2 * security/tomoyo/domain.c
4 * Domain transition functions for TOMOYO.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
10 #include <linux/binfmts.h>
11 #include <linux/slab.h>
13 /* Variables definitions.*/
15 /* The initial domain. */
16 struct tomoyo_domain_info tomoyo_kernel_domain
;
19 * tomoyo_update_policy - Update an entry for exception policy.
21 * @new_entry: Pointer to "struct tomoyo_acl_info".
22 * @size: Size of @new_entry in bytes.
23 * @is_delete: True if it is a delete request.
24 * @list: Pointer to "struct list_head".
25 * @check_duplicate: Callback function to find duplicated entry.
27 * Returns 0 on success, negative value otherwise.
29 * Caller holds tomoyo_read_lock().
31 int tomoyo_update_policy(struct tomoyo_acl_head
*new_entry
, const int size
,
32 bool is_delete
, struct list_head
*list
,
33 bool (*check_duplicate
) (const struct tomoyo_acl_head
35 const struct tomoyo_acl_head
38 int error
= is_delete
? -ENOENT
: -ENOMEM
;
39 struct tomoyo_acl_head
*entry
;
41 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
43 list_for_each_entry_rcu(entry
, list
, list
) {
44 if (!check_duplicate(entry
, new_entry
))
46 entry
->is_deleted
= is_delete
;
50 if (error
&& !is_delete
) {
51 entry
= tomoyo_commit_ok(new_entry
, size
);
53 list_add_tail_rcu(&entry
->list
, list
);
57 mutex_unlock(&tomoyo_policy_lock
);
62 * tomoyo_update_domain - Update an entry for domain policy.
64 * @new_entry: Pointer to "struct tomoyo_acl_info".
65 * @size: Size of @new_entry in bytes.
66 * @is_delete: True if it is a delete request.
67 * @domain: Pointer to "struct tomoyo_domain_info".
68 * @check_duplicate: Callback function to find duplicated entry.
69 * @merge_duplicate: Callback function to merge duplicated entry.
71 * Returns 0 on success, negative value otherwise.
73 * Caller holds tomoyo_read_lock().
75 int tomoyo_update_domain(struct tomoyo_acl_info
*new_entry
, const int size
,
76 bool is_delete
, struct tomoyo_domain_info
*domain
,
77 bool (*check_duplicate
) (const struct tomoyo_acl_info
79 const struct tomoyo_acl_info
81 bool (*merge_duplicate
) (struct tomoyo_acl_info
*,
82 struct tomoyo_acl_info
*,
85 int error
= is_delete
? -ENOENT
: -ENOMEM
;
86 struct tomoyo_acl_info
*entry
;
88 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
90 list_for_each_entry_rcu(entry
, &domain
->acl_info_list
, list
) {
91 if (!check_duplicate(entry
, new_entry
))
94 entry
->is_deleted
= merge_duplicate(entry
, new_entry
,
97 entry
->is_deleted
= is_delete
;
101 if (error
&& !is_delete
) {
102 entry
= tomoyo_commit_ok(new_entry
, size
);
104 list_add_tail_rcu(&entry
->list
, &domain
->acl_info_list
);
108 mutex_unlock(&tomoyo_policy_lock
);
112 void tomoyo_check_acl(struct tomoyo_request_info
*r
,
113 bool (*check_entry
) (const struct tomoyo_request_info
*,
114 const struct tomoyo_acl_info
*))
116 const struct tomoyo_domain_info
*domain
= r
->domain
;
117 struct tomoyo_acl_info
*ptr
;
119 list_for_each_entry_rcu(ptr
, &domain
->acl_info_list
, list
) {
120 if (ptr
->is_deleted
|| ptr
->type
!= r
->param_type
)
122 if (check_entry(r
, ptr
)) {
131 * tomoyo_domain_list is used for holding list of domains.
132 * The ->acl_info_list of "struct tomoyo_domain_info" is used for holding
133 * permissions (e.g. "allow_read /lib/libc-2.5.so") given to each domain.
135 * An entry is added by
137 * # ( echo "<kernel>"; echo "allow_execute /sbin/init" ) > \
138 * /sys/kernel/security/tomoyo/domain_policy
142 * # ( echo "<kernel>"; echo "delete allow_execute /sbin/init" ) > \
143 * /sys/kernel/security/tomoyo/domain_policy
145 * and all entries are retrieved by
147 * # cat /sys/kernel/security/tomoyo/domain_policy
149 * A domain is added by
151 * # echo "<kernel>" > /sys/kernel/security/tomoyo/domain_policy
155 * # echo "delete <kernel>" > /sys/kernel/security/tomoyo/domain_policy
157 * and all domains are retrieved by
159 * # grep '^<kernel>' /sys/kernel/security/tomoyo/domain_policy
161 * Normally, a domainname is monotonically getting longer because a domainname
162 * which the process will belong to if an execve() operation succeeds is
163 * defined as a concatenation of "current domainname" + "pathname passed to
165 * See tomoyo_domain_initializer_list and tomoyo_domain_keeper_list for
168 LIST_HEAD(tomoyo_domain_list
);
171 * tomoyo_get_last_name - Get last component of a domainname.
173 * @domain: Pointer to "struct tomoyo_domain_info".
175 * Returns the last component of the domainname.
177 const char *tomoyo_get_last_name(const struct tomoyo_domain_info
*domain
)
179 const char *cp0
= domain
->domainname
->name
;
180 const char *cp1
= strrchr(cp0
, ' ');
188 * tomoyo_domain_initializer_list is used for holding list of programs which
189 * triggers reinitialization of domainname. Normally, a domainname is
190 * monotonically getting longer. But sometimes, we restart daemon programs.
191 * It would be convenient for us that "a daemon started upon system boot" and
192 * "the daemon restarted from console" belong to the same domain. Thus, TOMOYO
193 * provides a way to shorten domainnames.
195 * An entry is added by
197 * # echo 'initialize_domain /usr/sbin/httpd' > \
198 * /sys/kernel/security/tomoyo/exception_policy
202 * # echo 'delete initialize_domain /usr/sbin/httpd' > \
203 * /sys/kernel/security/tomoyo/exception_policy
205 * and all entries are retrieved by
207 * # grep ^initialize_domain /sys/kernel/security/tomoyo/exception_policy
209 * In the example above, /usr/sbin/httpd will belong to
210 * "<kernel> /usr/sbin/httpd" domain.
212 * You may specify a domainname using "from" keyword.
213 * "initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
214 * will cause "/usr/sbin/httpd" executed from "<kernel> /etc/rc.d/init.d/httpd"
215 * domain to belong to "<kernel> /usr/sbin/httpd" domain.
217 * You may add "no_" prefix to "initialize_domain".
218 * "initialize_domain /usr/sbin/httpd" and
219 * "no_initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
220 * will cause "/usr/sbin/httpd" to belong to "<kernel> /usr/sbin/httpd" domain
221 * unless executed from "<kernel> /etc/rc.d/init.d/httpd" domain.
223 LIST_HEAD(tomoyo_domain_initializer_list
);
225 static bool tomoyo_same_domain_initializer_entry(const struct tomoyo_acl_head
*
227 const struct tomoyo_acl_head
*
230 const struct tomoyo_domain_initializer_entry
*p1
=
231 container_of(a
, typeof(*p1
), head
);
232 const struct tomoyo_domain_initializer_entry
*p2
=
233 container_of(b
, typeof(*p2
), head
);
234 return p1
->is_not
== p2
->is_not
&& p1
->is_last_name
== p2
->is_last_name
235 && p1
->domainname
== p2
->domainname
236 && p1
->program
== p2
->program
;
240 * tomoyo_update_domain_initializer_entry - Update "struct tomoyo_domain_initializer_entry" list.
242 * @domainname: The name of domain. May be NULL.
243 * @program: The name of program.
244 * @is_not: True if it is "no_initialize_domain" entry.
245 * @is_delete: True if it is a delete request.
247 * Returns 0 on success, negative value otherwise.
249 * Caller holds tomoyo_read_lock().
251 static int tomoyo_update_domain_initializer_entry(const char *domainname
,
254 const bool is_delete
)
256 struct tomoyo_domain_initializer_entry e
= { .is_not
= is_not
};
257 int error
= is_delete
? -ENOENT
: -ENOMEM
;
259 if (!tomoyo_correct_path(program
))
262 if (!tomoyo_domain_def(domainname
) &&
263 tomoyo_correct_path(domainname
))
264 e
.is_last_name
= true;
265 else if (!tomoyo_correct_domain(domainname
))
267 e
.domainname
= tomoyo_get_name(domainname
);
271 e
.program
= tomoyo_get_name(program
);
274 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
275 &tomoyo_domain_initializer_list
,
276 tomoyo_same_domain_initializer_entry
);
278 tomoyo_put_name(e
.domainname
);
279 tomoyo_put_name(e
.program
);
284 * tomoyo_read_domain_initializer_policy - Read "struct tomoyo_domain_initializer_entry" list.
286 * @head: Pointer to "struct tomoyo_io_buffer".
288 * Returns true on success, false otherwise.
290 * Caller holds tomoyo_read_lock().
292 bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer
*head
)
294 struct list_head
*pos
;
297 list_for_each_cookie(pos
, head
->read_var2
,
298 &tomoyo_domain_initializer_list
) {
300 const char *from
= "";
301 const char *domain
= "";
302 struct tomoyo_domain_initializer_entry
*ptr
;
303 ptr
= list_entry(pos
, struct tomoyo_domain_initializer_entry
,
305 if (ptr
->head
.is_deleted
)
307 no
= ptr
->is_not
? "no_" : "";
308 if (ptr
->domainname
) {
310 domain
= ptr
->domainname
->name
;
312 done
= tomoyo_io_printf(head
,
313 "%s" TOMOYO_KEYWORD_INITIALIZE_DOMAIN
314 "%s%s%s\n", no
, ptr
->program
->name
,
323 * tomoyo_write_domain_initializer_policy - Write "struct tomoyo_domain_initializer_entry" list.
325 * @data: String to parse.
326 * @is_not: True if it is "no_initialize_domain" entry.
327 * @is_delete: True if it is a delete request.
329 * Returns 0 on success, negative value otherwise.
331 * Caller holds tomoyo_read_lock().
333 int tomoyo_write_domain_initializer_policy(char *data
, const bool is_not
,
334 const bool is_delete
)
336 char *cp
= strstr(data
, " from ");
340 return tomoyo_update_domain_initializer_entry(cp
+ 6, data
,
344 return tomoyo_update_domain_initializer_entry(NULL
, data
, is_not
,
349 * tomoyo_domain_initializer - Check whether the given program causes domainname reinitialization.
351 * @domainname: The name of domain.
352 * @program: The name of program.
353 * @last_name: The last component of @domainname.
355 * Returns true if executing @program reinitializes domain transition,
358 * Caller holds tomoyo_read_lock().
360 static bool tomoyo_domain_initializer(const struct tomoyo_path_info
*
362 const struct tomoyo_path_info
*program
,
363 const struct tomoyo_path_info
*
366 struct tomoyo_domain_initializer_entry
*ptr
;
369 list_for_each_entry_rcu(ptr
, &tomoyo_domain_initializer_list
,
371 if (ptr
->head
.is_deleted
)
373 if (ptr
->domainname
) {
374 if (!ptr
->is_last_name
) {
375 if (ptr
->domainname
!= domainname
)
378 if (tomoyo_pathcmp(ptr
->domainname
, last_name
))
382 if (tomoyo_pathcmp(ptr
->program
, program
))
394 * tomoyo_domain_keeper_list is used for holding list of domainnames which
395 * suppresses domain transition. Normally, a domainname is monotonically
396 * getting longer. But sometimes, we want to suppress domain transition.
397 * It would be convenient for us that programs executed from a login session
398 * belong to the same domain. Thus, TOMOYO provides a way to suppress domain
401 * An entry is added by
403 * # echo 'keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
404 * /sys/kernel/security/tomoyo/exception_policy
408 * # echo 'delete keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
409 * /sys/kernel/security/tomoyo/exception_policy
411 * and all entries are retrieved by
413 * # grep ^keep_domain /sys/kernel/security/tomoyo/exception_policy
415 * In the example above, any process which belongs to
416 * "<kernel> /usr/sbin/sshd /bin/bash" domain will remain in that domain,
417 * unless explicitly specified by "initialize_domain" or "no_keep_domain".
419 * You may specify a program using "from" keyword.
420 * "keep_domain /bin/pwd from <kernel> /usr/sbin/sshd /bin/bash"
421 * will cause "/bin/pwd" executed from "<kernel> /usr/sbin/sshd /bin/bash"
422 * domain to remain in "<kernel> /usr/sbin/sshd /bin/bash" domain.
424 * You may add "no_" prefix to "keep_domain".
425 * "keep_domain <kernel> /usr/sbin/sshd /bin/bash" and
426 * "no_keep_domain /usr/bin/passwd from <kernel> /usr/sbin/sshd /bin/bash" will
427 * cause "/usr/bin/passwd" to belong to
428 * "<kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd" domain, unless
429 * explicitly specified by "initialize_domain".
431 LIST_HEAD(tomoyo_domain_keeper_list
);
433 static bool tomoyo_same_domain_keeper_entry(const struct tomoyo_acl_head
*a
,
434 const struct tomoyo_acl_head
*b
)
436 const struct tomoyo_domain_keeper_entry
*p1
=
437 container_of(a
, typeof(*p1
), head
);
438 const struct tomoyo_domain_keeper_entry
*p2
=
439 container_of(b
, typeof(*p2
), head
);
440 return p1
->is_not
== p2
->is_not
&& p1
->is_last_name
== p2
->is_last_name
441 && p1
->domainname
== p2
->domainname
442 && p1
->program
== p2
->program
;
446 * tomoyo_update_domain_keeper_entry - Update "struct tomoyo_domain_keeper_entry" list.
448 * @domainname: The name of domain.
449 * @program: The name of program. May be NULL.
450 * @is_not: True if it is "no_keep_domain" entry.
451 * @is_delete: True if it is a delete request.
453 * Returns 0 on success, negative value otherwise.
455 * Caller holds tomoyo_read_lock().
457 static int tomoyo_update_domain_keeper_entry(const char *domainname
,
460 const bool is_delete
)
462 struct tomoyo_domain_keeper_entry e
= { .is_not
= is_not
};
463 int error
= is_delete
? -ENOENT
: -ENOMEM
;
465 if (!tomoyo_domain_def(domainname
) &&
466 tomoyo_correct_path(domainname
))
467 e
.is_last_name
= true;
468 else if (!tomoyo_correct_domain(domainname
))
471 if (!tomoyo_correct_path(program
))
473 e
.program
= tomoyo_get_name(program
);
477 e
.domainname
= tomoyo_get_name(domainname
);
480 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
481 &tomoyo_domain_keeper_list
,
482 tomoyo_same_domain_keeper_entry
);
484 tomoyo_put_name(e
.domainname
);
485 tomoyo_put_name(e
.program
);
490 * tomoyo_write_domain_keeper_policy - Write "struct tomoyo_domain_keeper_entry" list.
492 * @data: String to parse.
493 * @is_not: True if it is "no_keep_domain" entry.
494 * @is_delete: True if it is a delete request.
496 * Caller holds tomoyo_read_lock().
498 int tomoyo_write_domain_keeper_policy(char *data
, const bool is_not
,
499 const bool is_delete
)
501 char *cp
= strstr(data
, " from ");
505 return tomoyo_update_domain_keeper_entry(cp
+ 6, data
, is_not
,
508 return tomoyo_update_domain_keeper_entry(data
, NULL
, is_not
, is_delete
);
512 * tomoyo_read_domain_keeper_policy - Read "struct tomoyo_domain_keeper_entry" list.
514 * @head: Pointer to "struct tomoyo_io_buffer".
516 * Returns true on success, false otherwise.
518 * Caller holds tomoyo_read_lock().
520 bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer
*head
)
522 struct list_head
*pos
;
525 list_for_each_cookie(pos
, head
->read_var2
,
526 &tomoyo_domain_keeper_list
) {
527 struct tomoyo_domain_keeper_entry
*ptr
;
529 const char *from
= "";
530 const char *program
= "";
532 ptr
= list_entry(pos
, struct tomoyo_domain_keeper_entry
,
534 if (ptr
->head
.is_deleted
)
536 no
= ptr
->is_not
? "no_" : "";
539 program
= ptr
->program
->name
;
541 done
= tomoyo_io_printf(head
,
542 "%s" TOMOYO_KEYWORD_KEEP_DOMAIN
543 "%s%s%s\n", no
, program
, from
,
544 ptr
->domainname
->name
);
552 * tomoyo_domain_keeper - Check whether the given program causes domain transition suppression.
554 * @domainname: The name of domain.
555 * @program: The name of program.
556 * @last_name: The last component of @domainname.
558 * Returns true if executing @program supresses domain transition,
561 * Caller holds tomoyo_read_lock().
563 static bool tomoyo_domain_keeper(const struct tomoyo_path_info
*domainname
,
564 const struct tomoyo_path_info
*program
,
565 const struct tomoyo_path_info
*last_name
)
567 struct tomoyo_domain_keeper_entry
*ptr
;
570 list_for_each_entry_rcu(ptr
, &tomoyo_domain_keeper_list
, head
.list
) {
571 if (ptr
->head
.is_deleted
)
573 if (!ptr
->is_last_name
) {
574 if (ptr
->domainname
!= domainname
)
577 if (tomoyo_pathcmp(ptr
->domainname
, last_name
))
580 if (ptr
->program
&& tomoyo_pathcmp(ptr
->program
, program
))
592 * tomoyo_aggregator_list is used for holding list of rewrite table for
593 * execve() request. Some programs provides similar functionality. This keyword
594 * allows users to aggregate such programs.
596 * Entries are added by
598 * # echo 'aggregator /usr/bin/vi /./editor' > \
599 * /sys/kernel/security/tomoyo/exception_policy
600 * # echo 'aggregator /usr/bin/emacs /./editor' > \
601 * /sys/kernel/security/tomoyo/exception_policy
605 * # echo 'delete aggregator /usr/bin/vi /./editor' > \
606 * /sys/kernel/security/tomoyo/exception_policy
607 * # echo 'delete aggregator /usr/bin/emacs /./editor' > \
608 * /sys/kernel/security/tomoyo/exception_policy
610 * and all entries are retrieved by
612 * # grep ^aggregator /sys/kernel/security/tomoyo/exception_policy
614 * In the example above, if /usr/bin/vi or /usr/bin/emacs are executed,
615 * permission is checked for /./editor and domainname which the current process
616 * will belong to after execve() succeeds is calculated using /./editor .
618 LIST_HEAD(tomoyo_aggregator_list
);
620 static bool tomoyo_same_aggregator_entry(const struct tomoyo_acl_head
*a
,
621 const struct tomoyo_acl_head
*b
)
623 const struct tomoyo_aggregator_entry
*p1
= container_of(a
, typeof(*p1
),
625 const struct tomoyo_aggregator_entry
*p2
= container_of(b
, typeof(*p2
),
627 return p1
->original_name
== p2
->original_name
&&
628 p1
->aggregated_name
== p2
->aggregated_name
;
632 * tomoyo_update_aggregator_entry - Update "struct tomoyo_aggregator_entry" list.
634 * @original_name: The original program's name.
635 * @aggregated_name: The program name to use.
636 * @is_delete: True if it is a delete request.
638 * Returns 0 on success, negative value otherwise.
640 * Caller holds tomoyo_read_lock().
642 static int tomoyo_update_aggregator_entry(const char *original_name
,
643 const char *aggregated_name
,
644 const bool is_delete
)
646 struct tomoyo_aggregator_entry e
= { };
647 int error
= is_delete
? -ENOENT
: -ENOMEM
;
649 if (!tomoyo_correct_path(original_name
) ||
650 !tomoyo_correct_path(aggregated_name
))
652 e
.original_name
= tomoyo_get_name(original_name
);
653 e
.aggregated_name
= tomoyo_get_name(aggregated_name
);
654 if (!e
.original_name
|| !e
.aggregated_name
||
655 e
.aggregated_name
->is_patterned
) /* No patterns allowed. */
657 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
658 &tomoyo_aggregator_list
,
659 tomoyo_same_aggregator_entry
);
661 tomoyo_put_name(e
.original_name
);
662 tomoyo_put_name(e
.aggregated_name
);
667 * tomoyo_read_aggregator_policy - Read "struct tomoyo_aggregator_entry" list.
669 * @head: Pointer to "struct tomoyo_io_buffer".
671 * Returns true on success, false otherwise.
673 * Caller holds tomoyo_read_lock().
675 bool tomoyo_read_aggregator_policy(struct tomoyo_io_buffer
*head
)
677 struct list_head
*pos
;
680 list_for_each_cookie(pos
, head
->read_var2
, &tomoyo_aggregator_list
) {
681 struct tomoyo_aggregator_entry
*ptr
;
683 ptr
= list_entry(pos
, struct tomoyo_aggregator_entry
,
685 if (ptr
->head
.is_deleted
)
687 done
= tomoyo_io_printf(head
, TOMOYO_KEYWORD_AGGREGATOR
688 "%s %s\n", ptr
->original_name
->name
,
689 ptr
->aggregated_name
->name
);
697 * tomoyo_write_aggregator_policy - Write "struct tomoyo_aggregator_entry" list.
699 * @data: String to parse.
700 * @is_delete: True if it is a delete request.
702 * Returns 0 on success, negative value otherwise.
704 * Caller holds tomoyo_read_lock().
706 int tomoyo_write_aggregator_policy(char *data
, const bool is_delete
)
708 char *cp
= strchr(data
, ' ');
713 return tomoyo_update_aggregator_entry(data
, cp
, is_delete
);
717 * tomoyo_alias_list is used for holding list of symlink's pathnames which are
718 * allowed to be passed to an execve() request. Normally, the domainname which
719 * the current process will belong to after execve() succeeds is calculated
720 * using dereferenced pathnames. But some programs behave differently depending
721 * on the name passed to argv[0]. For busybox, calculating domainname using
722 * dereferenced pathnames will cause all programs in the busybox to belong to
723 * the same domain. Thus, TOMOYO provides a way to allow use of symlink's
724 * pathname for checking execve()'s permission and calculating domainname which
725 * the current process will belong to after execve() succeeds.
727 * An entry is added by
729 * # echo 'alias /bin/busybox /bin/cat' > \
730 * /sys/kernel/security/tomoyo/exception_policy
734 * # echo 'delete alias /bin/busybox /bin/cat' > \
735 * /sys/kernel/security/tomoyo/exception_policy
737 * and all entries are retrieved by
739 * # grep ^alias /sys/kernel/security/tomoyo/exception_policy
741 * In the example above, if /bin/cat is a symlink to /bin/busybox and execution
742 * of /bin/cat is requested, permission is checked for /bin/cat rather than
743 * /bin/busybox and domainname which the current process will belong to after
744 * execve() succeeds is calculated using /bin/cat rather than /bin/busybox .
746 LIST_HEAD(tomoyo_alias_list
);
748 static bool tomoyo_same_alias_entry(const struct tomoyo_acl_head
*a
,
749 const struct tomoyo_acl_head
*b
)
751 const struct tomoyo_alias_entry
*p1
= container_of(a
, typeof(*p1
),
753 const struct tomoyo_alias_entry
*p2
= container_of(b
, typeof(*p2
),
755 return p1
->original_name
== p2
->original_name
&&
756 p1
->aliased_name
== p2
->aliased_name
;
760 * tomoyo_update_alias_entry - Update "struct tomoyo_alias_entry" list.
762 * @original_name: The original program's real name.
763 * @aliased_name: The symbolic program's symbolic link's name.
764 * @is_delete: True if it is a delete request.
766 * Returns 0 on success, negative value otherwise.
768 * Caller holds tomoyo_read_lock().
770 static int tomoyo_update_alias_entry(const char *original_name
,
771 const char *aliased_name
,
772 const bool is_delete
)
774 struct tomoyo_alias_entry e
= { };
775 int error
= is_delete
? -ENOENT
: -ENOMEM
;
777 if (!tomoyo_correct_path(original_name
) ||
778 !tomoyo_correct_path(aliased_name
))
780 e
.original_name
= tomoyo_get_name(original_name
);
781 e
.aliased_name
= tomoyo_get_name(aliased_name
);
782 if (!e
.original_name
|| !e
.aliased_name
||
783 e
.original_name
->is_patterned
|| e
.aliased_name
->is_patterned
)
784 goto out
; /* No patterns allowed. */
785 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
787 tomoyo_same_alias_entry
);
789 tomoyo_put_name(e
.original_name
);
790 tomoyo_put_name(e
.aliased_name
);
795 * tomoyo_read_alias_policy - Read "struct tomoyo_alias_entry" list.
797 * @head: Pointer to "struct tomoyo_io_buffer".
799 * Returns true on success, false otherwise.
801 * Caller holds tomoyo_read_lock().
803 bool tomoyo_read_alias_policy(struct tomoyo_io_buffer
*head
)
805 struct list_head
*pos
;
808 list_for_each_cookie(pos
, head
->read_var2
, &tomoyo_alias_list
) {
809 struct tomoyo_alias_entry
*ptr
;
811 ptr
= list_entry(pos
, struct tomoyo_alias_entry
, head
.list
);
812 if (ptr
->head
.is_deleted
)
814 done
= tomoyo_io_printf(head
, TOMOYO_KEYWORD_ALIAS
"%s %s\n",
815 ptr
->original_name
->name
,
816 ptr
->aliased_name
->name
);
824 * tomoyo_write_alias_policy - Write "struct tomoyo_alias_entry" list.
826 * @data: String to parse.
827 * @is_delete: True if it is a delete request.
829 * Returns 0 on success, negative value otherwise.
831 * Caller holds tomoyo_read_lock().
833 int tomoyo_write_alias_policy(char *data
, const bool is_delete
)
835 char *cp
= strchr(data
, ' ');
840 return tomoyo_update_alias_entry(data
, cp
, is_delete
);
844 * tomoyo_find_or_assign_new_domain - Create a domain.
846 * @domainname: The name of domain.
847 * @profile: Profile number to assign if the domain was newly created.
849 * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
851 * Caller holds tomoyo_read_lock().
853 struct tomoyo_domain_info
*tomoyo_find_or_assign_new_domain(const char *
857 struct tomoyo_domain_info
*entry
;
858 struct tomoyo_domain_info
*domain
= NULL
;
859 const struct tomoyo_path_info
*saved_domainname
;
862 if (!tomoyo_correct_domain(domainname
))
864 saved_domainname
= tomoyo_get_name(domainname
);
865 if (!saved_domainname
)
867 entry
= kzalloc(sizeof(*entry
), GFP_NOFS
);
868 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
870 list_for_each_entry_rcu(domain
, &tomoyo_domain_list
, list
) {
871 if (domain
->is_deleted
||
872 tomoyo_pathcmp(saved_domainname
, domain
->domainname
))
877 if (!found
&& tomoyo_memory_ok(entry
)) {
878 INIT_LIST_HEAD(&entry
->acl_info_list
);
879 entry
->domainname
= saved_domainname
;
880 saved_domainname
= NULL
;
881 entry
->profile
= profile
;
882 list_add_tail_rcu(&entry
->list
, &tomoyo_domain_list
);
887 mutex_unlock(&tomoyo_policy_lock
);
889 tomoyo_put_name(saved_domainname
);
891 return found
? domain
: NULL
;
895 * tomoyo_find_next_domain - Find a domain.
897 * @bprm: Pointer to "struct linux_binprm".
899 * Returns 0 on success, negative value otherwise.
901 * Caller holds tomoyo_read_lock().
903 int tomoyo_find_next_domain(struct linux_binprm
*bprm
)
905 struct tomoyo_request_info r
;
906 char *tmp
= kzalloc(TOMOYO_EXEC_TMPSIZE
, GFP_NOFS
);
907 struct tomoyo_domain_info
*old_domain
= tomoyo_domain();
908 struct tomoyo_domain_info
*domain
= NULL
;
909 const char *old_domain_name
= old_domain
->domainname
->name
;
910 const char *original_name
= bprm
->filename
;
913 int retval
= -ENOMEM
;
914 bool need_kfree
= false;
915 struct tomoyo_path_info rn
= { }; /* real name */
916 struct tomoyo_path_info sn
= { }; /* symlink name */
917 struct tomoyo_path_info ln
; /* last name */
919 ln
.name
= tomoyo_get_last_name(old_domain
);
920 tomoyo_fill_path_info(&ln
);
921 mode
= tomoyo_init_request_info(&r
, NULL
, TOMOYO_MAC_FILE_EXECUTE
);
922 is_enforce
= (mode
== TOMOYO_CONFIG_ENFORCING
);
931 /* Get tomoyo_realpath of program. */
933 rn
.name
= tomoyo_realpath(original_name
);
936 tomoyo_fill_path_info(&rn
);
939 /* Get tomoyo_realpath of symbolic link. */
940 sn
.name
= tomoyo_realpath_nofollow(original_name
);
943 tomoyo_fill_path_info(&sn
);
945 /* Check 'alias' directive. */
946 if (tomoyo_pathcmp(&rn
, &sn
)) {
947 struct tomoyo_alias_entry
*ptr
;
948 /* Is this program allowed to be called via symbolic links? */
949 list_for_each_entry_rcu(ptr
, &tomoyo_alias_list
, head
.list
) {
950 if (ptr
->head
.is_deleted
||
951 tomoyo_pathcmp(&rn
, ptr
->original_name
) ||
952 tomoyo_pathcmp(&sn
, ptr
->aliased_name
))
956 /* This is OK because it is read only. */
957 rn
= *ptr
->aliased_name
;
962 /* Check 'aggregator' directive. */
964 struct tomoyo_aggregator_entry
*ptr
;
965 list_for_each_entry_rcu(ptr
, &tomoyo_aggregator_list
,
967 if (ptr
->head
.is_deleted
||
968 !tomoyo_path_matches_pattern(&rn
,
974 /* This is OK because it is read only. */
975 rn
= *ptr
->aggregated_name
;
980 /* Check execute permission. */
981 retval
= tomoyo_path_permission(&r
, TOMOYO_TYPE_EXECUTE
, &rn
);
982 if (retval
== TOMOYO_RETRY_REQUEST
)
987 if (tomoyo_domain_initializer(old_domain
->domainname
, &rn
, &ln
)) {
988 /* Transit to the child of tomoyo_kernel_domain domain. */
989 snprintf(tmp
, TOMOYO_EXEC_TMPSIZE
- 1,
990 TOMOYO_ROOT_NAME
" " "%s", rn
.name
);
991 } else if (old_domain
== &tomoyo_kernel_domain
&&
992 !tomoyo_policy_loaded
) {
994 * Needn't to transit from kernel domain before starting
995 * /sbin/init. But transit from kernel domain if executing
996 * initializers because they might start before /sbin/init.
999 } else if (tomoyo_domain_keeper(old_domain
->domainname
, &rn
, &ln
)) {
1000 /* Keep current domain. */
1001 domain
= old_domain
;
1003 /* Normal domain transition. */
1004 snprintf(tmp
, TOMOYO_EXEC_TMPSIZE
- 1,
1005 "%s %s", old_domain_name
, rn
.name
);
1007 if (domain
|| strlen(tmp
) >= TOMOYO_EXEC_TMPSIZE
- 10)
1009 domain
= tomoyo_find_domain(tmp
);
1013 int error
= tomoyo_supervisor(&r
, "# wants to create domain\n"
1015 if (error
== TOMOYO_RETRY_REQUEST
)
1020 domain
= tomoyo_find_or_assign_new_domain(tmp
, old_domain
->profile
);
1024 printk(KERN_WARNING
"TOMOYO-ERROR: Domain '%s' not defined.\n", tmp
);
1028 old_domain
->transition_failed
= true;
1031 domain
= old_domain
;
1032 /* Update reference count on "struct tomoyo_domain_info". */
1033 atomic_inc(&domain
->users
);
1034 bprm
->cred
->security
= domain
;