Lines Matching refs:the
3 "Good for you, you've decided to clean the elevator!"
6 Smack is the Simplified Mandatory Access Control Kernel.
10 Smack is not the only Mandatory Access Control scheme
12 are encouraged to compare Smack with the other mechanisms
13 available to determine which is best suited to the problem
27 Smack kernels use the CIPSO IP option. Some network
39 smackctl - load the Smack access rules
43 These two commands are obsolete with the introduction of
44 the smackfs/load2 and smackfs/cipso2 interfaces.
49 In keeping with the intent of Smack, configuration data is
51 configuration step is mounting the smackfs pseudo filesystem.
52 If smackutil is installed the startup script will take care
59 The /sys/fs/smackfs directory is created by the kernel.
62 objects. The attributes are stored in the extended attribute security
70 the label given to a new filesystem object will be the label
71 of the process that created it.
76 Don't allow the file to be mmapped by a process whose Smack
77 label does not allow all of the access permitted to a process
78 with the label contained in this attribute. This is a very
81 Can only have the value "TRUE". If this attribute is present
82 on a directory when an object is created in the directory and
83 the Smack rule (more below) that permitted the write access
84 to the directory includes the transmute ("t") mode the object
85 gets the label of the directory instead of the label of the
86 creating process. If the object being created is a directory
87 the SMACK64TRANSMUTE attribute is set as well.
90 Use the Smack label in this attribute for access control
94 Use the Smack label in this attribute for access control
102 A process can see the Smack label it is running with by
104 can set the process Smack by writing there.
107 in the smackfs filesystem. This pseudo-filesystem is mounted
111 This interface reports whether a subject with the specified
114 this file. The next read will indicate whether the access
118 This interface reports whether a subject with the specified
121 this file. The next read will indicate whether the access
125 This contains the Smack label applied to unlabeled network
131 where the first string is the subject label, the second the
132 object label, the third the access to allow and the fourth the
133 access to deny. The access strings may contain only the characters
135 modified by enabling the permissions in the third string and disabling
136 those in the fourth string. If there is no such rule it will be
137 created using the access specified in the third and the fourth strings.
143 the level to use. The second number is the number of categories.
144 The following numbers are the categories.
151 the level to use. The second number is the number of categories.
152 The following numbers are the categories.
155 This contains the CIPSO level used for Smack direct label
158 This contains the CIPSO domain of interpretation used in
162 the system defined rules to be specified. The format accepted
165 where the first string is the subject label, the second the
166 object label, and the third the requested access. The access
167 string may contain only the characters "rwxat-", and specifies
174 the system defined rules to be specified. The format accepted
177 where the first string is the subject label, the second the
178 object label, and the third the requested access. The access
179 string may contain only the characters "rwxat-", and specifies
187 restrictions on the process. The format is the same as for
188 the load interface.
193 restrictions on the process. The format is the same as for
194 the load2 interface.
196 This contains the Smack logging state.
198 This contains the CIPSO level used for Smack mapped label
204 that have Smack write access to the host label. All packets
205 received from single label hosts are given the specified
209 This contains the label processes must have for CAP_MAC_ADMIN
212 label. The value is set by writing the desired label to the
213 file or cleared by writing "-" to the file.
215 This is used to define the current ptrace policy
216 0 - default: this is the policy that relies on Smack access rules.
217 For the PTRACE_READ a subject needs to have a read access on
218 object. For the PTRACE_ATTACH a read-write access is required.
219 1 - exact: this is the policy that limits PTRACE_ATTACH. Attach is
222 2 - draconian: this policy behaves like the 'exact' above with an
225 Writing a Smack label here sets the access to '-' for all access
228 If the kernel is configured with CONFIG_SECURITY_SMACK_BRINGUP
231 the access permitted if it wouldn't be otherwise. Note that this
232 is dangerous and can ruin the proper labeling of your system.
235 You can add access rules in /etc/smack/accesses. They take the form:
239 access is a combination of the letters rwxatb which specify the
245 From the Smack Whitepaper:
255 shared among the people and services using the machine. Some of these schemes
256 allow the program or user to decide what other programs or users are allowed
258 control mechanisms because the access control is specified at the discretion
259 of the user. Other schemes do not leave the decision regarding what a user or
261 access control mechanisms because you don't have a choice regarding the users
266 From the middle of the 1980's until the turn of the century Mandatory Access
267 Control (MAC) was very closely associated with the Bell & LaPadula security
268 model, a mathematical description of the United States Department of Defense
270 within the Capital Beltway and Scandinavian supercomputer centers but was
275 Around the turn of the century Domain Type Enforcement (DTE) became popular.
279 maintain this scheme and the detailed understanding of the whole system
280 necessary to provide a secure domain mapping leads to the scheme being
281 disabled or used in limited ways in the majority of cases.
286 while avoiding the pitfalls of its predecessors. The limitations of Bell &
288 according to the requirements of the system and its purpose rather than those
290 Enforcement and avoided by defining access controls in terms of the access
296 with other MAC systems and shouldn't be too difficult for the uninitiated to
300 Subject: A subject is an active entity on the computer system.
301 On Smack a subject is a task, which is in turn the basic unit
304 Object: An object is a passive entity on the computer system.
310 Label: Data that identifies the Mandatory Access Control
313 These definitions are consistent with the traditional use in the security
317 violate an aspect of the system security policy, as identified by
318 the specific capability. A task that possesses one or more
322 Privilege: A task that is allowed to violate the system security
330 on what subjects can access which objects, based on the labels attached to
331 each of the subject and the object.
338 other than a letter or digit, are reserved for use by the Smack development
339 team. Smack labels are unstructured, case sensitive, and the only operation
341 contain unprintable characters, the "/" (slash), the "\" (backslash), the "'"
354 of a process will usually be assigned by the system initialization
359 Smack uses the traditional access modes of Linux. These modes are read,
360 execute, write, and occasionally append. There are a few cases where the
363 Signals: A signal is a write operation from the subject task to
364 the object task.
366 write operation from the source task to the destination task.
368 Smack restricts access based on the label attached to a subject and the label
369 attached to the object it is trying to access. The rules enforced are, in
378 5. Any access requested by a task on an object with the same
380 6. Any access requested that is explicitly defined in the loaded
386 With the isolation provided by Smack access separation is simple. There are
388 different labels is desired. One example is the familiar spy model of
400 Where subject-label is the Smack label of the task, object-label is the Smack
401 label of the thing being accessed, and access is a string specifying the sort
409 t: indicates that the rule requests transmutation.
410 b: indicates that the rule should be reported for bring-up.
412 Uppercase values for the specification letters are allowed as well.
431 with the same label specifying a rule for that case is pointless. Only
432 valid letters (rwxatbRWXATB) and the dash ('-') character are allowed in
433 access specifications. The dash is a placeholder, so "a-r" is the same
439 schemes and concepts from other systems. Most often, the other systems are
442 uniformly as is sensible while keeping with the spirit of the underlying
447 bit access. To open a file for reading read access is required on the file. To
449 requires both read and write access on the containing directory. Deleting a
450 file requires read and write access to the file and to the containing
452 but not any of its attributes by the circumstance of having read access to the
453 containing directory but not to the differently labeled file. This is an
454 artifact of the file name being data in the directory, not a part of the file.
456 If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the
458 includes 't' access the label assigned to the new object will be that
459 of the directory, not the creating process. This makes it much easier
464 namespaces and access requests are only required to match the object in
467 Process objects reflect tasks on the system and the Smack label used to access
468 them is the same Smack label that the task would use for its own access
469 attempts. Sending a signal via the kill() system call is a write operation
470 from the signaler to the recipient. Debugging a process requires both reading
475 one process to another requires that the sender have write access to the
476 receiver. The receiver is not required to have read access to the sender.
480 The configuration file /etc/smack/accesses contains the rules to be set at
481 system startup. The contents are written to the special file
484 one rule, with the most recently specified overriding any earlier
492 /proc/self/attr/current but not the label of another process.
497 named SMACK64 on the file. This attribute is in the security namespace. It can
503 CAP_MAC_OVERRIDE allows the process access to objects it would
511 label. This is done by adding a CIPSO tag to the header of the IP packet. Each
512 packet received is expected to have a CIPSO tag that identifies the label and
513 if it lacks such a tag the network ambient label is assumed. Before the packet
514 is delivered a check is made to determine that a subject with the label on the
515 packet has write access to the receiving process and if that is not the case
516 the packet is dropped.
520 It is normally unnecessary to specify the CIPSO configuration. The default
521 values used by the system handle all internal cases. Smack will compose CIPSO
522 label values to match the Smack labels being used without administrative
523 intervention. Unlabeled packets that come into the system will be given the
526 Smack requires configuration in the case where packets from a system that is
531 of systems that use compatible labeling schemes, and the DOI specified on the
532 Smack system must match that of the remote system or packets will be
539 A Smack/CIPSO mapping has the form:
543 Smack does not expect the level or category sets to be related in any
559 CIPSO level is used to indicate that the category set passed in the packet is
560 in fact an encoding of the Smack label. The level used is 250 by default. The
570 SMACK64IPIN: The Smack label of the task object. A privileged
571 program that will enforce policy may set this to the star label.
574 A privileged program may set this to match the label of another
579 You will often find that your labeled application has to talk to the outside,
581 where you can add some exceptions in the form of :
586 write access on LABEL1, and access to the subnet @IP2/MASK if it has write
589 Entries in the /sys/fs/smackfs/netlabel file are matched by longest mask
615 By far the majority of applications have no reason whatever to care about the
616 unique properties of Smack. Since invoking a program has no impact on the
617 Smack label associated with the process the only concern likely to arise is
618 whether the process has execute access to the program.
629 the enforcement of system policy. In most cases these are the programs that
641 will put the Smack label of the root directory into value. A privileged
642 process can set the Smack label of a file system object with setxattr(2).
647 will set the Smack label of /foo to "Rubble" if the program has appropriate
654 A privileged process can set the Smack label of outgoing packets with
660 will set the Smack label "Rubble" on packets going out from the socket if the
665 will set the Smack label "*" as the object label against which incoming
666 packets will be checked if the program has appropriate privilege.
672 smackfsdef=label: specifies the label to give files that lack
673 the Smack label extended attribute.
675 smackfsroot=label: specifies the label to assign the root of the
676 file system if it lacks the Smack extended attribute.
679 all labels set on the filesystem. Not yet enforced.
681 smackfsfloor=label: specifies a label to which all labels set on the
691 writing a single character to the /sys/fs/smackfs/logging file :
698 the subject, the object, the rights requested, the action, the kernel function
699 that triggered the event, plus other pairs depending on the type of event
705 configuration and system bringup easier. Configure the kernel with
707 mode is enabled accesses that succeed due to rules marked with the "b"
709 rules can be added aggressively, marked with the "b". The logging allows
712 Another feature of bringup mode is the "unconfined" option. Writing
717 be created in places they couldn't if the policy were being enforced.