1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * security/tomoyo/tomoyo.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8 #include <linux/lsm_hooks.h> 9 #include "common.h" 10 11 /** 12 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 13 * 14 * Returns pointer to "struct tomoyo_domain_info" for current thread. 15 */ 16 struct tomoyo_domain_info *tomoyo_domain(void) 17 { 18 struct tomoyo_task *s = tomoyo_task(current); 19 20 if (s->old_domain_info && !current->in_execve) { 21 atomic_dec(&s->old_domain_info->users); 22 s->old_domain_info = NULL; 23 } 24 return s->domain_info; 25 } 26 27 /** 28 * tomoyo_cred_prepare - Target for security_prepare_creds(). 29 * 30 * @new: Pointer to "struct cred". 31 * @old: Pointer to "struct cred". 32 * @gfp: Memory allocation flags. 33 * 34 * Returns 0. 35 */ 36 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, 37 gfp_t gfp) 38 { 39 /* Restore old_domain_info saved by previous execve() request. */ 40 struct tomoyo_task *s = tomoyo_task(current); 41 42 if (s->old_domain_info && !current->in_execve) { 43 atomic_dec(&s->domain_info->users); 44 s->domain_info = s->old_domain_info; 45 s->old_domain_info = NULL; 46 } 47 return 0; 48 } 49 50 /** 51 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). 52 * 53 * @bprm: Pointer to "struct linux_binprm". 54 */ 55 static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm) 56 { 57 /* Clear old_domain_info saved by execve() request. */ 58 struct tomoyo_task *s = tomoyo_task(current); 59 60 atomic_dec(&s->old_domain_info->users); 61 s->old_domain_info = NULL; 62 } 63 64 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 65 /** 66 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). 67 * 68 * @bprm: Pointer to "struct linux_binprm". 69 * 70 * Returns 0. 71 */ 72 static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) 73 { 74 /* 75 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested 76 * for the first time. 77 */ 78 if (!tomoyo_policy_loaded) 79 tomoyo_load_policy(bprm->filename); 80 return 0; 81 } 82 #endif 83 84 /** 85 * tomoyo_bprm_check_security - Target for security_bprm_check(). 86 * 87 * @bprm: Pointer to "struct linux_binprm". 88 * 89 * Returns 0 on success, negative value otherwise. 90 */ 91 static int tomoyo_bprm_check_security(struct linux_binprm *bprm) 92 { 93 struct tomoyo_task *s = tomoyo_task(current); 94 95 /* 96 * Execute permission is checked against pathname passed to execve() 97 * using current domain. 98 */ 99 if (!s->old_domain_info) { 100 const int idx = tomoyo_read_lock(); 101 const int err = tomoyo_find_next_domain(bprm); 102 103 tomoyo_read_unlock(idx); 104 return err; 105 } 106 /* 107 * Read permission is checked against interpreters using next domain. 108 */ 109 return tomoyo_check_open_permission(s->domain_info, 110 &bprm->file->f_path, O_RDONLY); 111 } 112 113 /** 114 * tomoyo_inode_getattr - Target for security_inode_getattr(). 115 * 116 * @path: Pointer to "struct path". 117 * 118 * Returns 0 on success, negative value otherwise. 119 */ 120 static int tomoyo_inode_getattr(const struct path *path) 121 { 122 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); 123 } 124 125 /** 126 * tomoyo_path_truncate - Target for security_path_truncate(). 127 * 128 * @path: Pointer to "struct path". 129 * 130 * Returns 0 on success, negative value otherwise. 131 */ 132 static int tomoyo_path_truncate(const struct path *path) 133 { 134 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); 135 } 136 137 /** 138 * tomoyo_file_truncate - Target for security_file_truncate(). 139 * 140 * @file: Pointer to "struct file". 141 * 142 * Returns 0 on success, negative value otherwise. 143 */ 144 static int tomoyo_file_truncate(struct file *file) 145 { 146 return tomoyo_path_truncate(&file->f_path); 147 } 148 149 /** 150 * tomoyo_path_unlink - Target for security_path_unlink(). 151 * 152 * @parent: Pointer to "struct path". 153 * @dentry: Pointer to "struct dentry". 154 * 155 * Returns 0 on success, negative value otherwise. 156 */ 157 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) 158 { 159 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 160 161 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); 162 } 163 164 /** 165 * tomoyo_path_mkdir - Target for security_path_mkdir(). 166 * 167 * @parent: Pointer to "struct path". 168 * @dentry: Pointer to "struct dentry". 169 * @mode: DAC permission mode. 170 * 171 * Returns 0 on success, negative value otherwise. 172 */ 173 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, 174 umode_t mode) 175 { 176 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 177 178 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, 179 mode & S_IALLUGO); 180 } 181 182 /** 183 * tomoyo_path_rmdir - Target for security_path_rmdir(). 184 * 185 * @parent: Pointer to "struct path". 186 * @dentry: Pointer to "struct dentry". 187 * 188 * Returns 0 on success, negative value otherwise. 189 */ 190 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) 191 { 192 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 193 194 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); 195 } 196 197 /** 198 * tomoyo_path_symlink - Target for security_path_symlink(). 199 * 200 * @parent: Pointer to "struct path". 201 * @dentry: Pointer to "struct dentry". 202 * @old_name: Symlink's content. 203 * 204 * Returns 0 on success, negative value otherwise. 205 */ 206 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, 207 const char *old_name) 208 { 209 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 210 211 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); 212 } 213 214 /** 215 * tomoyo_path_mknod - Target for security_path_mknod(). 216 * 217 * @parent: Pointer to "struct path". 218 * @dentry: Pointer to "struct dentry". 219 * @mode: DAC permission mode. 220 * @dev: Device attributes. 221 * 222 * Returns 0 on success, negative value otherwise. 223 */ 224 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, 225 umode_t mode, unsigned int dev) 226 { 227 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 228 int type = TOMOYO_TYPE_CREATE; 229 const unsigned int perm = mode & S_IALLUGO; 230 231 switch (mode & S_IFMT) { 232 case S_IFCHR: 233 type = TOMOYO_TYPE_MKCHAR; 234 break; 235 case S_IFBLK: 236 type = TOMOYO_TYPE_MKBLOCK; 237 break; 238 default: 239 goto no_dev; 240 } 241 return tomoyo_mkdev_perm(type, &path, perm, dev); 242 no_dev: 243 switch (mode & S_IFMT) { 244 case S_IFIFO: 245 type = TOMOYO_TYPE_MKFIFO; 246 break; 247 case S_IFSOCK: 248 type = TOMOYO_TYPE_MKSOCK; 249 break; 250 } 251 return tomoyo_path_number_perm(type, &path, perm); 252 } 253 254 /** 255 * tomoyo_path_link - Target for security_path_link(). 256 * 257 * @old_dentry: Pointer to "struct dentry". 258 * @new_dir: Pointer to "struct path". 259 * @new_dentry: Pointer to "struct dentry". 260 * 261 * Returns 0 on success, negative value otherwise. 262 */ 263 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, 264 struct dentry *new_dentry) 265 { 266 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; 267 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; 268 269 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); 270 } 271 272 /** 273 * tomoyo_path_rename - Target for security_path_rename(). 274 * 275 * @old_parent: Pointer to "struct path". 276 * @old_dentry: Pointer to "struct dentry". 277 * @new_parent: Pointer to "struct path". 278 * @new_dentry: Pointer to "struct dentry". 279 * @flags: Rename options. 280 * 281 * Returns 0 on success, negative value otherwise. 282 */ 283 static int tomoyo_path_rename(const struct path *old_parent, 284 struct dentry *old_dentry, 285 const struct path *new_parent, 286 struct dentry *new_dentry, 287 const unsigned int flags) 288 { 289 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; 290 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; 291 292 if (flags & RENAME_EXCHANGE) { 293 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2, 294 &path1); 295 296 if (err) 297 return err; 298 } 299 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); 300 } 301 302 /** 303 * tomoyo_file_fcntl - Target for security_file_fcntl(). 304 * 305 * @file: Pointer to "struct file". 306 * @cmd: Command for fcntl(). 307 * @arg: Argument for @cmd. 308 * 309 * Returns 0 on success, negative value otherwise. 310 */ 311 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, 312 unsigned long arg) 313 { 314 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) 315 return 0; 316 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, 317 O_WRONLY | (arg & O_APPEND)); 318 } 319 320 /** 321 * tomoyo_file_open - Target for security_file_open(). 322 * 323 * @f: Pointer to "struct file". 324 * 325 * Returns 0 on success, negative value otherwise. 326 */ 327 static int tomoyo_file_open(struct file *f) 328 { 329 /* Don't check read permission here if called from execve(). */ 330 if (current->in_execve) 331 return 0; 332 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, 333 f->f_flags); 334 } 335 336 /** 337 * tomoyo_file_ioctl - Target for security_file_ioctl(). 338 * 339 * @file: Pointer to "struct file". 340 * @cmd: Command for ioctl(). 341 * @arg: Argument for @cmd. 342 * 343 * Returns 0 on success, negative value otherwise. 344 */ 345 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, 346 unsigned long arg) 347 { 348 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); 349 } 350 351 /** 352 * tomoyo_path_chmod - Target for security_path_chmod(). 353 * 354 * @path: Pointer to "struct path". 355 * @mode: DAC permission mode. 356 * 357 * Returns 0 on success, negative value otherwise. 358 */ 359 static int tomoyo_path_chmod(const struct path *path, umode_t mode) 360 { 361 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, 362 mode & S_IALLUGO); 363 } 364 365 /** 366 * tomoyo_path_chown - Target for security_path_chown(). 367 * 368 * @path: Pointer to "struct path". 369 * @uid: Owner ID. 370 * @gid: Group ID. 371 * 372 * Returns 0 on success, negative value otherwise. 373 */ 374 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 375 { 376 int error = 0; 377 378 if (uid_valid(uid)) 379 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, 380 from_kuid(&init_user_ns, uid)); 381 if (!error && gid_valid(gid)) 382 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, 383 from_kgid(&init_user_ns, gid)); 384 return error; 385 } 386 387 /** 388 * tomoyo_path_chroot - Target for security_path_chroot(). 389 * 390 * @path: Pointer to "struct path". 391 * 392 * Returns 0 on success, negative value otherwise. 393 */ 394 static int tomoyo_path_chroot(const struct path *path) 395 { 396 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); 397 } 398 399 /** 400 * tomoyo_sb_mount - Target for security_sb_mount(). 401 * 402 * @dev_name: Name of device file. Maybe NULL. 403 * @path: Pointer to "struct path". 404 * @type: Name of filesystem type. Maybe NULL. 405 * @flags: Mount options. 406 * @data: Optional data. Maybe NULL. 407 * 408 * Returns 0 on success, negative value otherwise. 409 */ 410 static int tomoyo_sb_mount(const char *dev_name, const struct path *path, 411 const char *type, unsigned long flags, void *data) 412 { 413 return tomoyo_mount_permission(dev_name, path, type, flags, data); 414 } 415 416 /** 417 * tomoyo_sb_umount - Target for security_sb_umount(). 418 * 419 * @mnt: Pointer to "struct vfsmount". 420 * @flags: Unmount options. 421 * 422 * Returns 0 on success, negative value otherwise. 423 */ 424 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) 425 { 426 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; 427 428 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); 429 } 430 431 /** 432 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). 433 * 434 * @old_path: Pointer to "struct path". 435 * @new_path: Pointer to "struct path". 436 * 437 * Returns 0 on success, negative value otherwise. 438 */ 439 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) 440 { 441 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); 442 } 443 444 /** 445 * tomoyo_socket_listen - Check permission for listen(). 446 * 447 * @sock: Pointer to "struct socket". 448 * @backlog: Backlog parameter. 449 * 450 * Returns 0 on success, negative value otherwise. 451 */ 452 static int tomoyo_socket_listen(struct socket *sock, int backlog) 453 { 454 return tomoyo_socket_listen_permission(sock); 455 } 456 457 /** 458 * tomoyo_socket_connect - Check permission for connect(). 459 * 460 * @sock: Pointer to "struct socket". 461 * @addr: Pointer to "struct sockaddr". 462 * @addr_len: Size of @addr. 463 * 464 * Returns 0 on success, negative value otherwise. 465 */ 466 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, 467 int addr_len) 468 { 469 return tomoyo_socket_connect_permission(sock, addr, addr_len); 470 } 471 472 /** 473 * tomoyo_socket_bind - Check permission for bind(). 474 * 475 * @sock: Pointer to "struct socket". 476 * @addr: Pointer to "struct sockaddr". 477 * @addr_len: Size of @addr. 478 * 479 * Returns 0 on success, negative value otherwise. 480 */ 481 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, 482 int addr_len) 483 { 484 return tomoyo_socket_bind_permission(sock, addr, addr_len); 485 } 486 487 /** 488 * tomoyo_socket_sendmsg - Check permission for sendmsg(). 489 * 490 * @sock: Pointer to "struct socket". 491 * @msg: Pointer to "struct msghdr". 492 * @size: Size of message. 493 * 494 * Returns 0 on success, negative value otherwise. 495 */ 496 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, 497 int size) 498 { 499 return tomoyo_socket_sendmsg_permission(sock, msg, size); 500 } 501 502 struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = { 503 .lbs_task = sizeof(struct tomoyo_task), 504 }; 505 506 /** 507 * tomoyo_task_alloc - Target for security_task_alloc(). 508 * 509 * @task: Pointer to "struct task_struct". 510 * @clone_flags: clone() flags. 511 * 512 * Returns 0. 513 */ 514 static int tomoyo_task_alloc(struct task_struct *task, 515 unsigned long clone_flags) 516 { 517 struct tomoyo_task *old = tomoyo_task(current); 518 struct tomoyo_task *new = tomoyo_task(task); 519 520 new->domain_info = old->domain_info; 521 atomic_inc(&new->domain_info->users); 522 new->old_domain_info = NULL; 523 return 0; 524 } 525 526 /** 527 * tomoyo_task_free - Target for security_task_free(). 528 * 529 * @task: Pointer to "struct task_struct". 530 */ 531 static void tomoyo_task_free(struct task_struct *task) 532 { 533 struct tomoyo_task *s = tomoyo_task(task); 534 535 if (s->domain_info) { 536 atomic_dec(&s->domain_info->users); 537 s->domain_info = NULL; 538 } 539 if (s->old_domain_info) { 540 atomic_dec(&s->old_domain_info->users); 541 s->old_domain_info = NULL; 542 } 543 } 544 545 /* 546 * tomoyo_security_ops is a "struct security_operations" which is used for 547 * registering TOMOYO. 548 */ 549 static struct security_hook_list tomoyo_hooks[] __ro_after_init = { 550 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), 551 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), 552 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), 553 LSM_HOOK_INIT(task_free, tomoyo_task_free), 554 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 555 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), 556 #endif 557 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), 558 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), 559 LSM_HOOK_INIT(file_open, tomoyo_file_open), 560 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate), 561 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), 562 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), 563 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), 564 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), 565 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), 566 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), 567 LSM_HOOK_INIT(path_link, tomoyo_path_link), 568 LSM_HOOK_INIT(path_rename, tomoyo_path_rename), 569 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), 570 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), 571 LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl), 572 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), 573 LSM_HOOK_INIT(path_chown, tomoyo_path_chown), 574 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), 575 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), 576 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), 577 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), 578 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), 579 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), 580 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), 581 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), 582 }; 583 584 /* Lock for GC. */ 585 DEFINE_SRCU(tomoyo_ss); 586 587 int tomoyo_enabled __ro_after_init = 1; 588 589 /** 590 * tomoyo_init - Register TOMOYO Linux as a LSM module. 591 * 592 * Returns 0. 593 */ 594 static int __init tomoyo_init(void) 595 { 596 struct tomoyo_task *s = tomoyo_task(current); 597 598 /* register ourselves with the security framework */ 599 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); 600 pr_info("TOMOYO Linux initialized\n"); 601 s->domain_info = &tomoyo_kernel_domain; 602 atomic_inc(&tomoyo_kernel_domain.users); 603 s->old_domain_info = NULL; 604 tomoyo_mm_init(); 605 606 return 0; 607 } 608 609 DEFINE_LSM(tomoyo) = { 610 .name = "tomoyo", 611 .enabled = &tomoyo_enabled, 612 .flags = LSM_FLAG_LEGACY_MAJOR, 613 .blobs = &tomoyo_blob_sizes, 614 .init = tomoyo_init, 615 }; 616