Smack: Make the syslog control configurable
The syslog control requires that the calling proccess have the floor ("_") Smack label. Tizen does not run any processes except for kernel helpers with the floor label. This changes allows the admin to configure a specific label for syslog. The default value is the star ("*") label, effectively removing the restriction. The value can be set using smackfs/syslog for anyone who wants a more restrictive behavior. Targeted for git://git.gitorious.org/smack-next/kernel.git Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
This commit is contained in:
parent
19760ad03c
commit
00f84f3f2e
3 changed files with 99 additions and 13 deletions
|
@ -241,7 +241,8 @@ u32 smack_to_secid(const char *);
|
||||||
extern int smack_cipso_direct;
|
extern int smack_cipso_direct;
|
||||||
extern int smack_cipso_mapped;
|
extern int smack_cipso_mapped;
|
||||||
extern struct smack_known *smack_net_ambient;
|
extern struct smack_known *smack_net_ambient;
|
||||||
extern char *smack_onlycap;
|
extern struct smack_known *smack_onlycap;
|
||||||
|
extern struct smack_known *smack_syslog_label;
|
||||||
extern const char *smack_cipso_option;
|
extern const char *smack_cipso_option;
|
||||||
|
|
||||||
extern struct smack_known smack_known_floor;
|
extern struct smack_known smack_known_floor;
|
||||||
|
@ -312,7 +313,7 @@ static inline int smack_privileged(int cap)
|
||||||
|
|
||||||
if (!capable(cap))
|
if (!capable(cap))
|
||||||
return 0;
|
return 0;
|
||||||
if (smack_onlycap == NULL || smack_onlycap == skp->smk_known)
|
if (smack_onlycap == NULL || smack_onlycap == skp)
|
||||||
return 1;
|
return 1;
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -219,8 +219,6 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
|
||||||
* smack_syslog - Smack approval on syslog
|
* smack_syslog - Smack approval on syslog
|
||||||
* @type: message type
|
* @type: message type
|
||||||
*
|
*
|
||||||
* Require that the task has the floor label
|
|
||||||
*
|
|
||||||
* Returns 0 on success, error code otherwise.
|
* Returns 0 on success, error code otherwise.
|
||||||
*/
|
*/
|
||||||
static int smack_syslog(int typefrom_file)
|
static int smack_syslog(int typefrom_file)
|
||||||
|
@ -231,7 +229,7 @@ static int smack_syslog(int typefrom_file)
|
||||||
if (smack_privileged(CAP_MAC_OVERRIDE))
|
if (smack_privileged(CAP_MAC_OVERRIDE))
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
if (skp != &smack_known_floor)
|
if (smack_syslog_label != NULL && smack_syslog_label != skp)
|
||||||
rc = -EACCES;
|
rc = -EACCES;
|
||||||
|
|
||||||
return rc;
|
return rc;
|
||||||
|
|
|
@ -52,6 +52,7 @@ enum smk_inos {
|
||||||
SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
|
SMK_CIPSO2 = 17, /* load long label -> CIPSO mapping */
|
||||||
SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
|
SMK_REVOKE_SUBJ = 18, /* set rules with subject label to '-' */
|
||||||
SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
|
SMK_CHANGE_RULE = 19, /* change or add rules (long labels) */
|
||||||
|
SMK_SYSLOG = 20, /* change syslog label) */
|
||||||
};
|
};
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -59,6 +60,7 @@ enum smk_inos {
|
||||||
*/
|
*/
|
||||||
static DEFINE_MUTEX(smack_cipso_lock);
|
static DEFINE_MUTEX(smack_cipso_lock);
|
||||||
static DEFINE_MUTEX(smack_ambient_lock);
|
static DEFINE_MUTEX(smack_ambient_lock);
|
||||||
|
static DEFINE_MUTEX(smack_syslog_lock);
|
||||||
static DEFINE_MUTEX(smk_netlbladdr_lock);
|
static DEFINE_MUTEX(smk_netlbladdr_lock);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -90,7 +92,13 @@ int smack_cipso_mapped = SMACK_CIPSO_MAPPED_DEFAULT;
|
||||||
* everyone. It is expected that the hat (^) label
|
* everyone. It is expected that the hat (^) label
|
||||||
* will be used if any label is used.
|
* will be used if any label is used.
|
||||||
*/
|
*/
|
||||||
char *smack_onlycap;
|
struct smack_known *smack_onlycap;
|
||||||
|
|
||||||
|
/*
|
||||||
|
* If this value is set restrict syslog use to the label specified.
|
||||||
|
* It can be reset via smackfs/syslog
|
||||||
|
*/
|
||||||
|
struct smack_known *smack_syslog_label;
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Certain IP addresses may be designated as single label hosts.
|
* Certain IP addresses may be designated as single label hosts.
|
||||||
|
@ -1603,7 +1611,7 @@ static const struct file_operations smk_ambient_ops = {
|
||||||
};
|
};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* smk_read_onlycap - read() for /smack/onlycap
|
* smk_read_onlycap - read() for smackfs/onlycap
|
||||||
* @filp: file pointer, not actually used
|
* @filp: file pointer, not actually used
|
||||||
* @buf: where to put the result
|
* @buf: where to put the result
|
||||||
* @cn: maximum to send along
|
* @cn: maximum to send along
|
||||||
|
@ -1622,7 +1630,7 @@ static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
if (smack_onlycap != NULL)
|
if (smack_onlycap != NULL)
|
||||||
smack = smack_onlycap;
|
smack = smack_onlycap->smk_known;
|
||||||
|
|
||||||
asize = strlen(smack) + 1;
|
asize = strlen(smack) + 1;
|
||||||
|
|
||||||
|
@ -1633,7 +1641,7 @@ static ssize_t smk_read_onlycap(struct file *filp, char __user *buf,
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* smk_write_onlycap - write() for /smack/onlycap
|
* smk_write_onlycap - write() for smackfs/onlycap
|
||||||
* @file: file pointer, not actually used
|
* @file: file pointer, not actually used
|
||||||
* @buf: where to get the data from
|
* @buf: where to get the data from
|
||||||
* @count: bytes sent
|
* @count: bytes sent
|
||||||
|
@ -1656,7 +1664,7 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
|
||||||
* explicitly for clarity. The smk_access() implementation
|
* explicitly for clarity. The smk_access() implementation
|
||||||
* would use smk_access(smack_onlycap, MAY_WRITE)
|
* would use smk_access(smack_onlycap, MAY_WRITE)
|
||||||
*/
|
*/
|
||||||
if (smack_onlycap != NULL && smack_onlycap != skp->smk_known)
|
if (smack_onlycap != NULL && smack_onlycap != skp)
|
||||||
return -EPERM;
|
return -EPERM;
|
||||||
|
|
||||||
data = kzalloc(count, GFP_KERNEL);
|
data = kzalloc(count, GFP_KERNEL);
|
||||||
|
@ -1676,7 +1684,7 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
|
||||||
if (copy_from_user(data, buf, count) != 0)
|
if (copy_from_user(data, buf, count) != 0)
|
||||||
rc = -EFAULT;
|
rc = -EFAULT;
|
||||||
else
|
else
|
||||||
smack_onlycap = smk_import(data, count);
|
smack_onlycap = smk_import_entry(data, count);
|
||||||
|
|
||||||
kfree(data);
|
kfree(data);
|
||||||
return rc;
|
return rc;
|
||||||
|
@ -2159,12 +2167,89 @@ static const struct file_operations smk_change_rule_ops = {
|
||||||
};
|
};
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* smk_fill_super - fill the /smackfs superblock
|
* smk_read_syslog - read() for smackfs/syslog
|
||||||
|
* @filp: file pointer, not actually used
|
||||||
|
* @buf: where to put the result
|
||||||
|
* @cn: maximum to send along
|
||||||
|
* @ppos: where to start
|
||||||
|
*
|
||||||
|
* Returns number of bytes read or error code, as appropriate
|
||||||
|
*/
|
||||||
|
static ssize_t smk_read_syslog(struct file *filp, char __user *buf,
|
||||||
|
size_t cn, loff_t *ppos)
|
||||||
|
{
|
||||||
|
struct smack_known *skp;
|
||||||
|
ssize_t rc = -EINVAL;
|
||||||
|
int asize;
|
||||||
|
|
||||||
|
if (*ppos != 0)
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
if (smack_syslog_label == NULL)
|
||||||
|
skp = &smack_known_star;
|
||||||
|
else
|
||||||
|
skp = smack_syslog_label;
|
||||||
|
|
||||||
|
asize = strlen(skp->smk_known) + 1;
|
||||||
|
|
||||||
|
if (cn >= asize)
|
||||||
|
rc = simple_read_from_buffer(buf, cn, ppos, skp->smk_known,
|
||||||
|
asize);
|
||||||
|
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* smk_write_syslog - write() for smackfs/syslog
|
||||||
|
* @file: file pointer, not actually used
|
||||||
|
* @buf: where to get the data from
|
||||||
|
* @count: bytes sent
|
||||||
|
* @ppos: where to start
|
||||||
|
*
|
||||||
|
* Returns number of bytes written or error code, as appropriate
|
||||||
|
*/
|
||||||
|
static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
|
||||||
|
size_t count, loff_t *ppos)
|
||||||
|
{
|
||||||
|
char *data;
|
||||||
|
struct smack_known *skp;
|
||||||
|
int rc = count;
|
||||||
|
|
||||||
|
if (!smack_privileged(CAP_MAC_ADMIN))
|
||||||
|
return -EPERM;
|
||||||
|
|
||||||
|
data = kzalloc(count, GFP_KERNEL);
|
||||||
|
if (data == NULL)
|
||||||
|
return -ENOMEM;
|
||||||
|
|
||||||
|
if (copy_from_user(data, buf, count) != 0)
|
||||||
|
rc = -EFAULT;
|
||||||
|
else {
|
||||||
|
skp = smk_import_entry(data, count);
|
||||||
|
if (skp == NULL)
|
||||||
|
rc = -EINVAL;
|
||||||
|
else
|
||||||
|
smack_syslog_label = smk_import_entry(data, count);
|
||||||
|
}
|
||||||
|
|
||||||
|
kfree(data);
|
||||||
|
return rc;
|
||||||
|
}
|
||||||
|
|
||||||
|
static const struct file_operations smk_syslog_ops = {
|
||||||
|
.read = smk_read_syslog,
|
||||||
|
.write = smk_write_syslog,
|
||||||
|
.llseek = default_llseek,
|
||||||
|
};
|
||||||
|
|
||||||
|
|
||||||
|
/**
|
||||||
|
* smk_fill_super - fill the smackfs superblock
|
||||||
* @sb: the empty superblock
|
* @sb: the empty superblock
|
||||||
* @data: unused
|
* @data: unused
|
||||||
* @silent: unused
|
* @silent: unused
|
||||||
*
|
*
|
||||||
* Fill in the well known entries for /smack
|
* Fill in the well known entries for the smack filesystem
|
||||||
*
|
*
|
||||||
* Returns 0 on success, an error code on failure
|
* Returns 0 on success, an error code on failure
|
||||||
*/
|
*/
|
||||||
|
@ -2209,6 +2294,8 @@ static int smk_fill_super(struct super_block *sb, void *data, int silent)
|
||||||
S_IRUGO|S_IWUSR},
|
S_IRUGO|S_IWUSR},
|
||||||
[SMK_CHANGE_RULE] = {
|
[SMK_CHANGE_RULE] = {
|
||||||
"change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
|
"change-rule", &smk_change_rule_ops, S_IRUGO|S_IWUSR},
|
||||||
|
[SMK_SYSLOG] = {
|
||||||
|
"syslog", &smk_syslog_ops, S_IRUGO|S_IWUSR},
|
||||||
/* last one */
|
/* last one */
|
||||||
{""}
|
{""}
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in a new issue