linux kernel security module smack transmutation example

Question

In the kernel documentation for smack security module it reads: "If a directory is marked as transmuting (SMACK64TRANSMUTE=TRUE) and the access rule that allows a process to create an object in that directory includes 't' access the label assigned to the new object will be that of the directory, not the creating process. This makes it much easier for two processes with different labels to share data without granting access to all of their files.".

Can someone give an example how to set up the rules and permissions for the directory and files or other resources being shared?

I'm reading about the tizen three domain security model and the subject that is hard to understand is about the /run directory. Specifically about the System::Run label: "The User domain has complete, transmuting access to this label." On my desktop system the /run directory contains only stuffs owned by root. How would a user process have a write access to it? Or does the "complete access" not mean to have the write permission?

Answer 1

Transmute feature in Smack solves a problem of two applications running with different Smack rules sharing data in a single directory. First of all, both applications need write ('w') and execute ('x') access to label of the directory in order to be able to write into it. But the files that would be created will have Smack label of the process that created them. If one of two apps would like to access files in that directory that were created by the other app, it would need access to the other app's label.

To solve that, Smack provides transmute feature. Two parts are needed:

• The applications that write to the directory must have 't' access to the directory label.
• The directory needs to have transmute attribute. If it is an ordinary directory, you set the attribute with security.SMACK64TRANSMUTE xattr set to "TRUE", or simpler with "chsmack -t " command. If the directory is a mount point (like /run in your Tizen example), it can be mounted with smackfstransmute="some_label" mount option to give it desired Smack label and enable transmute.

This will enable transmute, affecting Smack labels of newly created files in that directory. Every file created there by one of the apps will now get Smack label of the directory instead of Smack label of the process that created it. And every sub-directory created in that directory will also get transmute attribute.

Let me show an example:

# mkdir /tmp/test
# chsmack -a dir_label /tmp/test
# chsmack /tmp/test
/tmp/test access="dir_label"
# echo "process_label dir_label wx" | smackload
# echo process_label >/proc/self/attr/current

With directory /tmp/test having label "dir_label" and current shell running with label "process_label", let's see how new files and directories will be labeled:

# touch /tmp/test/file1
# mkdir /tmp/test/dir1
# chsmack /tmp/test/file1 /tmp/test/dir1
/tmp/test/file1 access="process_label"
/tmp/test/dir1 access="process_label"

Let's enable transmute:

# chsmack -t /tmp/test
# chsmack /tmp/test
/tmp/test/ access="dir_label" transmute="TRUE"
# echo "process_label dir_label wxt" | smackload

And transmute in action:

# touch /tmp/test/file2
# mkdir /tmp/test/dir2
# chsmack  /tmp/test/file2 /tmp/test/dir2
/tmp/test/file2 access="dir_label"
/tmp/test/dir2 access="dir_label" transmute="TRUE"