Orange Pi5 kernel

^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   1) /* SPDX-License-Identifier: GPL-2.0-only */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   3)  * Copyright (C) 2007 Casey Schaufler <casey@schaufler-ca.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   4)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   5)  * Author:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   6)  *      Casey Schaufler <casey@schaufler-ca.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   7)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   8) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300   9) #ifndef _SECURITY_SMACK_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  10) #define _SECURITY_SMACK_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  11) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  12) #include <linux/capability.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  13) #include <linux/spinlock.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  14) #include <linux/lsm_hooks.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  15) #include <linux/in.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  16) #if IS_ENABLED(CONFIG_IPV6)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  17) #include <linux/in6.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  18) #endif /* CONFIG_IPV6 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  19) #include <net/netlabel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  20) #include <linux/list.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  21) #include <linux/rculist.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  22) #include <linux/lsm_audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  23) #include <linux/msg.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  24) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  25) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  26)  * Use IPv6 port labeling if IPv6 is enabled and secmarks
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  27)  * are not being used.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  28)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  29) #if IS_ENABLED(CONFIG_IPV6) && !defined(CONFIG_SECURITY_SMACK_NETFILTER)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  30) #define SMACK_IPV6_PORT_LABELING 1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  31) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  32) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  33) #if IS_ENABLED(CONFIG_IPV6) && defined(CONFIG_SECURITY_SMACK_NETFILTER)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  34) #define SMACK_IPV6_SECMARK_LABELING 1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  35) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  36) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  37) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  38)  * Smack labels were limited to 23 characters for a long time.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  39)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  40) #define SMK_LABELLEN	24
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  41) #define SMK_LONGLABEL	256
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  42) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  43) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  44)  * This is the repository for labels seen so that it is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  45)  * not necessary to keep allocating tiny chuncks of memory
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  46)  * and so that they can be shared.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  47)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  48)  * Labels are never modified in place. Anytime a label
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  49)  * is imported (e.g. xattrset on a file) the list is checked
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  50)  * for it and it is added if it doesn't exist. The address
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  51)  * is passed out in either case. Entries are added, but
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  52)  * never deleted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  53)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  54)  * Since labels are hanging around anyway it doesn't
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  55)  * hurt to maintain a secid for those awkward situations
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  56)  * where kernel components that ought to use LSM independent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  57)  * interfaces don't. The secid should go away when all of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  58)  * these components have been repaired.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  59)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  60)  * The cipso value associated with the label gets stored here, too.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  61)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  62)  * Keep the access rules for this subject label here so that
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  63)  * the entire set of rules does not need to be examined every
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  64)  * time.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  65)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  66) struct smack_known {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  67) 	struct list_head		list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  68) 	struct hlist_node		smk_hashed;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  69) 	char				*smk_known;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  70) 	u32				smk_secid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  71) 	struct netlbl_lsm_secattr	smk_netlabel;	/* on wire labels */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  72) 	struct list_head		smk_rules;	/* access rules */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  73) 	struct mutex			smk_rules_lock;	/* lock for rules */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  74) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  75) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  76) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  77)  * Maximum number of bytes for the levels in a CIPSO IP option.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  78)  * Why 23? CIPSO is constrained to 30, so a 32 byte buffer is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  79)  * bigger than can be used, and 24 is the next lower multiple
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  80)  * of 8, and there are too many issues if there isn't space set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  81)  * aside for the terminating null byte.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  82)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  83) #define SMK_CIPSOLEN	24
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  84) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  85) struct superblock_smack {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  86) 	struct smack_known	*smk_root;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  87) 	struct smack_known	*smk_floor;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  88) 	struct smack_known	*smk_hat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  89) 	struct smack_known	*smk_default;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  90) 	int			smk_flags;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  91) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  92) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  93) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  94)  * Superblock flags
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  95)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  96) #define SMK_SB_INITIALIZED	0x01
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  97) #define SMK_SB_UNTRUSTED	0x02
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  98) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300  99) struct socket_smack {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) 	struct smack_known	*smk_out;	/* outbound label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) 	struct smack_known	*smk_in;	/* inbound label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) 	struct smack_known	*smk_packet;	/* TCP peer label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) 	int			smk_state;	/* netlabel socket states */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) #define	SMK_NETLBL_UNSET	0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) #define	SMK_NETLBL_UNLABELED	1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) #define	SMK_NETLBL_LABELED	2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) #define	SMK_NETLBL_REQSKB	3
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111)  * Inode smack data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) struct inode_smack {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) 	struct smack_known	*smk_inode;	/* label of the fso */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) 	struct smack_known	*smk_task;	/* label of the task */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) 	struct smack_known	*smk_mmap;	/* label of the mmap domain */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) 	int			smk_flags;	/* smack inode flags */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) struct task_smack {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) 	struct smack_known	*smk_task;	/* label for access control */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) 	struct smack_known	*smk_forked;	/* label when forked */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) 	struct list_head	smk_rules;	/* per task access rules */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) 	struct mutex		smk_rules_lock;	/* lock for the rules */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) 	struct list_head	smk_relabel;	/* transit allowed labels */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) #define	SMK_INODE_INSTANT	0x01	/* inode is instantiated */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) #define	SMK_INODE_TRANSMUTE	0x02	/* directory is transmuting */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) #define	SMK_INODE_CHANGED	0x04	/* smack was transmuted */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) #define	SMK_INODE_IMPURE	0x08	/* involved in an impure transaction */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134)  * A label access rule.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) struct smack_rule {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) 	struct list_head	list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) 	struct smack_known	*smk_subject;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) 	struct smack_known	*smk_object;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) 	int			smk_access;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144)  * An entry in the table identifying IPv4 hosts.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) struct smk_net4addr {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) 	struct list_head	list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) 	struct in_addr		smk_host;	/* network address */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) 	struct in_addr		smk_mask;	/* network mask */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) 	int			smk_masks;	/* mask size */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) 	struct smack_known	*smk_label;	/* label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155)  * An entry in the table identifying IPv6 hosts.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) struct smk_net6addr {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) 	struct list_head	list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) 	struct in6_addr		smk_host;	/* network address */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) 	struct in6_addr		smk_mask;	/* network mask */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) 	int			smk_masks;	/* mask size */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) 	struct smack_known	*smk_label;	/* label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166)  * An entry in the table identifying ports.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) struct smk_port_label {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) 	struct list_head	list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) 	struct sock		*smk_sock;	/* socket initialized on */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) 	unsigned short		smk_port;	/* the port number */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) 	struct smack_known	*smk_in;	/* inbound label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) 	struct smack_known	*smk_out;	/* outgoing label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) 	short			smk_sock_type;	/* Socket type */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) 	short			smk_can_reuse;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) struct smack_known_list_elem {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) 	struct list_head	list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) 	struct smack_known	*smk_label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) /* Super block security struct flags for mount options */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) #define FSDEFAULT_MNT	0x01
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) #define FSFLOOR_MNT	0x02
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) #define FSHAT_MNT	0x04
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) #define FSROOT_MNT	0x08
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) #define FSTRANS_MNT	0x10
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) #define NUM_SMK_MNT_OPTS	5
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) 	Opt_error = -1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194) 	Opt_fsdefault = 0,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) 	Opt_fsfloor = 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) 	Opt_fshat = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) 	Opt_fsroot = 3,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) 	Opt_fstransmute = 4,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) #define SMACK_DELETE_OPTION	"-DELETE"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) #define SMACK_CIPSO_OPTION 	"-CIPSO"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205)  * CIPSO defaults.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) #define SMACK_CIPSO_DOI_DEFAULT		3	/* Historical */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) #define SMACK_CIPSO_DOI_INVALID		-1	/* Not a DOI */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) #define SMACK_CIPSO_DIRECT_DEFAULT	250	/* Arbitrary */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) #define SMACK_CIPSO_MAPPED_DEFAULT	251	/* Also arbitrary */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) #define SMACK_CIPSO_MAXLEVEL            255     /* CIPSO 2.2 standard */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213)  * CIPSO 2.2 standard is 239, but Smack wants to use the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214)  * categories in a structured way that limits the value to
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215)  * the bits in 23 bytes, hence the unusual number.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) #define SMACK_CIPSO_MAXCATNUM           184     /* 23 * 8 */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220)  * Ptrace rules
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) #define SMACK_PTRACE_DEFAULT	0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) #define SMACK_PTRACE_EXACT	1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) #define SMACK_PTRACE_DRACONIAN	2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) #define SMACK_PTRACE_MAX	SMACK_PTRACE_DRACONIAN
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228)  * Flags for untraditional access modes.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229)  * It shouldn't be necessary to avoid conflicts with definitions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230)  * in fs.h, but do so anyway.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) #define MAY_TRANSMUTE	0x00001000	/* Controls directory labeling */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) #define MAY_LOCK	0x00002000	/* Locks should be writes, but ... */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234) #define MAY_BRINGUP	0x00004000	/* Report use of this rule */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237)  * The policy for delivering signals is configurable.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238)  * It is usually "write", but can be "append".
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) #ifdef CONFIG_SECURITY_SMACK_APPEND_SIGNALS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241) #define MAY_DELIVER	MAY_APPEND	/* Signal delivery requires append */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) #define MAY_DELIVER	MAY_WRITE	/* Signal delivery requires write */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246) #define SMACK_BRINGUP_ALLOW		1	/* Allow bringup mode */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) #define SMACK_UNCONFINED_SUBJECT	2	/* Allow unconfined label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) #define SMACK_UNCONFINED_OBJECT		3	/* Allow unconfined label */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251)  * Just to make the common cases easier to deal with
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) #define MAY_ANYREAD	(MAY_READ | MAY_EXEC)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254) #define MAY_READWRITE	(MAY_READ | MAY_WRITE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) #define MAY_NOT		0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258)  * Number of access types used by Smack (rwxatlb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) #define SMK_NUM_ACCESS_TYPE 7
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) /* SMACK data */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263) struct smack_audit_data {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) 	const char *function;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) 	char *subject;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) 	char *object;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) 	char *request;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268) 	int result;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272)  * Smack audit data; is empty if CONFIG_AUDIT not set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273)  * to save some stack
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275) struct smk_audit_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) #ifdef CONFIG_AUDIT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) 	struct common_audit_data a;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) 	struct smack_audit_data sad;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283)  * These functions are in smack_access.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) int smk_access_entry(char *, char *, struct list_head *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286) int smk_access(struct smack_known *, struct smack_known *,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) 	       int, struct smk_audit_info *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) int smk_tskacc(struct task_smack *, struct smack_known *,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) 	       u32, struct smk_audit_info *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) int smk_curacc(struct smack_known *, u32, struct smk_audit_info *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) struct smack_known *smack_from_secid(const u32);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) char *smk_parse_smack(const char *string, int len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293) int smk_netlbl_mls(int, char *, struct netlbl_lsm_secattr *, int);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) struct smack_known *smk_import_entry(const char *, int);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) void smk_insert_entry(struct smack_known *skp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296) struct smack_known *smk_find_entry(const char *);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) bool smack_privileged(int cap);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) bool smack_privileged_cred(int cap, const struct cred *cred);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) void smk_destroy_label_list(struct list_head *list);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300) int smack_populate_secattr(struct smack_known *skp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303)  * Shared data.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) extern int smack_enabled;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) extern int smack_cipso_direct;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) extern int smack_cipso_mapped;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308) extern struct smack_known *smack_net_ambient;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) extern struct smack_known *smack_syslog_label;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) #ifdef CONFIG_SECURITY_SMACK_BRINGUP
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) extern struct smack_known *smack_unconfined;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) extern int smack_ptrace_rule;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) extern struct lsm_blob_sizes smack_blob_sizes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) extern struct smack_known smack_known_floor;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) extern struct smack_known smack_known_hat;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) extern struct smack_known smack_known_huh;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) extern struct smack_known smack_known_star;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) extern struct smack_known smack_known_web;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) extern struct mutex	smack_known_lock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) extern struct list_head smack_known_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) extern struct list_head smk_net4addr_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) extern struct list_head smk_net6addr_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) extern struct mutex     smack_onlycap_lock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) extern struct list_head smack_onlycap_list;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330) #define SMACK_HASH_SLOTS 16
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) extern struct hlist_head smack_known_hash[SMACK_HASH_SLOTS];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) extern struct kmem_cache *smack_rule_cache;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) static inline struct task_smack *smack_cred(const struct cred *cred)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) 	return cred->security + smack_blob_sizes.lbs_cred;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) static inline struct smack_known **smack_file(const struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341) 	return (struct smack_known **)(file->f_security +
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) 				       smack_blob_sizes.lbs_file);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345) static inline struct inode_smack *smack_inode(const struct inode *inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) 	return inode->i_security + smack_blob_sizes.lbs_inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350) static inline struct smack_known **smack_msg_msg(const struct msg_msg *msg)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) 	return msg->security + smack_blob_sizes.lbs_msg_msg;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) 	return ipc->security + smack_blob_sizes.lbs_ipc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361)  * Is the directory transmuting?
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) static inline int smk_inode_transmutable(const struct inode *isp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) 	struct inode_smack *sip = smack_inode(isp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366) 	return (sip->smk_flags & SMK_INODE_TRANSMUTE) != 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370)  * Present a pointer to the smack label entry in an inode blob.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) static inline struct smack_known *smk_of_inode(const struct inode *isp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) 	struct inode_smack *sip = smack_inode(isp);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) 	return sip->smk_inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379)  * Present a pointer to the smack label entry in an task blob.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381) static inline struct smack_known *smk_of_task(const struct task_smack *tsp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) 	return tsp->smk_task;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386) static inline struct smack_known *smk_of_task_struct(
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) 						const struct task_struct *t)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) 	struct smack_known *skp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) 	const struct cred *cred;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) 	rcu_read_lock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) 	cred = __task_cred(t);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) 	skp = smk_of_task(smack_cred(cred));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) 	rcu_read_unlock();
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) 	return skp;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403)  * Present a pointer to the forked smack label entry in an task blob.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) static inline struct smack_known *smk_of_forked(const struct task_smack *tsp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) 	return tsp->smk_forked;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411)  * Present a pointer to the smack label in the current task blob.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) static inline struct smack_known *smk_of_current(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) 	return smk_of_task(smack_cred(current_cred()));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419)  * logging functions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421) #define SMACK_AUDIT_DENIED 0x1
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) #define SMACK_AUDIT_ACCEPT 0x2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) extern int log_policy;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) void smack_log(char *subject_label, char *object_label,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) 		int request,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427) 		int result, struct smk_audit_info *auditdata);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429) #ifdef CONFIG_AUDIT
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432)  * some inline functions to set up audit data
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433)  * they do nothing if CONFIG_AUDIT is not set
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434)  *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435)  */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437) 			       char type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) 	memset(&a->sad, 0, sizeof(a->sad));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) 	a->a.type = type;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) 	a->a.smack_audit_data = &a->sad;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) 	a->a.smack_audit_data->function = func;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) static inline void smk_ad_init_net(struct smk_audit_info *a, const char *func,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) 				   char type, struct lsm_network_audit *net)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448) 	smk_ad_init(a, func, type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) 	memset(net, 0, sizeof(*net));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450) 	a->a.u.net = net;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) 					 struct task_struct *t)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) 	a->a.u.tsk = t;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458) static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) 						    struct dentry *d)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) 	a->a.u.dentry = d;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464) 					      struct inode *i)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) 	a->a.u.inode = i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) 					     struct path p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) 	a->a.u.path = p;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473) static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) 					    struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) 	a->a.u.net->sk = sk;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479) #else /* no AUDIT */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) static inline void smk_ad_init(struct smk_audit_info *a, const char *func,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482) 			       char type)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) static inline void smk_ad_setfield_u_tsk(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486) 					 struct task_struct *t)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489) static inline void smk_ad_setfield_u_fs_path_dentry(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) 						    struct dentry *d)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) static inline void smk_ad_setfield_u_fs_inode(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494) 					      struct inode *i)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) static inline void smk_ad_setfield_u_fs_path(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) 					     struct path p)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) static inline void smk_ad_setfield_u_net_sk(struct smk_audit_info *a,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) 					    struct sock *sk)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) 
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) #endif  /* _SECURITY_SMACK_H */