lsm: smack: smack callbacks for kdbus security hooks

This adds implementation of three smack callbacks sitting behind kdbus
security hooks as proposed by Karol Lewandowski.

Originates from:

git://git.infradead.org/users/pcmoore/selinux (branch: working-kdbus)
commit: fc3505d058c001fe72a6f66b833e0be5b2d118f3

https://github.com/lmctl/linux.git (branch: kdbus-lsm-v4.for-systemd-v212)
commit: 103c26fd27d1ec8c32d85dd3d85681f936ac66fb

Signed-off-by: Karol Lewandowski <k.lewandowsk@samsung.com>
Signed-off-by: Paul Osmialowski <p.osmialowsk@samsung.com>

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c4a82b1..763f3b7 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -42,6 +42,7 @@
 #include <linux/shm.h>
 #include <linux/binfmts.h>
 #include <linux/parser.h>
+#include <kdbus/connection.h>
 #include "smack.h"
 
 #define TRANS_TRUE     "TRUE"
@@ -3583,6 +3584,60 @@ static int smack_setprocattr(struct task_struct *p, char *name,
        return size;
 }
 
+#ifdef CONFIG_KDBUS
+
+/**
+ * smack_kdbus_conn_alloc - Set the security blob for a KDBus connection
+ * @conn: the connection
+ *
+ * Returns 0
+ */
+static int smack_kdbus_conn_alloc(struct kdbus_conn *conn)
+{
+       conn->security = smk_of_current();
+
+       return 0;
+}
+
+/**
+ * smack_kdbus_conn_free - Clear the security blob for a KDBus connection
+ * @conn: the connection
+ *
+ * Clears the blob pointer
+ */
+static void smack_kdbus_conn_free(struct kdbus_conn *conn)
+{
+       conn->security = NULL;
+}
+
+/**
+ * smack_kdbus_talk - Smack access on KDBus
+ * @src: source kdbus connection
+ * @dst: destination kdbus connection
+ *
+ * Return 0 if a subject with the smack of sock could access
+ * an object with the smack of other, otherwise an error code
+ */
+static int smack_kdbus_talk(const struct kdbus_conn *src,
+                           const struct kdbus_conn *dst)
+{
+       struct smk_audit_info ad;
+       struct smack_known *sskp = src->security;
+       struct smack_known *dskp = dst->security;
+       int rc;
+
+       if (smack_privileged(CAP_MAC_OVERRIDE))
+               return 0;
+
+       smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NONE);
+
+       rc = smk_access(sskp, dskp, MAY_WRITE, &ad);
+       rc = smk_bu_note("kdbus talk", sskp, dskp, MAY_WRITE, rc);
+       return rc;
+}
+
+#endif /* CONFIG_KDBUS */
+
 /**
  * smack_unix_stream_connect - Smack access on UDS
  * @sock: one sock
@@ -4604,6 +4659,12 @@ struct security_operations smack_ops = {
        .getprocattr =                  smack_getprocattr,
        .setprocattr =                  smack_setprocattr,
 
+#ifdef CONFIG_KDBUS
+       .kdbus_conn_alloc =             smack_kdbus_conn_alloc,
+       .kdbus_conn_free =              smack_kdbus_conn_free,
+       .kdbus_talk =                   smack_kdbus_talk,
+#endif
+
        .unix_stream_connect =          smack_unix_stream_connect,
        .unix_may_send =                smack_unix_may_send,