1 /*
2 * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, version 2.
7 *
8 * Authors:
9 * Casey Schaufler <casey@schaufler-ca.com>
10 * Ahmed S. Darwish <darwish.07@gmail.com>
11 *
12 * Special thanks to the authors of selinuxfs.
13 *
14 * Karl MacMillan <kmacmillan@tresys.com>
15 * James Morris <jmorris@redhat.com>
16 *
17 */
18
19 #include <linux/kernel.h>
20 #include <linux/vmalloc.h>
21 #include <linux/security.h>
22 #include <linux/mutex.h>
23 #include <net/netlabel.h>
24 #include <net/cipso_ipv4.h>
25 #include <linux/seq_file.h>
26 #include <linux/ctype.h>
27 #include <linux/audit.h>
28 #include "smack.h"
29
30 /*
31 * smackfs pseudo filesystem.
32 */
33
34 enum smk_inos {
35 SMK_ROOT_INO = 2,
36 SMK_LOAD = 3, /* load policy */
37 SMK_CIPSO = 4, /* load label -> CIPSO mapping */
38 SMK_DOI = 5, /* CIPSO DOI */
39 SMK_DIRECT = 6, /* CIPSO level indicating direct label */
40 SMK_AMBIENT = 7, /* internet ambient label */
41 SMK_NLTYPE = 8, /* label scheme to use by default */
42 };
43
44 /*
45 * List locks
46 */
47 static DEFINE_MUTEX(smack_list_lock);
48 static DEFINE_MUTEX(smack_cipso_lock);
49 static DEFINE_MUTEX(smack_ambient_lock);
50
51 /*
52 * This is the "ambient" label for network traffic.
53 * If it isn't somehow marked, use this.
54 * It can be reset via smackfs/ambient
55 */
56 char *smack_net_ambient = smack_known_floor.smk_known;
57
58 /*
59 * This is the default packet marking scheme for network traffic.
60 * It can be reset via smackfs/nltype
61 */
62 int smack_net_nltype = NETLBL_NLTYPE_CIPSOV4;
63
64 /*
65 * This is the level in a CIPSO header that indicates a
66 * smack label is contained directly in the category set.
67 * It can be reset via smackfs/direct
68 */
69 int smack_cipso_direct = SMACK_CIPSO_DIRECT_DEFAULT;
70
71 static int smk_cipso_doi_value = SMACK_CIPSO_DOI_DEFAULT;
72 struct smk_list_entry *smack_list;
73
74 #define SEQ_READ_FINISHED 1
75
76 /*
77 * Values for parsing cipso rules
78 * SMK_DIGITLEN: Length of a digit field in a rule.
79 * SMK_CIPSOMIN: Minimum possible cipso rule length.
80 * SMK_CIPSOMAX: Maximum possible cipso rule length.
81 */
82 #define SMK_DIGITLEN 4
83 #define SMK_CIPSOMIN (SMK_LABELLEN + 2 * SMK_DIGITLEN)
84 #define SMK_CIPSOMAX (SMK_CIPSOMIN + SMACK_CIPSO_MAXCATNUM * SMK_DIGITLEN)
85
86 /*
87 * Values for parsing MAC rules
88 * SMK_ACCESS: Maximum possible combination of access permissions
89 * SMK_ACCESSLEN: Maximum length for a rule access field
90 * SMK_LOADLEN: Smack rule length
91 */
92 #define SMK_ACCESS "rwxa"
93 #define SMK_ACCESSLEN (sizeof(SMK_ACCESS) - 1)
94 #define SMK_LOADLEN (SMK_LABELLEN + SMK_LABELLEN + SMK_ACCESSLEN)
95
96
97 /*
98 * Seq_file read operations for /smack/load
99 */
100
101 static void *load_seq_start(struct seq_file *s, loff_t *pos)
102 {
103 if (*pos == SEQ_READ_FINISHED)
104 return NULL;
105
106 return smack_list;
107 }
108
109 static void *load_seq_next(struct seq_file *s, void *v, loff_t *pos)
110 {
111 struct smk_list_entry *skp = ((struct smk_list_entry *) v)->smk_next;
112
113 if (skp == NULL)
114 *pos = SEQ_READ_FINISHED;
115
116 return skp;
117 }
118
119 static int load_seq_show(struct seq_file *s, void *v)
120 {
121 struct smk_list_entry *slp = (struct smk_list_entry *) v;
122 struct smack_rule *srp = &slp->smk_rule;
123
124 seq_printf(s, "%s %s", (char *)srp->smk_subject,
125 (char *)srp->smk_object);
126
127 seq_putc(s, ' ');
128
129 if (srp->smk_access & MAY_READ)
130 seq_putc(s, 'r');
131 if (srp->smk_access & MAY_WRITE)
132 seq_putc(s, 'w');
133 if (srp->smk_access & MAY_EXEC)
134 seq_putc(s, 'x');
135 if (srp->smk_access & MAY_APPEND)
136 seq_putc(s, 'a');
137 if (srp->smk_access == 0)
138 seq_putc(s, '-');
139
140 seq_putc(s, '\n');
141
142 return 0;
143 }
144
145 static void load_seq_stop(struct seq_file *s, void *v)
146 {
147 /* No-op */
148 }
149
150 static struct seq_operations load_seq_ops = {
151 .start = load_seq_start,
152 .next = load_seq_next,
153 .show = load_seq_show,
154 .stop = load_seq_stop,
155 };
156
157 /**
158 * smk_open_load - open() for /smack/load
159 * @inode: inode structure representing file
160 * @file: "load" file pointer
161 *
162 * For reading, use load_seq_* seq_file reading operations.
163 */
164 static int smk_open_load(struct inode *inode, struct file *file)
165 {
166 return seq_open(file, &load_seq_ops);
167 }
168
169 /**
170 * smk_set_access - add a rule to the rule list
171 * @srp: the new rule to add
172 *
173 * Looks through the current subject/object/access list for
174 * the subject/object pair and replaces the access that was
175 * there. If the pair isn't found add it with the specified
176 * access.
177 */
178 static void smk_set_access(struct smack_rule *srp)
179 {
180 struct smk_list_entry *sp;
181 struct smk_list_entry *newp;
182
183 mutex_lock(&smack_list_lock);
184
185 for (sp = smack_list; sp != NULL; sp = sp->smk_next)
186 if (sp->smk_rule.smk_subject == srp->smk_subject &&
187 sp->smk_rule.smk_object == srp->smk_object) {
188 sp->smk_rule.smk_access = srp->smk_access;
189 break;
190 }
191
192 if (sp == NULL) {
193 newp = kzalloc(sizeof(struct smk_list_entry), GFP_KERNEL);
194 newp->smk_rule = *srp;
195 newp->smk_next = smack_list;
196 smack_list = newp;
197 }
198
199 mutex_unlock(&smack_list_lock);
200
201 return;
202 }
203
204 /**
205 * smk_write_load - write() for /smack/load
206 * @filp: file pointer, not actually used
207 * @buf: where to get the data from
208 * @count: bytes sent
209 * @ppos: where to start - must be 0
210 *
211 * Get one smack access rule from above.
212 * The format is exactly:
213 * char subject[SMK_LABELLEN]
214 * char object[SMK_LABELLEN]
215 * char access[SMK_ACCESSLEN]
216 *
217 * writes must be SMK_LABELLEN+SMK_LABELLEN+SMK_ACCESSLEN bytes.
218 */
219 static ssize_t smk_write_load(struct file *file, const char __user *buf,
220 size_t count, loff_t *ppos)
221 {
222 struct smack_rule rule;
223 char *data;
224 int rc = -EINVAL;
225
226 /*
227 * Must have privilege.
228 * No partial writes.
229 * Enough data must be present.
230 */
231 if (!capable(CAP_MAC_ADMIN))
232 return -EPERM;
233 if (*ppos != 0)
234 return -EINVAL;
235 if (count != SMK_LOADLEN)
236 return -EINVAL;
237
238 data = kzalloc(count, GFP_KERNEL);
239 if (data == NULL)
240 return -ENOMEM;
241
242 if (copy_from_user(data, buf, count) != 0) {
243 rc = -EFAULT;
244 goto out;
245 }
246
247 rule.smk_subject = smk_import(data, 0);
248 if (rule.smk_subject == NULL)
249 goto out;
250
251 rule.smk_object = smk_import(data + SMK_LABELLEN, 0);
252 if (rule.smk_object == NULL)
253 goto out;
254
255 rule.smk_access = 0;
256
257 switch (data[SMK_LABELLEN + SMK_LABELLEN]) {
258 case '-':
259 break;
260 case 'r':
261 case 'R':
262 rule.smk_access |= MAY_READ;
263 break;
264 default:
265 goto out;
266 }
267
268 switch (data[SMK_LABELLEN + SMK_LABELLEN + 1]) {
269 case '-':
270 break;
271 case 'w':
272 case 'W':
273 rule.smk_access |= MAY_WRITE;
274 break;
275 default:
276 goto out;
277 }
278
279 switch (data[SMK_LABELLEN + SMK_LABELLEN + 2]) {
280 case '-':
281 break;
282 case 'x':
283 case 'X':
284 rule.smk_access |= MAY_EXEC;
285 break;
286 default:
287 goto out;
288 }
289
290 switch (data[SMK_LABELLEN + SMK_LABELLEN + 3]) {
291 case '-':
292 break;
293 case 'a':
294 case 'A':
295 rule.smk_access |= MAY_READ;
296 break;
297 default:
298 goto out;
299 }
300
301 smk_set_access(&rule);
302 rc = count;
303
304 out:
305 kfree(data);
306 return rc;
307 }
308
309 static const struct file_operations smk_load_ops = {
310 .open = smk_open_load,
311 .read = seq_read,
312 .llseek = seq_lseek,
313 .write = smk_write_load,
314 .release = seq_release,
315 };
316
317 /**
318 * smk_cipso_doi - initialize the CIPSO domain
319 */
320 void smk_cipso_doi(void)
321 {
322 int rc;
323 struct cipso_v4_doi *doip;
324 struct netlbl_audit audit_info;
325
326 audit_info.loginuid = audit_get_loginuid(current);
327 audit_info.secid = smack_to_secid(current->security);
328
329 rc = netlbl_cfg_map_del(NULL, &audit_info);
330 if (rc != 0)
331 printk(KERN_WARNING "%s:%d remove rc = %d\n",
332 __func__, __LINE__, rc);
333
334 doip = kmalloc(sizeof(struct cipso_v4_doi), GFP_KERNEL);
335 if (doip == NULL)
336 panic("smack: Failed to initialize cipso DOI.\n");
337 doip->map.std = NULL;
338 doip->doi = smk_cipso_doi_value;
339 doip->type = CIPSO_V4_MAP_PASS;
340 doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
341 for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
342 doip->tags[rc] = CIPSO_V4_TAG_INVALID;
343
344 rc = netlbl_cfg_cipsov4_add_map(doip, NULL, &audit_info);
345 if (rc != 0)
346 printk(KERN_WARNING "%s:%d add rc = %d\n",
347 __func__, __LINE__, rc);
348 }
349
350 /**
351 * smk_unlbl_ambient - initialize the unlabeled domain
352 */
353 void smk_unlbl_ambient(char *oldambient)
354 {
355 int rc;
356 struct netlbl_audit audit_info;
357
358 audit_info.loginuid = audit_get_loginuid(current);
359 audit_info.secid = smack_to_secid(current->security);
360
361 if (oldambient != NULL) {
362 rc = netlbl_cfg_map_del(oldambient, &audit_info);
363 if (rc != 0)
364 printk(KERN_WARNING "%s:%d remove rc = %d\n",
365 __func__, __LINE__, rc);
366 }
367
368 rc = netlbl_cfg_unlbl_add_map(smack_net_ambient, &audit_info);
369 if (rc != 0)
370 printk(KERN_WARNING "%s:%d add rc = %d\n",
371 __func__, __LINE__, rc);
372 }
373
374 /*
375 * Seq_file read operations for /smack/cipso
376 */
377
378 static void *cipso_seq_start(struct seq_file *s, loff_t *pos)
379 {
380 if (*pos == SEQ_READ_FINISHED)
381 return NULL;
382
383 return smack_known;
384 }
385
386 static void *cipso_seq_next(struct seq_file *s, void *v, loff_t *pos)
387 {
388 struct smack_known *skp = ((struct smack_known *) v)->smk_next;
389
390 /*
391 * Omit labels with no associated cipso value
392 */
393 while (skp != NULL && !skp->smk_cipso)
394 skp = skp->smk_next;
395
396 if (skp == NULL)
397 *pos = SEQ_READ_FINISHED;
398
399 return skp;
400 }
401
402 /*
403 * Print cipso labels in format:
404 * label level[/cat[,cat]]
405 */
406 static int cipso_seq_show(struct seq_file *s, void *v)
407 {
408 struct smack_known *skp = (struct smack_known *) v;
409 struct smack_cipso *scp = skp->smk_cipso;
410 char *cbp;
411 char sep = '/';
412 int cat = 1;
413 int i;
414 unsigned char m;
415
416 if (scp == NULL)
417 return 0;
418
419 seq_printf(s, "%s %3d", (char *)&skp->smk_known, scp->smk_level);
420
421 cbp = scp->smk_catset;
422 for (i = 0; i < SMK_LABELLEN; i++)
423 for (m = 0x80; m != 0; m >>= 1) {
424 if (m & cbp[i]) {
425 seq_printf(s, "%c%d", sep, cat);
426 sep = ',';
427 }
428 cat++;
429 }
430
431 seq_putc(s, '\n');
432
433 return 0;
434 }
435
436 static void cipso_seq_stop(struct seq_file *s, void *v)
437 {
438 /* No-op */
439 }
440
441 static struct seq_operations cipso_seq_ops = {
442 .start = cipso_seq_start,
443 .stop = cipso_seq_stop,
444 .next = cipso_seq_next,
445 .show = cipso_seq_show,
446 };
447
448 /**
449 * smk_open_cipso - open() for /smack/cipso
450 * @inode: inode structure representing file
451 * @file: "cipso" file pointer
452 *
453 * Connect our cipso_seq_* operations with /smack/cipso
454 * file_operations
455 */
456 static int smk_open_cipso(struct inode *inode, struct file *file)
457 {
458 return seq_open(file, &cipso_seq_ops);
459 }
460
461 /**
462 * smk_write_cipso - write() for /smack/cipso
463 * @filp: file pointer, not actually used
464 * @buf: where to get the data from
465 * @count: bytes sent
466 * @ppos: where to start
467 *
468 * Accepts only one cipso rule per write call.
469 * Returns number of bytes written or error code, as appropriate
470 */
471 static ssize_t smk_write_cipso(struct file *file, const char __user *buf,
472 size_t count, loff_t *ppos)
473 {
474 struct smack_known *skp;
475 struct smack_cipso *scp = NULL;
476 char mapcatset[SMK_LABELLEN];
477 int maplevel;
478 int cat;
479 int catlen;
480 ssize_t rc = -EINVAL;
481 char *data = NULL;
482 char *rule;
483 int ret;
484 int i;
485
486 /*
487 * Must have privilege.
488 * No partial writes.
489 * Enough data must be present.
490 */
491 if (!capable(CAP_MAC_ADMIN))
492 return -EPERM;
493 if (*ppos != 0)
494 return -EINVAL;
495 if (count < SMK_CIPSOMIN || count > SMK_CIPSOMAX)
496 return -EINVAL;
497
498 data = kzalloc(count + 1, GFP_KERNEL);
499 if (data == NULL)
500 return -ENOMEM;
501
502 if (copy_from_user(data, buf, count) != 0) {
503 rc = -EFAULT;
504 goto unlockedout;
505 }
506
507 data[count] = '\0';
508 rule = data;
509 /*
510 * Only allow one writer at a time. Writes should be
511 * quite rare and small in any case.
512 */
513 mutex_lock(&smack_cipso_lock);
514
515 skp = smk_import_entry(rule, 0);
516 if (skp == NULL)
517 goto out;
518
519 rule += SMK_LABELLEN;;
520 ret = sscanf(rule, "%d", &maplevel);
521 if (ret != 1 || maplevel > SMACK_CIPSO_MAXLEVEL)
522 goto out;
523
524 rule += SMK_DIGITLEN;
525 ret = sscanf(rule, "%d", &catlen);
526 if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
527 goto out;
528
529 if (count != (SMK_CIPSOMIN + catlen * SMK_DIGITLEN))
530 goto out;
531
532 memset(mapcatset, 0, sizeof(mapcatset));
533
534 for (i = 0; i < catlen; i++) {
535 rule += SMK_DIGITLEN;
536 ret = sscanf(rule, "%d", &cat);
537 if (ret != 1 || cat > SMACK_CIPSO_MAXCATVAL)
538 goto out;
539
540 smack_catset_bit(cat, mapcatset);
541 }
542
543 if (skp->smk_cipso == NULL) {
544 scp = kzalloc(sizeof(struct smack_cipso), GFP_KERNEL);
545 if (scp == NULL) {
546 rc = -ENOMEM;
547 goto out;
548 }
549 }
550
551 spin_lock_bh(&skp->smk_cipsolock);
552
553 if (scp == NULL)
554 scp = skp->smk_cipso;
555 else
556 skp->smk_cipso = scp;
557
558 scp->smk_level = maplevel;
559 memcpy(scp->smk_catset, mapcatset, sizeof(mapcatset));
560
561 spin_unlock_bh(&skp->smk_cipsolock);
562
563 rc = count;
564 out:
565 mutex_unlock(&smack_cipso_lock);
566 unlockedout:
567 kfree(data);
568 return rc;
569 }
570
571 static const struct file_operations smk_cipso_ops = {
572 .open = smk_open_cipso,
573 .read = seq_read,
574 .llseek = seq_lseek,
575 .write = smk_write_cipso,
576 .release = seq_release,
577 };
578
579 /**
580 * smk_read_doi - read() for /smack/doi
581 * @filp: file pointer, not actually used
582 * @buf: where to put the result
583 * @count: maximum to send along
584 * @ppos: where to start
585 *
586 * Returns number of bytes read or error code, as appropriate
587 */
588 static ssize_t smk_read_doi(struct file *filp, char __user *buf,
589 size_t count, loff_t *ppos)
590 {
591 char temp[80];
592 ssize_t rc;
593
594 if (*ppos != 0)
595 return 0;
596
597 sprintf(temp, "%d", smk_cipso_doi_value);
598 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
599
600 return rc;
601 }
602
603 /**
604 * smk_write_doi - write() for /smack/doi
605 * @filp: file pointer, not actually used
606 * @buf: where to get the data from
607 * @count: bytes sent
608 * @ppos: where to start
609 *
610 * Returns number of bytes written or error code, as appropriate
611 */
612 static ssize_t smk_write_doi(struct file *file, const char __user *buf,
613 size_t count, loff_t *ppos)
614 {
615 char temp[80];
616 int i;
617
618 if (!capable(CAP_MAC_ADMIN))
619 return -EPERM;
620
621 if (count >= sizeof(temp) || count == 0)
622 return -EINVAL;
623
624 if (copy_from_user(temp, buf, count) != 0)
625 return -EFAULT;
626
627 temp[count] = '\0';
628
629 if (sscanf(temp, "%d", &i) != 1)
630 return -EINVAL;
631
632 smk_cipso_doi_value = i;
633
634 smk_cipso_doi();
635
636 return count;
637 }
638
639 static const struct file_operations smk_doi_ops = {
640 .read = smk_read_doi,
641 .write = smk_write_doi,
642 };
643
644 /**
645 * smk_read_direct - read() for /smack/direct
646 * @filp: file pointer, not actually used
647 * @buf: where to put the result
648 * @count: maximum to send along
649 * @ppos: where to start
650 *
651 * Returns number of bytes read or error code, as appropriate
652 */
653 static ssize_t smk_read_direct(struct file *filp, char __user *buf,
654 size_t count, loff_t *ppos)
655 {
656 char temp[80];
657 ssize_t rc;
658
659 if (*ppos != 0)
660 return 0;
661
662 sprintf(temp, "%d", smack_cipso_direct);
663 rc = simple_read_from_buffer(buf, count, ppos, temp, strlen(temp));
664
665 return rc;
666 }
667
668 /**
669 * smk_write_direct - write() for /smack/direct
670 * @filp: file pointer, not actually used
671 * @buf: where to get the data from
672 * @count: bytes sent
673 * @ppos: where to start
674 *
675 * Returns number of bytes written or error code, as appropriate
676 */
677 static ssize_t smk_write_direct(struct file *file, const char __user *buf,
678 size_t count, loff_t *ppos)
679 {
680 char temp[80];
681 int i;
682
683 if (!capable(CAP_MAC_ADMIN))
684 return -EPERM;
685
686 if (count >= sizeof(temp) || count == 0)
687 return -EINVAL;
688
689 if (copy_from_user(temp, buf, count) != 0)
690 return -EFAULT;
691
692 temp[count] = '\0';
693
694 if (sscanf(temp, "%d", &i) != 1)
695 return -EINVAL;
696
697 smack_cipso_direct = i;
698
699 return count;
700 }
701
702 static const struct file_operations smk_direct_ops = {
703 .read = smk_read_direct,
704 .write = smk_write_direct,
705 };
706
707 /**
708 * smk_read_ambient - read() for /smack/ambient
709 * @filp: file pointer, not actually used
710 * @buf: where to put the result
711 * @cn: maximum to send along
712 * @ppos: where to start
713 *
714 * Returns number of bytes read or error code, as appropriate
715 */
716 static ssize_t smk_read_ambient(struct file *filp, char __user *buf,
717 size_t cn, loff_t *ppos)
718 {
719 ssize_t rc;
720 int asize;
721
722 if (*ppos != 0)
723 return 0;
724 /*
725 * Being careful to avoid a problem in the case where
726 * smack_net_ambient gets changed in midstream.
727 */
728 mutex_lock(&smack_ambient_lock);
729
730 asize = strlen(smack_net_ambient) + 1;
731
732 if (cn >= asize)
733 rc = simple_read_from_buffer(buf, cn, ppos,
734 smack_net_ambient, asize);
735 else
736 rc = -EINVAL;
737
738 mutex_unlock(&smack_ambient_lock);
739
740 return rc;
741 }
742
743 /**
744 * smk_write_ambient - write() for /smack/ambient
745 * @filp: file pointer, not actually used
746 * @buf: where to get the data from
747 * @count: bytes sent
748 * @ppos: where to start
749 *
750 * Returns number of bytes written or error code, as appropriate
751 */
752 static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
753 size_t count, loff_t *ppos)
754 {
755 char in[SMK_LABELLEN];
756 char *oldambient;
757 char *smack;
758
759 if (!capable(CAP_MAC_ADMIN))
760 return -EPERM;
761
762 if (count >= SMK_LABELLEN)
763 return -EINVAL;
764
765 if (copy_from_user(in, buf, count) != 0)
766 return -EFAULT;
767
768 smack = smk_import(in, count);
769 if (smack == NULL)
770 return -EINVAL;
771
772 mutex_lock(&smack_ambient_lock);
773
774 oldambient = smack_net_ambient;
775 smack_net_ambient = smack;
776 smk_unlbl_ambient(oldambient);
777
778 mutex_unlock(&smack_ambient_lock);
779
780 return count;
781 }
782
783 static const struct file_operations smk_ambient_ops = {
784 .read = smk_read_ambient,
785 .write = smk_write_ambient,
786 };
787
788 struct option_names {
789 int o_number;
790 char *o_name;
791 char *o_alias;
792 };
793
794 static struct option_names netlbl_choices[] = {
795 { NETLBL_NLTYPE_RIPSO,
796 NETLBL_NLTYPE_RIPSO_NAME, "ripso" },
797 { NETLBL_NLTYPE_CIPSOV4,
798 NETLBL_NLTYPE_CIPSOV4_NAME, "cipsov4" },
799 { NETLBL_NLTYPE_CIPSOV4,
800 NETLBL_NLTYPE_CIPSOV4_NAME, "cipso" },
801 { NETLBL_NLTYPE_CIPSOV6,
802 NETLBL_NLTYPE_CIPSOV6_NAME, "cipsov6" },
803 { NETLBL_NLTYPE_UNLABELED,
804 NETLBL_NLTYPE_UNLABELED_NAME, "unlabeled" },
805 };
806
807 /**
808 * smk_read_nltype - read() for /smack/nltype
809 * @filp: file pointer, not actually used
810 * @buf: where to put the result
811 * @count: maximum to send along
812 * @ppos: where to start
813 *
814 * Returns number of bytes read or error code, as appropriate
815 */
816 static ssize_t smk_read_nltype(struct file *filp, char __user *buf,
817 size_t count, loff_t *ppos)
818 {
819 char bound[40];
820 ssize_t rc;
821 int i;
822
823 if (count < SMK_LABELLEN)
824 return -EINVAL;
825
826 if (*ppos != 0)
827 return 0;
828
829 sprintf(bound, "unknown");
830
831 for (i = 0; i < ARRAY_SIZE(netlbl_choices); i++)
832 if (smack_net_nltype == netlbl_choices[i].o_number) {
833 sprintf(bound, "%s", netlbl_choices[i].o_name);
834 break;
835 }
836
837 rc = simple_read_from_buffer(buf, count, ppos, bound, strlen(bound));
838
839 return rc;
840 }
841
842 /**
843 * smk_write_nltype - write() for /smack/nltype
844 * @filp: file pointer, not actually used
845 * @buf: where to get the data from
846 * @count: bytes sent
847 * @ppos: where to start
848 *
849 * Returns number of bytes written or error code, as appropriate
850 */
851 static ssize_t smk_write_nltype(struct file *file, const char __user *buf,
852 size_t count, loff_t *ppos)
853 {
854 char bound[40];
855 char *cp;
856 int i;
857
858 if (!capable(CAP_MAC_ADMIN))
859 return -EPERM;
860
861 if (count >= 40)
862 return -EINVAL;
863
864 if (copy_from_user(bound, buf, count) != 0)
865 return -EFAULT;
866
867 bound[count] = '\0';
868 cp = strchr(bound, ' ');
869 if (cp != NULL)
870 *cp = '\0';
871 cp = strchr(bound, '\n');
872 if (cp != NULL)
873 *cp = '\0';
874
875 for (i = 0; i < ARRAY_SIZE(netlbl_choices); i++)
876 if (strcmp(bound, netlbl_choices[i].o_name) == 0 ||
877 strcmp(bound, netlbl_choices[i].o_alias) == 0) {
878 smack_net_nltype = netlbl_choices[i].o_number;
879 return count;
880 }
881 /*
882 * Not a valid choice.
883 */
884 return -EINVAL;
885 }
886
887 static const struct file_operations smk_nltype_ops = {
888 .read = smk_read_nltype,
889 .write = smk_write_nltype,
890 };
891
892 /**
893 * smk_fill_super - fill the /smackfs superblock
894 * @sb: the empty superblock
895 * @data: unused
896 * @silent: unused
897 *
898 * Fill in the well known entries for /smack
899 *
900 * Returns 0 on success, an error code on failure
901 */
902 static int smk_fill_super(struct super_block *sb, void *data, int silent)
903 {
904 int rc;
905 struct inode *root_inode;
906
907 static struct tree_descr smack_files[] = {
908 [SMK_LOAD] =
909 {"load", &smk_load_ops, S_IRUGO|S_IWUSR},
910 [SMK_CIPSO] =
911 {"cipso", &smk_cipso_ops, S_IRUGO|S_IWUSR},
912 [SMK_DOI] =
913 {"doi", &smk_doi_ops, S_IRUGO|S_IWUSR},
914 [SMK_DIRECT] =
915 {"direct", &smk_direct_ops, S_IRUGO|S_IWUSR},
916 [SMK_AMBIENT] =
917 {"ambient", &smk_ambient_ops, S_IRUGO|S_IWUSR},
918 [SMK_NLTYPE] =
919 {"nltype", &smk_nltype_ops, S_IRUGO|S_IWUSR},
920 /* last one */ {""}
921 };
922
923 rc = simple_fill_super(sb, SMACK_MAGIC, smack_files);
924 if (rc != 0) {
925 printk(KERN_ERR "%s failed %d while creating inodes\n",
926 __func__, rc);
927 return rc;
928 }
929
930 root_inode = sb->s_root->d_inode;
931 root_inode->i_security = new_inode_smack(smack_known_floor.smk_known);
932
933 return 0;
934 }
935
936 /**
937 * smk_get_sb - get the smackfs superblock
938 * @fs_type: passed along without comment
939 * @flags: passed along without comment
940 * @dev_name: passed along without comment
941 * @data: passed along without comment
942 * @mnt: passed along without comment
943 *
944 * Just passes everything along.
945 *
946 * Returns what the lower level code does.
947 */
948 static int smk_get_sb(struct file_system_type *fs_type,
949 int flags, const char *dev_name, void *data,
950 struct vfsmount *mnt)
951 {
952 return get_sb_single(fs_type, flags, data, smk_fill_super, mnt);
953 }
954
955 static struct file_system_type smk_fs_type = {
956 .name = "smackfs",
957 .get_sb = smk_get_sb,
958 .kill_sb = kill_litter_super,
959 };
960
961 static struct vfsmount *smackfs_mount;
962
963 /**
964 * init_smk_fs - get the smackfs superblock
965 *
966 * register the smackfs
967 *
968 * Returns 0 unless the registration fails.
969 */
970 static int __init init_smk_fs(void)
971 {
972 int err;
973
974 err = register_filesystem(&smk_fs_type);
975 if (!err) {
976 smackfs_mount = kern_mount(&smk_fs_type);
977 if (IS_ERR(smackfs_mount)) {
978 printk(KERN_ERR "smackfs: could not mount!\n");
979 err = PTR_ERR(smackfs_mount);
980 smackfs_mount = NULL;
981 }
982 }
983
984 smk_cipso_doi();
985 smk_unlbl_ambient(NULL);
986
987 return err;
988 }
989
990 __initcall(init_smk_fs);
991
|
This page was automatically generated by the
LXR engine.
|