2 * This file is part of libsmack
4 * Copyright (C) 2010 Nokia Corporation
5 * Copyright (C) 2011 Intel Corporation
7 * This library is free software; you can redistribute it and/or
8 * modify it under the terms of the GNU Lesser General Public License
9 * version 2.1 as published by the Free Software Foundation.
11 * This library is distributed in the hope that it will be useful, but
12 * WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
22 * Jarkko Sakkinen <jarkko.sakkinen@intel.com>
23 * Brian McGillion <brian.mcgillion@intel.com>
32 #include <sys/socket.h>
34 #include <sys/types.h>
37 #define LOAD_LEN (2 * (LABEL_LEN + 1) + ACC_LEN)
46 #define KERNEL_FORMAT "%-23s %-23s %5s"
47 #define READ_BUF_SIZE 512
48 #define SMACKFS_MNT "/smack"
49 #define SELF_LABEL_FILE "/proc/self/attr/current"
52 char subject[LABEL_LEN + 1];
53 char object[LABEL_LEN + 1];
55 struct smack_rule *next;
58 struct smack_accesses {
59 struct smack_rule *first;
60 struct smack_rule *last;
63 static int accesses_apply(struct smack_accesses *handle, int clear);
64 static inline int access_type_to_int(const char *access_type);
65 static inline void int_to_access_type_c(unsigned ac, char *str);
66 static inline void int_to_access_type_k(unsigned ac, char *str);
68 int smack_accesses_new(struct smack_accesses **accesses)
70 struct smack_accesses *result;
72 result = calloc(sizeof(struct smack_accesses), 1);
80 int smack_accesses_new_from_file(int fd, struct smack_accesses **accesses)
82 struct smack_accesses *result = NULL;
84 char buf[READ_BUF_SIZE];
86 const char *subject, *object, *access;
89 if (smack_accesses_new(&result))
96 file = fdopen(newfd, "r");
102 while (fgets(buf, READ_BUF_SIZE, file) != NULL) {
103 subject = strtok_r(buf, " \t\n", &ptr);
104 object = strtok_r(NULL, " \t\n", &ptr);
105 access = strtok_r(NULL, " \t\n", &ptr);
107 if (subject == NULL || object == NULL || access == NULL ||
108 strtok_r(NULL, " \t\n", &ptr) != NULL) {
113 if (smack_accesses_add(result, subject, object, access))
125 smack_accesses_free(result);
129 void smack_accesses_free(struct smack_accesses *handle)
134 struct smack_rule *rule = handle->first;
135 struct smack_rule *next_rule = NULL;
137 while (rule != NULL) {
138 next_rule = rule->next;
146 int smack_accesses_save(struct smack_accesses *handle, int fd)
148 struct smack_rule *rule = handle->first;
149 char access_type[ACC_LEN + 1];
158 file = fdopen(newfd, "w");
165 int_to_access_type_c(rule->access_code, access_type);
167 ret = fprintf(file, "%s %s %s\n",
168 rule->subject, rule->object, access_type);
181 int smack_accesses_apply(struct smack_accesses *handle)
183 accesses_apply(handle, 0);
186 int smack_accesses_clear(struct smack_accesses *handle)
188 accesses_apply(handle, 1);
191 int smack_accesses_add(struct smack_accesses *handle, const char *subject,
192 const char *object, const char *access_type)
194 struct smack_rule *rule = NULL;
196 rule = calloc(sizeof(struct smack_rule), 1);
200 strncpy(rule->subject, subject, LABEL_LEN + 1);
201 strncpy(rule->object, object, LABEL_LEN + 1);
202 rule->access_code = access_type_to_int(access_type);
204 if (handle->first == NULL) {
205 handle->first = handle->last = rule;
207 handle->last->next = rule;
214 int smack_have_access(const char *subject, const char *object,
215 const char *access_type)
217 char buf[LOAD_LEN + 1];
218 char access_type_k[ACC_LEN + 1];
219 unsigned access_code;
223 access_code = access_type_to_int(access_type);
224 int_to_access_type_k(access_code, access_type_k);
226 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_FORMAT, subject, object,
231 fd = open(SMACKFS_MNT "/access", O_RDWR);
235 ret = write(fd, buf, LOAD_LEN);
241 ret = read(fd, buf, 1);
246 return buf[0] == '1';
249 int smack_new_label_from_self(char **label)
255 result = calloc(LABEL_LEN + 1, 1);
259 fd = open(SELF_LABEL_FILE, O_RDONLY);
265 ret = read(fd, result, LABEL_LEN);
276 int smack_new_label_from_socket(int fd, char **label)
280 socklen_t length = 1;
283 ret = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, &dummy, &length);
284 if (ret < 0 && errno != ERANGE)
287 result = calloc(length, 1);
291 ret = getsockopt(fd, SOL_SOCKET, SO_PEERSEC, result, &length);
301 static int accesses_apply(struct smack_accesses *handle, int clear)
303 char buf[LOAD_LEN + 1];
304 char access_type[ACC_LEN + 1];
305 struct smack_rule *rule;
309 fd = open(SMACKFS_MNT "/load", O_WRONLY);
314 strcpy(access_type, "-----");
316 for (rule = handle->first; rule != NULL; rule = rule->next) {
318 int_to_access_type_k(rule->access_code, access_type);
320 ret = snprintf(buf, LOAD_LEN + 1, KERNEL_FORMAT, rule->subject, rule->object, access_type);
326 ret = write(fd, buf, LOAD_LEN);
337 static inline int access_type_to_int(const char *access_type)
343 for (i = 0; i < ACC_LEN && access_type[i] != '\0'; i++)
344 switch (access_type[i]) {
372 static inline void int_to_access_type_c(unsigned access, char *str)
376 if ((access & ACC_R) != 0)
378 if ((access & ACC_W) != 0)
380 if ((access & ACC_X) != 0)
382 if ((access & ACC_A) != 0)
384 if ((access & ACC_T) != 0)
389 static inline void int_to_access_type_k(unsigned access, char *str)
391 str[0] = ((access & ACC_R) != 0) ? 'r' : '-';
392 str[1] = ((access & ACC_W) != 0) ? 'w' : '-';
393 str[2] = ((access & ACC_X) != 0) ? 'x' : '-';
394 str[3] = ((access & ACC_A) != 0) ? 'a' : '-';
395 str[4] = ((access & ACC_T) != 0) ? 't' : '-';