Smack: allow to access /smack/access as normal user

Allow query access as a normal user removing the need for CAP_MAC_ADMIN. Give RW access to /smack/access for UGO. Do not import smack labels in access check.

Jarkko Sakkinen committed 15 years ago

Commit 0e94ae11 parent d86b2b63 files · +50 −23Browse files

Unified · Split

3 files

security/smack/smack.h +1 −0
security/smack/smack_access.c +19 −8
security/smack/smackfs.c +30 −15

security/smack/smack.h+1−0

@@ -208,6 +208,7 @@ int smk_curacc(char , u32, struct smk_audit_info ); · 207 unmodified lines
208	int smack_to_cipso(const char , struct smack_cipso );	208	int smack_to_cipso(const char , struct smack_cipso );
209	char smack_from_cipso(u32, char );	209	char smack_from_cipso(u32, char );
210	char *smack_from_secid(const u32);	210	char *smack_from_secid(const u32);
		211	void smk_parse_smack(const char string, int len, char smack);
211	char smk_import(const char , int);	212	char smk_import(const char , int);
212	struct smack_known smk_import_entry(const char , int);	213	struct smack_known smk_import_entry(const char , int);
213	struct smack_known smk_find_entry(const char );	214	struct smack_known smk_find_entry(const char );

security/smack/smack_access.c+19−8

 }
 /**
- * smk_import_entry - import a label, return the list entry
+ * smk_parse_smack - parse smack label from a text string
- * @string: a text string that might be a Smack label
+ * @string: a text string that might contain a Smack label
  * @len: the maximum size, or zero if it is NULL terminated.
- *
+ * @smack: parsed smack label, or NULL if parse error
- * Returns a pointer to the entry in the label list that
- * matches the passed string, adding it if necessary.
  */
-struct smack_known *smk_import_entry(const char *string, int len)
+void smk_parse_smack(const char *string, int len, char *smack)
 {
-	struct smack_known *skp;
-	char smack[SMK_LABELLEN];
 	int found;
 	int i;
 		} else
 			smack[i] = string[i];
 	}
+}
+/**
+ * smk_import_entry - import a label, return the list entry
+ * @string: a text string that might be a Smack label
+ * @len: the maximum size, or zero if it is NULL terminated.
+ *
+ * Returns a pointer to the entry in the label list that
+ * matches the passed string, adding it if necessary.
+ */
+struct smack_known *smk_import_entry(const char *string, int len)
+{
+	struct smack_known *skp;
+	char smack[SMK_LABELLEN];
+	smk_parse_smack(string, len, smack);
 	if (smack[0] == '\0')
 		return NULL;

security/smack/smackfs.c+30−15

 }
 /**
- * smk_parse_rule - parse subject, object and access type
+ * smk_parse_rule - parse Smack rule from load string
  * @data: string to be parsed whose size is SMK_LOADLEN
- * @rule: parsed entities are stored in here
+ * @rule: Smack rule
+ * @import: if non-zero, import labels
  */
-static int smk_parse_rule(const char *data, struct smack_rule *rule)
+static int smk_parse_rule(const char *data, struct smack_rule *rule, int import)
 {
-	rule->smk_subject = smk_import(data, 0);
+	char smack[SMK_LABELLEN];
-	if (rule->smk_subject == NULL)
+	struct smack_known *skp;
-		return -1;
-	rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
+	if (import) {
-	if (rule->smk_object == NULL)
+		rule->smk_subject = smk_import(data, 0);
-		return -1;
+		if (rule->smk_subject == NULL)
+			return -1;
+		rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
+		if (rule->smk_object == NULL)
+			return -1;
+	} else {
+		smk_parse_smack(data, 0, smack);
+		skp = smk_find_entry(smack);
+		if (skp == NULL)
+			return -1;
+		rule->smk_subject = skp->smk_known;
+		smk_parse_smack(data + SMK_LABELLEN, 0, smack);
+		skp = smk_find_entry(smack);
+		if (skp == NULL)
+			return -1;
+		rule->smk_object = skp->smk_known;
+	}
 	rule->smk_access = 0;
 		goto out;
 	}
-	if (smk_parse_rule(data, rule))
+	if (smk_parse_rule(data, rule, 1))
 		goto out_free_rule;
 	if (rule_list == NULL) {
 	char *data;
 	int res;
-	if (!capable(CAP_MAC_ADMIN))
-		return -EPERM;
 	data = simple_transaction_get(file, buf, count);
 	if (IS_ERR(data))
 		return PTR_ERR(data);
-	if (count < SMK_LOADLEN || smk_parse_rule(data, &rule))
+	if (count < SMK_LOADLEN || smk_parse_rule(data, &rule, 0))
 		return -EINVAL;
 	res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access,
 		[SMK_LOAD_SELF] = {
 			"load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
 		[SMK_ACCESSES] = {
-			"access", &smk_access_ops, S_IRUGO|S_IWUSR},
+			"access", &smk_access_ops, S_IRUGO|S_IWUGO},
 		/* last one */
 			{""}
 	};