History

Smack: allow to access /smack/access as normal user

Allow query access as a normal user removing the need for CAP_MAC_ADMIN. Give RW access to /smack/access for UGO. Do not import smack labels in access check.

Jarkko Sakkinen committed 15 years ago

Commit 0e94ae11 parent d86b2b63 files · +50 −23Browse files

Showing the changes to security (3 of 3 files). Show all

Unified · Split

3 files
  1. security/smack/smack.h +1 −0
  2. security/smack/smack_access.c +19 −8
  3. security/smack/smackfs.c +30 −15
security/smack/smack.h+1−0
@@ -208,6 +208,7 @@ int smk_curacc(char *, u32, struct smk_audit_info *); · 207 unmodified lines
208208 int smack_to_cipso(const char *, struct smack_cipso *);
209209 char *smack_from_cipso(u32, char *);
210210 char *smack_from_secid(const u32);
211+void smk_parse_smack(const char *string, int len, char *smack);
211212 char *smk_import(const char *, int);
212213 struct smack_known *smk_import_entry(const char *, int);
213214 struct smack_known *smk_find_entry(const char *);
security/smack/smack_access.c+19−8
@@ -353,17 +353,13 @@ struct smack_known *smk_find_entry(const char *string) · 352 unmodified lines
353353 }
354354
355355 /**
356− * smk_import_entry - import a label, return the list entry
357− * @string: a text string that might be a Smack label
356+ * smk_parse_smack - parse smack label from a text string
357+ * @string: a text string that might contain a Smack label
358358 * @len: the maximum size, or zero if it is NULL terminated.
359− *
360− * Returns a pointer to the entry in the label list that
361− * matches the passed string, adding it if necessary.
359+ * @smack: parsed smack label, or NULL if parse error
362360 */
363−struct smack_known *smk_import_entry(const char *string, int len)
361+void smk_parse_smack(const char *string, int len, char *smack)
364362 {
365− struct smack_known *skp;
366− char smack[SMK_LABELLEN];
367363 int found;
368364 int i;
369365
@@ -381,7 +377,22 @@ struct smack_known *smk_import_entry(const char *string, int len) · 11 unmodified lines
381377 } else
382378 smack[i] = string[i];
383379 }
380+}
381+
382+/**
383+ * smk_import_entry - import a label, return the list entry
384+ * @string: a text string that might be a Smack label
385+ * @len: the maximum size, or zero if it is NULL terminated.
386+ *
387+ * Returns a pointer to the entry in the label list that
388+ * matches the passed string, adding it if necessary.
389+ */
390+struct smack_known *smk_import_entry(const char *string, int len)
391+{
392+ struct smack_known *skp;
393+ char smack[SMK_LABELLEN];
384394
395+ smk_parse_smack(string, len, smack);
385396 if (smack[0] == '\0')
386397 return NULL;
387398
security/smack/smackfs.c+30−15
@@ -191,19 +191,37 @@ static int smk_set_access(struct smack_rule *srp, struct list_head *rule_list, · 190 unmodified lines
191191 }
192192
193193 /**
194− * smk_parse_rule - parse subject, object and access type
194+ * smk_parse_rule - parse Smack rule from load string
195195 * @data: string to be parsed whose size is SMK_LOADLEN
196− * @rule: parsed entities are stored in here
196+ * @rule: Smack rule
197+ * @import: if non-zero, import labels
197198 */
198−static int smk_parse_rule(const char *data, struct smack_rule *rule)
199+static int smk_parse_rule(const char *data, struct smack_rule *rule, int import)
199200 {
200− rule->smk_subject = smk_import(data, 0);
201− if (rule->smk_subject == NULL)
202− return -1;
201+ char smack[SMK_LABELLEN];
202+ struct smack_known *skp;
203203
204− rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
205− if (rule->smk_object == NULL)
206− return -1;
204+ if (import) {
205+ rule->smk_subject = smk_import(data, 0);
206+ if (rule->smk_subject == NULL)
207+ return -1;
208+
209+ rule->smk_object = smk_import(data + SMK_LABELLEN, 0);
210+ if (rule->smk_object == NULL)
211+ return -1;
212+ } else {
213+ smk_parse_smack(data, 0, smack);
214+ skp = smk_find_entry(smack);
215+ if (skp == NULL)
216+ return -1;
217+ rule->smk_subject = skp->smk_known;
218+
219+ smk_parse_smack(data + SMK_LABELLEN, 0, smack);
220+ skp = smk_find_entry(smack);
221+ if (skp == NULL)
222+ return -1;
223+ rule->smk_object = skp->smk_known;
224+ }
207225
208226 rule->smk_access = 0;
209227
@@ -327,7 +345,7 @@ static ssize_t smk_write_load_list(struct file *file, const char __user *buf, · 117 unmodified lines
327345 goto out;
328346 }
329347
330− if (smk_parse_rule(data, rule))
348+ if (smk_parse_rule(data, rule, 1))
331349 goto out_free_rule;
332350
333351 if (rule_list == NULL) {
@@ -1499,14 +1517,11 @@ static ssize_t smk_write_access(struct file *file, const char __user *buf, · 1165 unmodified lines
14991517 char *data;
15001518 int res;
15011519
1502− if (!capable(CAP_MAC_ADMIN))
1503− return -EPERM;
1504−
15051520 data = simple_transaction_get(file, buf, count);
15061521 if (IS_ERR(data))
15071522 return PTR_ERR(data);
15081523
1509− if (count < SMK_LOADLEN || smk_parse_rule(data, &rule))
1524+ if (count < SMK_LOADLEN || smk_parse_rule(data, &rule, 0))
15101525 return -EINVAL;
15111526
15121527 res = smk_access(rule.smk_subject, rule.smk_object, rule.smk_access,
@@ -1560,7 +1575,7 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent) · 47 unmodified lines
15601575 [SMK_LOAD_SELF] = {
15611576 "load-self", &smk_load_self_ops, S_IRUGO|S_IWUGO},
15621577 [SMK_ACCESSES] = {
1563− "access", &smk_access_ops, S_IRUGO|S_IWUSR},
1578+ "access", &smk_access_ops, S_IRUGO|S_IWUGO},
15641579 /* last one */
15651580 {""}
15661581 };