admin-guide/LSM/Smack.rst

9 Smack is the Simplified Mandatory Access Control Kernel.
10 Smack is a kernel based implementation of mandatory access
13 Smack is not the only Mandatory Access Control scheme
14 available for Linux. Those new to Mandatory Access Control
33 access to systems that use them as Smack does.
50 	load the Smack access rules
53 	report if a process with one label has access
85 	Used to make access control decisions. In almost all cases
95 	label does not allow all of the access permitted to a process
102 	the Smack rule (more below) that permitted the write access
110 	Use the Smack label in this attribute for access control
115 	Use the Smack label in this attribute for access control
131 access
135 	Smack label has a particular access to an object with a
136 	specified Smack label. Write a fixed format access rule to
137 	this file. The next read will indicate whether the access
139 	access, or "0" indicating denial.
143 	Smack label has a particular access to an object with a
144 	specified Smack label. Write a long format access rule to
145 	this file. The next read will indicate whether the access
147 	access, or "0" indicating denial.
154 	This interface allows modification of existing access control rules.
160 	object label, the third the access to allow and the fourth the
161 	access to deny. The access strings may contain only the characters
165 	created using the access specified in the third and the fourth strings.
204 	label hosts only from processes that have Smack write access
217 	This interface allows access control rules in addition to
224 	object label, and the third the requested access. The access
226 	which sort of access is allowed. The "-" is a placeholder for
228 	specify read and execute access. Labels are limited to 23
232 	This interface allows access control rules in addition to
239 	object label, and the third the requested access. The access
241 	which sort of access is allowed. The "-" is a placeholder for
243 	specify read and execute access.
248 	This interface allows process specific access rules to be
249 	defined. These rules are only consulted if access would
255 	This interface allows process specific access rules to be
256 	defined. These rules are only consulted if access would
272 	that have Smack write access to the host label. All packets
292 	    this is the policy that relies on Smack access rules.
293 	    For the ``PTRACE_READ`` a subject needs to have a read access on
294 	    object. For the ``PTRACE_ATTACH`` a read-write access is required.
306 	Writing a Smack label here sets the access to '-' for all access
313 	the access permitted if it wouldn't be otherwise. Note that this
329 you can add access rules in ``/etc/smack/accesses``. They take the form::
331     subjectlabel objectlabel access
333 access is a combination of the letters rwxatb which specify the
334 kind of access permitted a subject with subjectlabel on an
335 object with objectlabel. If there is no rule no access is allowed.
339 The Simplified Mandatory Access Control Kernel (Whitepaper)
345 Mandatory Access Control
351 access to pieces of data. These schemes are called discretionary access
352 control mechanisms because the access control is specified at the discretion
354 program can access up to users or programs. These schemes are called mandatory
355 access control mechanisms because you don't have a choice regarding the users
356 or programs that have access to pieces of data.
361 From the middle of the 1980's until the turn of the century Mandatory Access
382 Smack is a Mandatory Access Control mechanism designed to provide useful MAC
384 LaPadula are addressed by providing a scheme whereby access can be controlled
387 Enforcement and avoided by defining access controls in terms of the access
407   Access:
409 	information from an object is an access.
412 	Data that identifies the Mandatory Access Control
435 on what subjects can access which objects, based on the labels attached to
463 Access Rules
466 Smack uses the traditional access modes of Linux. These modes are read,
468 access mode may not be obvious. These include:
478 Smack restricts access based on the label attached to a subject and the label
479 attached to the object it is trying to access. The rules enforced are, in
482 	1. Any access requested by a task labeled "*" is denied.
483 	2. A read or execute access requested by a task labeled "^"
485 	3. A read or execute access requested on an object labeled "_"
487 	4. Any access requested on an object labeled "*" is permitted.
488 	5. Any access requested by a task on an object with the same
490 	6. Any access requested that is explicitly defined in the loaded
492 	7. Any other access is denied.
494 Smack Access Rules
497 With the isolation provided by Smack access separation is simple. There are
498 many interesting cases where limited access by subjects to objects with
503 mechanism for specifying rules allowing access between labels.
505 Access Rule Format
508 The format of an access rule is::
510 	subject-label object-label access
513 label of the thing being accessed, and access is a string specifying the sort
514 of access allowed. The access specification is searched for letters that
515 describe access modes:
517 	a: indicates that append access should be granted.
518 	r: indicates that read access should be granted.
519 	w: indicates that write access should be granted.
520 	x: indicates that execute access should be granted.
525 Access mode specifications can be in any order. Examples of acceptable rules
542 Spaces are not allowed in labels. Since a subject always has access to files
545 access specifications. The dash is a placeholder, so "a-r" is the same
546 as "ar". A lone dash is used to specify that no access should be allowed.
548 Applying Access Rules
554 access control models is not one of them. Smack strives to treat accesses as
559 and devices require access permissions that closely match those used by mode
560 bit access. To open a file for reading read access is required on the file. To
561 search a directory requires execute access. Creating a file with write access
562 requires both read and write access on the containing directory. Deleting a
563 file requires read and write access to the file and to the containing
565 but not any of its attributes by the circumstance of having read access to the
570 access rule that allows a process to create an object in that directory
571 includes 't' access the label assigned to the new object will be that
574 access to all of their files.
577 namespaces and access requests are only required to match the object in
580 Process objects reflect tasks on the system and the Smack label used to access
581 them is the same Smack label that the task would use for its own access
585 tasks with identical Smack labels and requires no access checks.
588 one process to another requires that the sender have write access to the
589 receiver. The receiver is not required to have read access to the sender.
591 Setting Access Rules
620 CAP_MAC_OVERRIDE allows the process access to objects it would
627 As mentioned before, Smack enforces access control on network protocol
633 packet has write access to the receiving process and if that is not the case
709 It means that your application will have unlabeled access to @IP1 if it has
710 write access on LABEL1, and access to the subnet @IP2/MASK if it has write
711 access on LABEL2.
718 	@      means Internet, any application with any label has access to it
727 Internet access, you can have::
746 whether the process has execute access to the program.
814 	specifies a label that must have read access to
819 	filesystem must have read access. Not yet enforced.
852 access mode will logged. When a new label is introduced for processes
858 able to access any object, and objects with that label accessible to
859 all subjects. Any access that is granted because a label is unconfined