forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2023-12-08 01573e231f18eb2d99162747186f59511f56b64d 
 kernel/security/smack/smack.h
....@@ -1,13 +1,9 @@
1
+/* SPDX-License-Identifier: GPL-2.0-only */
12 /*
23  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
34  *
4
- *      This program is free software; you can redistribute it and/or modify
5
- *      it under the terms of the GNU General Public License as published by
6
- *      the Free Software Foundation, version 2.
7
- *
85  * Author:
96  *      Casey Schaufler <casey@schaufler-ca.com>
10
- *
117  */
128 
139 #ifndef _SECURITY_SMACK_H
....@@ -24,6 +20,7 @@
2420 #include <linux/list.h>
2521 #include <linux/rculist.h>
2622 #include <linux/lsm_audit.h>
23
+#include <linux/msg.h>
2724 
2825 /*
2926  * Use IPv6 port labeling if IPv6 is enabled and secmarks
....@@ -103,7 +100,12 @@
103100 	struct smack_known	*smk_out;	/* outbound label */
104101 	struct smack_known	*smk_in;	/* inbound label */
105102 	struct smack_known	*smk_packet;	/* TCP peer label */
103
+	int			smk_state;	/* netlabel socket states */
106104 };
105
+#define	SMK_NETLBL_UNSET	0
106
+#define	SMK_NETLBL_UNLABELED	1
107
+#define	SMK_NETLBL_LABELED	2
108
+#define	SMK_NETLBL_REQSKB	3
107109 
108110 /*
109111  * Inode smack data
....@@ -112,9 +114,7 @@
112114 	struct smack_known	*smk_inode;	/* label of the fso */
113115 	struct smack_known	*smk_task;	/* label of the task */
114116 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
115
-	struct mutex		smk_lock;	/* initialization lock */
116117 	int			smk_flags;	/* smack inode flags */
117
-	struct rcu_head         smk_rcu;	/* for freeing inode_smack */
118118 };
119119 
120120 struct task_smack {
....@@ -151,7 +151,6 @@
151151 	struct smack_known	*smk_label;	/* label */
152152 };
153153 
154
-#if IS_ENABLED(CONFIG_IPV6)
155154 /*
156155  * An entry in the table identifying IPv6 hosts.
157156  */
....@@ -162,9 +161,7 @@
162161 	int			smk_masks;	/* mask size */
163162 	struct smack_known	*smk_label;	/* label */
164163 };
165
-#endif /* CONFIG_IPV6 */
166164 
167
-#ifdef SMACK_IPV6_PORT_LABELING
168165 /*
169166  * An entry in the table identifying ports.
170167  */
....@@ -177,7 +174,6 @@
177174 	short			smk_sock_type;	/* Socket type */
178175 	short			smk_can_reuse;
179176 };
180
-#endif /* SMACK_IPV6_PORT_LABELING */
181177 
182178 struct smack_known_list_elem {
183179 	struct list_head	list;
....@@ -195,37 +191,15 @@
195191 
196192 enum {
197193 	Opt_error = -1,
198
-	Opt_fsdefault = 1,
199
-	Opt_fsfloor = 2,
200
-	Opt_fshat = 3,
201
-	Opt_fsroot = 4,
202
-	Opt_fstransmute = 5,
194
+	Opt_fsdefault = 0,
195
+	Opt_fsfloor = 1,
196
+	Opt_fshat = 2,
197
+	Opt_fsroot = 3,
198
+	Opt_fstransmute = 4,
203199 };
204
-
205
-/*
206
- * Mount options
207
- */
208
-#define SMK_FSDEFAULT	"smackfsdef="
209
-#define SMK_FSFLOOR	"smackfsfloor="
210
-#define SMK_FSHAT	"smackfshat="
211
-#define SMK_FSROOT	"smackfsroot="
212
-#define SMK_FSTRANS	"smackfstransmute="
213200 
214201 #define SMACK_DELETE_OPTION	"-DELETE"
215202 #define SMACK_CIPSO_OPTION 	"-CIPSO"
216
-
217
-/*
218
- * How communications on this socket are treated.
219
- * Usually it's determined by the underlying netlabel code
220
- * but there are certain cases, including single label hosts
221
- * and potentially single label interfaces for which the
222
- * treatment can not be known in advance.
223
- *
224
- * The possibility of additional labeling schemes being
225
- * introduced in the future exists as well.
226
- */
227
-#define SMACK_UNLABELED_SOCKET	0
228
-#define SMACK_CIPSO_SOCKET	1
229203 
230204 /*
231205  * CIPSO defaults.
....@@ -323,6 +297,7 @@
323297 bool smack_privileged(int cap);
324298 bool smack_privileged_cred(int cap, const struct cred *cred);
325299 void smk_destroy_label_list(struct list_head *list);
300
+int smack_populate_secattr(struct smack_known *skp);
326301 
327302 /*
328303  * Shared data.
....@@ -336,6 +311,7 @@
336311 extern struct smack_known *smack_unconfined;
337312 #endif
338313 extern int smack_ptrace_rule;
314
+extern struct lsm_blob_sizes smack_blob_sizes;
339315 
340316 extern struct smack_known smack_known_floor;
341317 extern struct smack_known smack_known_hat;
....@@ -346,22 +322,47 @@
346322 extern struct mutex	smack_known_lock;
347323 extern struct list_head smack_known_list;
348324 extern struct list_head smk_net4addr_list;
349
-#if IS_ENABLED(CONFIG_IPV6)
350325 extern struct list_head smk_net6addr_list;
351
-#endif /* CONFIG_IPV6 */
352326 
353327 extern struct mutex     smack_onlycap_lock;
354328 extern struct list_head smack_onlycap_list;
355329 
356330 #define SMACK_HASH_SLOTS 16
357331 extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
332
+extern struct kmem_cache *smack_rule_cache;
333
+
334
+static inline struct task_smack *smack_cred(const struct cred *cred)
335
+{
336
+	return cred->security + smack_blob_sizes.lbs_cred;
337
+}
338
+
339
+static inline struct smack_known **smack_file(const struct file *file)
340
+{
341
+	return (struct smack_known **)(file->f_security +
342
+				       smack_blob_sizes.lbs_file);
343
+}
344
+
345
+static inline struct inode_smack *smack_inode(const struct inode *inode)
346
+{
347
+	return inode->i_security + smack_blob_sizes.lbs_inode;
348
+}
349
+
350
+static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
351
+{
352
+	return msg->security + smack_blob_sizes.lbs_msg_msg;
353
+}
354
+
355
+static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
356
+{
357
+	return ipc->security + smack_blob_sizes.lbs_ipc;
358
+}
358359 
359360 /*
360361  * Is the directory transmuting?
361362  */
362363 static inline int smk_inode_transmutable(const struct inode *isp)
363364 {
364
-	struct inode_smack *sip = isp->i_security;
365
+	struct inode_smack *sip = smack_inode(isp);
365366 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
366367 }
367368 
....@@ -370,7 +371,7 @@
370371  */
371372 static inline struct smack_known *smk_of_inode(const struct inode *isp)
372373 {
373
-	struct inode_smack *sip = isp->i_security;
374
+	struct inode_smack *sip = smack_inode(isp);
374375 	return sip->smk_inode;
375376 }
376377 
....@@ -382,13 +383,19 @@
382383 	return tsp->smk_task;
383384 }
384385 
385
-static inline struct smack_known *smk_of_task_struct(const struct task_struct *t)
386
+static inline struct smack_known *smk_of_task_struct(
387
+						const struct task_struct *t)
386388 {
387389 	struct smack_known *skp;
390
+	const struct cred *cred;
388391 
389392 	rcu_read_lock();
390
-	skp = smk_of_task(__task_cred(t)->security);
393
+
394
+	cred = __task_cred(t);
395
+	skp = smk_of_task(smack_cred(cred));
396
+
391397 	rcu_read_unlock();
398
+
392399 	return skp;
393400 }
394401 
....@@ -405,7 +412,7 @@
405412  */
406413 static inline struct smack_known *smk_of_current(void)
407414 {
408
-	return smk_of_task(current_security());
415
+	return smk_of_task(smack_cred(current_cred()));
409416 }
410417 
411418 /*
....@@ -481,10 +488,6 @@
481488 }
482489 static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
483490 						    struct dentry *d)
484
-{
485
-}
486
-static inline void smk_ad_setfield_u_fs_path_mnt(struct smk_audit_info *a,
487
-						 struct vfsmount *m)
488491 {
489492 }
490493 static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,