk_known, otsp->smk_task->smk_known, acc,
131 current->comm, otp->comm);
132 return 0;
133}
134#else
135#define smk_bu_task(otp, mode, RC) (RC)
136#endif
137
138#ifdef CONFIG_SECURITY_SMACK_BRINGUP
139static int smk_bu_inode(struct inode *inode, int mode, int rc)
140{
141 struct task_smack *tsp = current_security();
142 char acc[SMK_NUM_ACCESS_TYPE + 1];
143
144 if (rc <= 0)
145 return rc;
146
147 smk_bu_mode(mode, acc);
148 pr_info("Smack Bringup: (%s %s %s) inode=(%s %ld) %s\n",
149 tsp->smk_task->smk_known, smk_of_inode(inode)->smk_known, acc,
150 inode->i_sb->s_id, inode->i_ino, current->comm);
151 return 0;
152}
153#else
154#define smk_bu_inode(inode, mode, RC) (RC)
155#endif
156
157#ifdef CONFIG_SECURITY_SMACK_BRINGUP
158static int smk_bu_file(struct file *file, int mode, int rc)
159{
160 struct task_smack *tsp = current_security();
161 struct smack_known *sskp = tsp->smk_task;
162 struct inode *inode = file->f_inode;
163 char acc[SMK_NUM_ACCESS_TYPE + 1];
164
165 if (rc <= 0)
166 return rc;
167
168 smk_bu_mode(mode, acc);
169 pr_info("Smack Bringup: (%s %s %s) file=(%s %ld %s) %s\n",
170 sskp->smk_known, (char *)file->f_security, acc,
171 inode->i_sb->s_id, inode->i_ino, file->f_dentry->d_name.name,
172 current->comm);
173 return 0;
174}
175#else
176#define smk_bu_file(file, mode, RC) (RC)
177#endif
178
179#ifdef CONFIG_SECURITY_SMACK_BRINGUP
180static int smk_bu_credfile(const struct cred *cred, struct file *file,
181 int mode, int rc)
182{
183 struct task_smack *tsp = cred->security;
184 struct smack_known *sskp = tsp->smk_task;
185 struct inode *inode = file->f_inode;
186 char acc[SMK_NUM_ACCESS_TYPE + 1];
187
188 if (rc <= 0)
189 return rc;
190
191 smk_bu_mode(mode, acc);
192 pr_info("Smack Bringup: (%s %s %s) file=(%s %ld %s) %s\n",
193 sskp->smk_known, smk_of_inode(inode)->smk_known, acc,
194 inode->i_sb->s_id, inode->i_ino, file->f_dentry->d_name.name,
195 current->comm);
196 return 0;
197}
198#else
199#define smk_bu_credfile(cred, file, mode, RC) (RC)
200#endif
201
57/** 202/**
58 * smk_fetch - Fetch the smack label from a file. 203 * smk_fetch - Fetch the smack label from a file.
59 * @ip: a pointer to the inode 204 * @ip: a pointer to the inode
@@ -87,11 +232,11 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip,
87 232
88/** 233/**
89 * new_inode_smack - allocate an inode security blob 234 * new_inode_smack - allocate an inode security blob
90 * @smack: a pointer to the Smack label to use in the blob 235 * @skp: a pointer to the Smack label entry to use in the blob
91 * 236 *
92 * Returns the new blob or NULL if there's no memory available 237 * Returns the new blob or NULL if there's no memory available
93 */ 238 */
94struct inode_smack *new_inode_smack(char *smack) 239struct inode_smack *new_inode_smack(struct smack_known *skp)
95{ 240{
96 struct inode_smack *isp; 241 struct inode_smack *isp;
97 242
@@ -99,7 +244,7 @@ struct inode_smack *new_inode_smack(char *smack)
99 if (isp == NULL) 244 if (isp == NULL)
100 return NULL; 245 return NULL;
101 246
102 isp->smk_inode = smack; 247 isp->smk_inode = skp;
103 isp->smk_flags = 0; 248 isp->smk_flags = 0;
104 mutex_init(&isp->smk_lock); 249 mutex_init(&isp->smk_lock);
105 250
@@ -178,20 +323,20 @@ static inline unsigned int smk_ptrace_mode(unsigned int mode)
178/** 323/**
179 * smk_ptrace_rule_check - helper for ptrace access 324 * smk_ptrace_rule_check - helper for ptrace access
180 * @tracer: tracer process 325 * @tracer: tracer process
181 * @tracee_label: label of the process that's about to be traced, 326 * @tracee_known: label entry of the process that's about to be traced
182 * the pointer must originate from smack structures
183 * @mode: ptrace attachment mode (PTRACE_MODE_*) 327 * @mode: ptrace attachment mode (PTRACE_MODE_*)
184 * @func: name of the function that called us, used for audit 328 * @func: name of the function that called us, used for audit
185 * 329 *
186 * Returns 0 on access granted, -error on error 330 * Returns 0 on access granted, -error on error
187 */ 331 */
188static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label, 332static int smk_ptrace_rule_check(struct task_struct *tracer,
333 struct smack_known *tracee_known,
189 unsigned int mode, const char *func) 334 unsigned int mode, const char *func)
190{ 335{
191 int rc; 336 int rc;
192 struct smk_audit_info ad, *saip = NULL; 337 struct smk_audit_info ad, *saip = NULL;
193 struct task_smack *tsp; 338 struct task_smack *tsp;
194 struct smack_known *skp; 339 struct smack_known *tracer_known;
195 340
196 if ((mode & PTRACE_MODE_NOAUDIT) == 0) { 341 if ((mode & PTRACE_MODE_NOAUDIT) == 0) {
197 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK); 342 smk_ad_init(&ad, func, LSM_AUDIT_DATA_TASK);
@@ -200,12 +345,12 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label,
200 } 345 }
201 346
202 tsp = task_security(tracer); 347 tsp = task_security(tracer);
203 skp = smk_of_task(tsp); 348 tracer_known = smk_of_task(tsp);
204 349
205 if ((mode & PTRACE_MODE_ATTACH) && 350 if ((mode & PTRACE_MODE_ATTACH) &&
206 (smack_ptrace_rule == SMACK_PTRACE_EXACT || 351 (smack_ptrace_rule == SMACK_PTRACE_EXACT ||
207 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) { 352 smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)) {
208 if (skp->smk_known == tracee_label) 353 if (tracer_known->smk_known == tracee_known->smk_known)
209 rc = 0; 354 rc = 0;
210 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) 355 else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN)
211 rc = -EACCES; 356 rc = -EACCES;
@@ -215,13 +360,15 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, char *tracee_label,
215 rc = -EACCES; 360 rc = -EACCES;
216 361
217 if (saip) 362 if (saip)
218 smack_log(skp->smk_known, tracee_label, 0, rc, saip); 363 smack_log(tracer_known->smk_known,
364 tracee_known->smk_known,
365 0, rc, saip);
219 366
220 return rc; 367 return rc;
221 } 368 }
222 369
223 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */ 370 /* In case of rule==SMACK_PTRACE_DEFAULT or mode==PTRACE_MODE_READ */
224 rc = smk_tskacc(tsp, tracee_label, smk_ptrace_mode(mode), saip); 371 rc = smk_tskacc(tsp, tracee_known, smk_ptrace_mode(mode), saip);
225 return rc; 372 return rc;
226} 373}
227 374
@@ -250,7 +397,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
250 397
251 skp = smk_of_task(task_security(ctp)); 398 skp = smk_of_task(task_security(ctp));
252 399
253 rc = smk_ptrace_rule_check(current, skp->smk_known, mode, __func__); 400 rc = smk_ptrace_rule_check(current, skp, mode, __func__);
254 return rc; 401 return rc;
255} 402}
256 403
@@ -273,8 +420,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
273 420
274 skp = smk_of_task(current_security()); 421 skp = smk_of_task(current_security());
275 422
276 rc = smk_ptrace_rule_check(ptp, skp->smk_known, 423 rc = smk_ptrace_rule_check(ptp, skp, PTRACE_MODE_ATTACH, __func__);
277 PTRACE_MODE_ATTACH, __func__);
278 return rc; 424 return rc;
279} 425}
280 426
@@ -318,10 +464,10 @@ static int smack_sb_alloc_security(struct super_block *sb)
318 if (sbsp == NULL) 464 if (sbsp == NULL)
319 return -ENOMEM; 465 return -ENOMEM;
320 466
321 sbsp->smk_root = smack_known_floor.smk_known; 467 sbsp->smk_root = &smack_known_floor;
322 sbsp->smk_default = smack_known_floor.smk_known; 468 sbsp->smk_default = &smack_known_floor;
323 sbsp->smk_floor = smack_known_floor.smk_known; 469 sbsp->smk_floor = &smack_known_floor;
324 sbsp->smk_hat = smack_known_hat.smk_known; 470 sbsp->smk_hat = &smack_known_hat;
325 /* 471 /*
326 * smk_initialized will be zero from kzalloc. 472 * smk_initialized will be zero from kzalloc.
327 */ 473 */
@@ -405,7 +551,6 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
405 struct smack_known *skp; 551 struct smack_known *skp;
406 char *op; 552 char *op;
407 char *commap; 553 char *commap;
408 char *nsp;
409 int transmute = 0; 554 int transmute = 0;
410 int specified = 0; 555 int specified = 0;
411 556
@@ -421,38 +566,38 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
421 566
422 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) { 567 if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) {
423 op += strlen(SMK_FSHAT); 568 op += strlen(SMK_FSHAT);
424 nsp = smk_import(op, 0); 569 skp = smk_import_entry(op, 0);
425 if (nsp != NULL) { 570 if (skp != NULL) {
426 sp->smk_hat = nsp; 571 sp->smk_hat = skp;
427 specified = 1; 572 specified = 1;
428 } 573 }
429 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) { 574 } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) {
430 op += strlen(SMK_FSFLOOR); 575 op += strlen(SMK_FSFLOOR);
431 nsp = smk_import(op, 0); 576 skp = smk_import_entry(op, 0);
432 if (nsp != NULL) { 577 if (skp != NULL) {
433 sp->smk_floor = nsp; 578 sp->smk_floor = skp;
434 specified = 1; 579 specified = 1;
435 } 580 }
436 } else if (strncmp(op, SMK_FSDEFAULT, 581 } else if (strncmp(op, SMK_FSDEFAULT,
437 strlen(SMK_FSDEFAULT)) == 0) { 582 strlen(SMK_FSDEFAULT)) == 0) {
438 op += strlen(SMK_FSDEFAULT); 583 op += strlen(SMK_FSDEFAULT);
439 nsp = smk_import(op, 0); 584 skp = smk_import_entry(op, 0);
440 if (nsp != NULL) { 585 if (skp != NULL) {
441 sp->smk_default = nsp; 586 sp->smk_default = skp;
442 specified = 1; 587 specified = 1;
443 } 588 }
444 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) { 589 } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) {
445 op += strlen(SMK_FSROOT); 590 op += strlen(SMK_FSROOT);
446 nsp = smk_import(op, 0); 591 skp = smk_import_entry(op, 0);
447 if (nsp != NULL) { 592 if (skp != NULL) {
448 sp->smk_root = nsp; 593 sp->smk_root = skp;
449 specified = 1; 594 specified = 1;
450 } 595 }
451 } else if (strncmp(op, SMK_FSTRANS, strlen(SMK_FSTRANS)) == 0) { 596 } else if (strncmp(op, SMK_FSTRANS, strlen(SMK_FSTRANS)) == 0) {
452 op += strlen(SMK_FSTRANS); 597 op += strlen(SMK_FSTRANS);
453 nsp = smk_import(op, 0); 598 skp = smk_import_entry(op, 0);
454 if (nsp != NULL) { 599 if (skp != NULL) {
455 sp->smk_root = nsp; 600 sp->smk_root = skp;
456 transmute = 1; 601 transmute = 1;
457 specified = 1; 602 specified = 1;
458 } 603 }
@@ -469,8 +614,8 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
469 * Unprivileged mounts get root and default from the caller. 614 * Unprivileged mounts get root and default from the caller.
470 */ 615 */
471 skp = smk_of_current(); 616 skp = smk_of_current();
472 sp->smk_root = skp->smk_known; 617 sp->smk_root = skp;
473 sp->smk_default = skp->smk_known; 618 sp->smk_default = skp;
474 } 619 }
475 /* 620 /*
476 * Initialize the root inode. 621 * Initialize the root inode.
@@ -507,6 +652,7 @@ static int smack_sb_statfs(struct dentry *dentry)
507 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 652 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
508 653
509 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad); 654 rc = smk_curacc(sbp->smk_floor, MAY_READ, &ad);
655 rc = smk_bu_current("statfs", sbp->smk_floor, MAY_READ, rc);
510 return rc; 656 return rc;
511} 657}
512 658
@@ -546,7 +692,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
546 tracer = ptrace_parent(current); 692 tracer = ptrace_parent(current);
547 if (likely(tracer != NULL)) 693 if (likely(tracer != NULL))
548 rc = smk_ptrace_rule_check(tracer, 694 rc = smk_ptrace_rule_check(tracer,
549 isp->smk_task->smk_known, 695 isp->smk_task,
550 PTRACE_MODE_ATTACH, 696 PTRACE_MODE_ATTACH,
551 __func__); 697 __func__);
552 rcu_read_unlock(); 698 rcu_read_unlock();
@@ -607,7 +753,7 @@ static int smack_inode_alloc_security(struct inode *inode)
607{ 753{
608 struct smack_known *skp = smk_of_current(); 754 struct smack_known *skp = smk_of_current();
609 755
610 inode->i_security = new_inode_smack(skp->smk_known); 756 inode->i_security = new_inode_smack(skp);
611 if (inode->i_security == NULL) 757 if (inode->i_security == NULL)
612 return -ENOMEM; 758 return -ENOMEM;
613 return 0; 759 return 0;
@@ -627,8 +773,8 @@ static void smack_inode_free_security(struct inode *inode)
627 773
628/** 774/**
629 * smack_inode_init_security - copy out the smack from an inode 775 * smack_inode_init_security - copy out the smack from an inode
630 * @inode: the inode 776 * @inode: the newly created inode
631 * @dir: unused 777 * @dir: containing directory object
632 * @qstr: unused 778 * @qstr: unused
633 * @name: where to put the attribute name 779 * @name: where to put the attribute name
634 * @value: where to put the attribute value 780 * @value: where to put the attribute value
@@ -642,8 +788,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
642{ 788{
643 struct inode_smack *issp = inode->i_security; 789 struct inode_smack *issp = inode->i_security;
644 struct smack_known *skp = smk_of_current(); 790 struct smack_known *skp = smk_of_current();
645 char *isp = smk_of_inode(inode); 791 struct smack_known *isp = smk_of_inode(inode);
646 char *dsp = smk_of_inode(dir); 792 struct smack_known *dsp = smk_of_inode(dir);
647 int may; 793 int may;
648 794
649 if (name) 795 if (name)
@@ -651,7 +797,8 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
651 797
652 if (value) { 798 if (value) {
653 rcu_read_lock(); 799 rcu_read_lock();
654 may = smk_access_entry(skp->smk_known, dsp, &skp->smk_rules); 800 may = smk_access_entry(skp->smk_known, dsp->smk_known,
801 &skp->smk_rules);
655 rcu_read_unlock(); 802 rcu_read_unlock();
656 803
657 /* 804 /*
@@ -666,13 +813,13 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
666 issp->smk_flags |= SMK_INODE_CHANGED; 813 issp->smk_flags |= SMK_INODE_CHANGED;
667 } 814 }
668 815
669 *value = kstrdup(isp, GFP_NOFS); 816 *value = kstrdup(isp->smk_known, GFP_NOFS);
670 if (*value == NULL) 817 if (*value == NULL)
671 return -ENOMEM; 818 return -ENOMEM;
672 } 819 }
673 820
674 if (len) 821 if (len)
675 *len = strlen(isp) + 1; 822 *len = strlen(isp->smk_known);
676 823
677 return 0; 824 return 0;
678} 825}
@@ -688,7 +835,7 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir,
688static int smack_inode_link(struct dentry *old_dentry, struct inode *dir, 835static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
689 struct dentry *new_dentry) 836 struct dentry *new_dentry)
690{ 837{
691 char *isp; 838 struct smack_known *isp;
692 struct smk_audit_info ad; 839 struct smk_audit_info ad;
693 int rc; 840 int rc;
694 841
@@ -697,11 +844,13 @@ static int smack_inode_link(struct dentry *old_dentry, struct inode *dir,
697 844
698 isp = smk_of_inode(old_dentry->d_inode); 845 isp = smk_of_inode(old_dentry->d_inode);
699 rc = smk_curacc(isp, MAY_WRITE, &ad); 846 rc = smk_curacc(isp, MAY_WRITE, &ad);
847 rc = smk_bu_inode(old_dentry->d_inode, MAY_WRITE, rc);
700 848
701 if (rc == 0 && new_dentry->d_inode != NULL) { 849 if (rc == 0 && new_dentry->d_inode != NULL) {
702 isp = smk_of_inode(new_dentry->d_inode); 850 isp = smk_of_inode(new_dentry->d_inode);
703 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 851 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
704 rc = smk_curacc(isp, MAY_WRITE, &ad); 852 rc = smk_curacc(isp, MAY_WRITE, &ad);
853 rc = smk_bu_inode(new_dentry->d_inode, MAY_WRITE, rc);
705 } 854 }
706 855
707 return rc; 856 return rc;
@@ -728,6 +877,7 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
728 * You need write access to the thing you're unlinking 877 * You need write access to the thing you're unlinking
729 */ 878 */
730 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad); 879 rc = smk_curacc(smk_of_inode(ip), MAY_WRITE, &ad);
880 rc = smk_bu_inode(ip, MAY_WRITE, rc);
731 if (rc == 0) { 881 if (rc == 0) {
732 /* 882 /*
733 * You also need write access to the containing directory 883 * You also need write access to the containing directory
@@ -735,6 +885,7 @@ static int smack_inode_unlink(struct inode *dir, struct dentry *dentry)
735 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 885 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
736 smk_ad_setfield_u_fs_inode(&ad, dir); 886 smk_ad_setfield_u_fs_inode(&ad, dir);
737 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 887 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
888 rc = smk_bu_inode(dir, MAY_WRITE, rc);
738 } 889 }
739 return rc; 890 return rc;
740} 891}
@@ -759,6 +910,7 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
759 * You need write access to the thing you're removing 910 * You need write access to the thing you're removing
760 */ 911 */
761 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 912 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
913 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
762 if (rc == 0) { 914 if (rc == 0) {
763 /* 915 /*
764 * You also need write access to the containing directory 916 * You also need write access to the containing directory
@@ -766,6 +918,7 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
766 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 918 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
767 smk_ad_setfield_u_fs_inode(&ad, dir); 919 smk_ad_setfield_u_fs_inode(&ad, dir);
768 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad); 920 rc = smk_curacc(smk_of_inode(dir), MAY_WRITE, &ad);
921 rc = smk_bu_inode(dir, MAY_WRITE, rc);
769 } 922 }
770 923
771 return rc; 924 return rc;
@@ -773,10 +926,10 @@ static int smack_inode_rmdir(struct inode *dir, struct dentry *dentry)
773 926
774/** 927/**
775 * smack_inode_rename - Smack check on rename 928 * smack_inode_rename - Smack check on rename
776 * @old_inode: the old directory 929 * @old_inode: unused
777 * @old_dentry: unused 930 * @old_dentry: the old object
778 * @new_inode: the new directory 931 * @new_inode: unused
779 * @new_dentry: unused 932 * @new_dentry: the new object
780 * 933 *
781 * Read and write access is required on both the old and 934 * Read and write access is required on both the old and
782 * new directories. 935 * new directories.
@@ -789,7 +942,7 @@ static int smack_inode_rename(struct inode *old_inode,
789 struct dentry *new_dentry) 942 struct dentry *new_dentry)
790{ 943{
791 int rc; 944 int rc;
792 char *isp; 945 struct smack_known *isp;
793 struct smk_audit_info ad; 946 struct smk_audit_info ad;
794 947
795 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 948 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
@@ -797,11 +950,13 @@ static int smack_inode_rename(struct inode *old_inode,
797 950
798 isp = smk_of_inode(old_dentry->d_inode); 951 isp = smk_of_inode(old_dentry->d_inode);
799 rc = smk_curacc(isp, MAY_READWRITE, &ad); 952 rc = smk_curacc(isp, MAY_READWRITE, &ad);
953 rc = smk_bu_inode(old_dentry->d_inode, MAY_READWRITE, rc);
800 954
801 if (rc == 0 && new_dentry->d_inode != NULL) { 955 if (rc == 0 && new_dentry->d_inode != NULL) {
802 isp = smk_of_inode(new_dentry->d_inode); 956 isp = smk_of_inode(new_dentry->d_inode);
803 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry); 957 smk_ad_setfield_u_fs_path_dentry(&ad, new_dentry);
804 rc = smk_curacc(isp, MAY_READWRITE, &ad); 958 rc = smk_curacc(isp, MAY_READWRITE, &ad);
959 rc = smk_bu_inode(new_dentry->d_inode, MAY_READWRITE, rc);
805 } 960 }
806 return rc; 961 return rc;
807} 962}
@@ -819,6 +974,7 @@ static int smack_inode_permission(struct inode *inode, int mask)
819{ 974{
820 struct smk_audit_info ad; 975 struct smk_audit_info ad;
821 int no_block = mask & MAY_NOT_BLOCK; 976 int no_block = mask & MAY_NOT_BLOCK;
977 int rc;
822 978
823 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 979 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
824 /* 980 /*
@@ -832,7 +988,9 @@ static int smack_inode_permission(struct inode *inode, int mask)
832 return -ECHILD; 988 return -ECHILD;
833 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE); 989 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_INODE);
834 smk_ad_setfield_u_fs_inode(&ad, inode); 990 smk_ad_setfield_u_fs_inode(&ad, inode);
835 return smk_curacc(smk_of_inode(inode), mask, &ad); 991 rc = smk_curacc(smk_of_inode(inode), mask, &ad);
992 rc = smk_bu_inode(inode, mask, rc);
993 return rc;
836} 994}
837 995
838/** 996/**
@@ -845,6 +1003,8 @@ static int smack_inode_permission(struct inode *inode, int mask)
845static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr) 1003static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
846{ 1004{
847 struct smk_audit_info ad; 1005 struct smk_audit_info ad;
1006 int rc;
1007
848 /* 1008 /*
849 * Need to allow for clearing the setuid bit. 1009 * Need to allow for clearing the setuid bit.
850 */ 1010 */
@@ -853,12 +1013,14 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
853 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1013 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
854 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1014 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
855 1015
856 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1016 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1017 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1018 return rc;
857} 1019}
858 1020
859/** 1021/**
860 * smack_inode_getattr - Smack check for getting attributes 1022 * smack_inode_getattr - Smack check for getting attributes
861 * @mnt: unused 1023 * @mnt: vfsmount of the object
862 * @dentry: the object 1024 * @dentry: the object
863 * 1025 *
864 * Returns 0 if access is permitted, an error code otherwise 1026 * Returns 0 if access is permitted, an error code otherwise
@@ -867,21 +1029,24 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
867{ 1029{
868 struct smk_audit_info ad; 1030 struct smk_audit_info ad;
869 struct path path; 1031 struct path path;
1032 int rc;
870 1033
871 path.dentry = dentry; 1034 path.dentry = dentry;
872 path.mnt = mnt; 1035 path.mnt = mnt;
873 1036
874 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1037 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
875 smk_ad_setfield_u_fs_path(&ad, path); 1038 smk_ad_setfield_u_fs_path(&ad, path);
876 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 1039 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
1040 rc = smk_bu_inode(dentry->d_inode, MAY_READ, rc);
1041 return rc;
877} 1042}
878 1043
879/** 1044/**
880 * smack_inode_setxattr - Smack check for setting xattrs 1045 * smack_inode_setxattr - Smack check for setting xattrs
881 * @dentry: the object 1046 * @dentry: the object
882 * @name: name of the attribute 1047 * @name: name of the attribute
883 * @value: unused 1048 * @value: value of the attribute
884 * @size: unused 1049 * @size: size of the value
885 * @flags: unused 1050 * @flags: unused
886 * 1051 *
887 * This protects the Smack attribute explicitly. 1052 * This protects the Smack attribute explicitly.
@@ -923,7 +1088,7 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
923 rc = -EPERM; 1088 rc = -EPERM;
924 1089
925 if (rc == 0 && check_import) { 1090 if (rc == 0 && check_import) {
926 skp = smk_import_entry(value, size); 1091 skp = size ? smk_import_entry(value, size) : NULL;
927 if (skp == NULL || (check_star && 1092 if (skp == NULL || (check_star &&
928 (skp == &smack_known_star || skp == &smack_known_web))) 1093 (skp == &smack_known_star || skp == &smack_known_web)))
929 rc = -EINVAL; 1094 rc = -EINVAL;
@@ -932,8 +1097,10 @@ static int smack_inode_setxattr(struct dentry *dentry, const char *name,
932 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1097 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
933 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1098 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
934 1099
935 if (rc == 0) 1100 if (rc == 0) {
936 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1101 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1102 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1103 }
937 1104
938 return rc; 1105 return rc;
939} 1106}
@@ -963,9 +1130,9 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
963 if (strcmp(name, XATTR_NAME_SMACK) == 0) { 1130 if (strcmp(name, XATTR_NAME_SMACK) == 0) {
964 skp = smk_import_entry(value, size); 1131 skp = smk_import_entry(value, size);
965 if (skp != NULL) 1132 if (skp != NULL)
966 isp->smk_inode = skp->smk_known; 1133 isp->smk_inode = skp;
967 else 1134 else
968 isp->smk_inode = smack_known_invalid.smk_known; 1135 isp->smk_inode = &smack_known_invalid;
969 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) { 1136 } else if (strcmp(name, XATTR_NAME_SMACKEXEC) == 0) {
970 skp = smk_import_entry(value, size); 1137 skp = smk_import_entry(value, size);
971 if (skp != NULL) 1138 if (skp != NULL)
@@ -993,11 +1160,14 @@ static void smack_inode_post_setxattr(struct dentry *dentry, const char *name,
993static int smack_inode_getxattr(struct dentry *dentry, const char *name) 1160static int smack_inode_getxattr(struct dentry *dentry, const char *name)
994{ 1161{
995 struct smk_audit_info ad; 1162 struct smk_audit_info ad;
1163 int rc;
996 1164
997 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY); 1165 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_DENTRY);
998 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1166 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
999 1167
1000 return smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad); 1168 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
1169 rc = smk_bu_inode(dentry->d_inode, MAY_READ, rc);
1170 return rc;
1001} 1171}
1002 1172
1003/** 1173/**
@@ -1033,6 +1203,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name)
1033 smk_ad_setfield_u_fs_path_dentry(&ad, dentry); 1203 smk_ad_setfield_u_fs_path_dentry(&ad, dentry);
1034 1204
1035 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad); 1205 rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE, &ad);
1206 rc = smk_bu_inode(dentry->d_inode, MAY_WRITE, rc);
1036 if (rc != 0) 1207 if (rc != 0)
1037 return rc; 1208 return rc;
1038 1209
@@ -1070,14 +1241,14 @@ static int smack_inode_getsecurity(const struct inode *inode,
1070 struct socket *sock; 1241 struct socket *sock;
1071 struct super_block *sbp; 1242 struct super_block *sbp;
1072 struct inode *ip = (struct inode *)inode; 1243 struct inode *ip = (struct inode *)inode;
1073 char *isp; 1244 struct smack_known *isp;
1074 int ilen; 1245 int ilen;
1075 int rc = 0; 1246 int rc = 0;
1076 1247
1077 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 1248 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
1078 isp = smk_of_inode(inode); 1249 isp = smk_of_inode(inode);
1079 ilen = strlen(isp) + 1; 1250 ilen = strlen(isp->smk_known);
1080 *buffer = isp; 1251 *buffer = isp->smk_known;
1081 return ilen; 1252 return ilen;
1082 } 1253 }
1083 1254
@@ -1095,15 +1266,15 @@ static int smack_inode_getsecurity(const struct inode *inode,
1095 ssp = sock->sk->sk_security; 1266 ssp = sock->sk->sk_security;
1096 1267
1097 if (strcmp(name, XATTR_SMACK_IPIN) == 0) 1268 if (strcmp(name, XATTR_SMACK_IPIN) == 0)
1098 isp = ssp->smk_in->smk_known; 1269 isp = ssp->smk_in;
1099 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) 1270 else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
1100 isp = ssp->smk_out->smk_known; 1271 isp = ssp->smk_out;
1101 else 1272 else
1102 return -EOPNOTSUPP; 1273 return -EOPNOTSUPP;
1103 1274
1104 ilen = strlen(isp) + 1; 1275 ilen = strlen(isp->smk_known);
1105 if (rc == 0) { 1276 if (rc == 0) {
1106 *buffer = isp; 1277 *buffer = isp->smk_known;
1107 rc = ilen; 1278 rc = ilen;
1108 } 1279 }
1109 1280
@@ -1122,13 +1293,12 @@ static int smack_inode_getsecurity(const struct inode *inode,
1122static int smack_inode_listsecurity(struct inode *inode, char *buffer, 1293static int smack_inode_listsecurity(struct inode *inode, char *buffer,
1123 size_t buffer_size) 1294 size_t buffer_size)
1124{ 1295{
1125 int len = strlen(XATTR_NAME_SMACK); 1296 int len = sizeof(XATTR_NAME_SMACK);
1126 1297
1127 if (buffer != NULL && len <= buffer_size) { 1298 if (buffer != NULL && len <= buffer_size)
1128 memcpy(buffer, XATTR_NAME_SMACK, len); 1299 memcpy(buffer, XATTR_NAME_SMACK, len);
1129 return len; 1300
1130 } 1301 return len;
1131 return -EINVAL;
1132} 1302}
1133 1303
1134/** 1304/**
@@ -1140,7 +1310,7 @@ static void smack_inode_getsecid(const struct inode *inode, u32 *secid)
1140{ 1310{
1141 struct inode_smack *isp = inode->i_security; 1311 struct inode_smack *isp = inode->i_security;
1142 1312
1143 *secid = smack_to_secid(isp->smk_inode); 1313 *secid = isp->smk_inode->smk_secid;
1144} 1314}
1145 1315
1146/* 1316/*
@@ -1179,7 +1349,7 @@ static int smack_file_alloc_security(struct file *file)
1179{ 1349{
1180 struct smack_known *skp = smk_of_current(); 1350 struct smack_known *skp = smk_of_current();
1181 1351
1182 file->f_security = skp->smk_known; 1352 file->f_security = skp;
1183 return 0; 1353 return 0;
1184} 1354}
1185 1355
@@ -1214,11 +1384,15 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
1214 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1384 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1215 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1385 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1216 1386
1217 if (_IOC_DIR(cmd) & _IOC_WRITE) 1387 if (_IOC_DIR(cmd) & _IOC_WRITE) {
1218 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1388 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1389 rc = smk_bu_file(file, MAY_WRITE, rc);
1390 }
1219 1391
1220 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) 1392 if (rc == 0 && (_IOC_DIR(cmd) & _IOC_READ)) {
1221 rc = smk_curacc(file->f_security, MAY_READ, &ad); 1393 rc = smk_curacc(file->f_security, MAY_READ, &ad);
1394 rc = smk_bu_file(file, MAY_READ, rc);
1395 }
1222 1396
1223 return rc; 1397 return rc;
1224} 1398}
@@ -1233,10 +1407,13 @@ static int smack_file_ioctl(struct file *file, unsigned int cmd,
1233static int smack_file_lock(struct file *file, unsigned int cmd) 1407static int smack_file_lock(struct file *file, unsigned int cmd)
1234{ 1408{
1235 struct smk_audit_info ad; 1409 struct smk_audit_info ad;
1410 int rc;
1236 1411
1237 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1412 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1238 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1413 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1239 return smk_curacc(file->f_security, MAY_LOCK, &ad); 1414 rc = smk_curacc(file->f_security, MAY_LOCK, &ad);
1415 rc = smk_bu_file(file, MAY_LOCK, rc);
1416 return rc;
1240} 1417}
1241 1418
1242/** 1419/**
@@ -1266,12 +1443,14 @@ static int smack_file_fcntl(struct file *file, unsigned int cmd,
1266 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1443 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1267 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1444 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1268 rc = smk_curacc(file->f_security, MAY_LOCK, &ad); 1445 rc = smk_curacc(file->f_security, MAY_LOCK, &ad);
1446 rc = smk_bu_file(file, MAY_LOCK, rc);
1269 break; 1447 break;
1270 case F_SETOWN: 1448 case F_SETOWN:
1271 case F_SETSIG: 1449 case F_SETSIG:
1272 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1450 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1273 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1451 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1274 rc = smk_curacc(file->f_security, MAY_WRITE, &ad); 1452 rc = smk_curacc(file->f_security, MAY_WRITE, &ad);
1453 rc = smk_bu_file(file, MAY_WRITE, rc);
1275 break; 1454 break;
1276 default: 1455 default:
1277 break; 1456 break;
@@ -1298,7 +1477,7 @@ static int smack_mmap_file(struct file *file,
1298 struct smack_known *mkp; 1477 struct smack_known *mkp;
1299 struct smack_rule *srp; 1478 struct smack_rule *srp;
1300 struct task_smack *tsp; 1479 struct task_smack *tsp;
1301 char *osmack; 1480 struct smack_known *okp;
1302 struct inode_smack *isp; 1481 struct inode_smack *isp;
1303 int may; 1482 int may;
1304 int mmay; 1483 int mmay;
@@ -1324,18 +1503,19 @@ static int smack_mmap_file(struct file *file,
1324 * to that rule's object label. 1503 * to that rule's object label.
1325 */ 1504 */
1326 list_for_each_entry_rcu(srp, &skp->smk_rules, list) { 1505 list_for_each_entry_rcu(srp, &skp->smk_rules, list) {
1327 osmack = srp->smk_object; 1506 okp = srp->smk_object;
1328 /* 1507 /*
1329 * Matching labels always allows access. 1508 * Matching labels always allows access.
1330 */ 1509 */
1331 if (mkp->smk_known == osmack) 1510 if (mkp->smk_known == okp->smk_known)
1332 continue; 1511 continue;
1333 /* 1512 /*
1334 * If there is a matching local rule take 1513 * If there is a matching local rule take
1335 * that into account as well. 1514 * that into account as well.
1336 */ 1515 */
1337 may = smk_access_entry(srp->smk_subject->smk_known, osmack, 1516 may = smk_access_entry(srp->smk_subject->smk_known,
1338 &tsp->smk_rules); 1517 okp->smk_known,
1518 &tsp->smk_rules);
1339 if (may == -ENOENT) 1519 if (may == -ENOENT)
1340 may = srp->smk_access; 1520 may = srp->smk_access;
1341 else 1521 else
@@ -1352,8 +1532,8 @@ static int smack_mmap_file(struct file *file,
1352 * If there isn't one a SMACK64MMAP subject 1532 * If there isn't one a SMACK64MMAP subject
1353 * can't have as much access as current. 1533 * can't have as much access as current.
1354 */ 1534 */
1355 mmay = smk_access_entry(mkp->smk_known, osmack, 1535 mmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1356 &mkp->smk_rules); 1536 &mkp->smk_rules);
1357 if (mmay == -ENOENT) { 1537 if (mmay == -ENOENT) {
1358 rc = -EACCES; 1538 rc = -EACCES;
1359 break; 1539 break;
@@ -1362,8 +1542,8 @@ static int smack_mmap_file(struct file *file,
1362 * If there is a local entry it modifies the 1542 * If there is a local entry it modifies the
1363 * potential access, too. 1543 * potential access, too.
1364 */ 1544 */
1365 tmay = smk_access_entry(mkp->smk_known, osmack, 1545 tmay = smk_access_entry(mkp->smk_known, okp->smk_known,
1366 &tsp->smk_rules); 1546 &tsp->smk_rules);
1367 if (tmay != -ENOENT) 1547 if (tmay != -ENOENT)
1368 mmay &= tmay; 1548 mmay &= tmay;
1369 1549
@@ -1394,7 +1574,7 @@ static int smack_file_set_fowner(struct file *file)
1394{ 1574{
1395 struct smack_known *skp = smk_of_current(); 1575 struct smack_known *skp = smk_of_current();
1396 1576
1397 file->f_security = skp->smk_known; 1577 file->f_security = skp;
1398 return 0; 1578 return 0;
1399} 1579}
1400 1580
@@ -1424,14 +1604,15 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
1424 file = container_of(fown, struct file, f_owner); 1604 file = container_of(fown, struct file, f_owner);
1425 1605
1426 /* we don't log here as rc can be overriden */ 1606 /* we don't log here as rc can be overriden */
1427 skp = smk_find_entry(file->f_security); 1607 skp = file->f_security;
1428 rc = smk_access(skp, tkp->smk_known, MAY_WRITE, NULL); 1608 rc = smk_access(skp, tkp, MAY_WRITE, NULL);
1609 rc = smk_bu_note("sigiotask", skp, tkp, MAY_WRITE, rc);
1429 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) 1610 if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
1430 rc = 0; 1611 rc = 0;
1431 1612
1432 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1613 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1433 smk_ad_setfield_u_tsk(&ad, tsk); 1614 smk_ad_setfield_u_tsk(&ad, tsk);
1434 smack_log(file->f_security, tkp->smk_known, MAY_WRITE, rc, &ad); 1615 smack_log(skp->smk_known, tkp->smk_known, MAY_WRITE, rc, &ad);
1435 return rc; 1616 return rc;
1436} 1617}
1437 1618
@@ -1443,6 +1624,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
1443 */ 1624 */
1444static int smack_file_receive(struct file *file) 1625static int smack_file_receive(struct file *file)
1445{ 1626{
1627 int rc;
1446 int may = 0; 1628 int may = 0;
1447 struct smk_audit_info ad; 1629 struct smk_audit_info ad;
1448 1630
@@ -1456,7 +1638,9 @@ static int smack_file_receive(struct file *file)
1456 if (file->f_mode & FMODE_WRITE) 1638 if (file->f_mode & FMODE_WRITE)
1457 may |= MAY_WRITE; 1639 may |= MAY_WRITE;
1458 1640
1459 return smk_curacc(file->f_security, may, &ad); 1641 rc = smk_curacc(file->f_security, may, &ad);
1642 rc = smk_bu_file(file, may, rc);
1643 return rc;
1460} 1644}
1461 1645
1462/** 1646/**
@@ -1478,12 +1662,15 @@ static int smack_file_open(struct file *file, const struct cred *cred)
1478 struct smk_audit_info ad; 1662 struct smk_audit_info ad;
1479 int rc; 1663 int rc;
1480 1664
1481 if (smack_privileged(CAP_MAC_OVERRIDE)) 1665 if (smack_privileged(CAP_MAC_OVERRIDE)) {
1666 file->f_security = isp->smk_inode;
1482 return 0; 1667 return 0;
1668 }
1483 1669
1484 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH); 1670 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
1485 smk_ad_setfield_u_fs_path(&ad, file->f_path); 1671 smk_ad_setfield_u_fs_path(&ad, file->f_path);
1486 rc = smk_access(tsp->smk_task, isp->smk_inode, MAY_READ, &ad); 1672 rc = smk_access(tsp->smk_task, isp->smk_inode, MAY_READ, &ad);
1673 rc = smk_bu_credfile(cred, file, MAY_READ, rc);
1487 if (rc == 0) 1674 if (rc == 0)
1488 file->f_security = isp->smk_inode; 1675 file->f_security = isp->smk_inode;
1489 1676
@@ -1622,7 +1809,7 @@ static int smack_kernel_create_files_as(struct cred *new,
1622 struct inode_smack *isp = inode->i_security; 1809 struct inode_smack *isp = inode->i_security;
1623 struct task_smack *tsp = new->security; 1810 struct task_smack *tsp = new->security;
1624 1811
1625 tsp->smk_forked = smk_find_entry(isp->smk_inode); 1812 tsp->smk_forked = isp->smk_inode;
1626 tsp->smk_task = tsp->smk_forked; 1813 tsp->smk_task = tsp->smk_forked;
1627 return 0; 1814 return 0;
1628} 1815}
@@ -1640,10 +1827,13 @@ static int smk_curacc_on_task(struct task_struct *p, int access,
1640{ 1827{
1641 struct smk_audit_info ad; 1828 struct smk_audit_info ad;
1642 struct smack_known *skp = smk_of_task(task_security(p)); 1829 struct smack_known *skp = smk_of_task(task_security(p));
1830 int rc;
1643 1831
1644 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK); 1832 smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
1645 smk_ad_setfield_u_tsk(&ad, p); 1833 smk_ad_setfield_u_tsk(&ad, p);
1646 return smk_curacc(skp->smk_known, access, &ad); 1834 rc = smk_curacc(skp, access, &ad);
1835 rc = smk_bu_task(p, access, rc);
1836 return rc;
1647} 1837}
1648 1838
1649/** 1839/**
@@ -1797,6 +1987,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
1797 struct smk_audit_info ad; 1987 struct smk_audit_info ad;
1798 struct smack_known *skp; 1988 struct smack_known *skp;
1799 struct smack_known *tkp = smk_of_task(task_security(p)); 1989 struct smack_known *tkp = smk_of_task(task_security(p));
1990 int rc;
1800 1991
1801 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); 1992 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
1802 smk_ad_setfield_u_tsk(&ad, p); 1993 smk_ad_setfield_u_tsk(&ad, p);
@@ -1804,15 +1995,20 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
1804 * Sending a signal requires that the sender 1995 * Sending a signal requires that the sender
1805 * can write the receiver. 1996 * can write the receiver.
1806 */ 1997 */
1807 if (secid == 0) 1998 if (secid == 0) {
1808 return smk_curacc(tkp->smk_known, MAY_WRITE, &ad); 1999 rc = smk_curacc(tkp, MAY_WRITE, &ad);
2000 rc = smk_bu_task(p, MAY_WRITE, rc);
2001 return rc;
2002 }
1809 /* 2003 /*
1810 * If the secid isn't 0 we're dealing with some USB IO 2004 * If the secid isn't 0 we're dealing with some USB IO
1811 * specific behavior. This is not clean. For one thing 2005 * specific behavior. This is not clean. For one thing
1812 * we can't take privilege into account. 2006 * we can't take privilege into account.
1813 */ 2007 */
1814 skp = smack_from_secid(secid); 2008 skp = smack_from_secid(secid);
1815 return smk_access(skp, tkp->smk_known, MAY_WRITE, &ad); 2009 rc = smk_access(skp, tkp, MAY_WRITE, &ad);
2010 rc = smk_bu_note("USB signal", skp, tkp, MAY_WRITE, rc);
2011 return rc;
1816} 2012}
1817 2013
1818/** 2014/**
@@ -1846,7 +2042,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
1846 struct inode_smack *isp = inode->i_security; 2042 struct inode_smack *isp = inode->i_security;
1847 struct smack_known *skp = smk_of_task(task_security(p)); 2043 struct smack_known *skp = smk_of_task(task_security(p));
1848 2044
1849 isp->smk_inode = skp->smk_known; 2045 isp->smk_inode = skp;
1850} 2046}
1851 2047
1852/* 2048/*
@@ -1904,7 +2100,7 @@ static void smack_sk_free_security(struct sock *sk)
1904* 2100*
1905* Returns the label of the far end or NULL if it's not special. 2101* Returns the label of the far end or NULL if it's not special.
1906*/ 2102*/
1907static char *smack_host_label(struct sockaddr_in *sip) 2103static struct smack_known *smack_host_label(struct sockaddr_in *sip)
1908{ 2104{
1909 struct smk_netlbladdr *snp; 2105 struct smk_netlbladdr *snp;
1910 struct in_addr *siap = &sip->sin_addr; 2106 struct in_addr *siap = &sip->sin_addr;
@@ -1921,7 +2117,7 @@ static char *smack_host_label(struct sockaddr_in *sip)
1921 if ((&snp->smk_host.sin_addr)->s_addr == 2117 if ((&snp->smk_host.sin_addr)->s_addr ==
1922 (siap->s_addr & (&snp->smk_mask)->s_addr)) { 2118 (siap->s_addr & (&snp->smk_mask)->s_addr)) {
1923 /* we have found the special CIPSO option */ 2119 /* we have found the special CIPSO option */
1924 if (snp->smk_label == smack_cipso_option) 2120 if (snp->smk_label == &smack_cipso_option)
1925 return NULL; 2121 return NULL;
1926 return snp->smk_label; 2122 return snp->smk_label;
1927 } 2123 }
@@ -1986,13 +2182,13 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
1986 struct smack_known *skp; 2182 struct smack_known *skp;
1987 int rc; 2183 int rc;
1988 int sk_lbl; 2184 int sk_lbl;
1989 char *hostsp; 2185 struct smack_known *hkp;
1990 struct socket_smack *ssp = sk->sk_security; 2186 struct socket_smack *ssp = sk->sk_security;
1991 struct smk_audit_info ad; 2187 struct smk_audit_info ad;
1992 2188
1993 rcu_read_lock(); 2189 rcu_read_lock();
1994 hostsp = smack_host_label(sap); 2190 hkp = smack_host_label(sap);
1995 if (hostsp != NULL) { 2191 if (hkp != NULL) {
1996#ifdef CONFIG_AUDIT 2192#ifdef CONFIG_AUDIT
1997 struct lsm_network_audit net; 2193 struct lsm_network_audit net;
1998 2194
@@ -2003,7 +2199,8 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap)
2003#endif 2199#endif
2004 sk_lbl = SMACK_UNLABELED_SOCKET; 2200 sk_lbl = SMACK_UNLABELED_SOCKET;
2005 skp = ssp->smk_out; 2201 skp = ssp->smk_out;
2006 rc = smk_access(skp, hostsp, MAY_WRITE, &ad); 2202 rc = smk_access(skp, hkp, MAY_WRITE, &ad);
2203 rc = smk_bu_note("IPv4 host check", skp, hkp, MAY_WRITE, rc);
2007 } else { 2204 } else {
2008 sk_lbl = SMACK_CIPSO_SOCKET; 2205 sk_lbl = SMACK_CIPSO_SOCKET;
2009 rc = 0; 2206 rc = 0;
@@ -2104,18 +2301,19 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2104 struct socket_smack *ssp = sk->sk_security; 2301 struct socket_smack *ssp = sk->sk_security;
2105 struct smack_known *skp; 2302 struct smack_known *skp;
2106 unsigned short port = 0; 2303 unsigned short port = 0;
2107 char *object; 2304 struct smack_known *object;
2108 struct smk_audit_info ad; 2305 struct smk_audit_info ad;
2306 int rc;
2109#ifdef CONFIG_AUDIT 2307#ifdef CONFIG_AUDIT
2110 struct lsm_network_audit net; 2308 struct lsm_network_audit net;
2111#endif 2309#endif
2112 2310
2113 if (act == SMK_RECEIVING) { 2311 if (act == SMK_RECEIVING) {
2114 skp = smack_net_ambient; 2312 skp = smack_net_ambient;
2115 object = ssp->smk_in->smk_known; 2313 object = ssp->smk_in;
2116 } else { 2314 } else {
2117 skp = ssp->smk_out; 2315 skp = ssp->smk_out;
2118 object = smack_net_ambient->smk_known; 2316 object = smack_net_ambient;
2119 } 2317 }
2120 2318
2121 /* 2319 /*
@@ -2142,7 +2340,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address,
2142 list_for_each_entry(spp, &smk_ipv6_port_list, list) { 2340 list_for_each_entry(spp, &smk_ipv6_port_list, list) {
2143 if (spp->smk_port != port) 2341 if (spp->smk_port != port)
2144 continue; 2342 continue;
2145 object = spp->smk_in->smk_known; 2343 object = spp->smk_in;
2146 if (act == SMK_CONNECTING) 2344 if (act == SMK_CONNECTING)
2147 ssp->smk_packet = spp->smk_out; 2345 ssp->smk_packet = spp->smk_out;
2148 break; 2346 break;
@@ -2159,7 +2357,9 @@ auditout:
2159 else 2357 else
2160 ad.a.u.net->v6info.daddr = address->sin6_addr; 2358 ad.a.u.net->v6info.daddr = address->sin6_addr;
2161#endif 2359#endif
2162 return smk_access(skp, object, MAY_WRITE, &ad); 2360 rc = smk_access(skp, object, MAY_WRITE, &ad);
2361 rc = smk_bu_note("IPv6 port check", skp, object, MAY_WRITE, rc);
2362 return rc;
2163} 2363}
2164 2364
2165/** 2365/**
@@ -2191,7 +2391,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name,
2191 return -EINVAL; 2391 return -EINVAL;
2192 2392
2193 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { 2393 if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
2194 nsp->smk_inode = skp->smk_known; 2394 nsp->smk_inode = skp;
2195 nsp->smk_flags |= SMK_INODE_INSTANT; 2395 nsp->smk_flags |= SMK_INODE_INSTANT;
2196 return 0; 2396 return 0;
2197 } 2397 }
@@ -2333,7 +2533,7 @@ static int smack_msg_msg_alloc_security(struct msg_msg *msg)
2333{ 2533{
2334 struct smack_known *skp = smk_of_current(); 2534 struct smack_known *skp = smk_of_current();
2335 2535
2336 msg->security = skp->smk_known; 2536 msg->security = skp;
2337 return 0; 2537 return 0;
2338} 2538}
2339 2539
@@ -2354,9 +2554,9 @@ static void smack_msg_msg_free_security(struct msg_msg *msg)
2354 * 2554 *
2355 * Returns a pointer to the smack value 2555 * Returns a pointer to the smack value
2356 */ 2556 */
2357static char *smack_of_shm(struct shmid_kernel *shp) 2557static struct smack_known *smack_of_shm(struct shmid_kernel *shp)
2358{ 2558{
2359 return (char *)shp->shm_perm.security; 2559 return (struct smack_known *)shp->shm_perm.security;
2360} 2560}
2361 2561
2362/** 2562/**
@@ -2370,7 +2570,7 @@ static int smack_shm_alloc_security(struct shmid_kernel *shp)
2370 struct kern_ipc_perm *isp = &shp->shm_perm; 2570 struct kern_ipc_perm *isp = &shp->shm_perm;
2371 struct smack_known *skp = smk_of_current(); 2571 struct smack_known *skp = smk_of_current();
2372 2572
2373 isp->security = skp->smk_known; 2573 isp->security = skp;
2374 return 0; 2574 return 0;
2375} 2575}
2376 2576
@@ -2396,14 +2596,17 @@ static void smack_shm_free_security(struct shmid_kernel *shp)
2396 */ 2596 */
2397static int smk_curacc_shm(struct shmid_kernel *shp, int access) 2597static int smk_curacc_shm(struct shmid_kernel *shp, int access)
2398{ 2598{
2399 char *ssp = smack_of_shm(shp); 2599 struct smack_known *ssp = smack_of_shm(shp);
2400 struct smk_audit_info ad; 2600 struct smk_audit_info ad;
2601 int rc;
2401 2602
2402#ifdef CONFIG_AUDIT 2603#ifdef CONFIG_AUDIT
2403 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2604 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2404 ad.a.u.ipc_id = shp->shm_perm.id; 2605 ad.a.u.ipc_id = shp->shm_perm.id;
2405#endif 2606#endif
2406 return smk_curacc(ssp, access, &ad); 2607 rc = smk_curacc(ssp, access, &ad);
2608 rc = smk_bu_current("shm", ssp, access, rc);
2609 return rc;
2407} 2610}
2408 2611
2409/** 2612/**
@@ -2478,9 +2681,9 @@ static int smack_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr,
2478 * 2681 *
2479 * Returns a pointer to the smack value 2682 * Returns a pointer to the smack value
2480 */ 2683 */
2481static char *smack_of_sem(struct sem_array *sma) 2684static struct smack_known *smack_of_sem(struct sem_array *sma)
2482{ 2685{
2483 return (char *)sma->sem_perm.security; 2686 return (struct smack_known *)sma->sem_perm.security;
2484} 2687}
2485 2688
2486/** 2689/**
@@ -2494,7 +2697,7 @@ static int smack_sem_alloc_security(struct sem_array *sma)
2494 struct kern_ipc_perm *isp = &sma->sem_perm; 2697 struct kern_ipc_perm *isp = &sma->sem_perm;
2495 struct smack_known *skp = smk_of_current(); 2698 struct smack_known *skp = smk_of_current();
2496 2699
2497 isp->security = skp->smk_known; 2700 isp->security = skp;
2498 return 0; 2701 return 0;
2499} 2702}
2500 2703
@@ -2520,14 +2723,17 @@ static void smack_sem_free_security(struct sem_array *sma)
2520 */ 2723 */
2521static int smk_curacc_sem(struct sem_array *sma, int access) 2724static int smk_curacc_sem(struct sem_array *sma, int access)
2522{ 2725{
2523 char *ssp = smack_of_sem(sma); 2726 struct smack_known *ssp = smack_of_sem(sma);
2524 struct smk_audit_info ad; 2727 struct smk_audit_info ad;
2728 int rc;
2525 2729
2526#ifdef CONFIG_AUDIT 2730#ifdef CONFIG_AUDIT
2527 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2731 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2528 ad.a.u.ipc_id = sma->sem_perm.id; 2732 ad.a.u.ipc_id = sma->sem_perm.id;
2529#endif 2733#endif
2530 return smk_curacc(ssp, access, &ad); 2734 rc = smk_curacc(ssp, access, &ad);
2735 rc = smk_bu_current("sem", ssp, access, rc);
2736 return rc;
2531} 2737}
2532 2738
2533/** 2739/**
@@ -2613,7 +2819,7 @@ static int smack_msg_queue_alloc_security(struct msg_queue *msq)
2613 struct kern_ipc_perm *kisp = &msq->q_perm; 2819 struct kern_ipc_perm *kisp = &msq->q_perm;
2614 struct smack_known *skp = smk_of_current(); 2820 struct smack_known *skp = smk_of_current();
2615 2821
2616 kisp->security = skp->smk_known; 2822 kisp->security = skp;
2617 return 0; 2823 return 0;
2618} 2824}
2619 2825
@@ -2634,11 +2840,11 @@ static void smack_msg_queue_free_security(struct msg_queue *msq)
2634 * smack_of_msq - the smack pointer for the msq 2840 * smack_of_msq - the smack pointer for the msq
2635 * @msq: the object 2841 * @msq: the object
2636 * 2842 *
2637 * Returns a pointer to the smack value 2843 * Returns a pointer to the smack label entry
2638 */ 2844 */
2639static char *smack_of_msq(struct msg_queue *msq) 2845static struct smack_known *smack_of_msq(struct msg_queue *msq)
2640{ 2846{
2641 return (char *)msq->q_perm.security; 2847 return (struct smack_known *)msq->q_perm.security;
2642} 2848}
2643 2849
2644/** 2850/**
@@ -2650,14 +2856,17 @@ static char *smack_of_msq(struct msg_queue *msq)
2650 */ 2856 */
2651static int smk_curacc_msq(struct msg_queue *msq, int access) 2857static int smk_curacc_msq(struct msg_queue *msq, int access)
2652{ 2858{
2653 char *msp = smack_of_msq(msq); 2859 struct smack_known *msp = smack_of_msq(msq);
2654 struct smk_audit_info ad; 2860 struct smk_audit_info ad;
2861 int rc;
2655 2862
2656#ifdef CONFIG_AUDIT 2863#ifdef CONFIG_AUDIT
2657 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2864 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2658 ad.a.u.ipc_id = msq->q_perm.id; 2865 ad.a.u.ipc_id = msq->q_perm.id;
2659#endif 2866#endif
2660 return smk_curacc(msp, access, &ad); 2867 rc = smk_curacc(msp, access, &ad);
2868 rc = smk_bu_current("msq", msp, access, rc);
2869 return rc;
2661} 2870}
2662 2871
2663/** 2872/**
@@ -2750,15 +2959,18 @@ static int smack_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
2750 */ 2959 */
2751static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) 2960static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
2752{ 2961{
2753 char *isp = ipp->security; 2962 struct smack_known *iskp = ipp->security;
2754 int may = smack_flags_to_may(flag); 2963 int may = smack_flags_to_may(flag);
2755 struct smk_audit_info ad; 2964 struct smk_audit_info ad;
2965 int rc;
2756 2966
2757#ifdef CONFIG_AUDIT 2967#ifdef CONFIG_AUDIT
2758 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC); 2968 smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_IPC);
2759 ad.a.u.ipc_id = ipp->id; 2969 ad.a.u.ipc_id = ipp->id;
2760#endif 2970#endif
2761 return smk_curacc(isp, may, &ad); 2971 rc = smk_curacc(iskp, may, &ad);
2972 rc = smk_bu_current("svipc", iskp, may, rc);
2973 return rc;
2762} 2974}
2763 2975
2764/** 2976/**
@@ -2768,9 +2980,9 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
2768 */ 2980 */
2769static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid) 2981static void smack_ipc_getsecid(struct kern_ipc_perm *ipp, u32 *secid)
2770{ 2982{
2771 char *smack = ipp->security; 2983 struct smack_known *iskp = ipp->security;
2772 2984
2773 *secid = smack_to_secid(smack); 2985 *secid = iskp->smk_secid;
2774} 2986}
2775 2987
2776/** 2988/**
@@ -2787,7 +2999,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2787 struct inode_smack *isp; 2999 struct inode_smack *isp;
2788 struct smack_known *skp; 3000 struct smack_known *skp;
2789 struct smack_known *ckp = smk_of_current(); 3001 struct smack_known *ckp = smk_of_current();
2790 char *final; 3002 struct smack_known *final;
2791 char trattr[TRANS_TRUE_SIZE]; 3003 char trattr[TRANS_TRUE_SIZE];
2792 int transflag = 0; 3004 int transflag = 0;
2793 int rc; 3005 int rc;
@@ -2827,8 +3039,8 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2827 * so there's no opportunity to set the mount 3039 * so there's no opportunity to set the mount
2828 * options. 3040 * options.
2829 */ 3041 */
2830 sbsp->smk_root = smack_known_star.smk_known; 3042 sbsp->smk_root = &smack_known_star;
2831 sbsp->smk_default = smack_known_star.smk_known; 3043 sbsp->smk_default = &smack_known_star;
2832 } 3044 }
2833 isp->smk_inode = sbsp->smk_root; 3045 isp->smk_inode = sbsp->smk_root;
2834 isp->smk_flags |= SMK_INODE_INSTANT; 3046 isp->smk_flags |= SMK_INODE_INSTANT;
@@ -2858,7 +3070,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2858 * 3070 *
2859 * Cgroupfs is special 3071 * Cgroupfs is special
2860 */ 3072 */
2861 final = smack_known_star.smk_known; 3073 final = &smack_known_star;
2862 break; 3074 break;
2863 case DEVPTS_SUPER_MAGIC: 3075 case DEVPTS_SUPER_MAGIC:
2864 /* 3076 /*
@@ -2866,7 +3078,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2866 * Programs that change smack have to treat the 3078 * Programs that change smack have to treat the
2867 * pty with respect. 3079 * pty with respect.
2868 */ 3080 */
2869 final = ckp->smk_known; 3081 final = ckp;
2870 break; 3082 break;
2871 case PROC_SUPER_MAGIC: 3083 case PROC_SUPER_MAGIC:
2872 /* 3084 /*
@@ -2880,7 +3092,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2880 * but watch out, because they're volitile, 3092 * but watch out, because they're volitile,
2881 * getting recreated on every reboot. 3093 * getting recreated on every reboot.
2882 */ 3094 */
2883 final = smack_known_star.smk_known; 3095 final = &smack_known_star;
2884 /* 3096 /*
2885 * No break. 3097 * No break.
2886 * 3098 *
@@ -2899,7 +3111,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2899 * UNIX domain sockets use lower level socket data. 3111 * UNIX domain sockets use lower level socket data.
2900 */ 3112 */
2901 if (S_ISSOCK(inode->i_mode)) { 3113 if (S_ISSOCK(inode->i_mode)) {
2902 final = smack_known_star.smk_known; 3114 final = &smack_known_star;
2903 break; 3115 break;
2904 } 3116 }
2905 /* 3117 /*
@@ -2916,7 +3128,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2916 dp = dget(opt_dentry); 3128 dp = dget(opt_dentry);
2917 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp); 3129 skp = smk_fetch(XATTR_NAME_SMACK, inode, dp);
2918 if (skp != NULL) 3130 if (skp != NULL)
2919 final = skp->smk_known; 3131 final = skp;
2920 3132
2921 /* 3133 /*
2922 * Transmuting directory 3134 * Transmuting directory
@@ -2965,7 +3177,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
2965 } 3177 }
2966 3178
2967 if (final == NULL) 3179 if (final == NULL)
2968 isp->smk_inode = ckp->smk_known; 3180 isp->smk_inode = ckp;
2969 else 3181 else
2970 isp->smk_inode = final; 3182 isp->smk_inode = final;
2971 3183
@@ -3090,9 +3302,13 @@ static int smack_unix_stream_connect(struct sock *sock,
3090 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); 3302 smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net);
3091 smk_ad_setfield_u_net_sk(&ad, other); 3303 smk_ad_setfield_u_net_sk(&ad, other);
3092#endif 3304#endif
3093 rc = smk_access(skp, okp->smk_known, MAY_WRITE, &ad); 3305 rc = smk_access(skp, okp, MAY_WRITE, &ad);
3094 if (rc == 0) 3306 rc = smk_bu_note("UDS connect", skp, okp, MAY_WRITE, rc);
3095 rc = smk_access(okp, okp->smk_known, MAY_WRITE, NULL); 3307 if (rc == 0) {
3308 rc = smk_access(okp, skp, MAY_WRITE, NULL);
3309 rc = smk_bu_note("UDS connect", okp, skp,
3310 MAY_WRITE, rc);
3311 }
3096 } 3312 }
3097 3313
3098 /* 3314 /*
@@ -3118,8 +3334,8 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
3118{ 3334{
3119 struct socket_smack *ssp = sock->sk->sk_security; 3335 struct socket_smack *ssp = sock->sk->sk_security;
3120 struct socket_smack *osp = other->sk->sk_security; 3336 struct socket_smack *osp = other->sk->sk_security;
3121 struct smack_known *skp;
3122 struct smk_audit_info ad; 3337 struct smk_audit_info ad;
3338 int rc;
3123 3339
3124#ifdef CONFIG_AUDIT 3340#ifdef CONFIG_AUDIT
3125 struct lsm_network_audit net; 3341 struct lsm_network_audit net;
@@ -3131,8 +3347,9 @@ static int smack_unix_may_send(struct socket *sock, struct socket *other)
3131 if (smack_privileged(CAP_MAC_OVERRIDE)) 3347 if (smack_privileged(CAP_MAC_OVERRIDE))
3132 return 0; 3348 return 0;
3133 3349
3134 skp = ssp->smk_out; 3350 rc = smk_access(ssp->smk_out, osp->smk_in, MAY_WRITE, &ad);
3135 return smk_access(skp, osp->smk_in->smk_known, MAY_WRITE, &ad); 3351 rc = smk_bu_note("UDS send", ssp->smk_out, osp->smk_in, MAY_WRITE, rc);
3352 return rc;
3136} 3353}
3137 3354
3138/** 3355/**
@@ -3346,7 +3563,9 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3346 * This is the simplist possible security model 3563 * This is the simplist possible security model
3347 * for networking. 3564 * for networking.
3348 */ 3565 */
3349 rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad); 3566 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3567 rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in,
3568 MAY_WRITE, rc);
3350 if (rc != 0) 3569 if (rc != 0)
3351 netlbl_skbuff_err(skb, rc, 0); 3570 netlbl_skbuff_err(skb, rc, 0);
3352 break; 3571 break;
@@ -3489,7 +3708,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3489 struct netlbl_lsm_secattr secattr; 3708 struct netlbl_lsm_secattr secattr;
3490 struct sockaddr_in addr; 3709 struct sockaddr_in addr;
3491 struct iphdr *hdr; 3710 struct iphdr *hdr;
3492 char *hsp; 3711 struct smack_known *hskp;
3493 int rc; 3712 int rc;
3494 struct smk_audit_info ad; 3713 struct smk_audit_info ad;
3495#ifdef CONFIG_AUDIT 3714#ifdef CONFIG_AUDIT
@@ -3526,7 +3745,8 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3526 * Receiving a packet requires that the other end be able to write 3745 * Receiving a packet requires that the other end be able to write
3527 * here. Read access is not required. 3746 * here. Read access is not required.
3528 */ 3747 */
3529 rc = smk_access(skp, ssp->smk_in->smk_known, MAY_WRITE, &ad); 3748 rc = smk_access(skp, ssp->smk_in, MAY_WRITE, &ad);
3749 rc = smk_bu_note("IPv4 connect", skp, ssp->smk_in, MAY_WRITE, rc);
3530 if (rc != 0) 3750 if (rc != 0)
3531 return rc; 3751 return rc;
3532 3752
@@ -3544,10 +3764,10 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3544 hdr = ip_hdr(skb); 3764 hdr = ip_hdr(skb);
3545 addr.sin_addr.s_addr = hdr->saddr; 3765 addr.sin_addr.s_addr = hdr->saddr;
3546 rcu_read_lock(); 3766 rcu_read_lock();
3547 hsp = smack_host_label(&addr); 3767 hskp = smack_host_label(&addr);
3548 rcu_read_unlock(); 3768 rcu_read_unlock();
3549 3769
3550 if (hsp == NULL) 3770 if (hskp == NULL)
3551 rc = netlbl_req_setattr(req, &skp->smk_netlabel); 3771 rc = netlbl_req_setattr(req, &skp->smk_netlabel);
3552 else 3772 else
3553 netlbl_req_delattr(req); 3773 netlbl_req_delattr(req);
@@ -3599,7 +3819,7 @@ static int smack_key_alloc(struct key *key, const struct cred *cred,
3599{ 3819{
3600 struct smack_known *skp = smk_of_task(cred->security); 3820 struct smack_known *skp = smk_of_task(cred->security);
3601 3821
3602 key->security = skp->smk_known; 3822 key->security = skp;
3603 return 0; 3823 return 0;
3604} 3824}
3605 3825
@@ -3630,6 +3850,7 @@ static int smack_key_permission(key_ref_t key_ref,
3630 struct smk_audit_info ad; 3850 struct smk_audit_info ad;
3631 struct smack_known *tkp = smk_of_task(cred->security); 3851 struct smack_known *tkp = smk_of_task(cred->security);
3632 int request = 0; 3852 int request = 0;
3853 int rc;
3633 3854
3634 keyp = key_ref_to_ptr(key_ref); 3855 keyp = key_ref_to_ptr(key_ref);
3635 if (keyp == NULL) 3856 if (keyp == NULL)
@@ -3654,7 +3875,9 @@ static int smack_key_permission(key_ref_t key_ref,
3654 request = MAY_READ; 3875 request = MAY_READ;
3655 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR)) 3876 if (perm & (KEY_NEED_WRITE | KEY_NEED_LINK | KEY_NEED_SETATTR))
3656 request = MAY_WRITE; 3877 request = MAY_WRITE;
3657 return smk_access(tkp, keyp->security, request, &ad); 3878 rc = smk_access(tkp, keyp->security, request, &ad);
3879 rc = smk_bu_note("key access", tkp, keyp->security, request, rc);
3880 return rc;
3658} 3881}
3659#endif /* CONFIG_KEYS */ 3882#endif /* CONFIG_KEYS */
3660 3883
@@ -3685,6 +3908,7 @@ static int smack_key_permission(key_ref_t key_ref,
3685 */ 3908 */
3686static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) 3909static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3687{ 3910{
3911 struct smack_known *skp;
3688 char **rule = (char **)vrule; 3912 char **rule = (char **)vrule;
3689 *rule = NULL; 3913 *rule = NULL;
3690 3914
@@ -3694,7 +3918,9 @@ static int smack_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule)
3694 if (op != Audit_equal && op != Audit_not_equal) 3918 if (op != Audit_equal && op != Audit_not_equal)
3695 return -EINVAL; 3919 return -EINVAL;
3696 3920
3697 *rule = smk_import(rulestr, 0); 3921 skp = smk_import_entry(rulestr, 0);
3922 if (skp)
3923 *rule = skp->smk_known;
3698 3924
3699 return 0; 3925 return 0;
3700} 3926}
@@ -3813,7 +4039,12 @@ static int smack_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
3813 */ 4039 */
3814static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 4040static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
3815{ 4041{
3816 *secid = smack_to_secid(secdata); 4042 struct smack_known *skp = smk_find_entry(secdata);
4043
4044 if (skp)
4045 *secid = skp->smk_secid;
4046 else
4047 *secid = 0;
3817 return 0; 4048 return 0;
3818} 4049}
3819 4050
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 3c720ff10591..bce4e8f1b267 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -131,14 +131,17 @@ LIST_HEAD(smack_rule_list);
131 131
132struct smack_parsed_rule { 132struct smack_parsed_rule {
133 struct smack_known *smk_subject; 133 struct smack_known *smk_subject;
134 char *smk_object; 134 struct smack_known *smk_object;
135 int smk_access1; 135 int smk_access1;
136 int smk_access2; 136 int smk_access2;
137}; 137};
138 138
139static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT; 139static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
140 140
141const char *smack_cipso_option = SMACK_CIPSO_OPTION; 141struct smack_known smack_cipso_option = {
142 .smk_known = SMACK_CIPSO_OPTION,
143 .smk_secid = 0,
144};
142 145
143/* 146/*
144 * Values for parsing cipso rules 147 * Values for parsing cipso rules
@@ -304,6 +307,10 @@ static int smk_perm_from_str(const char *string)
304 case 'L': 307 case 'L':
305 perm |= MAY_LOCK; 308 perm |= MAY_LOCK;
306 break; 309 break;
310 case 'b':
311 case 'B':
312 perm |= MAY_BRINGUP;
313 break;
307 default: 314 default:
308 return perm; 315 return perm;
309 } 316 }
@@ -335,7 +342,7 @@ static int smk_fill_rule(const char *subject, const char *object,
335 if (rule->smk_subject == NULL) 342 if (rule->smk_subject == NULL)
336 return -EINVAL; 343 return -EINVAL;
337 344
338 rule->smk_object = smk_import(object, len); 345 rule->smk_object = smk_import_entry(object, len);
339 if (rule->smk_object == NULL) 346 if (rule->smk_object == NULL)
340 return -EINVAL; 347 return -EINVAL;
341 } else { 348 } else {
@@ -355,7 +362,7 @@ static int smk_fill_rule(const char *subject, const char *object,
355 kfree(cp); 362 kfree(cp);
356 if (skp == NULL) 363 if (skp == NULL)
357 return -ENOENT; 364 return -ENOENT;
358 rule->smk_object = skp->smk_known; 365 rule->smk_object = skp;
359 } 366 }
360 367
361 rule->smk_access1 = smk_perm_from_str(access1); 368 rule->smk_access1 = smk_perm_from_str(access1);
@@ -594,13 +601,15 @@ static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
594 * anything you read back. 601 * anything you read back.
595 */ 602 */
596 if (strlen(srp->smk_subject->smk_known) >= max || 603 if (strlen(srp->smk_subject->smk_known) >= max ||
597 strlen(srp->smk_object) >= max) 604 strlen(srp->smk_object->smk_known) >= max)
598 return; 605 return;
599 606
600 if (srp->smk_access == 0) 607 if (srp->smk_access == 0)
601 return; 608 return;
602 609
603 seq_printf(s, "%s %s", srp->smk_subject->smk_known, srp->smk_object); 610 seq_printf(s, "%s %s",
611 srp->smk_subject->smk_known,
612 srp->smk_object->smk_known);
604 613
605 seq_putc(s, ' '); 614 seq_putc(s, ' ');
606 615
@@ -616,6 +625,8 @@ static void smk_rule_show(struct seq_file *s, struct smack_rule *srp, int max)
616 seq_putc(s, 't'); 625 seq_putc(s, 't');
617 if (srp->smk_access & MAY_LOCK) 626 if (srp->smk_access & MAY_LOCK)
618 seq_putc(s, 'l'); 627 seq_putc(s, 'l');
628 if (srp->smk_access & MAY_BRINGUP)
629 seq_putc(s, 'b');
619 630
620 seq_putc(s, '\n'); 631 seq_putc(s, '\n');
621} 632}
@@ -1067,7 +1078,7 @@ static int netlbladdr_seq_show(struct seq_file *s, void *v)
1067 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++); 1078 for (maskn = 0; temp_mask; temp_mask <<= 1, maskn++);
1068 1079
1069 seq_printf(s, "%u.%u.%u.%u/%d %s\n", 1080 seq_printf(s, "%u.%u.%u.%u/%d %s\n",
1070 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label); 1081 hp[0], hp[1], hp[2], hp[3], maskn, skp->smk_label->smk_known);
1071 1082
1072 return 0; 1083 return 0;
1073} 1084}
@@ -1147,10 +1158,10 @@ static void smk_netlbladdr_insert(struct smk_netlbladdr *new)
1147static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf, 1158static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1148 size_t count, loff_t *ppos) 1159 size_t count, loff_t *ppos)
1149{ 1160{
1150 struct smk_netlbladdr *skp; 1161 struct smk_netlbladdr *snp;
1151 struct sockaddr_in newname; 1162 struct sockaddr_in newname;
1152 char *smack; 1163 char *smack;
1153 char *sp; 1164 struct smack_known *skp;
1154 char *data; 1165 char *data;
1155 char *host = (char *)&newname.sin_addr.s_addr; 1166 char *host = (char *)&newname.sin_addr.s_addr;
1156 int rc; 1167 int rc;
@@ -1213,15 +1224,15 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1213 * If smack begins with '-', it is an option, don't import it 1224 * If smack begins with '-', it is an option, don't import it
1214 */ 1225 */
1215 if (smack[0] != '-') { 1226 if (smack[0] != '-') {
1216 sp = smk_import(smack, 0); 1227 skp = smk_import_entry(smack, 0);
1217 if (sp == NULL) { 1228 if (skp == NULL) {
1218 rc = -EINVAL; 1229 rc = -EINVAL;
1219 goto free_out; 1230 goto free_out;
1220 } 1231 }
1221 } else { 1232 } else {
1222 /* check known options */ 1233 /* check known options */
1223 if (strcmp(smack, smack_cipso_option) == 0) 1234 if (strcmp(smack, smack_cipso_option.smk_known) == 0)
1224 sp = (char *)smack_cipso_option; 1235 skp = &smack_cipso_option;
1225 else { 1236 else {
1226 rc = -EINVAL; 1237 rc = -EINVAL;
1227 goto free_out; 1238 goto free_out;
@@ -1244,9 +1255,9 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1244 nsa = newname.sin_addr.s_addr; 1255 nsa = newname.sin_addr.s_addr;
1245 /* try to find if the prefix is already in the list */ 1256 /* try to find if the prefix is already in the list */
1246 found = 0; 1257 found = 0;
1247 list_for_each_entry_rcu(skp, &smk_netlbladdr_list, list) { 1258 list_for_each_entry_rcu(snp, &smk_netlbladdr_list, list) {
1248 if (skp->smk_host.sin_addr.s_addr == nsa && 1259 if (snp->smk_host.sin_addr.s_addr == nsa &&
1249 skp->smk_mask.s_addr == mask.s_addr) { 1260 snp->smk_mask.s_addr == mask.s_addr) {
1250 found = 1; 1261 found = 1;
1251 break; 1262 break;
1252 } 1263 }
@@ -1254,26 +1265,26 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1254 smk_netlabel_audit_set(&audit_info); 1265 smk_netlabel_audit_set(&audit_info);
1255 1266
1256 if (found == 0) { 1267 if (found == 0) {
1257 skp = kzalloc(sizeof(*skp), GFP_KERNEL); 1268 snp = kzalloc(sizeof(*snp), GFP_KERNEL);
1258 if (skp == NULL) 1269 if (snp == NULL)
1259 rc = -ENOMEM; 1270 rc = -ENOMEM;
1260 else { 1271 else {
1261 rc = 0; 1272 rc = 0;
1262 skp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr; 1273 snp->smk_host.sin_addr.s_addr = newname.sin_addr.s_addr;
1263 skp->smk_mask.s_addr = mask.s_addr; 1274 snp->smk_mask.s_addr = mask.s_addr;
1264 skp->smk_label = sp; 1275 snp->smk_label = skp;
1265 smk_netlbladdr_insert(skp); 1276 smk_netlbladdr_insert(snp);
1266 } 1277 }
1267 } else { 1278 } else {
1268 /* we delete the unlabeled entry, only if the previous label 1279 /* we delete the unlabeled entry, only if the previous label
1269 * wasn't the special CIPSO option */ 1280 * wasn't the special CIPSO option */
1270 if (skp->smk_label != smack_cipso_option) 1281 if (snp->smk_label != &smack_cipso_option)
1271 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL, 1282 rc = netlbl_cfg_unlbl_static_del(&init_net, NULL,
1272 &skp->smk_host.sin_addr, &skp->smk_mask, 1283 &snp->smk_host.sin_addr, &snp->smk_mask,
1273 PF_INET, &audit_info); 1284 PF_INET, &audit_info);
1274 else 1285 else
1275 rc = 0; 1286 rc = 0;
1276 skp->smk_label = sp; 1287 snp->smk_label = skp;
1277 } 1288 }
1278 1289
1279 /* 1290 /*
@@ -1281,10 +1292,10 @@ static ssize_t smk_write_netlbladdr(struct file *file, const char __user *buf,
1281 * this host so that incoming packets get labeled. 1292 * this host so that incoming packets get labeled.
1282 * but only if we didn't get the special CIPSO option 1293 * but only if we didn't get the special CIPSO option
1283 */ 1294 */
1284 if (rc == 0 && sp != smack_cipso_option) 1295 if (rc == 0 && skp != &smack_cipso_option)
1285 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL, 1296 rc = netlbl_cfg_unlbl_static_add(&init_net, NULL,
1286 &skp->smk_host.sin_addr, &skp->smk_mask, PF_INET, 1297 &snp->smk_host.sin_addr, &snp->smk_mask, PF_INET,
1287 smack_to_secid(skp->smk_label), &audit_info); 1298 snp->smk_label->smk_secid, &audit_info);
1288 1299
1289 if (rc == 0) 1300 if (rc == 0)
1290 rc = count; 1301 rc = count;
@@ -1677,7 +1688,7 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
1677 if (smack_onlycap != NULL && smack_onlycap != skp) 1688 if (smack_onlycap != NULL && smack_onlycap != skp)
1678 return -EPERM; 1689 return -EPERM;
1679 1690
1680 data = kzalloc(count, GFP_KERNEL); 1691 data = kzalloc(count + 1, GFP_KERNEL);
1681 if (data == NULL) 1692 if (data == NULL)
1682 return -ENOMEM; 1693 return -ENOMEM;
1683 1694
@@ -1880,7 +1891,10 @@ static ssize_t smk_user_access(struct file *file, const char __user *buf,
1880 else if (res != -ENOENT) 1891 else if (res != -ENOENT)
1881 return -EINVAL; 1892 return -EINVAL;
1882 1893
1883 data[0] = res == 0 ? '1' : '0'; 1894 /*
1895 * smk_access() can return a value > 0 in the "bringup" case.
1896 */
1897 data[0] = res >= 0 ? '1' : '0';
1884 data[1] = '\0'; 1898 data[1] = '\0';
1885 1899
1886 simple_transaction_set(file, 2); 1900 simple_transaction_set(file, 2);
@@ -2228,7 +2242,7 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
2228 if (!smack_privileged(CAP_MAC_ADMIN)) 2242 if (!smack_privileged(CAP_MAC_ADMIN))
2229 return -EPERM; 2243 return -EPERM;
2230 2244
2231 data = kzalloc(count, GFP_KERNEL); 2245 data = kzalloc(count + 1, GFP_KERNEL);
2232 if (data == NULL) 2246 if (data == NULL)
2233 return -ENOMEM; 2247 return -ENOMEM;
2234 2248
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-05 19:35:17 -0400