Commit bcdca225 authored by Casey Schaufler's avatar Casey Schaufler Committed by Linus Torvalds

Smack: update for file capabilities

Update the Smack LSM to allow the registration of the capability "module"
as a secondary LSM.  Integrate the new hooks required for file based
capabilities.
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Cc: Serge Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 43627582
...@@ -584,14 +584,20 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) ...@@ -584,14 +584,20 @@ static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
static int smack_inode_setxattr(struct dentry *dentry, char *name, static int smack_inode_setxattr(struct dentry *dentry, char *name,
void *value, size_t size, int flags) void *value, size_t size, int flags)
{ {
if (!capable(CAP_MAC_ADMIN)) { int rc = 0;
if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPOUT) == 0)
return -EPERM;
}
return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
if (!capable(CAP_MAC_ADMIN))
rc = -EPERM;
} else
rc = cap_inode_setxattr(dentry, name, value, size, flags);
if (rc == 0)
rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
return rc;
} }
/** /**
...@@ -658,10 +664,20 @@ static int smack_inode_getxattr(struct dentry *dentry, char *name) ...@@ -658,10 +664,20 @@ static int smack_inode_getxattr(struct dentry *dentry, char *name)
*/ */
static int smack_inode_removexattr(struct dentry *dentry, char *name) static int smack_inode_removexattr(struct dentry *dentry, char *name)
{ {
if (strcmp(name, XATTR_NAME_SMACK) == 0 && !capable(CAP_MAC_ADMIN)) int rc = 0;
return -EPERM;
return smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE); if (strcmp(name, XATTR_NAME_SMACK) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPIN) == 0 ||
strcmp(name, XATTR_NAME_SMACKIPOUT) == 0) {
if (!capable(CAP_MAC_ADMIN))
rc = -EPERM;
} else
rc = cap_inode_removexattr(dentry, name);
if (rc == 0)
rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_WRITE);
return rc;
} }
/** /**
...@@ -1016,7 +1032,12 @@ static void smack_task_getsecid(struct task_struct *p, u32 *secid) ...@@ -1016,7 +1032,12 @@ static void smack_task_getsecid(struct task_struct *p, u32 *secid)
*/ */
static int smack_task_setnice(struct task_struct *p, int nice) static int smack_task_setnice(struct task_struct *p, int nice)
{ {
return smk_curacc(p->security, MAY_WRITE); int rc;
rc = cap_task_setnice(p, nice);
if (rc == 0)
rc = smk_curacc(p->security, MAY_WRITE);
return rc;
} }
/** /**
...@@ -1028,7 +1049,12 @@ static int smack_task_setnice(struct task_struct *p, int nice) ...@@ -1028,7 +1049,12 @@ static int smack_task_setnice(struct task_struct *p, int nice)
*/ */
static int smack_task_setioprio(struct task_struct *p, int ioprio) static int smack_task_setioprio(struct task_struct *p, int ioprio)
{ {
return smk_curacc(p->security, MAY_WRITE); int rc;
rc = cap_task_setioprio(p, ioprio);
if (rc == 0)
rc = smk_curacc(p->security, MAY_WRITE);
return rc;
} }
/** /**
...@@ -1053,7 +1079,12 @@ static int smack_task_getioprio(struct task_struct *p) ...@@ -1053,7 +1079,12 @@ static int smack_task_getioprio(struct task_struct *p)
static int smack_task_setscheduler(struct task_struct *p, int policy, static int smack_task_setscheduler(struct task_struct *p, int policy,
struct sched_param *lp) struct sched_param *lp)
{ {
return smk_curacc(p->security, MAY_WRITE); int rc;
rc = cap_task_setscheduler(p, policy, lp);
if (rc == 0)
rc = smk_curacc(p->security, MAY_WRITE);
return rc;
} }
/** /**
...@@ -1093,6 +1124,11 @@ static int smack_task_movememory(struct task_struct *p) ...@@ -1093,6 +1124,11 @@ static int smack_task_movememory(struct task_struct *p)
static int smack_task_kill(struct task_struct *p, struct siginfo *info, static int smack_task_kill(struct task_struct *p, struct siginfo *info,
int sig, u32 secid) int sig, u32 secid)
{ {
int rc;
rc = cap_task_kill(p, info, sig, secid);
if (rc != 0)
return rc;
/* /*
* Special cases where signals really ought to go through * Special cases where signals really ought to go through
* in spite of policy. Stephen Smalley suggests it may * in spite of policy. Stephen Smalley suggests it may
...@@ -1778,6 +1814,27 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag) ...@@ -1778,6 +1814,27 @@ static int smack_ipc_permission(struct kern_ipc_perm *ipp, short flag)
return smk_curacc(isp, may); return smk_curacc(isp, may);
} }
/* module stacking operations */
/**
* smack_register_security - stack capability module
* @name: module name
* @ops: module operations - ignored
*
* Allow the capability module to register.
*/
static int smack_register_security(const char *name,
struct security_operations *ops)
{
if (strcmp(name, "capability") != 0)
return -EINVAL;
printk(KERN_INFO "%s: Registering secondary module %s\n",
__func__, name);
return 0;
}
/** /**
* smack_d_instantiate - Make sure the blob is correct on an inode * smack_d_instantiate - Make sure the blob is correct on an inode
* @opt_dentry: unused * @opt_dentry: unused
...@@ -2412,6 +2469,8 @@ static struct security_operations smack_ops = { ...@@ -2412,6 +2469,8 @@ static struct security_operations smack_ops = {
.inode_post_setxattr = smack_inode_post_setxattr, .inode_post_setxattr = smack_inode_post_setxattr,
.inode_getxattr = smack_inode_getxattr, .inode_getxattr = smack_inode_getxattr,
.inode_removexattr = smack_inode_removexattr, .inode_removexattr = smack_inode_removexattr,
.inode_need_killpriv = cap_inode_need_killpriv,
.inode_killpriv = cap_inode_killpriv,
.inode_getsecurity = smack_inode_getsecurity, .inode_getsecurity = smack_inode_getsecurity,
.inode_setsecurity = smack_inode_setsecurity, .inode_setsecurity = smack_inode_setsecurity,
.inode_listsecurity = smack_inode_listsecurity, .inode_listsecurity = smack_inode_listsecurity,
...@@ -2471,6 +2530,8 @@ static struct security_operations smack_ops = { ...@@ -2471,6 +2530,8 @@ static struct security_operations smack_ops = {
.netlink_send = cap_netlink_send, .netlink_send = cap_netlink_send,
.netlink_recv = cap_netlink_recv, .netlink_recv = cap_netlink_recv,
.register_security = smack_register_security,
.d_instantiate = smack_d_instantiate, .d_instantiate = smack_d_instantiate,
.getprocattr = smack_getprocattr, .getprocattr = smack_getprocattr,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment