1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * security/tomoyo/tomoyo.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8 #include <linux/lsm_hooks.h> 9 #include "common.h" 10 11 /** 12 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 13 * 14 * Returns pointer to "struct tomoyo_domain_info" for current thread. 15 */ 16 struct tomoyo_domain_info *tomoyo_domain(void) 17 { 18 struct tomoyo_task *s = tomoyo_task(current); 19 20 if (s->old_domain_info && !current->in_execve) { 21 atomic_dec(&s->old_domain_info->users); 22 s->old_domain_info = NULL; 23 } 24 return s->domain_info; 25 } 26 27 /** 28 * tomoyo_cred_prepare - Target for security_prepare_creds(). 29 * 30 * @new: Pointer to "struct cred". 31 * @old: Pointer to "struct cred". 32 * @gfp: Memory allocation flags. 33 * 34 * Returns 0. 35 */ 36 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, 37 gfp_t gfp) 38 { 39 /* Restore old_domain_info saved by previous execve() request. */ 40 struct tomoyo_task *s = tomoyo_task(current); 41 42 if (s->old_domain_info && !current->in_execve) { 43 atomic_dec(&s->domain_info->users); 44 s->domain_info = s->old_domain_info; 45 s->old_domain_info = NULL; 46 } 47 return 0; 48 } 49 50 /** 51 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). 52 * 53 * @bprm: Pointer to "struct linux_binprm". 54 */ 55 static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm) 56 { 57 /* Clear old_domain_info saved by execve() request. */ 58 struct tomoyo_task *s = tomoyo_task(current); 59 60 atomic_dec(&s->old_domain_info->users); 61 s->old_domain_info = NULL; 62 } 63 64 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 65 /** 66 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). 67 * 68 * @bprm: Pointer to "struct linux_binprm". 69 * 70 * Returns 0. 71 */ 72 static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) 73 { 74 /* 75 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested 76 * for the first time. 77 */ 78 if (!tomoyo_policy_loaded) 79 tomoyo_load_policy(bprm->filename); 80 return 0; 81 } 82 #endif 83 84 /** 85 * tomoyo_bprm_check_security - Target for security_bprm_check(). 86 * 87 * @bprm: Pointer to "struct linux_binprm". 88 * 89 * Returns 0 on success, negative value otherwise. 90 */ 91 static int tomoyo_bprm_check_security(struct linux_binprm *bprm) 92 { 93 struct tomoyo_task *s = tomoyo_task(current); 94 95 /* 96 * Execute permission is checked against pathname passed to execve() 97 * using current domain. 98 */ 99 if (!s->old_domain_info) { 100 const int idx = tomoyo_read_lock(); 101 const int err = tomoyo_find_next_domain(bprm); 102 103 tomoyo_read_unlock(idx); 104 return err; 105 } 106 /* 107 * Read permission is checked against interpreters using next domain. 108 */ 109 return tomoyo_check_open_permission(s->domain_info, 110 &bprm->file->f_path, O_RDONLY); 111 } 112 113 /** 114 * tomoyo_inode_getattr - Target for security_inode_getattr(). 115 * 116 * @path: Pointer to "struct path". 117 * 118 * Returns 0 on success, negative value otherwise. 119 */ 120 static int tomoyo_inode_getattr(const struct path *path) 121 { 122 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); 123 } 124 125 /** 126 * tomoyo_path_truncate - Target for security_path_truncate(). 127 * 128 * @path: Pointer to "struct path". 129 * 130 * Returns 0 on success, negative value otherwise. 131 */ 132 static int tomoyo_path_truncate(const struct path *path) 133 { 134 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); 135 } 136 137 /** 138 * tomoyo_path_unlink - Target for security_path_unlink(). 139 * 140 * @parent: Pointer to "struct path". 141 * @dentry: Pointer to "struct dentry". 142 * 143 * Returns 0 on success, negative value otherwise. 144 */ 145 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) 146 { 147 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 148 149 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); 150 } 151 152 /** 153 * tomoyo_path_mkdir - Target for security_path_mkdir(). 154 * 155 * @parent: Pointer to "struct path". 156 * @dentry: Pointer to "struct dentry". 157 * @mode: DAC permission mode. 158 * 159 * Returns 0 on success, negative value otherwise. 160 */ 161 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, 162 umode_t mode) 163 { 164 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 165 166 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, 167 mode & S_IALLUGO); 168 } 169 170 /** 171 * tomoyo_path_rmdir - Target for security_path_rmdir(). 172 * 173 * @parent: Pointer to "struct path". 174 * @dentry: Pointer to "struct dentry". 175 * 176 * Returns 0 on success, negative value otherwise. 177 */ 178 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) 179 { 180 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 181 182 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); 183 } 184 185 /** 186 * tomoyo_path_symlink - Target for security_path_symlink(). 187 * 188 * @parent: Pointer to "struct path". 189 * @dentry: Pointer to "struct dentry". 190 * @old_name: Symlink's content. 191 * 192 * Returns 0 on success, negative value otherwise. 193 */ 194 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, 195 const char *old_name) 196 { 197 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 198 199 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); 200 } 201 202 /** 203 * tomoyo_path_mknod - Target for security_path_mknod(). 204 * 205 * @parent: Pointer to "struct path". 206 * @dentry: Pointer to "struct dentry". 207 * @mode: DAC permission mode. 208 * @dev: Device attributes. 209 * 210 * Returns 0 on success, negative value otherwise. 211 */ 212 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, 213 umode_t mode, unsigned int dev) 214 { 215 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 216 int type = TOMOYO_TYPE_CREATE; 217 const unsigned int perm = mode & S_IALLUGO; 218 219 switch (mode & S_IFMT) { 220 case S_IFCHR: 221 type = TOMOYO_TYPE_MKCHAR; 222 break; 223 case S_IFBLK: 224 type = TOMOYO_TYPE_MKBLOCK; 225 break; 226 default: 227 goto no_dev; 228 } 229 return tomoyo_mkdev_perm(type, &path, perm, dev); 230 no_dev: 231 switch (mode & S_IFMT) { 232 case S_IFIFO: 233 type = TOMOYO_TYPE_MKFIFO; 234 break; 235 case S_IFSOCK: 236 type = TOMOYO_TYPE_MKSOCK; 237 break; 238 } 239 return tomoyo_path_number_perm(type, &path, perm); 240 } 241 242 /** 243 * tomoyo_path_link - Target for security_path_link(). 244 * 245 * @old_dentry: Pointer to "struct dentry". 246 * @new_dir: Pointer to "struct path". 247 * @new_dentry: Pointer to "struct dentry". 248 * 249 * Returns 0 on success, negative value otherwise. 250 */ 251 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, 252 struct dentry *new_dentry) 253 { 254 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; 255 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; 256 257 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); 258 } 259 260 /** 261 * tomoyo_path_rename - Target for security_path_rename(). 262 * 263 * @old_parent: Pointer to "struct path". 264 * @old_dentry: Pointer to "struct dentry". 265 * @new_parent: Pointer to "struct path". 266 * @new_dentry: Pointer to "struct dentry". 267 * @flags: Rename options. 268 * 269 * Returns 0 on success, negative value otherwise. 270 */ 271 static int tomoyo_path_rename(const struct path *old_parent, 272 struct dentry *old_dentry, 273 const struct path *new_parent, 274 struct dentry *new_dentry, 275 const unsigned int flags) 276 { 277 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; 278 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; 279 280 if (flags & RENAME_EXCHANGE) { 281 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2, 282 &path1); 283 284 if (err) 285 return err; 286 } 287 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); 288 } 289 290 /** 291 * tomoyo_file_fcntl - Target for security_file_fcntl(). 292 * 293 * @file: Pointer to "struct file". 294 * @cmd: Command for fcntl(). 295 * @arg: Argument for @cmd. 296 * 297 * Returns 0 on success, negative value otherwise. 298 */ 299 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, 300 unsigned long arg) 301 { 302 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) 303 return 0; 304 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, 305 O_WRONLY | (arg & O_APPEND)); 306 } 307 308 /** 309 * tomoyo_file_open - Target for security_file_open(). 310 * 311 * @f: Pointer to "struct file". 312 * 313 * Returns 0 on success, negative value otherwise. 314 */ 315 static int tomoyo_file_open(struct file *f) 316 { 317 /* Don't check read permission here if called from execve(). */ 318 if (current->in_execve) 319 return 0; 320 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, 321 f->f_flags); 322 } 323 324 /** 325 * tomoyo_file_ioctl - Target for security_file_ioctl(). 326 * 327 * @file: Pointer to "struct file". 328 * @cmd: Command for ioctl(). 329 * @arg: Argument for @cmd. 330 * 331 * Returns 0 on success, negative value otherwise. 332 */ 333 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, 334 unsigned long arg) 335 { 336 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); 337 } 338 339 /** 340 * tomoyo_path_chmod - Target for security_path_chmod(). 341 * 342 * @path: Pointer to "struct path". 343 * @mode: DAC permission mode. 344 * 345 * Returns 0 on success, negative value otherwise. 346 */ 347 static int tomoyo_path_chmod(const struct path *path, umode_t mode) 348 { 349 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, 350 mode & S_IALLUGO); 351 } 352 353 /** 354 * tomoyo_path_chown - Target for security_path_chown(). 355 * 356 * @path: Pointer to "struct path". 357 * @uid: Owner ID. 358 * @gid: Group ID. 359 * 360 * Returns 0 on success, negative value otherwise. 361 */ 362 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 363 { 364 int error = 0; 365 366 if (uid_valid(uid)) 367 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, 368 from_kuid(&init_user_ns, uid)); 369 if (!error && gid_valid(gid)) 370 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, 371 from_kgid(&init_user_ns, gid)); 372 return error; 373 } 374 375 /** 376 * tomoyo_path_chroot - Target for security_path_chroot(). 377 * 378 * @path: Pointer to "struct path". 379 * 380 * Returns 0 on success, negative value otherwise. 381 */ 382 static int tomoyo_path_chroot(const struct path *path) 383 { 384 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); 385 } 386 387 /** 388 * tomoyo_sb_mount - Target for security_sb_mount(). 389 * 390 * @dev_name: Name of device file. Maybe NULL. 391 * @path: Pointer to "struct path". 392 * @type: Name of filesystem type. Maybe NULL. 393 * @flags: Mount options. 394 * @data: Optional data. Maybe NULL. 395 * 396 * Returns 0 on success, negative value otherwise. 397 */ 398 static int tomoyo_sb_mount(const char *dev_name, const struct path *path, 399 const char *type, unsigned long flags, void *data) 400 { 401 return tomoyo_mount_permission(dev_name, path, type, flags, data); 402 } 403 404 /** 405 * tomoyo_sb_umount - Target for security_sb_umount(). 406 * 407 * @mnt: Pointer to "struct vfsmount". 408 * @flags: Unmount options. 409 * 410 * Returns 0 on success, negative value otherwise. 411 */ 412 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) 413 { 414 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; 415 416 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); 417 } 418 419 /** 420 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). 421 * 422 * @old_path: Pointer to "struct path". 423 * @new_path: Pointer to "struct path". 424 * 425 * Returns 0 on success, negative value otherwise. 426 */ 427 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) 428 { 429 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); 430 } 431 432 /** 433 * tomoyo_socket_listen - Check permission for listen(). 434 * 435 * @sock: Pointer to "struct socket". 436 * @backlog: Backlog parameter. 437 * 438 * Returns 0 on success, negative value otherwise. 439 */ 440 static int tomoyo_socket_listen(struct socket *sock, int backlog) 441 { 442 return tomoyo_socket_listen_permission(sock); 443 } 444 445 /** 446 * tomoyo_socket_connect - Check permission for connect(). 447 * 448 * @sock: Pointer to "struct socket". 449 * @addr: Pointer to "struct sockaddr". 450 * @addr_len: Size of @addr. 451 * 452 * Returns 0 on success, negative value otherwise. 453 */ 454 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, 455 int addr_len) 456 { 457 return tomoyo_socket_connect_permission(sock, addr, addr_len); 458 } 459 460 /** 461 * tomoyo_socket_bind - Check permission for bind(). 462 * 463 * @sock: Pointer to "struct socket". 464 * @addr: Pointer to "struct sockaddr". 465 * @addr_len: Size of @addr. 466 * 467 * Returns 0 on success, negative value otherwise. 468 */ 469 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, 470 int addr_len) 471 { 472 return tomoyo_socket_bind_permission(sock, addr, addr_len); 473 } 474 475 /** 476 * tomoyo_socket_sendmsg - Check permission for sendmsg(). 477 * 478 * @sock: Pointer to "struct socket". 479 * @msg: Pointer to "struct msghdr". 480 * @size: Size of message. 481 * 482 * Returns 0 on success, negative value otherwise. 483 */ 484 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, 485 int size) 486 { 487 return tomoyo_socket_sendmsg_permission(sock, msg, size); 488 } 489 490 struct lsm_blob_sizes tomoyo_blob_sizes __lsm_ro_after_init = { 491 .lbs_task = sizeof(struct tomoyo_task), 492 }; 493 494 /** 495 * tomoyo_task_alloc - Target for security_task_alloc(). 496 * 497 * @task: Pointer to "struct task_struct". 498 * @clone_flags: clone() flags. 499 * 500 * Returns 0. 501 */ 502 static int tomoyo_task_alloc(struct task_struct *task, 503 unsigned long clone_flags) 504 { 505 struct tomoyo_task *old = tomoyo_task(current); 506 struct tomoyo_task *new = tomoyo_task(task); 507 508 new->domain_info = old->domain_info; 509 atomic_inc(&new->domain_info->users); 510 new->old_domain_info = NULL; 511 return 0; 512 } 513 514 /** 515 * tomoyo_task_free - Target for security_task_free(). 516 * 517 * @task: Pointer to "struct task_struct". 518 */ 519 static void tomoyo_task_free(struct task_struct *task) 520 { 521 struct tomoyo_task *s = tomoyo_task(task); 522 523 if (s->domain_info) { 524 atomic_dec(&s->domain_info->users); 525 s->domain_info = NULL; 526 } 527 if (s->old_domain_info) { 528 atomic_dec(&s->old_domain_info->users); 529 s->old_domain_info = NULL; 530 } 531 } 532 533 /* 534 * tomoyo_security_ops is a "struct security_operations" which is used for 535 * registering TOMOYO. 536 */ 537 static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = { 538 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), 539 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), 540 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), 541 LSM_HOOK_INIT(task_free, tomoyo_task_free), 542 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 543 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), 544 #endif 545 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), 546 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), 547 LSM_HOOK_INIT(file_open, tomoyo_file_open), 548 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), 549 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), 550 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), 551 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), 552 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), 553 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), 554 LSM_HOOK_INIT(path_link, tomoyo_path_link), 555 LSM_HOOK_INIT(path_rename, tomoyo_path_rename), 556 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), 557 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), 558 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), 559 LSM_HOOK_INIT(path_chown, tomoyo_path_chown), 560 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), 561 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), 562 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), 563 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), 564 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), 565 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), 566 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), 567 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), 568 }; 569 570 /* Lock for GC. */ 571 DEFINE_SRCU(tomoyo_ss); 572 573 int tomoyo_enabled __lsm_ro_after_init = 1; 574 575 /** 576 * tomoyo_init - Register TOMOYO Linux as a LSM module. 577 * 578 * Returns 0. 579 */ 580 static int __init tomoyo_init(void) 581 { 582 struct tomoyo_task *s = tomoyo_task(current); 583 584 /* register ourselves with the security framework */ 585 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); 586 pr_info("TOMOYO Linux initialized\n"); 587 s->domain_info = &tomoyo_kernel_domain; 588 atomic_inc(&tomoyo_kernel_domain.users); 589 s->old_domain_info = NULL; 590 tomoyo_mm_init(); 591 592 return 0; 593 } 594 595 DEFINE_LSM(tomoyo) = { 596 .name = "tomoyo", 597 .enabled = &tomoyo_enabled, 598 .flags = LSM_FLAG_LEGACY_MAJOR, 599 .blobs = &tomoyo_blob_sizes, 600 .init = tomoyo_init, 601 }; 602