security/smack/smack_access.c

Source file repositories/reference/linux-study-clean/security/smack/smack_access.c

File Facts

System
Linux kernel
Corpus path
security/smack/smack_access.c
Extension
.c
Size
19568 bytes
Lines
757
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: implementation source
Status
source implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

if (rc < 0) {
				netlbl_catmap_free(sap->attr.mls.cat);
				return rc;
			}
		}

	return 0;
}

/**
 * smack_populate_secattr - fill in the smack_known netlabel information
 * @skp: pointer to the structure to fill
 *
 * Populate the netlabel secattr structure for a Smack label.
 *
 * Returns 0 unless creating the category mapping fails
 */
int smack_populate_secattr(struct smack_known *skp)
{
	int slen;

	skp->smk_netlabel.attr.secid = skp->smk_secid;
	skp->smk_netlabel.domain = skp->smk_known;
	skp->smk_netlabel.cache = netlbl_secattr_cache_alloc(GFP_ATOMIC);
	if (skp->smk_netlabel.cache != NULL) {
		skp->smk_netlabel.flags |= NETLBL_SECATTR_CACHE;
		skp->smk_netlabel.cache->free = NULL;
		skp->smk_netlabel.cache->data = skp;
	}
	skp->smk_netlabel.flags |= NETLBL_SECATTR_SECID |
				   NETLBL_SECATTR_MLS_LVL |
				   NETLBL_SECATTR_DOMAIN;
	/*
	 * If direct labeling works use it.
	 * Otherwise use mapped labeling.
	 */
	slen = strlen(skp->smk_known);
	if (slen < SMK_CIPSOLEN)
		return smk_netlbl_mls(smack_cipso_direct, skp->smk_known,
				      &skp->smk_netlabel, slen);

	return smk_netlbl_mls(smack_cipso_mapped, (char *)&skp->smk_secid,
			      &skp->smk_netlabel, sizeof(skp->smk_secid));
}

/**
 * smk_import_valid_allocated_label - import a label, return the list entry
 * @smack: a text string that is a valid Smack label and may be kfree()ed.
 *         It is consumed: either becomes a part of the entry or kfree'ed.
 * @gfp: Allocation type
 *
 * Returns: see description of smk_import_entry()
 */
static struct smack_known *
smk_import_allocated_label(char *smack, gfp_t gfp)
{
	struct smack_known *skp;
	int rc;

	mutex_lock(&smack_known_lock);

	skp = smk_find_entry(smack);
	if (skp != NULL)
		goto freeout;

	skp = kzalloc_obj(*skp, gfp);
	if (skp == NULL) {
		skp = ERR_PTR(-ENOMEM);
		goto freeout;
	}

	skp->smk_known = smack;
	skp->smk_secid = smack_next_secid++;

	rc = smack_populate_secattr(skp);
	if (rc >= 0) {
		INIT_LIST_HEAD(&skp->smk_rules);
		mutex_init(&skp->smk_rules_lock);
		/*
		 * Make sure that the entry is actually
		 * filled before putting it on the list.
		 */
		smk_insert_entry(skp);
		goto unlockout;
	}
	kfree(skp);
	skp = ERR_PTR(rc);
freeout:
	kfree(smack);
unlockout:

Annotation

Implementation Notes