SMACK

SMACK (Simplified Mandatory Access Control Kernel) allows to define simple rules to limit a user or a process rights.

Context

The actual user context is defined in the following file :

/proc/$$/attr/current

Rules

A rule is defined as follows :

System  User  rwxat

• System is the subject’s label
• User is the object’s label
• rwx are the access read, write, execute, append and transmute

ℹ️ The processes System can read, write and execute User objects.

Possible access

• r = read
• w = write
• x = execute
• t = transmute (If a file is created in a directory with transmute access, it will inherit of the label of parent)
• a = append (add)
• l = lock (use for locking a file ==> Read-Only)
• b = bring-up (equivalent of permissive mode)

Without any capability, you can only reduce accesses. If you want to change a rule you need CAP_MAC_ADMIN capability.

You have two ways to change rules :

1) Runtime

smackload subject object rwt

Changes are lost on restart.

2) Persistant

Create a file in /etc/smack/accesses.d/ with rules :

# vim /etc/smack/accesses.d/demo-app.smack
subject object rwt

Changes are applied on restart.

Default smack access rules

✔️ If subject and object have the same label

🛑 All other rules not explicitly defined

Sources

https://www.kernel.org/doc/html/v4.15/admin-guide/LSM/Smack.html

https://wiki.tizen.org/Security:SmackThreeDomainModel