forked from ~ljy/RK356X_SDK_RELEASE
blame | history | patch | commit | commitdiff
hc
2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc 
 kernel/security/smack/smackfs.c
....@@ -1,9 +1,6 @@
1
+// SPDX-License-Identifier: GPL-2.0-only
12 /*
23  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
3
- *
4
- *	This program is free software; you can redistribute it and/or modify
5
- *  	it under the terms of the GNU General Public License as published by
6
- *	the Free Software Foundation, version 2.
74  *
85  * Authors:
96  * 	Casey Schaufler <casey@schaufler-ca.com>
....@@ -13,7 +10,6 @@
1310  *
1411  *	Karl MacMillan <kmacmillan@tresys.com>
1512  *	James Morris <jmorris@redhat.com>
16
- *
1713  */
1814 
1915 #include <linux/kernel.h>
....@@ -27,6 +23,7 @@
2723 #include <linux/ctype.h>
2824 #include <linux/audit.h>
2925 #include <linux/magic.h>
26
+#include <linux/fs_context.h>
3027 #include "smack.h"
3128 
3229 #define BEBITS	(sizeof(__be32) * 8)
....@@ -67,7 +64,6 @@
6764 /*
6865  * List locks
6966  */
70
-static DEFINE_MUTEX(smack_master_list_lock);
7167 static DEFINE_MUTEX(smack_cipso_lock);
7268 static DEFINE_MUTEX(smack_ambient_lock);
7369 static DEFINE_MUTEX(smk_net4addr_lock);
....@@ -134,15 +130,7 @@
134130 
135131 /*
136132  * Rule lists are maintained for each label.
137
- * This master list is just for reading /smack/load and /smack/load2.
138133  */
139
-struct smack_master_list {
140
-	struct list_head	list;
141
-	struct smack_rule	*smk_rule;
142
-};
143
-
144
-static LIST_HEAD(smack_rule_list);
145
-
146134 struct smack_parsed_rule {
147135 	struct smack_known	*smk_subject;
148136 	struct smack_known	*smk_object;
....@@ -211,7 +199,6 @@
211199  * @srp: the rule to add or replace
212200  * @rule_list: the list of rules
213201  * @rule_lock: the rule list lock
214
- * @global: if non-zero, indicates a global rule
215202  *
216203  * Looks through the current subject/object/access list for
217204  * the subject/object pair and replaces the access that was
....@@ -223,10 +210,9 @@
223210  */
224211 static int smk_set_access(struct smack_parsed_rule *srp,
225212 				struct list_head *rule_list,
226
-				struct mutex *rule_lock, int global)
213
+				struct mutex *rule_lock)
227214 {
228215 	struct smack_rule *sp;
229
-	struct smack_master_list *smlp;
230216 	int found = 0;
231217 	int rc = 0;
232218 
....@@ -247,7 +233,7 @@
247233 	}
248234 
249235 	if (found == 0) {
250
-		sp = kzalloc(sizeof(*sp), GFP_KERNEL);
236
+		sp = kmem_cache_zalloc(smack_rule_cache, GFP_KERNEL);
251237 		if (sp == NULL) {
252238 			rc = -ENOMEM;
253239 			goto out;
....@@ -258,22 +244,6 @@
258244 		sp->smk_access = srp->smk_access1 & ~srp->smk_access2;
259245 
260246 		list_add_rcu(&sp->list, rule_list);
261
-		/*
262
-		 * If this is a global as opposed to self and a new rule
263
-		 * it needs to get added for reporting.
264
-		 */
265
-		if (global) {
266
-			mutex_unlock(rule_lock);
267
-			smlp = kzalloc(sizeof(*smlp), GFP_KERNEL);
268
-			if (smlp != NULL) {
269
-				smlp->smk_rule = sp;
270
-				mutex_lock(&smack_master_list_lock);
271
-				list_add_rcu(&smlp->list, &smack_rule_list);
272
-				mutex_unlock(&smack_master_list_lock);
273
-			} else
274
-				rc = -ENOMEM;
275
-			return rc;
276
-		}
277247 	}
278248 
279249 out:
....@@ -540,9 +510,9 @@
540510 
541511 		if (rule_list == NULL)
542512 			rc = smk_set_access(&rule, &rule.smk_subject->smk_rules,
543
-				&rule.smk_subject->smk_rules_lock, 1);
513
+				&rule.smk_subject->smk_rules_lock);
544514 		else
545
-			rc = smk_set_access(&rule, rule_list, rule_lock, 0);
515
+			rc = smk_set_access(&rule, rule_list, rule_lock);
546516 
547517 		if (rc)
548518 			goto out;
....@@ -636,21 +606,23 @@
636606 
637607 static void *load2_seq_start(struct seq_file *s, loff_t *pos)
638608 {
639
-	return smk_seq_start(s, pos, &smack_rule_list);
609
+	return smk_seq_start(s, pos, &smack_known_list);
640610 }
641611 
642612 static void *load2_seq_next(struct seq_file *s, void *v, loff_t *pos)
643613 {
644
-	return smk_seq_next(s, v, pos, &smack_rule_list);
614
+	return smk_seq_next(s, v, pos, &smack_known_list);
645615 }
646616 
647617 static int load_seq_show(struct seq_file *s, void *v)
648618 {
649619 	struct list_head *list = v;
650
-	struct smack_master_list *smlp =
651
-		list_entry_rcu(list, struct smack_master_list, list);
620
+	struct smack_rule *srp;
621
+	struct smack_known *skp =
622
+		list_entry_rcu(list, struct smack_known, list);
652623 
653
-	smk_rule_show(s, smlp->smk_rule, SMK_LABELLEN);
624
+	list_for_each_entry_rcu(srp, &skp->smk_rules, list)
625
+		smk_rule_show(s, srp, SMK_LABELLEN);
654626 
655627 	return 0;
656628 }
....@@ -923,7 +895,7 @@
923895 	}
924896 
925897 	ret = sscanf(rule, "%d", &catlen);
926
-	if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
898
+	if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM)
927899 		goto out;
928900 
929901 	if (format == SMK_FIXED24_FMT &&
....@@ -953,6 +925,10 @@
953925 		synchronize_rcu();
954926 		netlbl_catmap_free(old_cat);
955927 		rc = count;
928
+		/*
929
+		 * This mapping may have been cached, so clear the cache.
930
+		 */
931
+		netlbl_cache_invalidate();
956932 	}
957933 
958934 out:
....@@ -2235,14 +2211,14 @@
22352211 
22362212 static void *load_self_seq_start(struct seq_file *s, loff_t *pos)
22372213 {
2238
-	struct task_smack *tsp = current_security();
2214
+	struct task_smack *tsp = smack_cred(current_cred());
22392215 
22402216 	return smk_seq_start(s, pos, &tsp->smk_rules);
22412217 }
22422218 
22432219 static void *load_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
22442220 {
2245
-	struct task_smack *tsp = current_security();
2221
+	struct task_smack *tsp = smack_cred(current_cred());
22462222 
22472223 	return smk_seq_next(s, v, pos, &tsp->smk_rules);
22482224 }
....@@ -2289,7 +2265,7 @@
22892265 static ssize_t smk_write_load_self(struct file *file, const char __user *buf,
22902266 			      size_t count, loff_t *ppos)
22912267 {
2292
-	struct task_smack *tsp = current_security();
2268
+	struct task_smack *tsp = smack_cred(current_cred());
22932269 
22942270 	return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
22952271 				    &tsp->smk_rules_lock, SMK_FIXED24_FMT);
....@@ -2379,10 +2355,12 @@
23792355 static int load2_seq_show(struct seq_file *s, void *v)
23802356 {
23812357 	struct list_head *list = v;
2382
-	struct smack_master_list *smlp =
2383
-		list_entry_rcu(list, struct smack_master_list, list);
2358
+	struct smack_rule *srp;
2359
+	struct smack_known *skp =
2360
+		list_entry_rcu(list, struct smack_known, list);
23842361 
2385
-	smk_rule_show(s, smlp->smk_rule, SMK_LONGLABEL);
2362
+	list_for_each_entry_rcu(srp, &skp->smk_rules, list)
2363
+		smk_rule_show(s, srp, SMK_LONGLABEL);
23862364 
23872365 	return 0;
23882366 }
....@@ -2441,14 +2419,14 @@
24412419 
24422420 static void *load_self2_seq_start(struct seq_file *s, loff_t *pos)
24432421 {
2444
-	struct task_smack *tsp = current_security();
2422
+	struct task_smack *tsp = smack_cred(current_cred());
24452423 
24462424 	return smk_seq_start(s, pos, &tsp->smk_rules);
24472425 }
24482426 
24492427 static void *load_self2_seq_next(struct seq_file *s, void *v, loff_t *pos)
24502428 {
2451
-	struct task_smack *tsp = current_security();
2429
+	struct task_smack *tsp = smack_cred(current_cred());
24522430 
24532431 	return smk_seq_next(s, v, pos, &tsp->smk_rules);
24542432 }
....@@ -2494,7 +2472,7 @@
24942472 static ssize_t smk_write_load_self2(struct file *file, const char __user *buf,
24952473 			      size_t count, loff_t *ppos)
24962474 {
2497
-	struct task_smack *tsp = current_security();
2475
+	struct task_smack *tsp = smack_cred(current_cred());
24982476 
24992477 	return smk_write_rules_list(file, buf, count, ppos, &tsp->smk_rules,
25002478 				    &tsp->smk_rules_lock, SMK_LONG_FMT);
....@@ -2712,14 +2690,14 @@
27122690 
27132691 static void *relabel_self_seq_start(struct seq_file *s, loff_t *pos)
27142692 {
2715
-	struct task_smack *tsp = current_security();
2693
+	struct task_smack *tsp = smack_cred(current_cred());
27162694 
27172695 	return smk_seq_start(s, pos, &tsp->smk_relabel);
27182696 }
27192697 
27202698 static void *relabel_self_seq_next(struct seq_file *s, void *v, loff_t *pos)
27212699 {
2722
-	struct task_smack *tsp = current_security();
2700
+	struct task_smack *tsp = smack_cred(current_cred());
27232701 
27242702 	return smk_seq_next(s, v, pos, &tsp->smk_relabel);
27252703 }
....@@ -2802,7 +2780,7 @@
28022780 			rc = -ENOMEM;
28032781 			goto out;
28042782 		}
2805
-		tsp = new->security;
2783
+		tsp = smack_cred(new);
28062784 		smk_destroy_label_list(&tsp->smk_relabel);
28072785 		list_splice(&list_tmp, &tsp->smk_relabel);
28082786 		commit_creds(new);
....@@ -2886,17 +2864,15 @@
28862864 /**
28872865  * smk_fill_super - fill the smackfs superblock
28882866  * @sb: the empty superblock
2889
- * @data: unused
2890
- * @silent: unused
2867
+ * @fc: unused
28912868  *
28922869  * Fill in the well known entries for the smack filesystem
28932870  *
28942871  * Returns 0 on success, an error code on failure
28952872  */
2896
-static int smk_fill_super(struct super_block *sb, void *data, int silent)
2873
+static int smk_fill_super(struct super_block *sb, struct fs_context *fc)
28972874 {
28982875 	int rc;
2899
-	struct inode *root_inode;
29002876 
29012877 	static const struct tree_descr smack_files[] = {
29022878 		[SMK_LOAD] = {
....@@ -2960,44 +2936,43 @@
29602936 		return rc;
29612937 	}
29622938 
2963
-	root_inode = d_inode(sb->s_root);
2964
-
29652939 	return 0;
29662940 }
29672941 
29682942 /**
2969
- * smk_mount - get the smackfs superblock
2970
- * @fs_type: passed along without comment
2971
- * @flags: passed along without comment
2972
- * @dev_name: passed along without comment
2973
- * @data: passed along without comment
2943
+ * smk_get_tree - get the smackfs superblock
2944
+ * @fc: The mount context, including any options
29742945  *
29752946  * Just passes everything along.
29762947  *
29772948  * Returns what the lower level code does.
29782949  */
2979
-static struct dentry *smk_mount(struct file_system_type *fs_type,
2980
-		      int flags, const char *dev_name, void *data)
2950
+static int smk_get_tree(struct fs_context *fc)
29812951 {
2982
-	return mount_single(fs_type, flags, data, smk_fill_super);
2952
+	return get_tree_single(fc, smk_fill_super);
2953
+}
2954
+
2955
+static const struct fs_context_operations smk_context_ops = {
2956
+	.get_tree	= smk_get_tree,
2957
+};
2958
+
2959
+/**
2960
+ * smk_init_fs_context - Initialise a filesystem context for smackfs
2961
+ * @fc: The blank mount context
2962
+ */
2963
+static int smk_init_fs_context(struct fs_context *fc)
2964
+{
2965
+	fc->ops = &smk_context_ops;
2966
+	return 0;
29832967 }
29842968 
29852969 static struct file_system_type smk_fs_type = {
29862970 	.name		= "smackfs",
2987
-	.mount		= smk_mount,
2971
+	.init_fs_context = smk_init_fs_context,
29882972 	.kill_sb	= kill_litter_super,
29892973 };
29902974 
29912975 static struct vfsmount *smackfs_mount;
2992
-
2993
-static int __init smk_preset_netlabel(struct smack_known *skp)
2994
-{
2995
-	skp->smk_netlabel.domain = skp->smk_known;
2996
-	skp->smk_netlabel.flags =
2997
-		NETLBL_SECATTR_DOMAIN | NETLBL_SECATTR_MLS_LVL;
2998
-	return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
2999
-				&skp->smk_netlabel, strlen(skp->smk_known));
3000
-}
30012976 
30022977 /**
30032978  * init_smk_fs - get the smackfs superblock
....@@ -3037,19 +3012,19 @@
30373012 	smk_cipso_doi();
30383013 	smk_unlbl_ambient(NULL);
30393014 
3040
-	rc = smk_preset_netlabel(&smack_known_floor);
3015
+	rc = smack_populate_secattr(&smack_known_floor);
30413016 	if (err == 0 && rc < 0)
30423017 		err = rc;
3043
-	rc = smk_preset_netlabel(&smack_known_hat);
3018
+	rc = smack_populate_secattr(&smack_known_hat);
30443019 	if (err == 0 && rc < 0)
30453020 		err = rc;
3046
-	rc = smk_preset_netlabel(&smack_known_huh);
3021
+	rc = smack_populate_secattr(&smack_known_huh);
30473022 	if (err == 0 && rc < 0)
30483023 		err = rc;
3049
-	rc = smk_preset_netlabel(&smack_known_star);
3024
+	rc = smack_populate_secattr(&smack_known_star);
30503025 	if (err == 0 && rc < 0)
30513026 		err = rc;
3052
-	rc = smk_preset_netlabel(&smack_known_web);
3027
+	rc = smack_populate_secattr(&smack_known_web);
30533028 	if (err == 0 && rc < 0)
30543029 		err = rc;
30553030