tomoyo.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * security/tomoyo/tomoyo.c
  4. *
  5. * Copyright (C) 2005-2011 NTT DATA CORPORATION
  6. */
  7. #include <linux/lsm_hooks.h>
  8. #include "common.h"
  9. /**
  10. * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
  11. *
  12. * Returns pointer to "struct tomoyo_domain_info" for current thread.
  13. */
  14. struct tomoyo_domain_info *tomoyo_domain(void)
  15. {
  16. struct tomoyo_task *s = tomoyo_task(current);
  17. if (s->old_domain_info && !current->in_execve) {
  18. atomic_dec(&s->old_domain_info->users);
  19. s->old_domain_info = NULL;
  20. }
  21. return s->domain_info;
  22. }
  23. /**
  24. * tomoyo_cred_prepare - Target for security_prepare_creds().
  25. *
  26. * @new: Pointer to "struct cred".
  27. * @old: Pointer to "struct cred".
  28. * @gfp: Memory allocation flags.
  29. *
  30. * Returns 0.
  31. */
  32. static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
  33. gfp_t gfp)
  34. {
  35. /* Restore old_domain_info saved by previous execve() request. */
  36. struct tomoyo_task *s = tomoyo_task(current);
  37. if (s->old_domain_info && !current->in_execve) {
  38. atomic_dec(&s->domain_info->users);
  39. s->domain_info = s->old_domain_info;
  40. s->old_domain_info = NULL;
  41. }
  42. return 0;
  43. }
  44. /**
  45. * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
  46. *
  47. * @bprm: Pointer to "struct linux_binprm".
  48. */
  49. static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm)
  50. {
  51. /* Clear old_domain_info saved by execve() request. */
  52. struct tomoyo_task *s = tomoyo_task(current);
  53. atomic_dec(&s->old_domain_info->users);
  54. s->old_domain_info = NULL;
  55. }
  56. #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
  57. /**
  58. * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec().
  59. *
  60. * @bprm: Pointer to "struct linux_binprm".
  61. *
  62. * Returns 0.
  63. */
  64. static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm)
  65. {
  66. /*
  67. * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
  68. * for the first time.
  69. */
  70. if (!tomoyo_policy_loaded)
  71. tomoyo_load_policy(bprm->filename);
  72. return 0;
  73. }
  74. #endif
  75. /**
  76. * tomoyo_bprm_check_security - Target for security_bprm_check().
  77. *
  78. * @bprm: Pointer to "struct linux_binprm".
  79. *
  80. * Returns 0 on success, negative value otherwise.
  81. */
  82. static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
  83. {
  84. struct tomoyo_task *s = tomoyo_task(current);
  85. /*
  86. * Execute permission is checked against pathname passed to execve()
  87. * using current domain.
  88. */
  89. if (!s->old_domain_info) {
  90. const int idx = tomoyo_read_lock();
  91. const int err = tomoyo_find_next_domain(bprm);
  92. tomoyo_read_unlock(idx);
  93. return err;
  94. }
  95. /*
  96. * Read permission is checked against interpreters using next domain.
  97. */
  98. return tomoyo_check_open_permission(s->domain_info,
  99. &bprm->file->f_path, O_RDONLY);
  100. }
  101. /**
  102. * tomoyo_inode_getattr - Target for security_inode_getattr().
  103. *
  104. * @path: Pointer to "struct path".
  105. *
  106. * Returns 0 on success, negative value otherwise.
  107. */
  108. static int tomoyo_inode_getattr(const struct path *path)
  109. {
  110. return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
  111. }
  112. /**
  113. * tomoyo_path_truncate - Target for security_path_truncate().
  114. *
  115. * @path: Pointer to "struct path".
  116. *
  117. * Returns 0 on success, negative value otherwise.
  118. */
  119. static int tomoyo_path_truncate(const struct path *path)
  120. {
  121. return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL);
  122. }
  123. /**
  124. * tomoyo_path_unlink - Target for security_path_unlink().
  125. *
  126. * @parent: Pointer to "struct path".
  127. * @dentry: Pointer to "struct dentry".
  128. *
  129. * Returns 0 on success, negative value otherwise.
  130. */
  131. static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
  132. {
  133. struct path path = { .mnt = parent->mnt, .dentry = dentry };
  134. return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
  135. }
  136. /**
  137. * tomoyo_path_mkdir - Target for security_path_mkdir().
  138. *
  139. * @parent: Pointer to "struct path".
  140. * @dentry: Pointer to "struct dentry".
  141. * @mode: DAC permission mode.
  142. *
  143. * Returns 0 on success, negative value otherwise.
  144. */
  145. static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
  146. umode_t mode)
  147. {
  148. struct path path = { .mnt = parent->mnt, .dentry = dentry };
  149. return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
  150. mode & S_IALLUGO);
  151. }
  152. /**
  153. * tomoyo_path_rmdir - Target for security_path_rmdir().
  154. *
  155. * @parent: Pointer to "struct path".
  156. * @dentry: Pointer to "struct dentry".
  157. *
  158. * Returns 0 on success, negative value otherwise.
  159. */
  160. static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
  161. {
  162. struct path path = { .mnt = parent->mnt, .dentry = dentry };
  163. return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
  164. }
  165. /**
  166. * tomoyo_path_symlink - Target for security_path_symlink().
  167. *
  168. * @parent: Pointer to "struct path".
  169. * @dentry: Pointer to "struct dentry".
  170. * @old_name: Symlink's content.
  171. *
  172. * Returns 0 on success, negative value otherwise.
  173. */
  174. static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
  175. const char *old_name)
  176. {
  177. struct path path = { .mnt = parent->mnt, .dentry = dentry };
  178. return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
  179. }
  180. /**
  181. * tomoyo_path_mknod - Target for security_path_mknod().
  182. *
  183. * @parent: Pointer to "struct path".
  184. * @dentry: Pointer to "struct dentry".
  185. * @mode: DAC permission mode.
  186. * @dev: Device attributes.
  187. *
  188. * Returns 0 on success, negative value otherwise.
  189. */
  190. static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
  191. umode_t mode, unsigned int dev)
  192. {
  193. struct path path = { .mnt = parent->mnt, .dentry = dentry };
  194. int type = TOMOYO_TYPE_CREATE;
  195. const unsigned int perm = mode & S_IALLUGO;
  196. switch (mode & S_IFMT) {
  197. case S_IFCHR:
  198. type = TOMOYO_TYPE_MKCHAR;
  199. break;
  200. case S_IFBLK:
  201. type = TOMOYO_TYPE_MKBLOCK;
  202. break;
  203. default:
  204. goto no_dev;
  205. }
  206. return tomoyo_mkdev_perm(type, &path, perm, dev);
  207. no_dev:
  208. switch (mode & S_IFMT) {
  209. case S_IFIFO:
  210. type = TOMOYO_TYPE_MKFIFO;
  211. break;
  212. case S_IFSOCK:
  213. type = TOMOYO_TYPE_MKSOCK;
  214. break;
  215. }
  216. return tomoyo_path_number_perm(type, &path, perm);
  217. }
  218. /**
  219. * tomoyo_path_link - Target for security_path_link().
  220. *
  221. * @old_dentry: Pointer to "struct dentry".
  222. * @new_dir: Pointer to "struct path".
  223. * @new_dentry: Pointer to "struct dentry".
  224. *
  225. * Returns 0 on success, negative value otherwise.
  226. */
  227. static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
  228. struct dentry *new_dentry)
  229. {
  230. struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
  231. struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
  232. return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
  233. }
  234. /**
  235. * tomoyo_path_rename - Target for security_path_rename().
  236. *
  237. * @old_parent: Pointer to "struct path".
  238. * @old_dentry: Pointer to "struct dentry".
  239. * @new_parent: Pointer to "struct path".
  240. * @new_dentry: Pointer to "struct dentry".
  241. * @flags: Rename options.
  242. *
  243. * Returns 0 on success, negative value otherwise.
  244. */
  245. static int tomoyo_path_rename(const struct path *old_parent,
  246. struct dentry *old_dentry,
  247. const struct path *new_parent,
  248. struct dentry *new_dentry,
  249. const unsigned int flags)
  250. {
  251. struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
  252. struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
  253. if (flags & RENAME_EXCHANGE) {
  254. const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2,
  255. &path1);
  256. if (err)
  257. return err;
  258. }
  259. return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
  260. }
  261. /**
  262. * tomoyo_file_fcntl - Target for security_file_fcntl().
  263. *
  264. * @file: Pointer to "struct file".
  265. * @cmd: Command for fcntl().
  266. * @arg: Argument for @cmd.
  267. *
  268. * Returns 0 on success, negative value otherwise.
  269. */
  270. static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
  271. unsigned long arg)
  272. {
  273. if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
  274. return 0;
  275. return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path,
  276. O_WRONLY | (arg & O_APPEND));
  277. }
  278. /**
  279. * tomoyo_file_open - Target for security_file_open().
  280. *
  281. * @f: Pointer to "struct file".
  282. *
  283. * Returns 0 on success, negative value otherwise.
  284. */
  285. static int tomoyo_file_open(struct file *f)
  286. {
  287. /* Don't check read permission here if called from execve(). */
  288. if (current->in_execve)
  289. return 0;
  290. return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path,
  291. f->f_flags);
  292. }
  293. /**
  294. * tomoyo_file_ioctl - Target for security_file_ioctl().
  295. *
  296. * @file: Pointer to "struct file".
  297. * @cmd: Command for ioctl().
  298. * @arg: Argument for @cmd.
  299. *
  300. * Returns 0 on success, negative value otherwise.
  301. */
  302. static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
  303. unsigned long arg)
  304. {
  305. return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd);
  306. }
  307. /**
  308. * tomoyo_path_chmod - Target for security_path_chmod().
  309. *
  310. * @path: Pointer to "struct path".
  311. * @mode: DAC permission mode.
  312. *
  313. * Returns 0 on success, negative value otherwise.
  314. */
  315. static int tomoyo_path_chmod(const struct path *path, umode_t mode)
  316. {
  317. return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
  318. mode & S_IALLUGO);
  319. }
  320. /**
  321. * tomoyo_path_chown - Target for security_path_chown().
  322. *
  323. * @path: Pointer to "struct path".
  324. * @uid: Owner ID.
  325. * @gid: Group ID.
  326. *
  327. * Returns 0 on success, negative value otherwise.
  328. */
  329. static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
  330. {
  331. int error = 0;
  332. if (uid_valid(uid))
  333. error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
  334. from_kuid(&init_user_ns, uid));
  335. if (!error && gid_valid(gid))
  336. error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path,
  337. from_kgid(&init_user_ns, gid));
  338. return error;
  339. }
  340. /**
  341. * tomoyo_path_chroot - Target for security_path_chroot().
  342. *
  343. * @path: Pointer to "struct path".
  344. *
  345. * Returns 0 on success, negative value otherwise.
  346. */
  347. static int tomoyo_path_chroot(const struct path *path)
  348. {
  349. return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL);
  350. }
  351. /**
  352. * tomoyo_sb_mount - Target for security_sb_mount().
  353. *
  354. * @dev_name: Name of device file. Maybe NULL.
  355. * @path: Pointer to "struct path".
  356. * @type: Name of filesystem type. Maybe NULL.
  357. * @flags: Mount options.
  358. * @data: Optional data. Maybe NULL.
  359. *
  360. * Returns 0 on success, negative value otherwise.
  361. */
  362. static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
  363. const char *type, unsigned long flags, void *data)
  364. {
  365. return tomoyo_mount_permission(dev_name, path, type, flags, data);
  366. }
  367. /**
  368. * tomoyo_sb_umount - Target for security_sb_umount().
  369. *
  370. * @mnt: Pointer to "struct vfsmount".
  371. * @flags: Unmount options.
  372. *
  373. * Returns 0 on success, negative value otherwise.
  374. */
  375. static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
  376. {
  377. struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
  378. return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
  379. }
  380. /**
  381. * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
  382. *
  383. * @old_path: Pointer to "struct path".
  384. * @new_path: Pointer to "struct path".
  385. *
  386. * Returns 0 on success, negative value otherwise.
  387. */
  388. static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
  389. {
  390. return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
  391. }
  392. /**
  393. * tomoyo_socket_listen - Check permission for listen().
  394. *
  395. * @sock: Pointer to "struct socket".
  396. * @backlog: Backlog parameter.
  397. *
  398. * Returns 0 on success, negative value otherwise.
  399. */
  400. static int tomoyo_socket_listen(struct socket *sock, int backlog)
  401. {
  402. return tomoyo_socket_listen_permission(sock);
  403. }
  404. /**
  405. * tomoyo_socket_connect - Check permission for connect().
  406. *
  407. * @sock: Pointer to "struct socket".
  408. * @addr: Pointer to "struct sockaddr".
  409. * @addr_len: Size of @addr.
  410. *
  411. * Returns 0 on success, negative value otherwise.
  412. */
  413. static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
  414. int addr_len)
  415. {
  416. return tomoyo_socket_connect_permission(sock, addr, addr_len);
  417. }
  418. /**
  419. * tomoyo_socket_bind - Check permission for bind().
  420. *
  421. * @sock: Pointer to "struct socket".
  422. * @addr: Pointer to "struct sockaddr".
  423. * @addr_len: Size of @addr.
  424. *
  425. * Returns 0 on success, negative value otherwise.
  426. */
  427. static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
  428. int addr_len)
  429. {
  430. return tomoyo_socket_bind_permission(sock, addr, addr_len);
  431. }
  432. /**
  433. * tomoyo_socket_sendmsg - Check permission for sendmsg().
  434. *
  435. * @sock: Pointer to "struct socket".
  436. * @msg: Pointer to "struct msghdr".
  437. * @size: Size of message.
  438. *
  439. * Returns 0 on success, negative value otherwise.
  440. */
  441. static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
  442. int size)
  443. {
  444. return tomoyo_socket_sendmsg_permission(sock, msg, size);
  445. }
  446. struct lsm_blob_sizes tomoyo_blob_sizes __lsm_ro_after_init = {
  447. .lbs_task = sizeof(struct tomoyo_task),
  448. };
  449. /**
  450. * tomoyo_task_alloc - Target for security_task_alloc().
  451. *
  452. * @task: Pointer to "struct task_struct".
  453. * @clone_flags: clone() flags.
  454. *
  455. * Returns 0.
  456. */
  457. static int tomoyo_task_alloc(struct task_struct *task,
  458. unsigned long clone_flags)
  459. {
  460. struct tomoyo_task *old = tomoyo_task(current);
  461. struct tomoyo_task *new = tomoyo_task(task);
  462. new->domain_info = old->domain_info;
  463. atomic_inc(&new->domain_info->users);
  464. new->old_domain_info = NULL;
  465. return 0;
  466. }
  467. /**
  468. * tomoyo_task_free - Target for security_task_free().
  469. *
  470. * @task: Pointer to "struct task_struct".
  471. */
  472. static void tomoyo_task_free(struct task_struct *task)
  473. {
  474. struct tomoyo_task *s = tomoyo_task(task);
  475. if (s->domain_info) {
  476. atomic_dec(&s->domain_info->users);
  477. s->domain_info = NULL;
  478. }
  479. if (s->old_domain_info) {
  480. atomic_dec(&s->old_domain_info->users);
  481. s->old_domain_info = NULL;
  482. }
  483. }
  484. /*
  485. * tomoyo_security_ops is a "struct security_operations" which is used for
  486. * registering TOMOYO.
  487. */
  488. static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = {
  489. LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
  490. LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
  491. LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
  492. LSM_HOOK_INIT(task_free, tomoyo_task_free),
  493. #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
  494. LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec),
  495. #endif
  496. LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
  497. LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
  498. LSM_HOOK_INIT(file_open, tomoyo_file_open),
  499. LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
  500. LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
  501. LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
  502. LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
  503. LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
  504. LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
  505. LSM_HOOK_INIT(path_link, tomoyo_path_link),
  506. LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
  507. LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
  508. LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
  509. LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
  510. LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
  511. LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
  512. LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
  513. LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
  514. LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
  515. LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
  516. LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
  517. LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
  518. LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
  519. };
  520. /* Lock for GC. */
  521. DEFINE_SRCU(tomoyo_ss);
  522. int tomoyo_enabled __lsm_ro_after_init = 1;
  523. /**
  524. * tomoyo_init - Register TOMOYO Linux as a LSM module.
  525. *
  526. * Returns 0.
  527. */
  528. static int __init tomoyo_init(void)
  529. {
  530. struct tomoyo_task *s = tomoyo_task(current);
  531. /* register ourselves with the security framework */
  532. security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
  533. pr_info("TOMOYO Linux initialized\n");
  534. s->domain_info = &tomoyo_kernel_domain;
  535. atomic_inc(&tomoyo_kernel_domain.users);
  536. s->old_domain_info = NULL;
  537. tomoyo_mm_init();
  538. return 0;
  539. }
  540. DEFINE_LSM(tomoyo) = {
  541. .name = "tomoyo",
  542. .enabled = &tomoyo_enabled,
  543. .flags = LSM_FLAG_LEGACY_MAJOR,
  544. .blobs = &tomoyo_blob_sizes,
  545. .init = tomoyo_init,
  546. };