862 lines · plain
1=====2Smack3=====4 5 6 "Good for you, you've decided to clean the elevator!"7 - The Elevator, from Dark Star8 9Smack is the Simplified Mandatory Access Control Kernel.10Smack is a kernel based implementation of mandatory access11control that includes simplicity in its primary design goals.12 13Smack is not the only Mandatory Access Control scheme14available for Linux. Those new to Mandatory Access Control15are encouraged to compare Smack with the other mechanisms16available to determine which is best suited to the problem17at hand.18 19Smack consists of three major components:20 21 - The kernel22 - Basic utilities, which are helpful but not required23 - Configuration data24 25The kernel component of Smack is implemented as a Linux26Security Modules (LSM) module. It requires netlabel and27works best with file systems that support extended attributes,28although xattr support is not strictly required.29It is safe to run a Smack kernel under a "vanilla" distribution.30 31Smack kernels use the CIPSO IP option. Some network32configurations are intolerant of IP options and can impede33access to systems that use them as Smack does.34 35Smack is used in the Tizen operating system. Please36go to http://wiki.tizen.org for information about how37Smack is used in Tizen.38 39The current git repository for Smack user space is:40 41 git://github.com/smack-team/smack.git42 43This should make and install on most modern distributions.44There are five commands included in smackutil:45 46chsmack:47 display or set Smack extended attribute values48 49smackctl:50 load the Smack access rules51 52smackaccess:53 report if a process with one label has access54 to an object with another55 56These two commands are obsolete with the introduction of57the smackfs/load2 and smackfs/cipso2 interfaces.58 59smackload:60 properly formats data for writing to smackfs/load61 62smackcipso:63 properly formats data for writing to smackfs/cipso64 65In keeping with the intent of Smack, configuration data is66minimal and not strictly required. The most important67configuration step is mounting the smackfs pseudo filesystem.68If smackutil is installed the startup script will take care69of this, but it can be manually as well.70 71Add this line to ``/etc/fstab``::72 73 smackfs /sys/fs/smackfs smackfs defaults 0 074 75The ``/sys/fs/smackfs`` directory is created by the kernel.76 77Smack uses extended attributes (xattrs) to store labels on filesystem78objects. The attributes are stored in the extended attribute security79name space. A process must have ``CAP_MAC_ADMIN`` to change any of these80attributes.81 82The extended attributes that Smack uses are:83 84SMACK6485 Used to make access control decisions. In almost all cases86 the label given to a new filesystem object will be the label87 of the process that created it.88 89SMACK64EXEC90 The Smack label of a process that execs a program file with91 this attribute set will run with this attribute's value.92 93SMACK64MMAP94 Don't allow the file to be mmapped by a process whose Smack95 label does not allow all of the access permitted to a process96 with the label contained in this attribute. This is a very97 specific use case for shared libraries.98 99SMACK64TRANSMUTE100 Can only have the value "TRUE". If this attribute is present101 on a directory when an object is created in the directory and102 the Smack rule (more below) that permitted the write access103 to the directory includes the transmute ("t") mode the object104 gets the label of the directory instead of the label of the105 creating process. If the object being created is a directory106 the SMACK64TRANSMUTE attribute is set as well.107 108SMACK64IPIN109 This attribute is only available on file descriptors for sockets.110 Use the Smack label in this attribute for access control111 decisions on packets being delivered to this socket.112 113SMACK64IPOUT114 This attribute is only available on file descriptors for sockets.115 Use the Smack label in this attribute for access control116 decisions on packets coming from this socket.117 118There are multiple ways to set a Smack label on a file::119 120 # attr -S -s SMACK64 -V "value" path121 # chsmack -a value path122 123A process can see the Smack label it is running with by124reading ``/proc/self/attr/current``. A process with ``CAP_MAC_ADMIN``125can set the process Smack by writing there.126 127Most Smack configuration is accomplished by writing to files128in the smackfs filesystem. This pseudo-filesystem is mounted129on ``/sys/fs/smackfs``.130 131access132 Provided for backward compatibility. The access2 interface133 is preferred and should be used instead.134 This interface reports whether a subject with the specified135 Smack label has a particular access to an object with a136 specified Smack label. Write a fixed format access rule to137 this file. The next read will indicate whether the access138 would be permitted. The text will be either "1" indicating139 access, or "0" indicating denial.140 141access2142 This interface reports whether a subject with the specified143 Smack label has a particular access to an object with a144 specified Smack label. Write a long format access rule to145 this file. The next read will indicate whether the access146 would be permitted. The text will be either "1" indicating147 access, or "0" indicating denial.148 149ambient150 This contains the Smack label applied to unlabeled network151 packets.152 153change-rule154 This interface allows modification of existing access control rules.155 The format accepted on write is::156 157 "%s %s %s %s"158 159 where the first string is the subject label, the second the160 object label, the third the access to allow and the fourth the161 access to deny. The access strings may contain only the characters162 "rwxat-". If a rule for a given subject and object exists it will be163 modified by enabling the permissions in the third string and disabling164 those in the fourth string. If there is no such rule it will be165 created using the access specified in the third and the fourth strings.166 167cipso168 Provided for backward compatibility. The cipso2 interface169 is preferred and should be used instead.170 This interface allows a specific CIPSO header to be assigned171 to a Smack label. The format accepted on write is::172 173 "%24s%4d%4d"["%4d"]...174 175 The first string is a fixed Smack label. The first number is176 the level to use. The second number is the number of categories.177 The following numbers are the categories::178 179 "level-3-cats-5-19 3 2 5 19"180 181cipso2182 This interface allows a specific CIPSO header to be assigned183 to a Smack label. The format accepted on write is::184 185 "%s%4d%4d"["%4d"]...186 187 The first string is a long Smack label. The first number is188 the level to use. The second number is the number of categories.189 The following numbers are the categories::190 191 "level-3-cats-5-19 3 2 5 19"192 193direct194 This contains the CIPSO level used for Smack direct label195 representation in network packets.196 197doi198 This contains the CIPSO domain of interpretation used in199 network packets.200 201ipv6host202 This interface allows specific IPv6 internet addresses to be203 treated as single label hosts. Packets are sent to single204 label hosts only from processes that have Smack write access205 to the host label. All packets received from single label hosts206 are given the specified label. The format accepted on write is::207 208 "%h:%h:%h:%h:%h:%h:%h:%h label" or209 "%h:%h:%h:%h:%h:%h:%h:%h/%d label".210 211 The "::" address shortcut is not supported.212 If label is "-DELETE" a matched entry will be deleted.213 214load215 Provided for backward compatibility. The load2 interface216 is preferred and should be used instead.217 This interface allows access control rules in addition to218 the system defined rules to be specified. The format accepted219 on write is::220 221 "%24s%24s%5s"222 223 where the first string is the subject label, the second the224 object label, and the third the requested access. The access225 string may contain only the characters "rwxat-", and specifies226 which sort of access is allowed. The "-" is a placeholder for227 permissions that are not allowed. The string "r-x--" would228 specify read and execute access. Labels are limited to 23229 characters in length.230 231load2232 This interface allows access control rules in addition to233 the system defined rules to be specified. The format accepted234 on write is::235 236 "%s %s %s"237 238 where the first string is the subject label, the second the239 object label, and the third the requested access. The access240 string may contain only the characters "rwxat-", and specifies241 which sort of access is allowed. The "-" is a placeholder for242 permissions that are not allowed. The string "r-x--" would243 specify read and execute access.244 245load-self246 Provided for backward compatibility. The load-self2 interface247 is preferred and should be used instead.248 This interface allows process specific access rules to be249 defined. These rules are only consulted if access would250 otherwise be permitted, and are intended to provide additional251 restrictions on the process. The format is the same as for252 the load interface.253 254load-self2255 This interface allows process specific access rules to be256 defined. These rules are only consulted if access would257 otherwise be permitted, and are intended to provide additional258 restrictions on the process. The format is the same as for259 the load2 interface.260 261logging262 This contains the Smack logging state.263 264mapped265 This contains the CIPSO level used for Smack mapped label266 representation in network packets.267 268netlabel269 This interface allows specific internet addresses to be270 treated as single label hosts. Packets are sent to single271 label hosts without CIPSO headers, but only from processes272 that have Smack write access to the host label. All packets273 received from single label hosts are given the specified274 label. The format accepted on write is::275 276 "%d.%d.%d.%d label" or "%d.%d.%d.%d/%d label".277 278 If the label specified is "-CIPSO" the address is treated279 as a host that supports CIPSO headers.280 281onlycap282 This contains labels processes must have for CAP_MAC_ADMIN283 and ``CAP_MAC_OVERRIDE`` to be effective. If this file is empty284 these capabilities are effective at for processes with any285 label. The values are set by writing the desired labels, separated286 by spaces, to the file or cleared by writing "-" to the file.287 288ptrace289 This is used to define the current ptrace policy290 291 0 - default:292 this is the policy that relies on Smack access rules.293 For the ``PTRACE_READ`` a subject needs to have a read access on294 object. For the ``PTRACE_ATTACH`` a read-write access is required.295 296 1 - exact:297 this is the policy that limits ``PTRACE_ATTACH``. Attach is298 only allowed when subject's and object's labels are equal.299 ``PTRACE_READ`` is not affected. Can be overridden with ``CAP_SYS_PTRACE``.300 301 2 - draconian:302 this policy behaves like the 'exact' above with an303 exception that it can't be overridden with ``CAP_SYS_PTRACE``.304 305revoke-subject306 Writing a Smack label here sets the access to '-' for all access307 rules with that subject label.308 309unconfined310 If the kernel is configured with ``CONFIG_SECURITY_SMACK_BRINGUP``311 a process with ``CAP_MAC_ADMIN`` can write a label into this interface.312 Thereafter, accesses that involve that label will be logged and313 the access permitted if it wouldn't be otherwise. Note that this314 is dangerous and can ruin the proper labeling of your system.315 It should never be used in production.316 317relabel-self318 This interface contains a list of labels to which the process can319 transition to, by writing to ``/proc/self/attr/current``.320 Normally a process can change its own label to any legal value, but only321 if it has ``CAP_MAC_ADMIN``. This interface allows a process without322 ``CAP_MAC_ADMIN`` to relabel itself to one of labels from predefined list.323 A process without ``CAP_MAC_ADMIN`` can change its label only once. When it324 does, this list will be cleared.325 The values are set by writing the desired labels, separated326 by spaces, to the file or cleared by writing "-" to the file.327 328If you are using the smackload utility329you can add access rules in ``/etc/smack/accesses``. They take the form::330 331 subjectlabel objectlabel access332 333access is a combination of the letters rwxatb which specify the334kind of access permitted a subject with subjectlabel on an335object with objectlabel. If there is no rule no access is allowed.336 337Look for additional programs on http://schaufler-ca.com338 339The Simplified Mandatory Access Control Kernel (Whitepaper)340===========================================================341 342Casey Schaufler343casey@schaufler-ca.com344 345Mandatory Access Control346------------------------347 348Computer systems employ a variety of schemes to constrain how information is349shared among the people and services using the machine. Some of these schemes350allow the program or user to decide what other programs or users are allowed351access to pieces of data. These schemes are called discretionary access352control mechanisms because the access control is specified at the discretion353of the user. Other schemes do not leave the decision regarding what a user or354program can access up to users or programs. These schemes are called mandatory355access control mechanisms because you don't have a choice regarding the users356or programs that have access to pieces of data.357 358Bell & LaPadula359---------------360 361From the middle of the 1980's until the turn of the century Mandatory Access362Control (MAC) was very closely associated with the Bell & LaPadula security363model, a mathematical description of the United States Department of Defense364policy for marking paper documents. MAC in this form enjoyed a following365within the Capital Beltway and Scandinavian supercomputer centers but was366often sited as failing to address general needs.367 368Domain Type Enforcement369-----------------------370 371Around the turn of the century Domain Type Enforcement (DTE) became popular.372This scheme organizes users, programs, and data into domains that are373protected from each other. This scheme has been widely deployed as a component374of popular Linux distributions. The administrative overhead required to375maintain this scheme and the detailed understanding of the whole system376necessary to provide a secure domain mapping leads to the scheme being377disabled or used in limited ways in the majority of cases.378 379Smack380-----381 382Smack is a Mandatory Access Control mechanism designed to provide useful MAC383while avoiding the pitfalls of its predecessors. The limitations of Bell &384LaPadula are addressed by providing a scheme whereby access can be controlled385according to the requirements of the system and its purpose rather than those386imposed by an arcane government policy. The complexity of Domain Type387Enforcement and avoided by defining access controls in terms of the access388modes already in use.389 390Smack Terminology391-----------------392 393The jargon used to talk about Smack will be familiar to those who have dealt394with other MAC systems and shouldn't be too difficult for the uninitiated to395pick up. There are four terms that are used in a specific way and that are396especially important:397 398 Subject:399 A subject is an active entity on the computer system.400 On Smack a subject is a task, which is in turn the basic unit401 of execution.402 403 Object:404 An object is a passive entity on the computer system.405 On Smack files of all types, IPC, and tasks can be objects.406 407 Access:408 Any attempt by a subject to put information into or get409 information from an object is an access.410 411 Label:412 Data that identifies the Mandatory Access Control413 characteristics of a subject or an object.414 415These definitions are consistent with the traditional use in the security416community. There are also some terms from Linux that are likely to crop up:417 418 Capability:419 A task that possesses a capability has permission to420 violate an aspect of the system security policy, as identified by421 the specific capability. A task that possesses one or more422 capabilities is a privileged task, whereas a task with no423 capabilities is an unprivileged task.424 425 Privilege:426 A task that is allowed to violate the system security427 policy is said to have privilege. As of this writing a task can428 have privilege either by possessing capabilities or by having an429 effective user of root.430 431Smack Basics432------------433 434Smack is an extension to a Linux system. It enforces additional restrictions435on what subjects can access which objects, based on the labels attached to436each of the subject and the object.437 438Labels439~~~~~~440 441Smack labels are ASCII character strings. They can be up to 255 characters442long, but keeping them to twenty-three characters is recommended.443Single character labels using special characters, that being anything444other than a letter or digit, are reserved for use by the Smack development445team. Smack labels are unstructured, case sensitive, and the only operation446ever performed on them is comparison for equality. Smack labels cannot447contain unprintable characters, the "/" (slash), the "\" (backslash), the "'"448(quote) and '"' (double-quote) characters.449Smack labels cannot begin with a '-'. This is reserved for special options.450 451There are some predefined labels::452 453 _ Pronounced "floor", a single underscore character.454 ^ Pronounced "hat", a single circumflex character.455 * Pronounced "star", a single asterisk character.456 ? Pronounced "huh", a single question mark character.457 @ Pronounced "web", a single at sign character.458 459Every task on a Smack system is assigned a label. The Smack label460of a process will usually be assigned by the system initialization461mechanism.462 463Access Rules464~~~~~~~~~~~~465 466Smack uses the traditional access modes of Linux. These modes are read,467execute, write, and occasionally append. There are a few cases where the468access mode may not be obvious. These include:469 470 Signals:471 A signal is a write operation from the subject task to472 the object task.473 474 Internet Domain IPC:475 Transmission of a packet is considered a476 write operation from the source task to the destination task.477 478Smack restricts access based on the label attached to a subject and the label479attached to the object it is trying to access. The rules enforced are, in480order:481 482 1. Any access requested by a task labeled "*" is denied.483 2. A read or execute access requested by a task labeled "^"484 is permitted.485 3. A read or execute access requested on an object labeled "_"486 is permitted.487 4. Any access requested on an object labeled "*" is permitted.488 5. Any access requested by a task on an object with the same489 label is permitted.490 6. Any access requested that is explicitly defined in the loaded491 rule set is permitted.492 7. Any other access is denied.493 494Smack Access Rules495~~~~~~~~~~~~~~~~~~496 497With the isolation provided by Smack access separation is simple. There are498many interesting cases where limited access by subjects to objects with499different labels is desired. One example is the familiar spy model of500sensitivity, where a scientist working on a highly classified project would be501able to read documents of lower classifications and anything she writes will502be "born" highly classified. To accommodate such schemes Smack includes a503mechanism for specifying rules allowing access between labels.504 505Access Rule Format506~~~~~~~~~~~~~~~~~~507 508The format of an access rule is::509 510 subject-label object-label access511 512Where subject-label is the Smack label of the task, object-label is the Smack513label of the thing being accessed, and access is a string specifying the sort514of access allowed. The access specification is searched for letters that515describe access modes:516 517 a: indicates that append access should be granted.518 r: indicates that read access should be granted.519 w: indicates that write access should be granted.520 x: indicates that execute access should be granted.521 t: indicates that the rule requests transmutation.522 b: indicates that the rule should be reported for bring-up.523 524Uppercase values for the specification letters are allowed as well.525Access mode specifications can be in any order. Examples of acceptable rules526are::527 528 TopSecret Secret rx529 Secret Unclass R530 Manager Game x531 User HR w532 Snap Crackle rwxatb533 New Old rRrRr534 Closed Off -535 536Examples of unacceptable rules are::537 538 Top Secret Secret rx539 Ace Ace r540 Odd spells waxbeans541 542Spaces are not allowed in labels. Since a subject always has access to files543with the same label specifying a rule for that case is pointless. Only544valid letters (rwxatbRWXATB) and the dash ('-') character are allowed in545access specifications. The dash is a placeholder, so "a-r" is the same546as "ar". A lone dash is used to specify that no access should be allowed.547 548Applying Access Rules549~~~~~~~~~~~~~~~~~~~~~550 551The developers of Linux rarely define new sorts of things, usually importing552schemes and concepts from other systems. Most often, the other systems are553variants of Unix. Unix has many endearing properties, but consistency of554access control models is not one of them. Smack strives to treat accesses as555uniformly as is sensible while keeping with the spirit of the underlying556mechanism.557 558File system objects including files, directories, named pipes, symbolic links,559and devices require access permissions that closely match those used by mode560bit access. To open a file for reading read access is required on the file. To561search a directory requires execute access. Creating a file with write access562requires both read and write access on the containing directory. Deleting a563file requires read and write access to the file and to the containing564directory. It is possible that a user may be able to see that a file exists565but not any of its attributes by the circumstance of having read access to the566containing directory but not to the differently labeled file. This is an567artifact of the file name being data in the directory, not a part of the file.568 569If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the570access rule that allows a process to create an object in that directory571includes 't' access the label assigned to the new object will be that572of the directory, not the creating process. This makes it much easier573for two processes with different labels to share data without granting574access to all of their files.575 576IPC objects, message queues, semaphore sets, and memory segments exist in flat577namespaces and access requests are only required to match the object in578question.579 580Process objects reflect tasks on the system and the Smack label used to access581them is the same Smack label that the task would use for its own access582attempts. Sending a signal via the kill() system call is a write operation583from the signaler to the recipient. Debugging a process requires both reading584and writing. Creating a new task is an internal operation that results in two585tasks with identical Smack labels and requires no access checks.586 587Sockets are data structures attached to processes and sending a packet from588one process to another requires that the sender have write access to the589receiver. The receiver is not required to have read access to the sender.590 591Setting Access Rules592~~~~~~~~~~~~~~~~~~~~593 594The configuration file /etc/smack/accesses contains the rules to be set at595system startup. The contents are written to the special file596/sys/fs/smackfs/load2. Rules can be added at any time and take effect597immediately. For any pair of subject and object labels there can be only598one rule, with the most recently specified overriding any earlier599specification.600 601Task Attribute602~~~~~~~~~~~~~~603 604The Smack label of a process can be read from /proc/<pid>/attr/current. A605process can read its own Smack label from /proc/self/attr/current. A606privileged process can change its own Smack label by writing to607/proc/self/attr/current but not the label of another process.608 609File Attribute610~~~~~~~~~~~~~~611 612The Smack label of a filesystem object is stored as an extended attribute613named SMACK64 on the file. This attribute is in the security namespace. It can614only be changed by a process with privilege.615 616Privilege617~~~~~~~~~618 619A process with CAP_MAC_OVERRIDE or CAP_MAC_ADMIN is privileged.620CAP_MAC_OVERRIDE allows the process access to objects it would621be denied otherwise. CAP_MAC_ADMIN allows a process to change622Smack data, including rules and attributes.623 624Smack Networking625~~~~~~~~~~~~~~~~626 627As mentioned before, Smack enforces access control on network protocol628transmissions. Every packet sent by a Smack process is tagged with its Smack629label. This is done by adding a CIPSO tag to the header of the IP packet. Each630packet received is expected to have a CIPSO tag that identifies the label and631if it lacks such a tag the network ambient label is assumed. Before the packet632is delivered a check is made to determine that a subject with the label on the633packet has write access to the receiving process and if that is not the case634the packet is dropped.635 636CIPSO Configuration637~~~~~~~~~~~~~~~~~~~638 639It is normally unnecessary to specify the CIPSO configuration. The default640values used by the system handle all internal cases. Smack will compose CIPSO641label values to match the Smack labels being used without administrative642intervention. Unlabeled packets that come into the system will be given the643ambient label.644 645Smack requires configuration in the case where packets from a system that is646not Smack that speaks CIPSO may be encountered. Usually this will be a Trusted647Solaris system, but there are other, less widely deployed systems out there.648CIPSO provides 3 important values, a Domain Of Interpretation (DOI), a level,649and a category set with each packet. The DOI is intended to identify a group650of systems that use compatible labeling schemes, and the DOI specified on the651Smack system must match that of the remote system or packets will be652discarded. The DOI is 3 by default. The value can be read from653/sys/fs/smackfs/doi and can be changed by writing to /sys/fs/smackfs/doi.654 655The label and category set are mapped to a Smack label as defined in656/etc/smack/cipso.657 658A Smack/CIPSO mapping has the form::659 660 smack level [category [category]*]661 662Smack does not expect the level or category sets to be related in any663particular way and does not assume or assign accesses based on them. Some664examples of mappings::665 666 TopSecret 7667 TS:A,B 7 1 2668 SecBDE 5 2 4 6669 RAFTERS 7 12 26670 671The ":" and "," characters are permitted in a Smack label but have no special672meaning.673 674The mapping of Smack labels to CIPSO values is defined by writing to675/sys/fs/smackfs/cipso2.676 677In addition to explicit mappings Smack supports direct CIPSO mappings. One678CIPSO level is used to indicate that the category set passed in the packet is679in fact an encoding of the Smack label. The level used is 250 by default. The680value can be read from /sys/fs/smackfs/direct and changed by writing to681/sys/fs/smackfs/direct.682 683Socket Attributes684~~~~~~~~~~~~~~~~~685 686There are two attributes that are associated with sockets. These attributes687can only be set by privileged tasks, but any task can read them for their own688sockets.689 690 SMACK64IPIN:691 The Smack label of the task object. A privileged692 program that will enforce policy may set this to the star label.693 694 SMACK64IPOUT:695 The Smack label transmitted with outgoing packets.696 A privileged program may set this to match the label of another697 task with which it hopes to communicate.698 699Smack Netlabel Exceptions700~~~~~~~~~~~~~~~~~~~~~~~~~701 702You will often find that your labeled application has to talk to the outside,703unlabeled world. To do this there's a special file /sys/fs/smackfs/netlabel704where you can add some exceptions in the form of::705 706 @IP1 LABEL1 or707 @IP2/MASK LABEL2708 709It means that your application will have unlabeled access to @IP1 if it has710write access on LABEL1, and access to the subnet @IP2/MASK if it has write711access on LABEL2.712 713Entries in the /sys/fs/smackfs/netlabel file are matched by longest mask714first, like in classless IPv4 routing.715 716A special label '@' and an option '-CIPSO' can be used there::717 718 @ means Internet, any application with any label has access to it719 -CIPSO means standard CIPSO networking720 721If you don't know what CIPSO is and don't plan to use it, you can just do::722 723 echo 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel724 echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabel725 726If you use CIPSO on your 192.168.0.0/16 local network and need also unlabeled727Internet access, you can have::728 729 echo 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel730 echo 192.168.0.0/16 -CIPSO > /sys/fs/smackfs/netlabel731 echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabel732 733Writing Applications for Smack734------------------------------735 736There are three sorts of applications that will run on a Smack system. How an737application interacts with Smack will determine what it will have to do to738work properly under Smack.739 740Smack Ignorant Applications741---------------------------742 743By far the majority of applications have no reason whatever to care about the744unique properties of Smack. Since invoking a program has no impact on the745Smack label associated with the process the only concern likely to arise is746whether the process has execute access to the program.747 748Smack Relevant Applications749---------------------------750 751Some programs can be improved by teaching them about Smack, but do not make752any security decisions themselves. The utility ls(1) is one example of such a753program.754 755Smack Enforcing Applications756----------------------------757 758These are special programs that not only know about Smack, but participate in759the enforcement of system policy. In most cases these are the programs that760set up user sessions. There are also network services that provide information761to processes running with various labels.762 763File System Interfaces764----------------------765 766Smack maintains labels on file system objects using extended attributes. The767Smack label of a file, directory, or other file system object can be obtained768using getxattr(2)::769 770 len = getxattr("/", "security.SMACK64", value, sizeof (value));771 772will put the Smack label of the root directory into value. A privileged773process can set the Smack label of a file system object with setxattr(2)::774 775 len = strlen("Rubble");776 rc = setxattr("/foo", "security.SMACK64", "Rubble", len, 0);777 778will set the Smack label of /foo to "Rubble" if the program has appropriate779privilege.780 781Socket Interfaces782-----------------783 784The socket attributes can be read using fgetxattr(2).785 786A privileged process can set the Smack label of outgoing packets with787fsetxattr(2)::788 789 len = strlen("Rubble");790 rc = fsetxattr(fd, "security.SMACK64IPOUT", "Rubble", len, 0);791 792will set the Smack label "Rubble" on packets going out from the socket if the793program has appropriate privilege::794 795 rc = fsetxattr(fd, "security.SMACK64IPIN, "*", strlen("*"), 0);796 797will set the Smack label "*" as the object label against which incoming798packets will be checked if the program has appropriate privilege.799 800Administration801--------------802 803Smack supports some mount options:804 805 smackfsdef=label:806 specifies the label to give files that lack807 the Smack label extended attribute.808 809 smackfsroot=label:810 specifies the label to assign the root of the811 file system if it lacks the Smack extended attribute.812 813 smackfshat=label:814 specifies a label that must have read access to815 all labels set on the filesystem. Not yet enforced.816 817 smackfsfloor=label:818 specifies a label to which all labels set on the819 filesystem must have read access. Not yet enforced.820 821 smackfstransmute=label:822 behaves exactly like smackfsroot except that it also823 sets the transmute flag on the root of the mount824 825These mount options apply to all file system types.826 827Smack auditing828--------------829 830If you want Smack auditing of security events, you need to set CONFIG_AUDIT831in your kernel configuration.832By default, all denied events will be audited. You can change this behavior by833writing a single character to the /sys/fs/smackfs/logging file::834 835 0 : no logging836 1 : log denied (default)837 2 : log accepted838 3 : log denied & accepted839 840Events are logged as 'key=value' pairs, for each event you at least will get841the subject, the object, the rights requested, the action, the kernel function842that triggered the event, plus other pairs depending on the type of event843audited.844 845Bringup Mode846------------847 848Bringup mode provides logging features that can make application849configuration and system bringup easier. Configure the kernel with850CONFIG_SECURITY_SMACK_BRINGUP to enable these features. When bringup851mode is enabled accesses that succeed due to rules marked with the "b"852access mode will logged. When a new label is introduced for processes853rules can be added aggressively, marked with the "b". The logging allows854tracking of which rules actual get used for that label.855 856Another feature of bringup mode is the "unconfined" option. Writing857a label to /sys/fs/smackfs/unconfined makes subjects with that label858able to access any object, and objects with that label accessible to859all subjects. Any access that is granted because a label is unconfined860is logged. This feature is dangerous, as files and directories may861be created in places they couldn't if the policy were being enforced.862