Smack: Make the syslog control configurable

The syslog control requires that the calling proccess
have the floor ("_") Smack label. Tizen does not run any
processes except for kernel helpers with the floor label.
This changes allows the admin to configure a specific
label for syslog. The default value is the star ("*")
label, effectively removing the restriction. The value
can be set using smackfs/syslog for anyone who wants
a more restrictive behavior.

Targeted for git://git.gitorious.org/smack-next/kernel.git

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[sw0312.kim: backport from mainline commit 00f84f3f2e9d to support non-root user dlog]
Signed-off-by: Seung-Woo Kim <sw0312.kim@samsung.com>
Change-Id: I030b6a271020c1ff9aa79538afb753fed3d7289e

diff --git a/security/smack/smack.h b/security/smack/smack.h
index 2ac8049c92bf15b57a5b2887baf737f134686f82..4d6085bfa3d2a26ac5946c89bcfeaff887a80796 100644 (file)
--- a/security/smack/smack.h
+++ b/security/smack/smack.h
@@ -281,6 +281,7 @@ extern int smack_enabled;
 extern int smack_cipso_direct;
 extern int smack_cipso_mapped;
 extern struct smack_known *smack_net_ambient;
+extern struct smack_known *smack_syslog_label;
 #ifdef CONFIG_SECURITY_SMACK_BRINGUP
 extern struct smack_known *smack_unconfined;
 #endif

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index ba54ee76da321cc0112f6b73290789aad66e5be5..acb170c502b2fcbb18272bf467e7c45d03650738 100644 (file)
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -494,8 +494,6 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
  * smack_syslog - Smack approval on syslog
  * @type: message type
  *
- * Require that the task has the floor label
- *
  * Returns 0 on success, error code otherwise.
  */
 static int smack_syslog(int typefrom_file)
@@ -506,7 +504,7 @@ static int smack_syslog(int typefrom_file)
        if (smack_privileged(CAP_MAC_OVERRIDE))
                return 0;
 
-       if (skp != &smack_known_floor)
+       if (smack_syslog_label != NULL && smack_syslog_label != skp)
                rc = -EACCES;
 
        return rc;

diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 90af9f57c3a2d306ce3784a5024bedc8471644b6..ae49ed697727777356767166f13fbcbe60418f34 100644 (file)
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -65,6 +65,7 @@ enum smk_inos {
  */
 static DEFINE_MUTEX(smack_cipso_lock);
 static DEFINE_MUTEX(smack_ambient_lock);
+static DEFINE_MUTEX(smack_syslog_lock);
 static DEFINE_MUTEX(smk_netlbladdr_lock);
 
 /*
@@ -107,6 +108,12 @@ struct smack_known *smack_unconfined;
  */
 int smack_ptrace_rule = SMACK_PTRACE_DEFAULT;
 
+/*
+ * If this value is set restrict syslog use to the label specified.
+ * It can be reset via smackfs/syslog
+ */
+struct smack_known *smack_syslog_label;
+
 /*
  * Certain IP addresses may be designated as single label hosts.
  * Packets are sent there unlabeled, but only from tasks that
@@ -1735,7 +1742,7 @@ void smk_destroy_label_list(struct list_head *list)
 }
 
 /**
- * smk_write_onlycap - write() for /smack/onlycap
+ * smk_write_onlycap - write() for smackfs/onlycap
  * @file: file pointer, not actually used
  * @buf: where to get the data from
  * @count: bytes sent
@@ -2517,12 +2524,89 @@ static const struct file_operations smk_change_rule_ops = {
 };
 
 /**
- * smk_fill_super - fill the /smackfs superblock
+ * smk_read_syslog - read() for smackfs/syslog
+ * @filp: file pointer, not actually used
+ * @buf: where to put the result
+ * @cn: maximum to send along
+ * @ppos: where to start
+ *
+ * Returns number of bytes read or error code, as appropriate
+ */
+static ssize_t smk_read_syslog(struct file *filp, char __user *buf,
+                               size_t cn, loff_t *ppos)
+{
+       struct smack_known *skp;
+       ssize_t rc = -EINVAL;
+       int asize;
+
+       if (*ppos != 0)
+               return 0;
+
+       if (smack_syslog_label == NULL)
+               skp = &smack_known_star;
+       else
+               skp = smack_syslog_label;
+
+       asize = strlen(skp->smk_known) + 1;
+
+       if (cn >= asize)
+               rc = simple_read_from_buffer(buf, cn, ppos, skp->smk_known,
+                                               asize);
+
+       return rc;
+}
+
+/**
+ * smk_write_syslog - write() for smackfs/syslog
+ * @file: file pointer, not actually used
+ * @buf: where to get the data from
+ * @count: bytes sent
+ * @ppos: where to start
+ *
+ * Returns number of bytes written or error code, as appropriate
+ */
+static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
+                               size_t count, loff_t *ppos)
+{
+       char *data;
+       struct smack_known *skp;
+       int rc = count;
+
+       if (!smack_privileged(CAP_MAC_ADMIN))
+               return -EPERM;
+
+       data = kzalloc(count, GFP_KERNEL);
+       if (data == NULL)
+               return -ENOMEM;
+
+       if (copy_from_user(data, buf, count) != 0)
+               rc = -EFAULT;
+       else {
+               skp = smk_import_entry(data, count);
+               if (skp == NULL)
+                       rc = -EINVAL;
+               else
+                       smack_syslog_label = smk_import_entry(data, count);
+       }
+
+       kfree(data);
+       return rc;
+}
+
+static const struct file_operations smk_syslog_ops = {
+       .read           = smk_read_syslog,
+       .write          = smk_write_syslog,
+       .llseek         = default_llseek,
+};
+
+
+/**
+ * smk_fill_super - fill the smackfs superblock
  * @sb: the empty superblock
  * @data: unused
  * @silent: unused
  *
- * Fill in the well known entries for /smack
+ * Fill in the well known entries for the smack filesystem
  *
  * Returns 0 on success, an error code on failure
  */
@@ -2567,6 +2651,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent)
                        S_IRUGO|S_IWUSR},
                [SMK_CHANGE_RULE] = {
                        "change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
+               [SMK_SYSLOG] = {
+                       "syslog", &smk_syslog_ops, S_IRUGO|S_IWUSR},
                [SMK_PTRACE] = {
                        "ptrace", &smk_ptrace_ops, S_IRUGO|S_IWUSR},
 #ifdef CONFIG_SECURITY_SMACK_BRINGUP