2 * This file is part of libsmack
4 * Copyright (C) 2010, 2011 Nokia Corporation
5 * Copyright (C) 2011, 2012, 2013 Intel Corporation
6 * Copyright (C) 2012, 2013 Samsung Electronics Co.
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public License
10 * version 2.1 as published by the Free Software Foundation.
12 * This library is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * Lesser General Public License for more details.
17 * You should have received a copy of the GNU Lesser General Public
18 * License along with this library; if not, write to the Free Software
19 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
23 #include "sys/smack.h"
29 #include <sys/socket.h>
31 #include <sys/types.h>
34 #include <sys/xattr.h>
37 #define LOAD_LEN (2 * (SMACK_LABEL_LEN + 1) + 2 * ACC_LEN + 1)
42 #define CAT_MAX_COUNT 240
43 #define CAT_MAX_VALUE 63
44 #define CIPSO_POS(i) (SMACK_LABEL_LEN + 1 + NUM_LEN + NUM_LEN + i * NUM_LEN)
45 #define CIPSO_MAX_SIZE CIPSO_POS(CAT_MAX_COUNT)
46 #define CIPSO_NUM_LEN_STR "%-4d"
48 #define KERNEL_LONG_FORMAT "%s %s %s"
49 #define KERNEL_SHORT_FORMAT "%-23s %-23s %5s"
50 #define KERNEL_MODIFY_FORMAT "%s %s %s %s"
51 #define READ_BUF_SIZE LOAD_LEN + 1
52 #define SELF_LABEL_FILE "/proc/self/attr/current"
53 #define ACC_CLEAR "-----"
55 extern char *smackfs_mnt;
58 char subject[SMACK_LABEL_LEN + 1];
59 char object[SMACK_LABEL_LEN + 1];
61 char access_type[ACC_LEN + 1];
62 char allow_access_type[ACC_LEN + 1];
63 char deny_access_type[ACC_LEN + 1];
64 struct smack_rule *next;
67 struct smack_accesses {
68 struct smack_rule *first;
69 struct smack_rule *last;
72 struct cipso_mapping {
73 char label[SMACK_LABEL_LEN + 1];
74 int cats[CAT_MAX_VALUE];
77 struct cipso_mapping *next;
81 struct cipso_mapping *first;
82 struct cipso_mapping *last;
85 static int accesses_apply(struct smack_accesses *handle, int clear);
86 static inline void parse_access_type(const char *in, char out[ACC_LEN + 1]);
87 static int smack_label_length(const char *label) __attribute__((unused));
89 int smack_accesses_new(struct smack_accesses **accesses)
91 struct smack_accesses *result;
93 result = calloc(sizeof(struct smack_accesses), 1);
101 void smack_accesses_free(struct smack_accesses *handle)
106 struct smack_rule *rule = handle->first;
107 struct smack_rule *next_rule = NULL;
109 while (rule != NULL) {
110 next_rule = rule->next;
118 int smack_accesses_save(struct smack_accesses *handle, int fd)
120 struct smack_rule *rule = handle->first;
129 file = fdopen(newfd, "w");
136 if (rule->is_modify) {
137 ret = fprintf(file, "%s %s %s %s\n",
138 rule->subject, rule->object,
139 rule->allow_access_type,
140 rule->deny_access_type);
142 ret = fprintf(file, "%s %s %s\n",
143 rule->subject, rule->object,
159 int smack_accesses_apply(struct smack_accesses *handle)
161 return accesses_apply(handle, 0);
164 int smack_accesses_clear(struct smack_accesses *handle)
166 return accesses_apply(handle, 1);
169 int smack_accesses_add(struct smack_accesses *handle, const char *subject,
170 const char *object, const char *access_type)
172 struct smack_rule *rule = NULL;
174 if (smack_label_length(subject) < 0 ||
175 smack_label_length(object) < 0)
178 rule = calloc(sizeof(struct smack_rule), 1);
182 strncpy(rule->subject, subject, SMACK_LABEL_LEN);
183 strncpy(rule->object, object, SMACK_LABEL_LEN);
184 parse_access_type(access_type, rule->access_type);
186 if (handle->first == NULL) {
187 handle->first = handle->last = rule;
189 handle->last->next = rule;
196 int smack_accesses_add_modify(struct smack_accesses *handle,
199 const char *allow_access_type,
200 const char *deny_access_type)
202 struct smack_rule *rule = NULL;
204 if (smack_label_length(subject) < 0 ||
205 smack_label_length(object) < 0)
208 rule = calloc(sizeof(struct smack_rule), 1);
212 strncpy(rule->subject, subject, SMACK_LABEL_LEN);
213 strncpy(rule->object, object, SMACK_LABEL_LEN);
214 parse_access_type(allow_access_type, rule->allow_access_type);
215 parse_access_type(deny_access_type, rule->deny_access_type);
218 if (handle->first == NULL) {
219 handle->first = handle->last = rule;
221 handle->last->next = rule;
228 int smack_accesses_add_from_file(struct smack_accesses *accesses, int fd)
231 char buf[READ_BUF_SIZE];
233 const char *subject, *object, *access, *access2;
241 file = fdopen(newfd, "r");
247 while (fgets(buf, READ_BUF_SIZE, file) != NULL) {
248 if (strcmp(buf, "\n") == 0)
250 subject = strtok_r(buf, " \t\n", &ptr);
251 object = strtok_r(NULL, " \t\n", &ptr);
252 access = strtok_r(NULL, " \t\n", &ptr);
253 access2 = strtok_r(NULL, " \t\n", &ptr);
255 if (subject == NULL || object == NULL || access == NULL ||
256 strtok_r(NULL, " \t\n", &ptr) != NULL) {
262 ret = smack_accesses_add(accesses, subject, object, access);
264 ret = smack_accesses_add_modify(accesses, subject, object, access, access2);
281 int smack_have_access(const char *subject, const char *object,
282 const char *access_type)
284 char buf[LOAD_LEN + 1];
285 char access_type_k[ACC_LEN + 1];
294 snprintf(path, sizeof path, "%s/access2", smackfs_mnt);
295 fd = open(path, O_RDWR);
300 snprintf(path, sizeof path, "%s/access", smackfs_mnt);
301 fd = open(path, O_RDWR);
307 parse_access_type(access_type, access_type_k);
310 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_LONG_FORMAT,
311 subject, object, access_type_k);
313 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_SHORT_FORMAT,
314 subject, object, access_type_k);
321 ret = write(fd, buf, strlen(buf));
327 ret = read(fd, buf, 1);
332 return buf[0] == '1';
335 int smack_cipso_new(struct smack_cipso **cipso)
337 struct smack_cipso *result;
339 result = calloc(sizeof(struct smack_cipso), 1);
347 void smack_cipso_free(struct smack_cipso *cipso)
352 struct cipso_mapping *mapping = cipso->first;
353 struct cipso_mapping *next_mapping = NULL;
355 while (mapping != NULL) {
356 next_mapping = mapping->next;
358 mapping = next_mapping;
362 int smack_cipso_apply(struct smack_cipso *cipso)
364 struct cipso_mapping *m = NULL;
365 char buf[CIPSO_MAX_SIZE];
374 snprintf(path, sizeof path, "%s/cipso2", smackfs_mnt);
375 fd = open(path, O_WRONLY);
379 memset(buf,0,CIPSO_MAX_SIZE);
380 for (m = cipso->first; m != NULL; m = m->next) {
381 snprintf(buf, SMACK_LABEL_LEN + 1, "%s", m->label);
382 offset += strlen(buf) + 1;
384 sprintf(&buf[offset], CIPSO_NUM_LEN_STR, m->level);
387 sprintf(&buf[offset], CIPSO_NUM_LEN_STR, m->ncats);
390 for (i = 0; i < m->ncats; i++){
391 sprintf(&buf[offset], CIPSO_NUM_LEN_STR, m->cats[i]);
395 if (write(fd, buf, offset) < 0) {
405 int smack_cipso_add_from_file(struct smack_cipso *cipso, int fd)
407 struct cipso_mapping *mapping = NULL;
410 char *label, *level, *cat, *ptr;
419 file = fdopen(newfd, "r");
425 while (fgets(buf, BUF_SIZE, file) != NULL) {
426 mapping = calloc(sizeof(struct cipso_mapping), 1);
430 label = strtok_r(buf, " \t\n", &ptr);
431 level = strtok_r(NULL, " \t\n", &ptr);
432 cat = strtok_r(NULL, " \t\n", &ptr);
433 if (smack_label_length(label) < 0 || level == NULL)
436 strncpy(mapping->label, label, SMACK_LABEL_LEN);
439 val = strtol(level, NULL, 10);
443 if (val < 0 || val > LEVEL_MAX)
446 mapping->level = val;
448 for (i = 0; i < CAT_MAX_COUNT && cat != NULL; i++) {
450 val = strtol(cat, NULL, 10);
454 if (val < 0 || val > CAT_MAX_VALUE)
457 mapping->cats[i] = val;
459 cat = strtok_r(NULL, " \t\n", &ptr);
464 if (cipso->first == NULL) {
465 cipso->first = cipso->last = mapping;
467 cipso->last->next = mapping;
468 cipso->last = mapping;
483 const char *smack_smackfs_path(void)
488 ssize_t smack_new_label_from_self(char **label)
494 result = calloc(SMACK_LABEL_LEN + 1, 1);
498 fd = open(SELF_LABEL_FILE, O_RDONLY);
504 ret = read(fd, result, SMACK_LABEL_LEN);
515 ssize_t smack_new_label_from_socket(int fd, char **label)
519 socklen_t length = 1;
522 ret = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, &dummy, &length);
523 if (ret < 0 && errno != ERANGE)
526 result = calloc(length + 1, 1);
530 ret = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, result, &length);
540 ssize_t smack_new_label_from_path(const char *path, const char *xattr,
541 int follow, char **label)
547 getxattr(path, xattr, NULL, 0) :
548 lgetxattr(path, xattr, NULL, 0);
549 if (ret < 0 && errno != ERANGE)
552 result = calloc(ret + 1, 1);
557 getxattr(path, xattr, result, ret) :
558 lgetxattr(path, xattr, result, ret);
568 int smack_set_label_for_self(const char *label)
574 len = smack_label_length(label);
578 fd = open(SELF_LABEL_FILE, O_WRONLY);
582 ret = write(fd, label, len);
585 return (ret < 0) ? -1 : 0;
588 int smack_revoke_subject(const char *subject)
595 len = smack_label_length(subject);
599 snprintf(path, sizeof path, "%s/revoke-subject", smackfs_mnt);
600 fd = open(path, O_WRONLY);
604 ret = write(fd, subject, len);
607 return (ret < 0) ? -1 : 0;
610 static int accesses_apply(struct smack_accesses *handle, int clear)
612 char buf[LOAD_LEN + 1];
613 struct smack_rule *rule;
624 snprintf(path, sizeof path, "%s/load2", smackfs_mnt);
625 load_fd = open(path, O_WRONLY);
630 snprintf(path, sizeof path, "%s/load", smackfs_mnt);
631 load_fd = open(path, O_WRONLY);
632 /* Try to continue if the file doesn't exist, we might not need it. */
633 if (load_fd < 0 && errno != ENOENT)
638 snprintf(path, sizeof path, "%s/change-rule", smackfs_mnt);
639 change_fd = open(path, O_WRONLY);
640 /* Try to continue if the file doesn't exist, we might not need it. */
641 if (change_fd < 0 && errno != ENOENT) {
646 for (rule = handle->first; rule != NULL; rule = rule->next) {
647 if (rule->is_modify && !clear) {
649 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_MODIFY_FORMAT,
650 rule->subject, rule->object,
651 rule->allow_access_type,
652 rule->deny_access_type);
656 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_LONG_FORMAT,
657 rule->subject, rule->object,
658 clear ? ACC_CLEAR : rule->access_type);
660 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_SHORT_FORMAT,
661 rule->subject, rule->object,
662 clear ? ACC_CLEAR : rule->access_type);
665 if (ret < 0 || fd < 0) {
670 ret = write(fd, buf, strlen(buf));
686 static inline void parse_access_type(const char *in, char out[ACC_LEN + 1])
690 for (i = 0; i < ACC_LEN; ++i)
694 for (i = 0; in[i] != '\0'; i++)
721 static int smack_label_length(const char *label)
725 if (!label || label[0] == '\0' || label[0] == '-')
728 for (i = 0; i < (SMACK_LABEL_LEN + 1) && label[i]; i++) {
741 return i < (SMACK_LABEL_LEN + 1) ? i : -1;