sphinx.addnodesdocument)}( rawsourcechildren]( translations LanguagesNode)}(hhh](h pending_xref)}(hhh]docutils.nodesTextChinese (Simplified)}parenthsba attributes}(ids]classes]names]dupnames]backrefs] refdomainstdreftypedoc reftarget)/translations/zh_CN/admin-guide/LSM/SmackmodnameN classnameN refexplicitutagnamehhh ubh)}(hhh]hChinese (Traditional)}hh2sbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/zh_TW/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hItalian}hhFsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/it_IT/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hJapanese}hhZsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/ja_JP/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hKorean}hhnsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/ko_KR/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hPortuguese (Brazilian)}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/pt_BR/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubh)}(hhh]hSpanish}hhsbah}(h]h ]h"]h$]h&] refdomainh)reftypeh+ reftarget)/translations/sp_SP/admin-guide/LSM/SmackmodnameN classnameN refexplicituh1hhh ubeh}(h]h ]h"]h$]h&]current_languageEnglishuh1h hh _documenthsourceNlineNubhsection)}(hhh](htitle)}(hSmackh]hSmack}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhhhC/var/lib/git/docbuild/linux/Documentation/admin-guide/LSM/Smack.rsthKubh block_quote)}(hU"Good for you, you've decided to clean the elevator!" - The Elevator, from Dark Star h]h paragraph)}(hT"Good for you, you've decided to clean the elevator!" - The Elevator, from Dark Starh]hZ“Good for you, you’ve decided to clean the elevator!” - The Elevator, from Dark Star}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hSmack is the Simplified Mandatory Access Control Kernel. Smack is a kernel based implementation of mandatory access control that includes simplicity in its primary design goals.h]hSmack is the Simplified Mandatory Access Control Kernel. Smack is a kernel based implementation of mandatory access control that includes simplicity in its primary design goals.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(hSmack is not the only Mandatory Access Control scheme available for Linux. Those new to Mandatory Access Control are encouraged to compare Smack with the other mechanisms available to determine which is best suited to the problem at hand.h]hSmack is not the only Mandatory Access Control scheme available for Linux. Those new to Mandatory Access Control are encouraged to compare Smack with the other mechanisms available to determine which is best suited to the problem at hand.}(hhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK hhhhubh)}(h)Smack consists of three major components:h]h)Smack consists of three major components:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hX- The kernel - Basic utilities, which are helpful but not required - Configuration data h]h bullet_list)}(hhh](h list_item)}(h The kernelh]h)}(hjh]h The kernel}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjubah}(h]h ]h"]h$]h&]uh1jhjubj)}(h3Basic utilities, which are helpful but not requiredh]h)}(hj5h]h3Basic utilities, which are helpful but not required}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhj3ubah}(h]h ]h"]h$]h&]uh1jhjubj)}(hConfiguration data h]h)}(hConfiguration datah]hConfiguration data}(hjNhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhjJubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]bullet-uh1jhhhKhjubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hX The kernel component of Smack is implemented as a Linux Security Modules (LSM) module. It requires netlabel and works best with file systems that support extended attributes, although xattr support is not strictly required. It is safe to run a Smack kernel under a "vanilla" distribution.h]hX$The kernel component of Smack is implemented as a Linux Security Modules (LSM) module. It requires netlabel and works best with file systems that support extended attributes, although xattr support is not strictly required. It is safe to run a Smack kernel under a “vanilla” distribution.}(hjphhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hSmack kernels use the CIPSO IP option. Some network configurations are intolerant of IP options and can impede access to systems that use them as Smack does.h]hSmack kernels use the CIPSO IP option. Some network configurations are intolerant of IP options and can impede access to systems that use them as Smack does.}(hj~hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhKhhhhubh)}(hSmack is used in the Tizen operating system. Please go to http://wiki.tizen.org for information about how Smack is used in Tizen.h](h:Smack is used in the Tizen operating system. Please go to }(hjhhhNhNubh reference)}(hhttp://wiki.tizen.orgh]hhttp://wiki.tizen.org}(hjhhhNhNubah}(h]h ]h"]h$]h&]refurijuh1jhjubh2 for information about how Smack is used in Tizen.}(hjhhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhK#hhhhubh)}(h3The current git repository for Smack user space is:h]h3The current git repository for Smack user space is:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK'hhhhubh)}(h&git://github.com/smack-team/smack.git h]h)}(h%git://github.com/smack-team/smack.gith]h%git://github.com/smack-team/smack.git}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK)hjubah}(h]h ]h"]h$]h&]uh1hhhhK)hhhhubh)}(hiThis should make and install on most modern distributions. There are five commands included in smackutil:h]hiThis should make and install on most modern distributions. There are five commands included in smackutil:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK+hhhhubhdefinition_list)}(hhh](hdefinition_list_item)}(h8chsmack: display or set Smack extended attribute values h](hterm)}(hchsmack:h]hchsmack:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK/hjubh definition)}(hhh]h)}(h.display or set Smack extended attribute valuesh]h.display or set Smack extended attribute values}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK/hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhK/hjubj)}(h&smackctl: load the Smack access rules h](j)}(h smackctl:h]h smackctl:}(hj!hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK2hjubj)}(hhh]h)}(hload the Smack access rulesh]hload the Smack access rules}(hj2hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK2hj/ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhK2hjhhubj)}(hUsmackaccess: report if a process with one label has access to an object with another h](j)}(h smackaccess:h]h smackaccess:}(hjPhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhK6hjLubj)}(hhh]h)}(hGreport if a process with one label has access to an object with anotherh]hGreport if a process with one label has access to an object with another}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK5hj^ubah}(h]h ]h"]h$]h&]uh1jhjLubeh}(h]h ]h"]h$]h&]uh1jhhhK6hjhhubeh}(h]h ]h"]h$]h&]uh1jhhhhhhhNubh)}(hiThese two commands are obsolete with the introduction of the smackfs/load2 and smackfs/cipso2 interfaces.h]hiThese two commands are obsolete with the introduction of the smackfs/load2 and smackfs/cipso2 interfaces.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhK8hhhhubj)}(hhh](j)}(h=smackload: properly formats data for writing to smackfs/load h](j)}(h smackload:h]h smackload:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhKthis is the policy that relies on Smack access rules. For the }(hjf hhhNhNubj )}(h``PTRACE_READ``h]h PTRACE_READ}(hjn hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjf ubh: a subject needs to have a read access on object. For the }(hjf hhhNhNubj )}(h``PTRACE_ATTACH``h]h PTRACE_ATTACH}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hjf ubh! a read-write access is required.}(hjf hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM$hjc ubah}(h]h ]h"]h$]h&]uh1jhjQ ubeh}(h]h ]h"]h$]h&]uh1jhhhM&hjN ubj)}(h1 - exact: this is the policy that limits ``PTRACE_ATTACH``. Attach is only allowed when subject's and object's labels are equal. ``PTRACE_READ`` is not affected. Can be overridden with ``CAP_SYS_PTRACE``. h](j)}(h 1 - exact:h]h 1 - exact:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM+hj ubj)}(hhh]h)}(hthis is the policy that limits ``PTRACE_ATTACH``. Attach is only allowed when subject's and object's labels are equal. ``PTRACE_READ`` is not affected. Can be overridden with ``CAP_SYS_PTRACE``.h](hthis is the policy that limits }(hj hhhNhNubj )}(h``PTRACE_ATTACH``h]h PTRACE_ATTACH}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhK. Attach is only allowed when subject’s and object’s labels are equal. }(hj hhhNhNubj )}(h``PTRACE_READ``h]h PTRACE_READ}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh) is not affected. Can be overridden with }(hj hhhNhNubj )}(h``CAP_SYS_PTRACE``h]hCAP_SYS_PTRACE}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM)hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhM+hjN ubj)}(h2 - draconian: this policy behaves like the 'exact' above with an exception that it can't be overridden with ``CAP_SYS_PTRACE``. h](j)}(h2 - draconian:h]h2 - draconian:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM/hj ubj)}(hhh]h)}(hqthis policy behaves like the 'exact' above with an exception that it can't be overridden with ``CAP_SYS_PTRACE``.h](hdthis policy behaves like the ‘exact’ above with an exception that it can’t be overridden with }(hj hhhNhNubj )}(h``CAP_SYS_PTRACE``h]hCAP_SYS_PTRACE}(hj& hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM.hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhM/hjN ubeh}(h]h ]h"]h$]h&]uh1jhj= ubeh}(h]h ]h"]h$]h&]uh1jhj+ ubeh}(h]h ]h"]h$]h&]uh1jhhhM/hjhhubj)}(horevoke-subject Writing a Smack label here sets the access to '-' for all access rules with that subject label. h](j)}(hrevoke-subjecth]hrevoke-subject}(hj` hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM3hj\ ubj)}(hhh]h)}(h_Writing a Smack label here sets the access to '-' for all access rules with that subject label.h]hcWriting a Smack label here sets the access to ‘-’ for all access rules with that subject label.}(hjq hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM2hjn ubah}(h]h ]h"]h$]h&]uh1jhj\ ubeh}(h]h ]h"]h$]h&]uh1jhhhM3hjhhubj)}(hX|unconfined If the kernel is configured with ``CONFIG_SECURITY_SMACK_BRINGUP`` a process with ``CAP_MAC_ADMIN`` can write a label into this interface. Thereafter, accesses that involve that label will be logged and the access permitted if it wouldn't be otherwise. Note that this is dangerous and can ruin the proper labeling of your system. It should never be used in production. h](j)}(h unconfinedh]h unconfined}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM;hj ubj)}(hhh]h)}(hXpIf the kernel is configured with ``CONFIG_SECURITY_SMACK_BRINGUP`` a process with ``CAP_MAC_ADMIN`` can write a label into this interface. Thereafter, accesses that involve that label will be logged and the access permitted if it wouldn't be otherwise. Note that this is dangerous and can ruin the proper labeling of your system. It should never be used in production.h](h!If the kernel is configured with }(hj hhhNhNubj )}(h!``CONFIG_SECURITY_SMACK_BRINGUP``h]hCONFIG_SECURITY_SMACK_BRINGUP}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh a process with }(hj hhhNhNubj )}(h``CAP_MAC_ADMIN``h]h CAP_MAC_ADMIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhX can write a label into this interface. Thereafter, accesses that involve that label will be logged and the access permitted if it wouldn’t be otherwise. Note that this is dangerous and can ruin the proper labeling of your system. It should never be used in production.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM6hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhM;hjhhubj)}(hXIrelabel-self This interface contains a list of labels to which the process can transition to, by writing to ``/proc/self/attr/current``. Normally a process can change its own label to any legal value, but only if it has ``CAP_MAC_ADMIN``. This interface allows a process without ``CAP_MAC_ADMIN`` to relabel itself to one of labels from predefined list. A process without ``CAP_MAC_ADMIN`` can change its label only once. When it does, this list will be cleared. The values are set by writing the desired labels, separated by spaces, to the file or cleared by writing "-" to the file. h](j)}(h relabel-selfh]h relabel-self}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMFhj ubj)}(hhh]h)}(hX;This interface contains a list of labels to which the process can transition to, by writing to ``/proc/self/attr/current``. Normally a process can change its own label to any legal value, but only if it has ``CAP_MAC_ADMIN``. This interface allows a process without ``CAP_MAC_ADMIN`` to relabel itself to one of labels from predefined list. A process without ``CAP_MAC_ADMIN`` can change its label only once. When it does, this list will be cleared. The values are set by writing the desired labels, separated by spaces, to the file or cleared by writing "-" to the file.h](h_This interface contains a list of labels to which the process can transition to, by writing to }(hj hhhNhNubj )}(h``/proc/self/attr/current``h]h/proc/self/attr/current}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhU. Normally a process can change its own label to any legal value, but only if it has }(hj hhhNhNubj )}(h``CAP_MAC_ADMIN``h]h CAP_MAC_ADMIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh*. This interface allows a process without }(hj hhhNhNubj )}(h``CAP_MAC_ADMIN``h]h CAP_MAC_ADMIN}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubhL to relabel itself to one of labels from predefined list. A process without }(hj hhhNhNubj )}(h``CAP_MAC_ADMIN``h]h CAP_MAC_ADMIN}(hj1 hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj ubh can change its label only once. When it does, this list will be cleared. The values are set by writing the desired labels, separated by spaces, to the file or cleared by writing “-” to the file.}(hj hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM>hj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMFhjhhubeh}(h]h ]h"]h$]h&]uh1jhhhhhhhNubh)}(hpIf you are using the smackload utility you can add access rules in ``/etc/smack/accesses``. They take the form::h](hCIf you are using the smackload utility you can add access rules in }(hj[ hhhNhNubj )}(h``/etc/smack/accesses``h]h/etc/smack/accesses}(hjc hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj[ ubh. They take the form:}(hj[ hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMHhhhhubj')}(hsubjectlabel objectlabel accessh]hsubjectlabel objectlabel access}hj{ sbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMKhhhhubh)}(haccess is a combination of the letters rwxatb which specify the kind of access permitted a subject with subjectlabel on an object with objectlabel. If there is no rule no access is allowed.h]haccess is a combination of the letters rwxatb which specify the kind of access permitted a subject with subjectlabel on an object with objectlabel. If there is no rule no access is allowed.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMMhhhhubh)}(h7Look for additional programs on http://schaufler-ca.comh](h Look for additional programs on }(hj hhhNhNubj)}(hhttp://schaufler-ca.comh]hhttp://schaufler-ca.com}(hj hhhNhNubah}(h]h ]h"]h$]h&]refurij uh1jhj ubeh}(h]h ]h"]h$]h&]uh1hhhhMQhhhhubh)}(hhh](h)}(h;The Simplified Mandatory Access Control Kernel (Whitepaper)h]h;The Simplified Mandatory Access Control Kernel (Whitepaper)}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMTubh)}(h&Casey Schaufler casey@schaufler-ca.comh](hCasey Schaufler }(hj hhhNhNubj)}(hcasey@schaufler-ca.comh]hcasey@schaufler-ca.com}(hj hhhNhNubah}(h]h ]h"]h$]h&]refurimailto:casey@schaufler-ca.comuh1jhj ubeh}(h]h ]h"]h$]h&]uh1hhhhMVhj hhubh)}(hhh](h)}(hMandatory Access Controlh]hMandatory Access Control}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMZubh)}(hXComputer systems employ a variety of schemes to constrain how information is shared among the people and services using the machine. Some of these schemes allow the program or user to decide what other programs or users are allowed access to pieces of data. These schemes are called discretionary access control mechanisms because the access control is specified at the discretion of the user. Other schemes do not leave the decision regarding what a user or program can access up to users or programs. These schemes are called mandatory access control mechanisms because you don't have a choice regarding the users or programs that have access to pieces of data.h]hXComputer systems employ a variety of schemes to constrain how information is shared among the people and services using the machine. Some of these schemes allow the program or user to decide what other programs or users are allowed access to pieces of data. These schemes are called discretionary access control mechanisms because the access control is specified at the discretion of the user. Other schemes do not leave the decision regarding what a user or program can access up to users or programs. These schemes are called mandatory access control mechanisms because you don’t have a choice regarding the users or programs that have access to pieces of data.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM\hj hhubeh}(h]mandatory-access-controlah ]h"]mandatory access controlah$]h&]uh1hhj hhhhhMZubh)}(hhh](h)}(hBell & LaPadulah]hBell & LaPadula}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMgubh)}(hXFrom the middle of the 1980's until the turn of the century Mandatory Access Control (MAC) was very closely associated with the Bell & LaPadula security model, a mathematical description of the United States Department of Defense policy for marking paper documents. MAC in this form enjoyed a following within the Capital Beltway and Scandinavian supercomputer centers but was often sited as failing to address general needs.h]hXFrom the middle of the 1980’s until the turn of the century Mandatory Access Control (MAC) was very closely associated with the Bell & LaPadula security model, a mathematical description of the United States Department of Defense policy for marking paper documents. MAC in this form enjoyed a following within the Capital Beltway and Scandinavian supercomputer centers but was often sited as failing to address general needs.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMihj hhubeh}(h] bell-lapadulaah ]h"]bell & lapadulaah$]h&]uh1hhj hhhhhMgubh)}(hhh](h)}(hDomain Type Enforcementh]hDomain Type Enforcement}(hj4 hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj1 hhhhhMqubh)}(hXAround the turn of the century Domain Type Enforcement (DTE) became popular. This scheme organizes users, programs, and data into domains that are protected from each other. This scheme has been widely deployed as a component of popular Linux distributions. The administrative overhead required to maintain this scheme and the detailed understanding of the whole system necessary to provide a secure domain mapping leads to the scheme being disabled or used in limited ways in the majority of cases.h]hXAround the turn of the century Domain Type Enforcement (DTE) became popular. This scheme organizes users, programs, and data into domains that are protected from each other. This scheme has been widely deployed as a component of popular Linux distributions. The administrative overhead required to maintain this scheme and the detailed understanding of the whole system necessary to provide a secure domain mapping leads to the scheme being disabled or used in limited ways in the majority of cases.}(hjB hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMshj1 hhubeh}(h]domain-type-enforcementah ]h"]domain type enforcementah$]h&]uh1hhj hhhhhMqubh)}(hhh](h)}(hSmackh]hSmack}(hj[ hhhNhNubah}(h]h ]h"]h$]h&]uh1hhjX hhhhhM|ubh)}(hXSmack is a Mandatory Access Control mechanism designed to provide useful MAC while avoiding the pitfalls of its predecessors. The limitations of Bell & LaPadula are addressed by providing a scheme whereby access can be controlled according to the requirements of the system and its purpose rather than those imposed by an arcane government policy. The complexity of Domain Type Enforcement and avoided by defining access controls in terms of the access modes already in use.h]hXSmack is a Mandatory Access Control mechanism designed to provide useful MAC while avoiding the pitfalls of its predecessors. The limitations of Bell & LaPadula are addressed by providing a scheme whereby access can be controlled according to the requirements of the system and its purpose rather than those imposed by an arcane government policy. The complexity of Domain Type Enforcement and avoided by defining access controls in terms of the access modes already in use.}(hji hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM~hjX hhubeh}(h]id1ah ]h"]h$]smackah&]uh1hhj hhhhhM| referencedKubh)}(hhh](h)}(hSmack Terminologyh]hSmack Terminology}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubh)}(hThe jargon used to talk about Smack will be familiar to those who have dealt with other MAC systems and shouldn't be too difficult for the uninitiated to pick up. There are four terms that are used in a specific way and that are especially important:h]hThe jargon used to talk about Smack will be familiar to those who have dealt with other MAC systems and shouldn’t be too difficult for the uninitiated to pick up. There are four terms that are used in a specific way and that are especially important:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hX Subject: A subject is an active entity on the computer system. On Smack a subject is a task, which is in turn the basic unit of execution. Object: An object is a passive entity on the computer system. On Smack files of all types, IPC, and tasks can be objects. Access: Any attempt by a subject to put information into or get information from an object is an access. Label: Data that identifies the Mandatory Access Control characteristics of a subject or an object. h]j)}(hhh](j)}(hSubject: A subject is an active entity on the computer system. On Smack a subject is a task, which is in turn the basic unit of execution. h](j)}(hSubject:h]hSubject:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hhh]h)}(hA subject is an active entity on the computer system. On Smack a subject is a task, which is in turn the basic unit of execution.h]hA subject is an active entity on the computer system. On Smack a subject is a task, which is in turn the basic unit of execution.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hzObject: An object is a passive entity on the computer system. On Smack files of all types, IPC, and tasks can be objects. h](j)}(hObject:h]hObject:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hhh]h)}(hqAn object is a passive entity on the computer system. On Smack files of all types, IPC, and tasks can be objects.h]hqAn object is a passive entity on the computer system. On Smack files of all types, IPC, and tasks can be objects.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hiAccess: Any attempt by a subject to put information into or get information from an object is an access. h](j)}(hAccess:h]hAccess:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hhh]h)}(h`Any attempt by a subject to put information into or get information from an object is an access.h]h`Any attempt by a subject to put information into or get information from an object is an access.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hdLabel: Data that identifies the Mandatory Access Control characteristics of a subject or an object. h](j)}(hLabel:h]hLabel:}(hj7 hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj3 ubj)}(hGhh]h)}(h\Data that identifies the Mandatory Access Control characteristics of a subject or an object.h]h\Data that identifies the Mandatory Access Control characteristics of a subject or an object.}(hjH hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjE ubah}(h]h ]h"]h$]h&]uh1jhj3 ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubeh}(h]h ]h"]h$]h&]uh1jhj ubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hThese definitions are consistent with the traditional use in the security community. There are also some terms from Linux that are likely to crop up:h]hThese definitions are consistent with the traditional use in the security community. There are also some terms from Linux that are likely to crop up:}(hjn hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hX/Capability: A task that possesses a capability has permission to violate an aspect of the system security policy, as identified by the specific capability. A task that possesses one or more capabilities is a privileged task, whereas a task with no capabilities is an unprivileged task. Privilege: A task that is allowed to violate the system security policy is said to have privilege. As of this writing a task can have privilege either by possessing capabilities or by having an effective user of root. h]j)}(hhh](j)}(hXCapability: A task that possesses a capability has permission to violate an aspect of the system security policy, as identified by the specific capability. A task that possesses one or more capabilities is a privileged task, whereas a task with no capabilities is an unprivileged task. h](j)}(h Capability:h]h Capability:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hhh]h)}(hXA task that possesses a capability has permission to violate an aspect of the system security policy, as identified by the specific capability. A task that possesses one or more capabilities is a privileged task, whereas a task with no capabilities is an unprivileged task.h]hXA task that possesses a capability has permission to violate an aspect of the system security policy, as identified by the specific capability. A task that possesses one or more capabilities is a privileged task, whereas a task with no capabilities is an unprivileged task.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hPrivilege: A task that is allowed to violate the system security policy is said to have privilege. As of this writing a task can have privilege either by possessing capabilities or by having an effective user of root. h](j)}(h Privilege:h]h Privilege:}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhj ubj)}(hhh]h)}(hA task that is allowed to violate the system security policy is said to have privilege. As of this writing a task can have privilege either by possessing capabilities or by having an effective user of root.h]hA task that is allowed to violate the system security policy is said to have privilege. As of this writing a task can have privilege either by possessing capabilities or by having an effective user of root.}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]uh1jhhhMhj ubeh}(h]h ]h"]h$]h&]uh1jhj| ubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubeh}(h]smack-terminologyah ]h"]smack terminologyah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(h Smack Basicsh]h Smack Basics}(hj hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj hhhhhMubh)}(hSmack is an extension to a Linux system. It enforces additional restrictions on what subjects can access which objects, based on the labels attached to each of the subject and the object.h]hSmack is an extension to a Linux system. It enforces additional restrictions on what subjects can access which objects, based on the labels attached to each of the subject and the object.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj hhubh)}(hhh](h)}(hLabelsh]hLabels}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hXvSmack labels are ASCII character strings. They can be up to 255 characters long, but keeping them to twenty-three characters is recommended. Single character labels using special characters, that being anything other than a letter or digit, are reserved for use by the Smack development team. Smack labels are unstructured, case sensitive, and the only operation ever performed on them is comparison for equality. Smack labels cannot contain unprintable characters, the "/" (slash), the "\" (backslash), the "'" (quote) and '"' (double-quote) characters. Smack labels cannot begin with a '-'. This is reserved for special options.h]hXSmack labels are ASCII character strings. They can be up to 255 characters long, but keeping them to twenty-three characters is recommended. Single character labels using special characters, that being anything other than a letter or digit, are reserved for use by the Smack development team. Smack labels are unstructured, case sensitive, and the only operation ever performed on them is comparison for equality. Smack labels cannot contain unprintable characters, the “/” (slash), the “" (backslash), the “’” (quote) and ‘”’ (double-quote) characters. Smack labels cannot begin with a ‘-’. This is reserved for special options.}(hj%hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(h"There are some predefined labels::h]h!There are some predefined labels:}(hj3hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(hX_ Pronounced "floor", a single underscore character. ^ Pronounced "hat", a single circumflex character. * Pronounced "star", a single asterisk character. ? Pronounced "huh", a single question mark character. @ Pronounced "web", a single at sign character.h]hX_ Pronounced "floor", a single underscore character. ^ Pronounced "hat", a single circumflex character. * Pronounced "star", a single asterisk character. ? Pronounced "huh", a single question mark character. @ Pronounced "web", a single at sign character.}hjAsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hEvery task on a Smack system is assigned a label. The Smack label of a process will usually be assigned by the system initialization mechanism.h]hEvery task on a Smack system is assigned a label. The Smack label of a process will usually be assigned by the system initialization mechanism.}(hjOhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]labelsah ]h"]labelsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(h Access Rulesh]h Access Rules}(hjhhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjehhhhhMubh)}(hSmack uses the traditional access modes of Linux. These modes are read, execute, write, and occasionally append. There are a few cases where the access mode may not be obvious. These include:h]hSmack uses the traditional access modes of Linux. These modes are read, execute, write, and occasionally append. There are a few cases where the access mode may not be obvious. These include:}(hjvhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjehhubh)}(hSignals: A signal is a write operation from the subject task to the object task. Internet Domain IPC: Transmission of a packet is considered a write operation from the source task to the destination task. h]j)}(hhh](j)}(hQSignals: A signal is a write operation from the subject task to the object task. h](j)}(hSignals:h]hSignals:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhjubj)}(hhh]h)}(hGA signal is a write operation from the subject task to the object task.h]hGA signal is a write operation from the subject task to the object task.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhMhjubj)}(h|Internet Domain IPC: Transmission of a packet is considered a write operation from the source task to the destination task. h](j)}(hInternet Domain IPC:h]hInternet Domain IPC:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhjubj)}(hhh]h)}(hfTransmission of a packet is considered a write operation from the source task to the destination task.h]hfTransmission of a packet is considered a write operation from the source task to the destination task.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhMhjubeh}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhMhjehhubh)}(hSmack restricts access based on the label attached to a subject and the label attached to the object it is trying to access. The rules enforced are, in order:h]hSmack restricts access based on the label attached to a subject and the label attached to the object it is trying to access. The rules enforced are, in order:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjehhubh)}(hX1. Any access requested by a task labeled "*" is denied. 2. A read or execute access requested by a task labeled "^" is permitted. 3. A read or execute access requested on an object labeled "_" is permitted. 4. Any access requested on an object labeled "*" is permitted. 5. Any access requested by a task on an object with the same label is permitted. 6. Any access requested that is explicitly defined in the loaded rule set is permitted. 7. Any other access is denied. h]henumerated_list)}(hhh](j)}(h5Any access requested by a task labeled "*" is denied.h]h)}(hjh]h9Any access requested by a task labeled “*” is denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hFA read or execute access requested by a task labeled "^" is permitted.h]h)}(hFA read or execute access requested by a task labeled "^" is permitted.h]hJA read or execute access requested by a task labeled “^” is permitted.}(hj'hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj#ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hIA read or execute access requested on an object labeled "_" is permitted.h]h)}(hIA read or execute access requested on an object labeled "_" is permitted.h]hMA read or execute access requested on an object labeled “_” is permitted.}(hj?hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj;ubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(h;Any access requested on an object labeled "*" is permitted.h]h)}(hjUh]h?Any access requested on an object labeled “*” is permitted.}(hjWhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjSubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hMAny access requested by a task on an object with the same label is permitted.h]h)}(hMAny access requested by a task on an object with the same label is permitted.h]hMAny access requested by a task on an object with the same label is permitted.}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjjubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hTAny access requested that is explicitly defined in the loaded rule set is permitted.h]h)}(hTAny access requested that is explicitly defined in the loaded rule set is permitted.h]hTAny access requested that is explicitly defined in the loaded rule set is permitted.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhj ubj)}(hAny other access is denied. h]h)}(hAny other access is denied.h]hAny other access is denied.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjubah}(h]h ]h"]h$]h&]uh1jhj ubeh}(h]h ]h"]h$]h&]enumtypearabicprefixhsuffix.uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhMhjehhubeh}(h] access-rulesah ]h"] access rulesah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSmack Access Rulesh]hSmack Access Rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hXWith the isolation provided by Smack access separation is simple. There are many interesting cases where limited access by subjects to objects with different labels is desired. One example is the familiar spy model of sensitivity, where a scientist working on a highly classified project would be able to read documents of lower classifications and anything she writes will be "born" highly classified. To accommodate such schemes Smack includes a mechanism for specifying rules allowing access between labels.h]hXWith the isolation provided by Smack access separation is simple. There are many interesting cases where limited access by subjects to objects with different labels is desired. One example is the familiar spy model of sensitivity, where a scientist working on a highly classified project would be able to read documents of lower classifications and anything she writes will be “born” highly classified. To accommodate such schemes Smack includes a mechanism for specifying rules allowing access between labels.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]smack-access-rulesah ]h"]smack access rulesah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hAccess Rule Formath]hAccess Rule Format}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(h!The format of an access rule is::h]h The format of an access rule is:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(h!subject-label object-label accessh]h!subject-label object-label access}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hWhere subject-label is the Smack label of the task, object-label is the Smack label of the thing being accessed, and access is a string specifying the sort of access allowed. The access specification is searched for letters that describe access modes:h]hWhere subject-label is the Smack label of the task, object-label is the Smack label of the thing being accessed, and access is a string specifying the sort of access allowed. The access specification is searched for letters that describe access modes:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hX9a: indicates that append access should be granted. r: indicates that read access should be granted. w: indicates that write access should be granted. x: indicates that execute access should be granted. t: indicates that the rule requests transmutation. b: indicates that the rule should be reported for bring-up. h]h)}(hX8a: indicates that append access should be granted. r: indicates that read access should be granted. w: indicates that write access should be granted. x: indicates that execute access should be granted. t: indicates that the rule requests transmutation. b: indicates that the rule should be reported for bring-up.h]hX8a: indicates that append access should be granted. r: indicates that read access should be granted. w: indicates that write access should be granted. x: indicates that execute access should be granted. t: indicates that the rule requests transmutation. b: indicates that the rule should be reported for bring-up.}(hj1hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj-ubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hUppercase values for the specification letters are allowed as well. Access mode specifications can be in any order. Examples of acceptable rules are::h]hUppercase values for the specification letters are allowed as well. Access mode specifications can be in any order. Examples of acceptable rules are:}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM hjhhubj')}(hTopSecret Secret rx Secret Unclass R Manager Game x User HR w Snap Crackle rwxatb New Old rRrRr Closed Off -h]hTopSecret Secret rx Secret Unclass R Manager Game x User HR w Snap Crackle rwxatb New Old rRrRr Closed Off -}hjSsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(h$Examples of unacceptable rules are::h]h#Examples of unacceptable rules are:}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(hOTop Secret Secret rx Ace Ace r Odd spells waxbeansh]hOTop Secret Secret rx Ace Ace r Odd spells waxbeans}hjosbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hXmSpaces are not allowed in labels. Since a subject always has access to files with the same label specifying a rule for that case is pointless. Only valid letters (rwxatbRWXATB) and the dash ('-') character are allowed in access specifications. The dash is a placeholder, so "a-r" is the same as "ar". A lone dash is used to specify that no access should be allowed.h]hXySpaces are not allowed in labels. Since a subject always has access to files with the same label specifying a rule for that case is pointless. Only valid letters (rwxatbRWXATB) and the dash (‘-’) character are allowed in access specifications. The dash is a placeholder, so “a-r” is the same as “ar”. A lone dash is used to specify that no access should be allowed.}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]access-rule-formatah ]h"]access rule formatah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hApplying Access Rulesh]hApplying Access Rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM%ubh)}(hXThe developers of Linux rarely define new sorts of things, usually importing schemes and concepts from other systems. Most often, the other systems are variants of Unix. Unix has many endearing properties, but consistency of access control models is not one of them. Smack strives to treat accesses as uniformly as is sensible while keeping with the spirit of the underlying mechanism.h]hXThe developers of Linux rarely define new sorts of things, usually importing schemes and concepts from other systems. Most often, the other systems are variants of Unix. Unix has many endearing properties, but consistency of access control models is not one of them. Smack strives to treat accesses as uniformly as is sensible while keeping with the spirit of the underlying mechanism.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM'hjhhubh)}(hXFile system objects including files, directories, named pipes, symbolic links, and devices require access permissions that closely match those used by mode bit access. To open a file for reading read access is required on the file. To search a directory requires execute access. Creating a file with write access requires both read and write access on the containing directory. Deleting a file requires read and write access to the file and to the containing directory. It is possible that a user may be able to see that a file exists but not any of its attributes by the circumstance of having read access to the containing directory but not to the differently labeled file. This is an artifact of the file name being data in the directory, not a part of the file.h]hXFile system objects including files, directories, named pipes, symbolic links, and devices require access permissions that closely match those used by mode bit access. To open a file for reading read access is required on the file. To search a directory requires execute access. Creating a file with write access requires both read and write access on the containing directory. Deleting a file requires read and write access to the file and to the containing directory. It is possible that a user may be able to see that a file exists but not any of its attributes by the circumstance of having read access to the containing directory but not to the differently labeled file. This is an artifact of the file name being data in the directory, not a part of the file.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM.hjhhubh)}(hXIf a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that directory includes 't' access the label assigned to the new object will be that of the directory, not the creating process. This makes it much easier for two processes with different labels to share data without granting access to all of their files.h]hXIf a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that directory includes ‘t’ access the label assigned to the new object will be that of the directory, not the creating process. This makes it much easier for two processes with different labels to share data without granting access to all of their files.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM9hjhhubh)}(hIPC objects, message queues, semaphore sets, and memory segments exist in flat namespaces and access requests are only required to match the object in question.h]hIPC objects, message queues, semaphore sets, and memory segments exist in flat namespaces and access requests are only required to match the object in question.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM@hjhhubh)}(hXProcess objects reflect tasks on the system and the Smack label used to access them is the same Smack label that the task would use for its own access attempts. Sending a signal via the kill() system call is a write operation from the signaler to the recipient. Debugging a process requires both reading and writing. Creating a new task is an internal operation that results in two tasks with identical Smack labels and requires no access checks.h]hXProcess objects reflect tasks on the system and the Smack label used to access them is the same Smack label that the task would use for its own access attempts. Sending a signal via the kill() system call is a write operation from the signaler to the recipient. Debugging a process requires both reading and writing. Creating a new task is an internal operation that results in two tasks with identical Smack labels and requires no access checks.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMDhjhhubh)}(hSockets are data structures attached to processes and sending a packet from one process to another requires that the sender have write access to the receiver. The receiver is not required to have read access to the sender.h]hSockets are data structures attached to processes and sending a packet from one process to another requires that the sender have write access to the receiver. The receiver is not required to have read access to the sender.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMKhjhhubeh}(h]applying-access-rulesah ]h"]applying access rulesah$]h&]uh1hhj hhhhhM%ubh)}(hhh](h)}(hSetting Access Rulesh]hSetting Access Rules}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMPubh)}(hXgThe configuration file /etc/smack/accesses contains the rules to be set at system startup. The contents are written to the special file /sys/fs/smackfs/load2. Rules can be added at any time and take effect immediately. For any pair of subject and object labels there can be only one rule, with the most recently specified overriding any earlier specification.h]hXgThe configuration file /etc/smack/accesses contains the rules to be set at system startup. The contents are written to the special file /sys/fs/smackfs/load2. Rules can be added at any time and take effect immediately. For any pair of subject and object labels there can be only one rule, with the most recently specified overriding any earlier specification.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMRhjhhubeh}(h]setting-access-rulesah ]h"]setting access rulesah$]h&]uh1hhj hhhhhMPubh)}(hhh](h)}(hTask Attributeh]hTask Attribute}(hj*hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj'hhhhhMZubh)}(hXThe Smack label of a process can be read from ``/proc//attr/current``. A process can read its own Smack label from ``/proc/self/attr/current``. A privileged process can change its own Smack label by writing to ``/proc/self/attr/current`` but not the label of another process.h](h.The Smack label of a process can be read from }(hj8hhhNhNubj )}(h``/proc//attr/current``h]h/proc//attr/current}(hj@hhhNhNubah}(h]h ]h"]h$]h&]uh1j hj8ubh.. A process can read its own Smack label from }(hj8hhhNhNubj )}(h``/proc/self/attr/current``h]h/proc/self/attr/current}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj8ubhD. A privileged process can change its own Smack label by writing to }(hj8hhhNhNubj )}(h``/proc/self/attr/current``h]h/proc/self/attr/current}(hjdhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj8ubh& but not the label of another process.}(hj8hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhM\hj'hhubh)}(hXFormat of writing is : only the label or the label followed by one of the 3 trailers: ``\n`` (by common agreement for ``/proc/...`` interfaces), ``\0`` (because some applications incorrectly include it), ``\n\0`` (because we think some applications may incorrectly include it).h](hVFormat of writing is : only the label or the label followed by one of the 3 trailers: }(hj|hhhNhNubj )}(h``\n``h]h\n}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|ubh (by common agreement for }(hj|hhhNhNubj )}(h ``/proc/...``h]h /proc/...}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|ubh interfaces), }(hj|hhhNhNubj )}(h``\0``h]h\0}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|ubh5 (because some applications incorrectly include it), }(hj|hhhNhNubj )}(h``\n\0``h]h\n\0}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1j hj|ubhA (because we think some applications may incorrectly include it).}(hj|hhhNhNubeh}(h]h ]h"]h$]h&]uh1hhhhMahj'hhubeh}(h]task-attributeah ]h"]task attributeah$]h&]uh1hhj hhhhhMZubh)}(hhh](h)}(hFile Attributeh]hFile Attribute}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMgubh)}(hThe Smack label of a filesystem object is stored as an extended attribute named SMACK64 on the file. This attribute is in the security namespace. It can only be changed by a process with privilege.h]hThe Smack label of a filesystem object is stored as an extended attribute named SMACK64 on the file. This attribute is in the security namespace. It can only be changed by a process with privilege.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMihjhhubeh}(h]file-attributeah ]h"]file attributeah$]h&]uh1hhj hhhhhMgubh)}(hhh](h)}(h Privilegeh]h Privilege}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMnubh)}(hA process with CAP_MAC_OVERRIDE or CAP_MAC_ADMIN is privileged. CAP_MAC_OVERRIDE allows the process access to objects it would be denied otherwise. CAP_MAC_ADMIN allows a process to change Smack data, including rules and attributes.h]hA process with CAP_MAC_OVERRIDE or CAP_MAC_ADMIN is privileged. CAP_MAC_OVERRIDE allows the process access to objects it would be denied otherwise. CAP_MAC_ADMIN allows a process to change Smack data, including rules and attributes.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMphjhhubeh}(h] privilegeah ]h"] privilegeah$]h&]uh1hhj hhhhhMnubh)}(hhh](h)}(hSmack Networkingh]hSmack Networking}(hj+hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj(hhhhhMvubh)}(hX2As mentioned before, Smack enforces access control on network protocol transmissions. Every packet sent by a Smack process is tagged with its Smack label. This is done by adding a CIPSO tag to the header of the IP packet. Each packet received is expected to have a CIPSO tag that identifies the label and if it lacks such a tag the network ambient label is assumed. Before the packet is delivered a check is made to determine that a subject with the label on the packet has write access to the receiving process and if that is not the case the packet is dropped.h]hX2As mentioned before, Smack enforces access control on network protocol transmissions. Every packet sent by a Smack process is tagged with its Smack label. This is done by adding a CIPSO tag to the header of the IP packet. Each packet received is expected to have a CIPSO tag that identifies the label and if it lacks such a tag the network ambient label is assumed. Before the packet is delivered a check is made to determine that a subject with the label on the packet has write access to the receiving process and if that is not the case the packet is dropped.}(hj9hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMxhj(hhubeh}(h]smack-networkingah ]h"]smack networkingah$]h&]uh1hhj hhhhhMvubh)}(hhh](h)}(hCIPSO Configurationh]hCIPSO Configuration}(hjRhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjOhhhhhMubh)}(hX<It is normally unnecessary to specify the CIPSO configuration. The default values used by the system handle all internal cases. Smack will compose CIPSO label values to match the Smack labels being used without administrative intervention. Unlabeled packets that come into the system will be given the ambient label.h]hX<It is normally unnecessary to specify the CIPSO configuration. The default values used by the system handle all internal cases. Smack will compose CIPSO label values to match the Smack labels being used without administrative intervention. Unlabeled packets that come into the system will be given the ambient label.}(hj`hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubh)}(hXSmack requires configuration in the case where packets from a system that is not Smack that speaks CIPSO may be encountered. Usually this will be a Trusted Solaris system, but there are other, less widely deployed systems out there. CIPSO provides 3 important values, a Domain Of Interpretation (DOI), a level, and a category set with each packet. The DOI is intended to identify a group of systems that use compatible labeling schemes, and the DOI specified on the Smack system must match that of the remote system or packets will be discarded. The DOI is 3 by default. The value can be read from /sys/fs/smackfs/doi and can be changed by writing to /sys/fs/smackfs/doi.h]hXSmack requires configuration in the case where packets from a system that is not Smack that speaks CIPSO may be encountered. Usually this will be a Trusted Solaris system, but there are other, less widely deployed systems out there. CIPSO provides 3 important values, a Domain Of Interpretation (DOI), a level, and a category set with each packet. The DOI is intended to identify a group of systems that use compatible labeling schemes, and the DOI specified on the Smack system must match that of the remote system or packets will be discarded. The DOI is 3 by default. The value can be read from /sys/fs/smackfs/doi and can be changed by writing to /sys/fs/smackfs/doi.}(hjnhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubh)}(hVThe label and category set are mapped to a Smack label as defined in /etc/smack/cipso.h]hVThe label and category set are mapped to a Smack label as defined in /etc/smack/cipso.}(hj|hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubh)}(h$A Smack/CIPSO mapping has the form::h]h#A Smack/CIPSO mapping has the form:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubj')}(h"smack level [category [category]*]h]h"smack level [category [category]*]}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjOhhubh)}(hSmack does not expect the level or category sets to be related in any particular way and does not assume or assign accesses based on them. Some examples of mappings::h]hSmack does not expect the level or category sets to be related in any particular way and does not assume or assign accesses based on them. Some examples of mappings:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubj')}(h?TopSecret 7 TS:A,B 7 1 2 SecBDE 5 2 4 6 RAFTERS 7 12 26h]h?TopSecret 7 TS:A,B 7 1 2 SecBDE 5 2 4 6 RAFTERS 7 12 26}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjOhhubh)}(hVThe ":" and "," characters are permitted in a Smack label but have no special meaning.h]h^The “:” and “,” characters are permitted in a Smack label but have no special meaning.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubh)}(h\The mapping of Smack labels to CIPSO values is defined by writing to /sys/fs/smackfs/cipso2.h]h\The mapping of Smack labels to CIPSO values is defined by writing to /sys/fs/smackfs/cipso2.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubh)}(hXFIn addition to explicit mappings Smack supports direct CIPSO mappings. One CIPSO level is used to indicate that the category set passed in the packet is in fact an encoding of the Smack label. The level used is 250 by default. The value can be read from /sys/fs/smackfs/direct and changed by writing to /sys/fs/smackfs/direct.h]hXFIn addition to explicit mappings Smack supports direct CIPSO mappings. One CIPSO level is used to indicate that the category set passed in the packet is in fact an encoding of the Smack label. The level used is 250 by default. The value can be read from /sys/fs/smackfs/direct and changed by writing to /sys/fs/smackfs/direct.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjOhhubeh}(h]cipso-configurationah ]h"]cipso configurationah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSocket Attributesh]hSocket Attributes}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hThere are two attributes that are associated with sockets. These attributes can only be set by privileged tasks, but any task can read them for their own sockets.h]hThere are two attributes that are associated with sockets. These attributes can only be set by privileged tasks, but any task can read them for their own sockets.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hXHSMACK64IPIN: The Smack label of the task object. A privileged program that will enforce policy may set this to the star label. SMACK64IPOUT: The Smack label transmitted with outgoing packets. A privileged program may set this to match the label of another task with which it hopes to communicate. h]j)}(hhh](j)}(hSMACK64IPIN: The Smack label of the task object. A privileged program that will enforce policy may set this to the star label. h](j)}(h SMACK64IPIN:h]h SMACK64IPIN:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhjubj)}(hhh]h)}(hqThe Smack label of the task object. A privileged program that will enforce policy may set this to the star label.h]hqThe Smack label of the task object. A privileged program that will enforce policy may set this to the star label.}(hj/hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj,ubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhMhjubj)}(hSMACK64IPOUT: The Smack label transmitted with outgoing packets. A privileged program may set this to match the label of another task with which it hopes to communicate. h](j)}(h SMACK64IPOUT:h]h SMACK64IPOUT:}(hjMhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMhjIubj)}(hhh]h)}(hThe Smack label transmitted with outgoing packets. A privileged program may set this to match the label of another task with which it hopes to communicate.h]hThe Smack label transmitted with outgoing packets. A privileged program may set this to match the label of another task with which it hopes to communicate.}(hj^hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhj[ubah}(h]h ]h"]h$]h&]uh1jhjIubeh}(h]h ]h"]h$]h&]uh1jhhhMhjubeh}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hUNIX domain socket (UDS) with a BSD address functions both as a file in a filesystem and as a socket. As a file, it carries the SMACK64 attribute. This attribute is not involved in Smack security enforcement and is immutably assigned the label "*".h]hUNIX domain socket (UDS) with a BSD address functions both as a file in a filesystem and as a socket. As a file, it carries the SMACK64 attribute. This attribute is not involved in Smack security enforcement and is immutably assigned the label “*”.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]socket-attributesah ]h"]socket attributesah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSmack Netlabel Exceptionsh]hSmack Netlabel Exceptions}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hYou will often find that your labeled application has to talk to the outside, unlabeled world. To do this there's a special file /sys/fs/smackfs/netlabel where you can add some exceptions in the form of::h]hYou will often find that your labeled application has to talk to the outside, unlabeled world. To do this there’s a special file /sys/fs/smackfs/netlabel where you can add some exceptions in the form of:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(h&@IP1 LABEL1 or @IP2/MASK LABEL2h]h&@IP1 LABEL1 or @IP2/MASK LABEL2}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hIt means that your application will have unlabeled access to @IP1 if it has write access on LABEL1, and access to the subnet @IP2/MASK if it has write access on LABEL2.h]hIt means that your application will have unlabeled access to @IP1 if it has write access on LABEL1, and access to the subnet @IP2/MASK if it has write access on LABEL2.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(hoEntries in the /sys/fs/smackfs/netlabel file are matched by longest mask first, like in classless IPv4 routing.h]hoEntries in the /sys/fs/smackfs/netlabel file are matched by longest mask first, like in classless IPv4 routing.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubh)}(h>A special label '@' and an option '-CIPSO' can be used there::h]hEA special label ‘@’ and an option ‘-CIPSO’ can be used there:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(hm@ means Internet, any application with any label has access to it -CIPSO means standard CIPSO networkingh]hm@ means Internet, any application with any label has access to it -CIPSO means standard CIPSO networking}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hKIf you don't know what CIPSO is and don't plan to use it, you can just do::h]hNIf you don’t know what CIPSO is and don’t plan to use it, you can just do:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(haecho 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabelh]haecho 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabel}hj sbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hmIf you use CIPSO on your 192.168.0.0/16 local network and need also unlabeled Internet access, you can have::h]hlIf you use CIPSO on your 192.168.0.0/16 local network and need also unlabeled Internet access, you can have:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(hecho 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel echo 192.168.0.0/16 -CIPSO > /sys/fs/smackfs/netlabel echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabelh]hecho 127.0.0.1 -CIPSO > /sys/fs/smackfs/netlabel echo 192.168.0.0/16 -CIPSO > /sys/fs/smackfs/netlabel echo 0.0.0.0/0 @ > /sys/fs/smackfs/netlabel}hj)sbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubeh}(h]smack-netlabel-exceptionsah ]h"]smack netlabel exceptionsah$]h&]uh1hhj hhhhhMubeh}(h] smack-basicsah ]h"] smack basicsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hWriting Applications for Smackh]hWriting Applications for Smack}(hjJhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjGhhhhhMubh)}(hThere are three sorts of applications that will run on a Smack system. How an application interacts with Smack will determine what it will have to do to work properly under Smack.h]hThere are three sorts of applications that will run on a Smack system. How an application interacts with Smack will determine what it will have to do to work properly under Smack.}(hjXhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjGhhubeh}(h]writing-applications-for-smackah ]h"]writing applications for smackah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSmack Ignorant Applicationsh]hSmack Ignorant Applications}(hjqhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjnhhhhhMubh)}(hXBy far the majority of applications have no reason whatever to care about the unique properties of Smack. Since invoking a program has no impact on the Smack label associated with the process the only concern likely to arise is whether the process has execute access to the program.h]hXBy far the majority of applications have no reason whatever to care about the unique properties of Smack. Since invoking a program has no impact on the Smack label associated with the process the only concern likely to arise is whether the process has execute access to the program.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjnhhubeh}(h]smack-ignorant-applicationsah ]h"]smack ignorant applicationsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSmack Relevant Applicationsh]hSmack Relevant Applications}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hSome programs can be improved by teaching them about Smack, but do not make any security decisions themselves. The utility ls(1) is one example of such a program.h]hSome programs can be improved by teaching them about Smack, but do not make any security decisions themselves. The utility ls(1) is one example of such a program.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]smack-relevant-applicationsah ]h"]smack relevant applicationsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSmack Enforcing Applicationsh]hSmack Enforcing Applications}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hXThese are special programs that not only know about Smack, but participate in the enforcement of system policy. In most cases these are the programs that set up user sessions. There are also network services that provide information to processes running with various labels.h]hXThese are special programs that not only know about Smack, but participate in the enforcement of system policy. In most cases these are the programs that set up user sessions. There are also network services that provide information to processes running with various labels.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]smack-enforcing-applicationsah ]h"]smack enforcing applicationsah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hFile System Interfacesh]hFile System Interfaces}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMubh)}(hSmack maintains labels on file system objects using extended attributes. The Smack label of a file, directory, or other file system object can be obtained using getxattr(2)::h]hSmack maintains labels on file system objects using extended attributes. The Smack label of a file, directory, or other file system object can be obtained using getxattr(2):}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(h?len = getxattr("/", "security.SMACK64", value, sizeof (value));h]h?len = getxattr("/", "security.SMACK64", value, sizeof (value));}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhM hjhhubh)}(hwill put the Smack label of the root directory into value. A privileged process can set the Smack label of a file system object with setxattr(2)::h]hwill put the Smack label of the root directory into value. A privileged process can set the Smack label of a file system object with setxattr(2):}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubj')}(hTlen = strlen("Rubble"); rc = setxattr("/foo", "security.SMACK64", "Rubble", len, 0);h]hTlen = strlen("Rubble"); rc = setxattr("/foo", "security.SMACK64", "Rubble", len, 0);}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjhhubh)}(hVwill set the Smack label of /foo to "Rubble" if the program has appropriate privilege.h]hZwill set the Smack label of /foo to “Rubble” if the program has appropriate privilege.}(hj,hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjhhubeh}(h]file-system-interfacesah ]h"]file system interfacesah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hSocket Interfacesh]hSocket Interfaces}(hjEhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjBhhhhhMubh)}(h5The socket attributes can be read using fgetxattr(2).h]h5The socket attributes can be read using fgetxattr(2).}(hjShhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjBhhubh)}(hTA privileged process can set the Smack label of outgoing packets with fsetxattr(2)::h]hSA privileged process can set the Smack label of outgoing packets with fsetxattr(2):}(hjahhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMhjBhhubj')}(hVlen = strlen("Rubble"); rc = fsetxattr(fd, "security.SMACK64IPOUT", "Rubble", len, 0);h]hVlen = strlen("Rubble"); rc = fsetxattr(fd, "security.SMACK64IPOUT", "Rubble", len, 0);}hjosbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMhjBhhubh)}(hqwill set the Smack label "Rubble" on packets going out from the socket if the program has appropriate privilege::h]htwill set the Smack label “Rubble” on packets going out from the socket if the program has appropriate privilege:}(hj}hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM"hjBhhubj')}(h?rc = fsetxattr(fd, "security.SMACK64IPIN, "*", strlen("*"), 0);h]h?rc = fsetxattr(fd, "security.SMACK64IPIN, "*", strlen("*"), 0);}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhM%hjBhhubh)}(hwill set the Smack label "*" as the object label against which incoming packets will be checked if the program has appropriate privilege.h]hwill set the Smack label “*” as the object label against which incoming packets will be checked if the program has appropriate privilege.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM'hjBhhubeh}(h]socket-interfacesah ]h"]socket interfacesah$]h&]uh1hhj hhhhhMubh)}(hhh](h)}(hAdministrationh]hAdministration}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhM+ubh)}(h"Smack supports some mount options:h]h"Smack supports some mount options:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM-hjhhubh)}(hXsmackfsdef=label: specifies the label to give files that lack the Smack label extended attribute. smackfsroot=label: specifies the label to assign the root of the file system if it lacks the Smack extended attribute. smackfshat=label: specifies a label that must have read access to all labels set on the filesystem. Not yet enforced. smackfsfloor=label: specifies a label to which all labels set on the filesystem must have read access. Not yet enforced. smackfstransmute=label: behaves exactly like smackfsroot except that it also sets the transmute flag on the root of the mount h]j)}(hhh](j)}(hbsmackfsdef=label: specifies the label to give files that lack the Smack label extended attribute. h](j)}(hsmackfsdef=label:h]hsmackfsdef=label:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM1hjubj)}(hhh]h)}(hOspecifies the label to give files that lack the Smack label extended attribute.h]hOspecifies the label to give files that lack the Smack label extended attribute.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM0hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhM1hjubj)}(hwsmackfsroot=label: specifies the label to assign the root of the file system if it lacks the Smack extended attribute. h](j)}(hsmackfsroot=label:h]hsmackfsroot=label:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM5hjubj)}(hhh]h)}(hcspecifies the label to assign the root of the file system if it lacks the Smack extended attribute.h]hcspecifies the label to assign the root of the file system if it lacks the Smack extended attribute.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM4hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhM5hjubj)}(hvsmackfshat=label: specifies a label that must have read access to all labels set on the filesystem. Not yet enforced. h](j)}(hsmackfshat=label:h]hsmackfshat=label:}(hj7hhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM9hj3ubj)}(hhh]h)}(hcspecifies a label that must have read access to all labels set on the filesystem. Not yet enforced.h]hcspecifies a label that must have read access to all labels set on the filesystem. Not yet enforced.}(hjHhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM8hjEubah}(h]h ]h"]h$]h&]uh1jhj3ubeh}(h]h ]h"]h$]h&]uh1jhhhM9hjubj)}(hysmackfsfloor=label: specifies a label to which all labels set on the filesystem must have read access. Not yet enforced. h](j)}(hsmackfsfloor=label:h]hsmackfsfloor=label:}(hjfhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhM=hjbubj)}(hhh]h)}(hdspecifies a label to which all labels set on the filesystem must have read access. Not yet enforced.h]hdspecifies a label to which all labels set on the filesystem must have read access. Not yet enforced.}(hjwhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM<hjtubah}(h]h ]h"]h$]h&]uh1jhjbubeh}(h]h ]h"]h$]h&]uh1jhhhM=hjubj)}(h~smackfstransmute=label: behaves exactly like smackfsroot except that it also sets the transmute flag on the root of the mount h](j)}(hsmackfstransmute=label:h]hsmackfstransmute=label:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1jhhhMAhjubj)}(hhh]h)}(hebehaves exactly like smackfsroot except that it also sets the transmute flag on the root of the mounth]hebehaves exactly like smackfsroot except that it also sets the transmute flag on the root of the mount}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhM@hjubah}(h]h ]h"]h$]h&]uh1jhjubeh}(h]h ]h"]h$]h&]uh1jhhhMAhjubeh}(h]h ]h"]h$]h&]uh1jhjubah}(h]h ]h"]h$]h&]uh1hhhhM/hjhhubh)}(h3These mount options apply to all file system types.h]h3These mount options apply to all file system types.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMChjhhubeh}(h]administrationah ]h"]administrationah$]h&]uh1hhj hhhhhM+ubh)}(hhh](h)}(hSmack auditingh]hSmack auditing}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjhhhhhMFubh)}(hIf you want Smack auditing of security events, you need to set CONFIG_AUDIT in your kernel configuration. By default, all denied events will be audited. You can change this behavior by writing a single character to the /sys/fs/smackfs/logging file::h]hIf you want Smack auditing of security events, you need to set CONFIG_AUDIT in your kernel configuration. By default, all denied events will be audited. You can change this behavior by writing a single character to the /sys/fs/smackfs/logging file:}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMHhjhhubj')}(hR0 : no logging 1 : log denied (default) 2 : log accepted 3 : log denied & acceptedh]hR0 : no logging 1 : log denied (default) 2 : log accepted 3 : log denied & accepted}hjsbah}(h]h ]h"]h$]h&]j6j7uh1j&hhhMMhjhhubh)}(hEvents are logged as 'key=value' pairs, for each event you at least will get the subject, the object, the rights requested, the action, the kernel function that triggered the event, plus other pairs depending on the type of event audited.h]hEvents are logged as ‘key=value’ pairs, for each event you at least will get the subject, the object, the rights requested, the action, the kernel function that triggered the event, plus other pairs depending on the type of event audited.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMRhjhhubeh}(h]smack-auditingah ]h"]smack auditingah$]h&]uh1hhj hhhhhMFubh)}(hhh](h)}(h Bringup Modeh]h Bringup Mode}(hj(hhhNhNubah}(h]h ]h"]h$]h&]uh1hhj%hhhhhMXubh)}(hXBringup mode provides logging features that can make application configuration and system bringup easier. Configure the kernel with CONFIG_SECURITY_SMACK_BRINGUP to enable these features. When bringup mode is enabled accesses that succeed due to rules marked with the "b" access mode will logged. When a new label is introduced for processes rules can be added aggressively, marked with the "b". The logging allows tracking of which rules actual get used for that label.h]hXBringup mode provides logging features that can make application configuration and system bringup easier. Configure the kernel with CONFIG_SECURITY_SMACK_BRINGUP to enable these features. When bringup mode is enabled accesses that succeed due to rules marked with the “b” access mode will logged. When a new label is introduced for processes rules can be added aggressively, marked with the “b”. The logging allows tracking of which rules actual get used for that label.}(hj6hhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMZhj%hhubh)}(hXAnother feature of bringup mode is the "unconfined" option. Writing a label to /sys/fs/smackfs/unconfined makes subjects with that label able to access any object, and objects with that label accessible to all subjects. Any access that is granted because a label is unconfined is logged. This feature is dangerous, as files and directories may be created in places they couldn't if the policy were being enforced.h]hXAnother feature of bringup mode is the “unconfined” option. Writing a label to /sys/fs/smackfs/unconfined makes subjects with that label able to access any object, and objects with that label accessible to all subjects. Any access that is granted because a label is unconfined is logged. This feature is dangerous, as files and directories may be created in places they couldn’t if the policy were being enforced.}(hjDhhhNhNubah}(h]h ]h"]h$]h&]uh1hhhhMbhj%hhubeh}(h] bringup-modeah ]h"] bringup modeah$]h&]uh1hhj hhhhhMXubeh}(h]9the-simplified-mandatory-access-control-kernel-whitepaperah ]h"];the simplified mandatory access control kernel (whitepaper)ah$]h&]uh1hhhhhhhhMTubeh}(h]smackah ]h"]h$]j} ah&]uh1hhhhhhhhKj Kubeh}(h]h ]h"]h$]h&]sourcehuh1hcurrent_sourceN current_lineNsettingsdocutils.frontendValues)}(hN generatorN datestampN source_linkN source_urlN toc_backlinksentryfootnote_backlinksK sectnum_xformKstrip_commentsNstrip_elements_with_classesN strip_classesN report_levelK halt_levelKexit_status_levelKdebugNwarning_streamN tracebackinput_encoding utf-8-siginput_encoding_error_handlerstrictoutput_encodingutf-8output_encoding_error_handlerjerror_encodingutf-8error_encoding_error_handlerbackslashreplace language_codeenrecord_dependenciesNconfigN id_prefixhauto_id_prefixid dump_settingsNdump_internalsNdump_transformsNdump_pseudo_xmlNexpose_internalsNstrict_visitorN_disable_configN_sourcehʌ _destinationN _config_files]7/var/lib/git/docbuild/linux/Documentation/docutils.confafile_insertion_enabled raw_enabledKline_length_limitM'pep_referencesN pep_base_urlhttps://peps.python.org/pep_file_url_templatepep-%04drfc_referencesN rfc_base_url&https://datatracker.ietf.org/doc/html/ tab_widthKtrim_footnote_reference_spacesyntax_highlightlong smart_quotessmartquotes_locales]character_level_inline_markupdoctitle_xform docinfo_xformKsectsubtitle_xform image_loadinglinkembed_stylesheetcloak_email_addressessection_self_linkenvNubreporterNindirect_targets]substitution_defs}substitution_names}refnames}refids}nameids}(smackNj_j\j j j. j+ jU jR j j jDjAjbj_jjjjjjjjj$j!jjjjj%j"jLjIjjjjj<j9jkjhjjjjjjj?j<jjjjj"jjWjTu nametypes}(jj_j j. jU j jDjbjjjjj$jjj%jLjjj<jkjjjj?jjj"jWuh}(jdhj\j j j j+ j jR j1 jy jX j j jAj j_jjjejjjjjjj!jjj'jjj"jjIj(jjOjjj9jjhjGjjnjjjjj<jjjBjjjjjTj%u footnote_refs} citation_refs} autofootnotes]autofootnote_refs]symbol_footnotes]symbol_footnote_refs] footnotes] citations]autofootnote_startKsymbol_footnote_startK id_counter collectionsCounter}jKsRparse_messages]hsystem_message)}(hhh]h)}(h(Duplicate implicit target name: "smack".h]h,Duplicate implicit target name: “smack”.}(hjhhhNhNubah}(h]h ]h"]h$]h&]uh1hhjubah}(h]h ]h"]h$]h&]jy alevelKtypeINFOsourcehʌlineM|uh1jhjX hhhhhM|ubatransform_messages] transformerN include_log] decorationNhhub.