smack: implement logging V3 (ecfcc53f) · Commits · 戴 / test

Documentation/Smack.txt

+18 −2

Original line number	Diff line number	Diff line
		@@ -184,8 +184,9 @@ length. Single character labels using special characters, that being anything
		other than a letter or digit, are reserved for use by the Smack development
		team. Smack labels are unstructured, case sensitive, and the only operation
		ever performed on them is comparison for equality. Smack labels cannot
		contain unprintable characters or the "/" (slash) character. Smack labels
		cannot begin with a '-', which is reserved for special options.
		contain unprintable characters, the "/" (slash), the "\" (backslash), the "'"
		(quote) and '"' (double-quote) characters.
		Smack labels cannot begin with a '-', which is reserved for special options.

		There are some predefined labels:

		@@ -523,3 +524,18 @@ Smack supports some mount options:

		These mount options apply to all file system types.

		Smack auditing

		If you want Smack auditing of security events, you need to set CONFIG_AUDIT
		in your kernel configuration.
		By default, all denied events will be audited. You can change this behavior by
		writing a single character to the /smack/logging file :
		0 : no logging
		1 : log denied (default)
		2 : log accepted
		3 : log denied & accepted

		Events are logged as 'key=value' pairs, for each event you at least will get
		the subjet, the object, the rights requested, the action, the kernel function
		that triggered the event, plus other pairs depending on the type of event
		audited.

security/Makefile

+3 −0

Original line number	Diff line number	Diff line
		@@ -16,6 +16,9 @@ obj-$(CONFIG_SECURITYFS) += inode.o
		# Must precede capability.o in order to stack properly.
		obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o
		obj-$(CONFIG_SECURITY_SMACK) += smack/built-in.o
		ifeq ($(CONFIG_AUDIT),y)
		obj-$(CONFIG_SECURITY_SMACK) += lsm_audit.o
		endif
		obj-$(CONFIG_SECURITY_TOMOYO) += tomoyo/built-in.o
		obj-$(CONFIG_SECURITY_ROOTPLUG) += root_plug.o
		obj-$(CONFIG_CGROUP_DEVICE) += device_cgroup.o

security/smack/smack.h

+106 −2

Original line number	Diff line number	Diff line
		@@ -20,6 +20,7 @@
		#include <net/netlabel.h>
		#include <linux/list.h>
		#include <linux/rculist.h>
		#include <linux/lsm_audit.h>

		/*
		* Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
		@@ -178,6 +179,20 @@ struct smack_known {
		#define MAY_READWRITE (MAY_READ \| MAY_WRITE)
		#define MAY_NOT 0

		/*
		* Number of access types used by Smack (rwxa)
		*/
		#define SMK_NUM_ACCESS_TYPE 4

		/*
		* Smack audit data; is empty if CONFIG_AUDIT not set
		* to save some stack
		*/
		struct smk_audit_info {
		#ifdef CONFIG_AUDIT
		struct common_audit_data a;
		#endif
		};
		/*
		* These functions are in smack_lsm.c
		*/
		@@ -186,8 +201,8 @@ struct inode_smack new_inode_smack(char );
		/*
		* These functions are in smack_access.c
		*/
		int smk_access(char , char , int);
		int smk_curacc(char *, u32);
		int smk_access(char , char , int, struct smk_audit_info *);
		int smk_curacc(char , u32, struct smk_audit_info );
		int smack_to_cipso(const char , struct smack_cipso );
		void smack_from_cipso(u32, char , char );
		char *smack_from_secid(const u32);
		@@ -237,4 +252,93 @@ static inline char smk_of_inode(const struct inode isp)
		return sip->smk_inode;
		}

		/*
		* logging functions
		*/
		#define SMACK_AUDIT_DENIED 0x1
		#define SMACK_AUDIT_ACCEPT 0x2
		extern int log_policy;

		void smack_log(char subject_label, char object_label,
		int request,
		int result, struct smk_audit_info *auditdata);

		#ifdef CONFIG_AUDIT

		/*
		* some inline functions to set up audit data
		* they do nothing if CONFIG_AUDIT is not set
		*
		*/
		static inline void smk_ad_init(struct smk_audit_info a, const char func,
		char type)
		{
		memset(a, 0, sizeof(*a));
		a->a.type = type;
		a->a.function = func;
		}

		static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
		struct task_struct *t)
		{
		a->a.u.tsk = t;
		}
		static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
		struct dentry *d)
		{
		a->a.u.fs.path.dentry = d;
		}
		static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
		struct vfsmount *m)
		{
		a->a.u.fs.path.mnt = m;
		}
		static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
		struct inode *i)
		{
		a->a.u.fs.inode = i;
		}
		static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
		struct path p)
		{
		a->a.u.fs.path = p;
		}
		static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
		struct sock *sk)
		{
		a->a.u.net.sk = sk;
		}

		#else /* no AUDIT */

		static inline void smk_ad_init(struct smk_audit_info a, const char func,
		char type)
		{
		}
		static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
		struct task_struct *t)
		{
		}
		static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
		struct dentry *d)
		{
		}
		static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
		struct vfsmount *m)
		{
		}
		static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
		struct inode *i)
		{
		}
		static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
		struct path p)
		{
		}
		static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
		struct sock *sk)
		{
		}
		#endif

		#endif /* _SECURITY_SMACK_H */

security/smack/smack_access.c

+127 −16

Original line number	Diff line number	Diff line
		@@ -59,11 +59,18 @@ LIST_HEAD(smack_known_list);
		*/
		static u32 smack_next_secid = 10;

		/*
		* what events do we log
		* can be overwritten at run-time by /smack/logging
		*/
		int log_policy = SMACK_AUDIT_DENIED;

		/**
		* smk_access - determine if a subject has a specific access to an object
		* @subject_label: a pointer to the subject's Smack label
		* @object_label: a pointer to the object's Smack label
		* @request: the access requested, in "MAY" format
		* @a : a pointer to the audit data
		*
		* This function looks up the subject/object pair in the
		* access rule list and returns 0 if the access is permitted,
		@@ -78,10 +85,12 @@ static u32 smack_next_secid = 10;
		* will be on the list, so checking the pointers may be a worthwhile
		* optimization.
		*/
		int smk_access(char subject_label, char object_label, int request)
		int smk_access(char subject_label, char object_label, int request,
		struct smk_audit_info *a)
		{
		u32 may = MAY_NOT;
		struct smack_rule *srp;
		int rc = 0;

		/*
		* Hardcoded comparisons.
		@@ -89,8 +98,10 @@ int smk_access(char subject_label, char object_label, int request)
		* A star subject can't access any object.
		*/
		if (subject_label == smack_known_star.smk_known \|\|
		strcmp(subject_label, smack_known_star.smk_known) == 0)
		return -EACCES;
		strcmp(subject_label, smack_known_star.smk_known) == 0) {
		rc = -EACCES;
		goto out_audit;
		}
		/*
		* An internet object can be accessed by any subject.
		* Tasks cannot be assigned the internet label.
		@@ -100,20 +111,20 @@ int smk_access(char subject_label, char object_label, int request)
		subject_label == smack_known_web.smk_known \|\|
		strcmp(object_label, smack_known_web.smk_known) == 0 \|\|
		strcmp(subject_label, smack_known_web.smk_known) == 0)
		return 0;
		goto out_audit;
		/*
		* A star object can be accessed by any subject.
		*/
		if (object_label == smack_known_star.smk_known \|\|
		strcmp(object_label, smack_known_star.smk_known) == 0)
		return 0;
		goto out_audit;
		/*
		* An object can be accessed in any way by a subject
		* with the same label.
		*/
		if (subject_label == object_label \|\|
		strcmp(subject_label, object_label) == 0)
		return 0;
		goto out_audit;
		/*
		* A hat subject can read any object.
		* A floor object can be read by any subject.
		@@ -121,10 +132,10 @@ int smk_access(char subject_label, char object_label, int request)
		if ((request & MAY_ANYREAD) == request) {
		if (object_label == smack_known_floor.smk_known \|\|
		strcmp(object_label, smack_known_floor.smk_known) == 0)
		return 0;
		goto out_audit;
		if (subject_label == smack_known_hat.smk_known \|\|
		strcmp(subject_label, smack_known_hat.smk_known) == 0)
		return 0;
		goto out_audit;
		}
		/*
		* Beyond here an explicit relationship is required.
		@@ -148,28 +159,36 @@ int smk_access(char subject_label, char object_label, int request)
		* This is a bit map operation.
		*/
		if ((request & may) == request)
		return 0;

		return -EACCES;
		goto out_audit;

		rc = -EACCES;
		out_audit:
		#ifdef CONFIG_AUDIT
		if (a)
		smack_log(subject_label, object_label, request, rc, a);
		#endif
		return rc;
		}

		/**
		* smk_curacc - determine if current has a specific access to an object
		* @obj_label: a pointer to the object's Smack label
		* @mode: the access requested, in "MAY" format
		* @a : common audit data
		*
		* This function checks the current subject label/object label pair
		* in the access rule list and returns 0 if the access is permitted,
		* non zero otherwise. It allows that current may have the capability
		* to override the rules.
		*/
		int smk_curacc(char *obj_label, u32 mode)
		int smk_curacc(char obj_label, u32 mode, struct smk_audit_info a)
		{
		int rc;
		char *sp = current_security();

		rc = smk_access(current_security(), obj_label, mode);
		rc = smk_access(sp, obj_label, mode, NULL);
		if (rc == 0)
		return 0;
		goto out_audit;

		/*
		* Return if a specific label has been designated as the
		@@ -177,14 +196,105 @@ int smk_curacc(char *obj_label, u32 mode)
		* have that label.
		*/
		if (smack_onlycap != NULL && smack_onlycap != current->cred->security)
		return rc;
		goto out_audit;

		if (capable(CAP_MAC_OVERRIDE))
		return 0;

		out_audit:
		#ifdef CONFIG_AUDIT
		if (a)
		smack_log(sp, obj_label, mode, rc, a);
		#endif
		return rc;
		}

		#ifdef CONFIG_AUDIT
		/**
		* smack_str_from_perm : helper to transalate an int to a
		* readable string
		* @string : the string to fill
		* @access : the int
		*
		*/
		static inline void smack_str_from_perm(char *string, int access)
		{
		int i = 0;
		if (access & MAY_READ)
		string[i++] = 'r';
		if (access & MAY_WRITE)
		string[i++] = 'w';
		if (access & MAY_EXEC)
		string[i++] = 'x';
		if (access & MAY_APPEND)
		string[i++] = 'a';
		string[i] = '\0';
		}
		/**
		* smack_log_callback - SMACK specific information
		* will be called by generic audit code
		* @ab : the audit_buffer
		* @a : audit_data
		*
		*/
		static void smack_log_callback(struct audit_buffer ab, void a)
		{
		struct common_audit_data *ad = a;
		struct smack_audit_data *sad = &ad->lsm_priv.smack_audit_data;
		audit_log_format(ab, "lsm=SMACK fn=%s action=%s", ad->function,
		sad->result ? "denied" : "granted");
		audit_log_format(ab, " subject=");
		audit_log_untrustedstring(ab, sad->subject);
		audit_log_format(ab, " object=");
		audit_log_untrustedstring(ab, sad->object);
		audit_log_format(ab, " requested=%s", sad->request);
		}

		/**
		* smack_log - Audit the granting or denial of permissions.
		* @subject_label : smack label of the requester
		* @object_label : smack label of the object being accessed
		* @request: requested permissions
		* @result: result from smk_access
		* @a: auxiliary audit data
		*
		* Audit the granting or denial of permissions in accordance
		* with the policy.
		*/
		void smack_log(char subject_label, char object_label, int request,
		int result, struct smk_audit_info *ad)
		{
		char request_buffer[SMK_NUM_ACCESS_TYPE + 1];
		struct smack_audit_data *sad;
		struct common_audit_data *a = &ad->a;

		/* check if we have to log the current event */
		if (result != 0 && (log_policy & SMACK_AUDIT_DENIED) == 0)
		return;
		if (result == 0 && (log_policy & SMACK_AUDIT_ACCEPT) == 0)
		return;

		if (a->function == NULL)
		a->function = "unknown";

		/* end preparing the audit data */
		sad = &a->lsm_priv.smack_audit_data;
		smack_str_from_perm(request_buffer, request);
		sad->subject = subject_label;
		sad->object = object_label;
		sad->request = request_buffer;
		sad->result = result;
		a->lsm_pre_audit = smack_log_callback;

		common_lsm_audit(a);
		}
		#else /* #ifdef CONFIG_AUDIT */
		void smack_log(char subject_label, char object_label, int request,
		int result, struct smk_audit_info *ad)
		{
		}
		#endif

		static DEFINE_MUTEX(smack_known_lock);

		/**
		@@ -209,7 +319,8 @@ struct smack_known smk_import_entry(const char string, int len)
		if (found)
		smack[i] = '\0';
		else if (i >= len \|\| string[i] > '~' \|\| string[i] <= ' ' \|\|
		string[i] == '/') {
		string[i] == '/' \|\| string[i] == '"' \|\|
		string[i] == '\\' \|\| string[i] == '\'') {
		smack[i] = '\0';
		found = 1;
		} else

security/smack/smack_lsm.c

+298 −92

File changed.

Preview size limit exceeded, changes collapsed.

Admin message