xref: /openbmc/linux/security/tomoyo/tomoyo.c (revision 3ce311af) 
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * security/tomoyo/tomoyo.c
4  *
5  * Copyright (C) 2005-2011  NTT DATA CORPORATION
6  */
7 
8 #include <linux/lsm_hooks.h>
9 #include "common.h"
10 
11 /**
12  * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
13  *
14  * Returns pointer to "struct tomoyo_domain_info" for current thread.
15  */
16 struct tomoyo_domain_info *tomoyo_domain(void)
17 {
18 	struct tomoyo_task *s = tomoyo_task(current);
19 
20 	if (s->old_domain_info && !current->in_execve) {
21 		atomic_dec(&s->old_domain_info->users);
22 		s->old_domain_info = NULL;
23 	}
24 	return s->domain_info;
25 }
26 
27 /**
28  * tomoyo_cred_prepare - Target for security_prepare_creds().
29  *
30  * @new: Pointer to "struct cred".
31  * @old: Pointer to "struct cred".
32  * @gfp: Memory allocation flags.
33  *
34  * Returns 0.
35  */
36 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
37 			       gfp_t gfp)
38 {
39 	/* Restore old_domain_info saved by previous execve() request. */
40 	struct tomoyo_task *s = tomoyo_task(current);
41 
42 	if (s->old_domain_info && !current->in_execve) {
43 		atomic_dec(&s->domain_info->users);
44 		s->domain_info = s->old_domain_info;
45 		s->old_domain_info = NULL;
46 	}
47 	return 0;
48 }
49 
50 /**
51  * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
52  *
53  * @bprm: Pointer to "struct linux_binprm".
54  */
55 static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm)
56 {
57 	/* Clear old_domain_info saved by execve() request. */
58 	struct tomoyo_task *s = tomoyo_task(current);
59 
60 	atomic_dec(&s->old_domain_info->users);
61 	s->old_domain_info = NULL;
62 }
63 
64 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
65 /**
66  * tomoyo_bprm_set_creds - Target for security_bprm_set_creds().
67  *
68  * @bprm: Pointer to "struct linux_binprm".
69  *
70  * Returns 0.
71  */
72 static int tomoyo_bprm_set_creds(struct linux_binprm *bprm)
73 {
74 	/*
75 	 * Do only if this function is called for the first time of an execve
76 	 * operation.
77 	 */
78 	if (bprm->called_set_creds)
79 		return 0;
80 	/*
81 	 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
82 	 * for the first time.
83 	 */
84 	if (!tomoyo_policy_loaded)
85 		tomoyo_load_policy(bprm->filename);
86 	return 0;
87 }
88 #endif
89 
90 /**
91  * tomoyo_bprm_check_security - Target for security_bprm_check().
92  *
93  * @bprm: Pointer to "struct linux_binprm".
94  *
95  * Returns 0 on success, negative value otherwise.
96  */
97 static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
98 {
99 	struct tomoyo_task *s = tomoyo_task(current);
100 
101 	/*
102 	 * Execute permission is checked against pathname passed to do_execve()
103 	 * using current domain.
104 	 */
105 	if (!s->old_domain_info) {
106 		const int idx = tomoyo_read_lock();
107 		const int err = tomoyo_find_next_domain(bprm);
108 
109 		tomoyo_read_unlock(idx);
110 		return err;
111 	}
112 	/*
113 	 * Read permission is checked against interpreters using next domain.
114 	 */
115 	return tomoyo_check_open_permission(s->domain_info,
116 					    &bprm->file->f_path, O_RDONLY);
117 }
118 
119 /**
120  * tomoyo_inode_getattr - Target for security_inode_getattr().
121  *
122  * @mnt:    Pointer to "struct vfsmount".
123  * @dentry: Pointer to "struct dentry".
124  *
125  * Returns 0 on success, negative value otherwise.
126  */
127 static int tomoyo_inode_getattr(const struct path *path)
128 {
129 	return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
130 }
131 
132 /**
133  * tomoyo_path_truncate - Target for security_path_truncate().
134  *
135  * @path: Pointer to "struct path".
136  *
137  * Returns 0 on success, negative value otherwise.
138  */
139 static int tomoyo_path_truncate(const struct path *path)
140 {
141 	return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL);
142 }
143 
144 /**
145  * tomoyo_path_unlink - Target for security_path_unlink().
146  *
147  * @parent: Pointer to "struct path".
148  * @dentry: Pointer to "struct dentry".
149  *
150  * Returns 0 on success, negative value otherwise.
151  */
152 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
153 {
154 	struct path path = { .mnt = parent->mnt, .dentry = dentry };
155 
156 	return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
157 }
158 
159 /**
160  * tomoyo_path_mkdir - Target for security_path_mkdir().
161  *
162  * @parent: Pointer to "struct path".
163  * @dentry: Pointer to "struct dentry".
164  * @mode:   DAC permission mode.
165  *
166  * Returns 0 on success, negative value otherwise.
167  */
168 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
169 			     umode_t mode)
170 {
171 	struct path path = { .mnt = parent->mnt, .dentry = dentry };
172 
173 	return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
174 				       mode & S_IALLUGO);
175 }
176 
177 /**
178  * tomoyo_path_rmdir - Target for security_path_rmdir().
179  *
180  * @parent: Pointer to "struct path".
181  * @dentry: Pointer to "struct dentry".
182  *
183  * Returns 0 on success, negative value otherwise.
184  */
185 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
186 {
187 	struct path path = { .mnt = parent->mnt, .dentry = dentry };
188 
189 	return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
190 }
191 
192 /**
193  * tomoyo_path_symlink - Target for security_path_symlink().
194  *
195  * @parent:   Pointer to "struct path".
196  * @dentry:   Pointer to "struct dentry".
197  * @old_name: Symlink's content.
198  *
199  * Returns 0 on success, negative value otherwise.
200  */
201 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
202 			       const char *old_name)
203 {
204 	struct path path = { .mnt = parent->mnt, .dentry = dentry };
205 
206 	return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
207 }
208 
209 /**
210  * tomoyo_path_mknod - Target for security_path_mknod().
211  *
212  * @parent: Pointer to "struct path".
213  * @dentry: Pointer to "struct dentry".
214  * @mode:   DAC permission mode.
215  * @dev:    Device attributes.
216  *
217  * Returns 0 on success, negative value otherwise.
218  */
219 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
220 			     umode_t mode, unsigned int dev)
221 {
222 	struct path path = { .mnt = parent->mnt, .dentry = dentry };
223 	int type = TOMOYO_TYPE_CREATE;
224 	const unsigned int perm = mode & S_IALLUGO;
225 
226 	switch (mode & S_IFMT) {
227 	case S_IFCHR:
228 		type = TOMOYO_TYPE_MKCHAR;
229 		break;
230 	case S_IFBLK:
231 		type = TOMOYO_TYPE_MKBLOCK;
232 		break;
233 	default:
234 		goto no_dev;
235 	}
236 	return tomoyo_mkdev_perm(type, &path, perm, dev);
237  no_dev:
238 	switch (mode & S_IFMT) {
239 	case S_IFIFO:
240 		type = TOMOYO_TYPE_MKFIFO;
241 		break;
242 	case S_IFSOCK:
243 		type = TOMOYO_TYPE_MKSOCK;
244 		break;
245 	}
246 	return tomoyo_path_number_perm(type, &path, perm);
247 }
248 
249 /**
250  * tomoyo_path_link - Target for security_path_link().
251  *
252  * @old_dentry: Pointer to "struct dentry".
253  * @new_dir:    Pointer to "struct path".
254  * @new_dentry: Pointer to "struct dentry".
255  *
256  * Returns 0 on success, negative value otherwise.
257  */
258 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
259 			    struct dentry *new_dentry)
260 {
261 	struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
262 	struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
263 
264 	return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
265 }
266 
267 /**
268  * tomoyo_path_rename - Target for security_path_rename().
269  *
270  * @old_parent: Pointer to "struct path".
271  * @old_dentry: Pointer to "struct dentry".
272  * @new_parent: Pointer to "struct path".
273  * @new_dentry: Pointer to "struct dentry".
274  *
275  * Returns 0 on success, negative value otherwise.
276  */
277 static int tomoyo_path_rename(const struct path *old_parent,
278 			      struct dentry *old_dentry,
279 			      const struct path *new_parent,
280 			      struct dentry *new_dentry)
281 {
282 	struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
283 	struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
284 
285 	return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
286 }
287 
288 /**
289  * tomoyo_file_fcntl - Target for security_file_fcntl().
290  *
291  * @file: Pointer to "struct file".
292  * @cmd:  Command for fcntl().
293  * @arg:  Argument for @cmd.
294  *
295  * Returns 0 on success, negative value otherwise.
296  */
297 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
298 			     unsigned long arg)
299 {
300 	if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
301 		return 0;
302 	return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path,
303 					    O_WRONLY | (arg & O_APPEND));
304 }
305 
306 /**
307  * tomoyo_file_open - Target for security_file_open().
308  *
309  * @f:    Pointer to "struct file".
310  * @cred: Pointer to "struct cred".
311  *
312  * Returns 0 on success, negative value otherwise.
313  */
314 static int tomoyo_file_open(struct file *f)
315 {
316 	/* Don't check read permission here if called from do_execve(). */
317 	if (current->in_execve)
318 		return 0;
319 	return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path,
320 					    f->f_flags);
321 }
322 
323 /**
324  * tomoyo_file_ioctl - Target for security_file_ioctl().
325  *
326  * @file: Pointer to "struct file".
327  * @cmd:  Command for ioctl().
328  * @arg:  Argument for @cmd.
329  *
330  * Returns 0 on success, negative value otherwise.
331  */
332 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
333 			     unsigned long arg)
334 {
335 	return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd);
336 }
337 
338 /**
339  * tomoyo_path_chmod - Target for security_path_chmod().
340  *
341  * @path: Pointer to "struct path".
342  * @mode: DAC permission mode.
343  *
344  * Returns 0 on success, negative value otherwise.
345  */
346 static int tomoyo_path_chmod(const struct path *path, umode_t mode)
347 {
348 	return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
349 				       mode & S_IALLUGO);
350 }
351 
352 /**
353  * tomoyo_path_chown - Target for security_path_chown().
354  *
355  * @path: Pointer to "struct path".
356  * @uid:  Owner ID.
357  * @gid:  Group ID.
358  *
359  * Returns 0 on success, negative value otherwise.
360  */
361 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
362 {
363 	int error = 0;
364 
365 	if (uid_valid(uid))
366 		error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
367 						from_kuid(&init_user_ns, uid));
368 	if (!error && gid_valid(gid))
369 		error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path,
370 						from_kgid(&init_user_ns, gid));
371 	return error;
372 }
373 
374 /**
375  * tomoyo_path_chroot - Target for security_path_chroot().
376  *
377  * @path: Pointer to "struct path".
378  *
379  * Returns 0 on success, negative value otherwise.
380  */
381 static int tomoyo_path_chroot(const struct path *path)
382 {
383 	return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL);
384 }
385 
386 /**
387  * tomoyo_sb_mount - Target for security_sb_mount().
388  *
389  * @dev_name: Name of device file. Maybe NULL.
390  * @path:     Pointer to "struct path".
391  * @type:     Name of filesystem type. Maybe NULL.
392  * @flags:    Mount options.
393  * @data:     Optional data. Maybe NULL.
394  *
395  * Returns 0 on success, negative value otherwise.
396  */
397 static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
398 			   const char *type, unsigned long flags, void *data)
399 {
400 	return tomoyo_mount_permission(dev_name, path, type, flags, data);
401 }
402 
403 /**
404  * tomoyo_sb_umount - Target for security_sb_umount().
405  *
406  * @mnt:   Pointer to "struct vfsmount".
407  * @flags: Unmount options.
408  *
409  * Returns 0 on success, negative value otherwise.
410  */
411 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
412 {
413 	struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
414 
415 	return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
416 }
417 
418 /**
419  * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
420  *
421  * @old_path: Pointer to "struct path".
422  * @new_path: Pointer to "struct path".
423  *
424  * Returns 0 on success, negative value otherwise.
425  */
426 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
427 {
428 	return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
429 }
430 
431 /**
432  * tomoyo_socket_listen - Check permission for listen().
433  *
434  * @sock:    Pointer to "struct socket".
435  * @backlog: Backlog parameter.
436  *
437  * Returns 0 on success, negative value otherwise.
438  */
439 static int tomoyo_socket_listen(struct socket *sock, int backlog)
440 {
441 	return tomoyo_socket_listen_permission(sock);
442 }
443 
444 /**
445  * tomoyo_socket_connect - Check permission for connect().
446  *
447  * @sock:     Pointer to "struct socket".
448  * @addr:     Pointer to "struct sockaddr".
449  * @addr_len: Size of @addr.
450  *
451  * Returns 0 on success, negative value otherwise.
452  */
453 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
454 				 int addr_len)
455 {
456 	return tomoyo_socket_connect_permission(sock, addr, addr_len);
457 }
458 
459 /**
460  * tomoyo_socket_bind - Check permission for bind().
461  *
462  * @sock:     Pointer to "struct socket".
463  * @addr:     Pointer to "struct sockaddr".
464  * @addr_len: Size of @addr.
465  *
466  * Returns 0 on success, negative value otherwise.
467  */
468 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
469 			      int addr_len)
470 {
471 	return tomoyo_socket_bind_permission(sock, addr, addr_len);
472 }
473 
474 /**
475  * tomoyo_socket_sendmsg - Check permission for sendmsg().
476  *
477  * @sock: Pointer to "struct socket".
478  * @msg:  Pointer to "struct msghdr".
479  * @size: Size of message.
480  *
481  * Returns 0 on success, negative value otherwise.
482  */
483 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
484 				 int size)
485 {
486 	return tomoyo_socket_sendmsg_permission(sock, msg, size);
487 }
488 
489 struct lsm_blob_sizes tomoyo_blob_sizes __lsm_ro_after_init = {
490 	.lbs_task = sizeof(struct tomoyo_task),
491 };
492 
493 /**
494  * tomoyo_task_alloc - Target for security_task_alloc().
495  *
496  * @task:  Pointer to "struct task_struct".
497  * @flags: clone() flags.
498  *
499  * Returns 0.
500  */
501 static int tomoyo_task_alloc(struct task_struct *task,
502 			     unsigned long clone_flags)
503 {
504 	struct tomoyo_task *old = tomoyo_task(current);
505 	struct tomoyo_task *new = tomoyo_task(task);
506 
507 	new->domain_info = old->domain_info;
508 	atomic_inc(&new->domain_info->users);
509 	new->old_domain_info = NULL;
510 	return 0;
511 }
512 
513 /**
514  * tomoyo_task_free - Target for security_task_free().
515  *
516  * @task: Pointer to "struct task_struct".
517  */
518 static void tomoyo_task_free(struct task_struct *task)
519 {
520 	struct tomoyo_task *s = tomoyo_task(task);
521 
522 	if (s->domain_info) {
523 		atomic_dec(&s->domain_info->users);
524 		s->domain_info = NULL;
525 	}
526 	if (s->old_domain_info) {
527 		atomic_dec(&s->old_domain_info->users);
528 		s->old_domain_info = NULL;
529 	}
530 }
531 
532 /*
533  * tomoyo_security_ops is a "struct security_operations" which is used for
534  * registering TOMOYO.
535  */
536 static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = {
537 	LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
538 	LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
539 	LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
540 	LSM_HOOK_INIT(task_free, tomoyo_task_free),
541 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
542 	LSM_HOOK_INIT(bprm_set_creds, tomoyo_bprm_set_creds),
543 #endif
544 	LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
545 	LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
546 	LSM_HOOK_INIT(file_open, tomoyo_file_open),
547 	LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
548 	LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
549 	LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
550 	LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
551 	LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
552 	LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
553 	LSM_HOOK_INIT(path_link, tomoyo_path_link),
554 	LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
555 	LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
556 	LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
557 	LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
558 	LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
559 	LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
560 	LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
561 	LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
562 	LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
563 	LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
564 	LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
565 	LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
566 	LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
567 };
568 
569 /* Lock for GC. */
570 DEFINE_SRCU(tomoyo_ss);
571 
572 int tomoyo_enabled __lsm_ro_after_init = 1;
573 
574 /**
575  * tomoyo_init - Register TOMOYO Linux as a LSM module.
576  *
577  * Returns 0.
578  */
579 static int __init tomoyo_init(void)
580 {
581 	struct tomoyo_task *s = tomoyo_task(current);
582 
583 	/* register ourselves with the security framework */
584 	security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
585 	pr_info("TOMOYO Linux initialized\n");
586 	s->domain_info = &tomoyo_kernel_domain;
587 	atomic_inc(&tomoyo_kernel_domain.users);
588 	s->old_domain_info = NULL;
589 	tomoyo_mm_init();
590 
591 	return 0;
592 }
593 
594 DEFINE_LSM(tomoyo) = {
595 	.name = "tomoyo",
596 	.enabled = &tomoyo_enabled,
597 	.flags = LSM_FLAG_LEGACY_MAJOR,
598 	.blobs = &tomoyo_blob_sizes,
599 	.init = tomoyo_init,
600 };
601