diff options
| -rw-r--r-- | security/smack/smack_lsm.c | 61 |
1 files changed, 61 insertions, 0 deletions
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 8e6c1e3dba5e..c2001be070c1 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -42,6 +42,7 @@ #include <linux/shm.h> #include <linux/binfmts.h> #include <linux/parser.h> +#include <kdbus/connection.h> #include "smack.h" #define TRANS_TRUE "TRUE" @@ -3607,6 +3608,60 @@ static int smack_setprocattr(struct task_struct *p, char *name, return size; } +#ifdef CONFIG_KDBUS + +/** + * smack_kdbus_conn_alloc - Set the security blob for a KDBus connection + * @conn: the connection + * + * Returns 0 + */ +static int smack_kdbus_conn_alloc(struct kdbus_conn *conn) +{ + conn->security = smk_of_current(); + + return 0; +} + +/** + * smack_kdbus_conn_free - Clear the security blob for a KDBus connection + * @conn: the connection + * + * Clears the blob pointer + */ +static void smack_kdbus_conn_free(struct kdbus_conn *conn) +{ + conn->security = NULL; +} + +/** + * smack_kdbus_talk - Smack access on KDBus + * @src: source kdbus connection + * @dst: destination kdbus connection + * + * Return 0 if a subject with the smack of sock could access + * an object with the smack of other, otherwise an error code + */ +static int smack_kdbus_talk(const struct kdbus_conn *src, + const struct kdbus_conn *dst) +{ + struct smk_audit_info ad; + struct smack_known *sskp = src->security; + struct smack_known *dskp = dst->security; + int rc; + + if (smack_privileged(CAP_MAC_OVERRIDE)) + return 0; + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NONE); + + rc = smk_access(sskp, dskp, MAY_WRITE, &ad); + rc = smk_bu_note("kdbus talk", sskp, dskp, MAY_WRITE, rc); + return rc; +} + +#endif /* CONFIG_KDBUS */ + /** * smack_unix_stream_connect - Smack access on UDS * @sock: one sock @@ -4628,6 +4683,12 @@ struct security_operations smack_ops = { .getprocattr = smack_getprocattr, .setprocattr = smack_setprocattr, +#ifdef CONFIG_KDBUS + .kdbus_conn_alloc = smack_kdbus_conn_alloc, + .kdbus_conn_free = smack_kdbus_conn_free, + .kdbus_talk = smack_kdbus_talk, +#endif + .unix_stream_connect = smack_unix_stream_connect, .unix_may_send = smack_unix_may_send, |