| 1 | /* |
| 2 | * security/tomoyo/tomoyo.c |
| 3 | * |
| 4 | * LSM hooks for TOMOYO Linux. |
| 5 | * |
| 6 | * Copyright (C) 2005-2010 NTT DATA CORPORATION |
| 7 | */ |
| 8 | |
| 9 | #include <linux/security.h> |
| 10 | #include "common.h" |
| 11 | |
| 12 | static int tomoyo_cred_alloc_blank(struct cred *new, gfp_t gfp) |
| 13 | { |
| 14 | new->security = NULL; |
| 15 | return 0; |
| 16 | } |
| 17 | |
| 18 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
| 19 | gfp_t gfp) |
| 20 | { |
| 21 | struct tomoyo_domain_info *domain = old->security; |
| 22 | new->security = domain; |
| 23 | if (domain) |
| 24 | atomic_inc(&domain->users); |
| 25 | return 0; |
| 26 | } |
| 27 | |
| 28 | static void tomoyo_cred_transfer(struct cred *new, const struct cred *old) |
| 29 | { |
| 30 | tomoyo_cred_prepare(new, old, 0); |
| 31 | } |
| 32 | |
| 33 | static void tomoyo_cred_free(struct cred *cred) |
| 34 | { |
| 35 | struct tomoyo_domain_info *domain = cred->security; |
| 36 | if (domain) |
| 37 | atomic_dec(&domain->users); |
| 38 | } |
| 39 | |
| 40 | static int tomoyo_bprm_set_creds(struct linux_binprm *bprm) |
| 41 | { |
| 42 | int rc; |
| 43 | |
| 44 | rc = cap_bprm_set_creds(bprm); |
| 45 | if (rc) |
| 46 | return rc; |
| 47 | |
| 48 | /* |
| 49 | * Do only if this function is called for the first time of an execve |
| 50 | * operation. |
| 51 | */ |
| 52 | if (bprm->cred_prepared) |
| 53 | return 0; |
| 54 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
| 55 | /* |
| 56 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested |
| 57 | * for the first time. |
| 58 | */ |
| 59 | if (!tomoyo_policy_loaded) |
| 60 | tomoyo_load_policy(bprm->filename); |
| 61 | #endif |
| 62 | /* |
| 63 | * Release reference to "struct tomoyo_domain_info" stored inside |
| 64 | * "bprm->cred->security". New reference to "struct tomoyo_domain_info" |
| 65 | * stored inside "bprm->cred->security" will be acquired later inside |
| 66 | * tomoyo_find_next_domain(). |
| 67 | */ |
| 68 | atomic_dec(&((struct tomoyo_domain_info *) |
| 69 | bprm->cred->security)->users); |
| 70 | /* |
| 71 | * Tell tomoyo_bprm_check_security() is called for the first time of an |
| 72 | * execve operation. |
| 73 | */ |
| 74 | bprm->cred->security = NULL; |
| 75 | return 0; |
| 76 | } |
| 77 | |
| 78 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
| 79 | { |
| 80 | struct tomoyo_domain_info *domain = bprm->cred->security; |
| 81 | |
| 82 | /* |
| 83 | * Execute permission is checked against pathname passed to do_execve() |
| 84 | * using current domain. |
| 85 | */ |
| 86 | if (!domain) { |
| 87 | const int idx = tomoyo_read_lock(); |
| 88 | const int err = tomoyo_find_next_domain(bprm); |
| 89 | tomoyo_read_unlock(idx); |
| 90 | return err; |
| 91 | } |
| 92 | /* |
| 93 | * Read permission is checked against interpreters using next domain. |
| 94 | */ |
| 95 | return tomoyo_check_open_permission(domain, &bprm->file->f_path, O_RDONLY); |
| 96 | } |
| 97 | |
| 98 | static int tomoyo_inode_getattr(struct vfsmount *mnt, struct dentry *dentry) |
| 99 | { |
| 100 | struct path path = { mnt, dentry }; |
| 101 | return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, &path, NULL); |
| 102 | } |
| 103 | |
| 104 | static int tomoyo_path_truncate(struct path *path) |
| 105 | { |
| 106 | return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); |
| 107 | } |
| 108 | |
| 109 | static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry) |
| 110 | { |
| 111 | struct path path = { parent->mnt, dentry }; |
| 112 | return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); |
| 113 | } |
| 114 | |
| 115 | static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry, |
| 116 | int mode) |
| 117 | { |
| 118 | struct path path = { parent->mnt, dentry }; |
| 119 | return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, |
| 120 | mode & S_IALLUGO); |
| 121 | } |
| 122 | |
| 123 | static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry) |
| 124 | { |
| 125 | struct path path = { parent->mnt, dentry }; |
| 126 | return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); |
| 127 | } |
| 128 | |
| 129 | static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry, |
| 130 | const char *old_name) |
| 131 | { |
| 132 | struct path path = { parent->mnt, dentry }; |
| 133 | return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); |
| 134 | } |
| 135 | |
| 136 | static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry, |
| 137 | int mode, unsigned int dev) |
| 138 | { |
| 139 | struct path path = { parent->mnt, dentry }; |
| 140 | int type = TOMOYO_TYPE_CREATE; |
| 141 | const unsigned int perm = mode & S_IALLUGO; |
| 142 | |
| 143 | switch (mode & S_IFMT) { |
| 144 | case S_IFCHR: |
| 145 | type = TOMOYO_TYPE_MKCHAR; |
| 146 | break; |
| 147 | case S_IFBLK: |
| 148 | type = TOMOYO_TYPE_MKBLOCK; |
| 149 | break; |
| 150 | default: |
| 151 | goto no_dev; |
| 152 | } |
| 153 | return tomoyo_mkdev_perm(type, &path, perm, dev); |
| 154 | no_dev: |
| 155 | switch (mode & S_IFMT) { |
| 156 | case S_IFIFO: |
| 157 | type = TOMOYO_TYPE_MKFIFO; |
| 158 | break; |
| 159 | case S_IFSOCK: |
| 160 | type = TOMOYO_TYPE_MKSOCK; |
| 161 | break; |
| 162 | } |
| 163 | return tomoyo_path_number_perm(type, &path, perm); |
| 164 | } |
| 165 | |
| 166 | static int tomoyo_path_link(struct dentry *old_dentry, struct path *new_dir, |
| 167 | struct dentry *new_dentry) |
| 168 | { |
| 169 | struct path path1 = { new_dir->mnt, old_dentry }; |
| 170 | struct path path2 = { new_dir->mnt, new_dentry }; |
| 171 | return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); |
| 172 | } |
| 173 | |
| 174 | static int tomoyo_path_rename(struct path *old_parent, |
| 175 | struct dentry *old_dentry, |
| 176 | struct path *new_parent, |
| 177 | struct dentry *new_dentry) |
| 178 | { |
| 179 | struct path path1 = { old_parent->mnt, old_dentry }; |
| 180 | struct path path2 = { new_parent->mnt, new_dentry }; |
| 181 | return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); |
| 182 | } |
| 183 | |
| 184 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
| 185 | unsigned long arg) |
| 186 | { |
| 187 | if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) |
| 188 | return 0; |
| 189 | return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, |
| 190 | O_WRONLY | (arg & O_APPEND)); |
| 191 | } |
| 192 | |
| 193 | static int tomoyo_dentry_open(struct file *f, const struct cred *cred) |
| 194 | { |
| 195 | int flags = f->f_flags; |
| 196 | /* Don't check read permission here if called from do_execve(). */ |
| 197 | if (current->in_execve) |
| 198 | return 0; |
| 199 | return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags); |
| 200 | } |
| 201 | |
| 202 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
| 203 | unsigned long arg) |
| 204 | { |
| 205 | return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); |
| 206 | } |
| 207 | |
| 208 | static int tomoyo_path_chmod(struct dentry *dentry, struct vfsmount *mnt, |
| 209 | mode_t mode) |
| 210 | { |
| 211 | struct path path = { mnt, dentry }; |
| 212 | return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, &path, |
| 213 | mode & S_IALLUGO); |
| 214 | } |
| 215 | |
| 216 | static int tomoyo_path_chown(struct path *path, uid_t uid, gid_t gid) |
| 217 | { |
| 218 | int error = 0; |
| 219 | if (uid != (uid_t) -1) |
| 220 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, uid); |
| 221 | if (!error && gid != (gid_t) -1) |
| 222 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, gid); |
| 223 | return error; |
| 224 | } |
| 225 | |
| 226 | static int tomoyo_path_chroot(struct path *path) |
| 227 | { |
| 228 | return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); |
| 229 | } |
| 230 | |
| 231 | static int tomoyo_sb_mount(char *dev_name, struct path *path, |
| 232 | char *type, unsigned long flags, void *data) |
| 233 | { |
| 234 | return tomoyo_mount_permission(dev_name, path, type, flags, data); |
| 235 | } |
| 236 | |
| 237 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
| 238 | { |
| 239 | struct path path = { mnt, mnt->mnt_root }; |
| 240 | return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); |
| 241 | } |
| 242 | |
| 243 | static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path) |
| 244 | { |
| 245 | return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); |
| 246 | } |
| 247 | |
| 248 | /* |
| 249 | * tomoyo_security_ops is a "struct security_operations" which is used for |
| 250 | * registering TOMOYO. |
| 251 | */ |
| 252 | static struct security_operations tomoyo_security_ops = { |
| 253 | .name = "tomoyo", |
| 254 | .cred_alloc_blank = tomoyo_cred_alloc_blank, |
| 255 | .cred_prepare = tomoyo_cred_prepare, |
| 256 | .cred_transfer = tomoyo_cred_transfer, |
| 257 | .cred_free = tomoyo_cred_free, |
| 258 | .bprm_set_creds = tomoyo_bprm_set_creds, |
| 259 | .bprm_check_security = tomoyo_bprm_check_security, |
| 260 | .file_fcntl = tomoyo_file_fcntl, |
| 261 | .dentry_open = tomoyo_dentry_open, |
| 262 | .path_truncate = tomoyo_path_truncate, |
| 263 | .path_unlink = tomoyo_path_unlink, |
| 264 | .path_mkdir = tomoyo_path_mkdir, |
| 265 | .path_rmdir = tomoyo_path_rmdir, |
| 266 | .path_symlink = tomoyo_path_symlink, |
| 267 | .path_mknod = tomoyo_path_mknod, |
| 268 | .path_link = tomoyo_path_link, |
| 269 | .path_rename = tomoyo_path_rename, |
| 270 | .inode_getattr = tomoyo_inode_getattr, |
| 271 | .file_ioctl = tomoyo_file_ioctl, |
| 272 | .path_chmod = tomoyo_path_chmod, |
| 273 | .path_chown = tomoyo_path_chown, |
| 274 | .path_chroot = tomoyo_path_chroot, |
| 275 | .sb_mount = tomoyo_sb_mount, |
| 276 | .sb_umount = tomoyo_sb_umount, |
| 277 | .sb_pivotroot = tomoyo_sb_pivotroot, |
| 278 | }; |
| 279 | |
| 280 | /* Lock for GC. */ |
| 281 | struct srcu_struct tomoyo_ss; |
| 282 | |
| 283 | static int __init tomoyo_init(void) |
| 284 | { |
| 285 | struct cred *cred = (struct cred *) current_cred(); |
| 286 | |
| 287 | if (!security_module_enable(&tomoyo_security_ops)) |
| 288 | return 0; |
| 289 | /* register ourselves with the security framework */ |
| 290 | if (register_security(&tomoyo_security_ops) || |
| 291 | init_srcu_struct(&tomoyo_ss)) |
| 292 | panic("Failure registering TOMOYO Linux"); |
| 293 | printk(KERN_INFO "TOMOYO Linux initialized\n"); |
| 294 | cred->security = &tomoyo_kernel_domain; |
| 295 | tomoyo_mm_init(); |
| 296 | return 0; |
| 297 | } |
| 298 | |
| 299 | security_initcall(tomoyo_init); |