security/smack/smackfs.c

Source file repositories/reference/linux-study-clean/security/smack/smackfs.c

File Facts

System
Linux kernel
Corpus path
security/smack/smackfs.c
Extension
.c
Size
71713 bytes
Lines
3045
Domain
Core OS
Bucket
Security And Isolation
Inferred role
Core OS: operation-table or driver-model contract
Status
pattern implementation candidate

Why This File Exists

Core operating-system implementation surface: boot, tasks, memory, VFS, syscall-facing interfaces, synchronization, credentials, and isolation.

Dependency Surface

Detected Declarations

Annotated Snippet

static const struct file_operations smk_load_ops = {
	.open           = smk_open_load,
	.read		= seq_read,
	.llseek         = seq_lseek,
	.write		= smk_write_load,
	.release        = seq_release,
};

/**
 * smk_cipso_doi - set netlabel maps
 * @ndoi: new value for our CIPSO DOI
 * @gfp_flags: kmalloc allocation context
 */
static int
smk_cipso_doi(u32 ndoi, gfp_t gfp_flags)
{
	int rc = 0;
	struct cipso_v4_doi *doip;
	struct netlbl_audit nai;

	mutex_lock(&smk_cipso_doi_lock);

	if (smk_cipso_doi_value == ndoi)
		goto clr_doi_lock;

	smk_netlabel_audit_set(&nai);

	doip = kmalloc_obj(struct cipso_v4_doi, gfp_flags);
	if (!doip) {
		rc = -ENOMEM;
		goto clr_doi_lock;
	}
	doip->map.std = NULL;
	doip->doi = ndoi;
	doip->type = CIPSO_V4_MAP_PASS;
	doip->tags[0] = CIPSO_V4_TAG_RBITMAP;
	for (rc = 1; rc < CIPSO_V4_TAG_MAXCNT; rc++)
		doip->tags[rc] = CIPSO_V4_TAG_INVALID;

	rc = netlbl_cfg_cipsov4_add(doip, &nai);
	if (rc) {
		kfree(doip);
		goto clr_doi_lock;
	}

	if (smk_cipso_doi_value != CIPSO_V4_DOI_UNKNOWN) {
		rc = netlbl_cfg_map_del(NULL, PF_INET, NULL, NULL, &nai);
		if (rc && rc != -ENOENT)
			goto clr_ndoi_def;

		netlbl_cfg_cipsov4_del(smk_cipso_doi_value, &nai);
	}

	rc = netlbl_cfg_cipsov4_map_add(ndoi, NULL, NULL, NULL, &nai);
	if (rc) {
		smk_cipso_doi_value = CIPSO_V4_DOI_UNKNOWN; // no default map
clr_ndoi_def:	netlbl_cfg_cipsov4_del(ndoi, &nai);
	} else
		smk_cipso_doi_value = ndoi;

clr_doi_lock:
	mutex_unlock(&smk_cipso_doi_lock);
	return rc;
}

/**
 * smk_unlbl_ambient - initialize the unlabeled domain
 * @oldambient: previous domain string
 */
static void smk_unlbl_ambient(char *oldambient)
{
	int rc;
	struct netlbl_audit nai;

	smk_netlabel_audit_set(&nai);

	if (oldambient != NULL) {
		rc = netlbl_cfg_map_del(oldambient, PF_INET, NULL, NULL, &nai);
		if (rc != 0)
			printk(KERN_WARNING "%s:%d remove rc = %d\n",
			       __func__, __LINE__, rc);
	}
	if (smack_net_ambient == NULL)
		smack_net_ambient = &smack_known_floor;

	rc = netlbl_cfg_unlbl_map_add(smack_net_ambient->smk_known, PF_INET,
				      NULL, NULL, &nai);
	if (rc != 0)
		printk(KERN_WARNING "%s:%d add rc = %d\n",
		       __func__, __LINE__, rc);

Annotation

Implementation Notes