smack: Add support for unlabeled network hosts and networks

[pandora-kernel.git] / security / smack / smack_access.c

diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
index 247cec3..2e0b83e 100644 (file)
--- a/security/smack/smack_access.c
+++ b/security/smack/smack_access.c
@@ -15,15 +15,8 @@
 #include <linux/sched.h>
 #include "smack.h"
 
-struct smack_known smack_known_unset = {
-       .smk_next       = NULL,
-       .smk_known      = "UNSET",
-       .smk_secid      = 1,
-       .smk_cipso      = NULL,
-};
-
 struct smack_known smack_known_huh = {
-       .smk_next       = &smack_known_unset,
+       .smk_next       = NULL,
        .smk_known      = "?",
        .smk_secid      = 2,
        .smk_cipso      = NULL,
@@ -57,7 +50,14 @@ struct smack_known smack_known_invalid = {
        .smk_cipso      = NULL,
 };
 
-struct smack_known *smack_known = &smack_known_invalid;
+struct smack_known smack_known_web = {
+       .smk_next       = &smack_known_invalid,
+       .smk_known      = "@",
+       .smk_secid      = 7,
+       .smk_cipso      = NULL,
+};
+
+struct smack_known *smack_known = &smack_known_web;
 
 /*
  * The initial value needs to be bigger than any of the
@@ -98,6 +98,16 @@ int smk_access(char *subject_label, char *object_label, int request)
        if (subject_label == smack_known_star.smk_known ||
            strcmp(subject_label, smack_known_star.smk_known) == 0)
                return -EACCES;
+       /*
+        * An internet object can be accessed by any subject.
+        * Tasks cannot be assigned the internet label.
+        * An internet subject can access any object.
+        */
+       if (object_label == smack_known_web.smk_known ||
+           subject_label == smack_known_web.smk_known ||
+           strcmp(object_label, smack_known_web.smk_known) == 0 ||
+           strcmp(subject_label, smack_known_web.smk_known) == 0)
+               return 0;
        /*
         * A star object can be accessed by any subject.
         */