2 * security/tomoyo/file.c
4 * Pathname restriction functions.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
10 #include <linux/slab.h>
12 /* Keyword array for operations with one pathname. */
13 const char *tomoyo_path_keyword
[TOMOYO_MAX_PATH_OPERATION
] = {
14 [TOMOYO_TYPE_READ_WRITE
] = "read/write",
15 [TOMOYO_TYPE_EXECUTE
] = "execute",
16 [TOMOYO_TYPE_READ
] = "read",
17 [TOMOYO_TYPE_WRITE
] = "write",
18 [TOMOYO_TYPE_UNLINK
] = "unlink",
19 [TOMOYO_TYPE_RMDIR
] = "rmdir",
20 [TOMOYO_TYPE_TRUNCATE
] = "truncate",
21 [TOMOYO_TYPE_SYMLINK
] = "symlink",
22 [TOMOYO_TYPE_REWRITE
] = "rewrite",
23 [TOMOYO_TYPE_CHROOT
] = "chroot",
24 [TOMOYO_TYPE_UMOUNT
] = "unmount",
27 /* Keyword array for operations with one pathname and three numbers. */
28 const char *tomoyo_mkdev_keyword
[TOMOYO_MAX_MKDEV_OPERATION
] = {
29 [TOMOYO_TYPE_MKBLOCK
] = "mkblock",
30 [TOMOYO_TYPE_MKCHAR
] = "mkchar",
33 /* Keyword array for operations with two pathnames. */
34 const char *tomoyo_path2_keyword
[TOMOYO_MAX_PATH2_OPERATION
] = {
35 [TOMOYO_TYPE_LINK
] = "link",
36 [TOMOYO_TYPE_RENAME
] = "rename",
37 [TOMOYO_TYPE_PIVOT_ROOT
] = "pivot_root",
40 /* Keyword array for operations with one pathname and one number. */
41 const char *tomoyo_path_number_keyword
[TOMOYO_MAX_PATH_NUMBER_OPERATION
] = {
42 [TOMOYO_TYPE_CREATE
] = "create",
43 [TOMOYO_TYPE_MKDIR
] = "mkdir",
44 [TOMOYO_TYPE_MKFIFO
] = "mkfifo",
45 [TOMOYO_TYPE_MKSOCK
] = "mksock",
46 [TOMOYO_TYPE_IOCTL
] = "ioctl",
47 [TOMOYO_TYPE_CHMOD
] = "chmod",
48 [TOMOYO_TYPE_CHOWN
] = "chown",
49 [TOMOYO_TYPE_CHGRP
] = "chgrp",
52 static const u8 tomoyo_p2mac
[TOMOYO_MAX_PATH_OPERATION
] = {
53 [TOMOYO_TYPE_READ_WRITE
] = TOMOYO_MAC_FILE_OPEN
,
54 [TOMOYO_TYPE_EXECUTE
] = TOMOYO_MAC_FILE_EXECUTE
,
55 [TOMOYO_TYPE_READ
] = TOMOYO_MAC_FILE_OPEN
,
56 [TOMOYO_TYPE_WRITE
] = TOMOYO_MAC_FILE_OPEN
,
57 [TOMOYO_TYPE_UNLINK
] = TOMOYO_MAC_FILE_UNLINK
,
58 [TOMOYO_TYPE_RMDIR
] = TOMOYO_MAC_FILE_RMDIR
,
59 [TOMOYO_TYPE_TRUNCATE
] = TOMOYO_MAC_FILE_TRUNCATE
,
60 [TOMOYO_TYPE_SYMLINK
] = TOMOYO_MAC_FILE_SYMLINK
,
61 [TOMOYO_TYPE_REWRITE
] = TOMOYO_MAC_FILE_REWRITE
,
62 [TOMOYO_TYPE_CHROOT
] = TOMOYO_MAC_FILE_CHROOT
,
63 [TOMOYO_TYPE_UMOUNT
] = TOMOYO_MAC_FILE_UMOUNT
,
66 static const u8 tomoyo_pnnn2mac
[TOMOYO_MAX_MKDEV_OPERATION
] = {
67 [TOMOYO_TYPE_MKBLOCK
] = TOMOYO_MAC_FILE_MKBLOCK
,
68 [TOMOYO_TYPE_MKCHAR
] = TOMOYO_MAC_FILE_MKCHAR
,
71 static const u8 tomoyo_pp2mac
[TOMOYO_MAX_PATH2_OPERATION
] = {
72 [TOMOYO_TYPE_LINK
] = TOMOYO_MAC_FILE_LINK
,
73 [TOMOYO_TYPE_RENAME
] = TOMOYO_MAC_FILE_RENAME
,
74 [TOMOYO_TYPE_PIVOT_ROOT
] = TOMOYO_MAC_FILE_PIVOT_ROOT
,
77 static const u8 tomoyo_pn2mac
[TOMOYO_MAX_PATH_NUMBER_OPERATION
] = {
78 [TOMOYO_TYPE_CREATE
] = TOMOYO_MAC_FILE_CREATE
,
79 [TOMOYO_TYPE_MKDIR
] = TOMOYO_MAC_FILE_MKDIR
,
80 [TOMOYO_TYPE_MKFIFO
] = TOMOYO_MAC_FILE_MKFIFO
,
81 [TOMOYO_TYPE_MKSOCK
] = TOMOYO_MAC_FILE_MKSOCK
,
82 [TOMOYO_TYPE_IOCTL
] = TOMOYO_MAC_FILE_IOCTL
,
83 [TOMOYO_TYPE_CHMOD
] = TOMOYO_MAC_FILE_CHMOD
,
84 [TOMOYO_TYPE_CHOWN
] = TOMOYO_MAC_FILE_CHOWN
,
85 [TOMOYO_TYPE_CHGRP
] = TOMOYO_MAC_FILE_CHGRP
,
88 void tomoyo_put_name_union(struct tomoyo_name_union
*ptr
)
93 tomoyo_put_group(ptr
->group
);
95 tomoyo_put_name(ptr
->filename
);
98 bool tomoyo_compare_name_union(const struct tomoyo_path_info
*name
,
99 const struct tomoyo_name_union
*ptr
)
102 return tomoyo_path_matches_group(name
, ptr
->group
);
103 return tomoyo_path_matches_pattern(name
, ptr
->filename
);
106 void tomoyo_put_number_union(struct tomoyo_number_union
*ptr
)
108 if (ptr
&& ptr
->is_group
)
109 tomoyo_put_group(ptr
->group
);
112 bool tomoyo_compare_number_union(const unsigned long value
,
113 const struct tomoyo_number_union
*ptr
)
116 return tomoyo_number_matches_group(value
, value
, ptr
->group
);
117 return value
>= ptr
->values
[0] && value
<= ptr
->values
[1];
120 static void tomoyo_add_slash(struct tomoyo_path_info
*buf
)
125 * This is OK because tomoyo_encode() reserves space for appending "/".
127 strcat((char *) buf
->name
, "/");
128 tomoyo_fill_path_info(buf
);
132 * tomoyo_strendswith - Check whether the token ends with the given token.
134 * @name: The token to check.
135 * @tail: The token to find.
137 * Returns true if @name ends with @tail, false otherwise.
139 static bool tomoyo_strendswith(const char *name
, const char *tail
)
145 len
= strlen(name
) - strlen(tail
);
146 return len
>= 0 && !strcmp(name
+ len
, tail
);
150 * tomoyo_get_realpath - Get realpath.
152 * @buf: Pointer to "struct tomoyo_path_info".
153 * @path: Pointer to "struct path".
155 * Returns true on success, false otherwise.
157 static bool tomoyo_get_realpath(struct tomoyo_path_info
*buf
, struct path
*path
)
159 buf
->name
= tomoyo_realpath_from_path(path
);
161 tomoyo_fill_path_info(buf
);
168 * tomoyo_audit_path_log - Audit path request log.
170 * @r: Pointer to "struct tomoyo_request_info".
172 * Returns 0 on success, negative value otherwise.
174 static int tomoyo_audit_path_log(struct tomoyo_request_info
*r
)
176 const char *operation
= tomoyo_path_keyword
[r
->param
.path
.operation
];
177 const struct tomoyo_path_info
*filename
= r
->param
.path
.filename
;
180 tomoyo_warn_log(r
, "%s %s", operation
, filename
->name
);
181 return tomoyo_supervisor(r
, "allow_%s %s\n", operation
,
182 tomoyo_file_pattern(filename
));
186 * tomoyo_audit_path2_log - Audit path/path request log.
188 * @r: Pointer to "struct tomoyo_request_info".
190 * Returns 0 on success, negative value otherwise.
192 static int tomoyo_audit_path2_log(struct tomoyo_request_info
*r
)
194 const char *operation
= tomoyo_path2_keyword
[r
->param
.path2
.operation
];
195 const struct tomoyo_path_info
*filename1
= r
->param
.path2
.filename1
;
196 const struct tomoyo_path_info
*filename2
= r
->param
.path2
.filename2
;
199 tomoyo_warn_log(r
, "%s %s %s", operation
, filename1
->name
,
201 return tomoyo_supervisor(r
, "allow_%s %s %s\n", operation
,
202 tomoyo_file_pattern(filename1
),
203 tomoyo_file_pattern(filename2
));
207 * tomoyo_audit_mkdev_log - Audit path/number/number/number request log.
209 * @r: Pointer to "struct tomoyo_request_info".
211 * Returns 0 on success, negative value otherwise.
213 static int tomoyo_audit_mkdev_log(struct tomoyo_request_info
*r
)
215 const char *operation
= tomoyo_mkdev_keyword
[r
->param
.mkdev
.operation
];
216 const struct tomoyo_path_info
*filename
= r
->param
.mkdev
.filename
;
217 const unsigned int major
= r
->param
.mkdev
.major
;
218 const unsigned int minor
= r
->param
.mkdev
.minor
;
219 const unsigned int mode
= r
->param
.mkdev
.mode
;
222 tomoyo_warn_log(r
, "%s %s 0%o %u %u", operation
, filename
->name
, mode
,
224 return tomoyo_supervisor(r
, "allow_%s %s 0%o %u %u\n", operation
,
225 tomoyo_file_pattern(filename
), mode
, major
,
230 * tomoyo_audit_path_number_log - Audit path/number request log.
232 * @r: Pointer to "struct tomoyo_request_info".
233 * @error: Error code.
235 * Returns 0 on success, negative value otherwise.
237 static int tomoyo_audit_path_number_log(struct tomoyo_request_info
*r
)
239 const u8 type
= r
->param
.path_number
.operation
;
241 const struct tomoyo_path_info
*filename
= r
->param
.path_number
.filename
;
242 const char *operation
= tomoyo_path_number_keyword
[type
];
247 case TOMOYO_TYPE_CREATE
:
248 case TOMOYO_TYPE_MKDIR
:
249 case TOMOYO_TYPE_MKFIFO
:
250 case TOMOYO_TYPE_MKSOCK
:
251 case TOMOYO_TYPE_CHMOD
:
252 radix
= TOMOYO_VALUE_TYPE_OCTAL
;
254 case TOMOYO_TYPE_IOCTL
:
255 radix
= TOMOYO_VALUE_TYPE_HEXADECIMAL
;
258 radix
= TOMOYO_VALUE_TYPE_DECIMAL
;
261 tomoyo_print_ulong(buffer
, sizeof(buffer
), r
->param
.path_number
.number
,
263 tomoyo_warn_log(r
, "%s %s %s", operation
, filename
->name
, buffer
);
264 return tomoyo_supervisor(r
, "allow_%s %s %s\n", operation
,
265 tomoyo_file_pattern(filename
), buffer
);
269 * tomoyo_globally_readable_list is used for holding list of pathnames which
270 * are by default allowed to be open()ed for reading by any process.
272 * An entry is added by
274 * # echo 'allow_read /lib/libc-2.5.so' > \
275 * /sys/kernel/security/tomoyo/exception_policy
279 * # echo 'delete allow_read /lib/libc-2.5.so' > \
280 * /sys/kernel/security/tomoyo/exception_policy
282 * and all entries are retrieved by
284 * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
286 * In the example above, any process is allowed to
287 * open("/lib/libc-2.5.so", O_RDONLY).
288 * One exception is, if the domain which current process belongs to is marked
289 * as "ignore_global_allow_read", current process can't do so unless explicitly
290 * given "allow_read /lib/libc-2.5.so" to the domain which current process
293 LIST_HEAD(tomoyo_globally_readable_list
);
295 static bool tomoyo_same_globally_readable(const struct tomoyo_acl_head
*a
,
296 const struct tomoyo_acl_head
*b
)
298 return container_of(a
, struct tomoyo_globally_readable_file_entry
,
300 container_of(b
, struct tomoyo_globally_readable_file_entry
,
305 * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
307 * @filename: Filename unconditionally permitted to open() for reading.
308 * @is_delete: True if it is a delete request.
310 * Returns 0 on success, negative value otherwise.
312 * Caller holds tomoyo_read_lock().
314 static int tomoyo_update_globally_readable_entry(const char *filename
,
315 const bool is_delete
)
317 struct tomoyo_globally_readable_file_entry e
= { };
320 if (!tomoyo_correct_word(filename
))
322 e
.filename
= tomoyo_get_name(filename
);
325 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
326 &tomoyo_globally_readable_list
,
327 tomoyo_same_globally_readable
);
328 tomoyo_put_name(e
.filename
);
333 * tomoyo_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
335 * @filename: The filename to check.
337 * Returns true if any domain can open @filename for reading, false otherwise.
339 * Caller holds tomoyo_read_lock().
341 static bool tomoyo_globally_readable_file(const struct tomoyo_path_info
*
344 struct tomoyo_globally_readable_file_entry
*ptr
;
347 list_for_each_entry_rcu(ptr
, &tomoyo_globally_readable_list
,
349 if (!ptr
->head
.is_deleted
&&
350 tomoyo_path_matches_pattern(filename
, ptr
->filename
)) {
359 * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
361 * @data: String to parse.
362 * @is_delete: True if it is a delete request.
364 * Returns 0 on success, negative value otherwise.
366 * Caller holds tomoyo_read_lock().
368 int tomoyo_write_globally_readable_policy(char *data
, const bool is_delete
)
370 return tomoyo_update_globally_readable_entry(data
, is_delete
);
374 * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
376 * @head: Pointer to "struct tomoyo_io_buffer".
378 * Returns true on success, false otherwise.
380 * Caller holds tomoyo_read_lock().
382 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer
*head
)
384 struct list_head
*pos
;
387 list_for_each_cookie(pos
, head
->read_var2
,
388 &tomoyo_globally_readable_list
) {
389 struct tomoyo_globally_readable_file_entry
*ptr
;
390 ptr
= list_entry(pos
,
391 struct tomoyo_globally_readable_file_entry
,
393 if (ptr
->head
.is_deleted
)
395 done
= tomoyo_io_printf(head
, TOMOYO_KEYWORD_ALLOW_READ
"%s\n",
396 ptr
->filename
->name
);
403 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
404 * converting pathnames to pathname patterns during learning mode.
406 * An entry is added by
408 * # echo 'file_pattern /proc/\$/mounts' > \
409 * /sys/kernel/security/tomoyo/exception_policy
413 * # echo 'delete file_pattern /proc/\$/mounts' > \
414 * /sys/kernel/security/tomoyo/exception_policy
416 * and all entries are retrieved by
418 * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
420 * In the example above, if a process which belongs to a domain which is in
421 * learning mode requested open("/proc/1/mounts", O_RDONLY),
422 * "allow_read /proc/\$/mounts" is automatically added to the domain which that
423 * process belongs to.
425 * It is not a desirable behavior that we have to use /proc/\$/ instead of
426 * /proc/self/ when current process needs to access only current process's
427 * information. As of now, LSM version of TOMOYO is using __d_path() for
428 * calculating pathname. Non LSM version of TOMOYO is using its own function
429 * which pretends as if /proc/self/ is not a symlink; so that we can forbid
430 * current process from accessing other process's information.
432 LIST_HEAD(tomoyo_pattern_list
);
434 static bool tomoyo_same_pattern(const struct tomoyo_acl_head
*a
,
435 const struct tomoyo_acl_head
*b
)
437 return container_of(a
, struct tomoyo_pattern_entry
, head
)->pattern
==
438 container_of(b
, struct tomoyo_pattern_entry
, head
)->pattern
;
442 * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
444 * @pattern: Pathname pattern.
445 * @is_delete: True if it is a delete request.
447 * Returns 0 on success, negative value otherwise.
449 * Caller holds tomoyo_read_lock().
451 static int tomoyo_update_file_pattern_entry(const char *pattern
,
452 const bool is_delete
)
454 struct tomoyo_pattern_entry e
= { };
457 if (!tomoyo_correct_word(pattern
))
459 e
.pattern
= tomoyo_get_name(pattern
);
462 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
463 &tomoyo_pattern_list
,
464 tomoyo_same_pattern
);
465 tomoyo_put_name(e
.pattern
);
470 * tomoyo_file_pattern - Get patterned pathname.
472 * @filename: The filename to find patterned pathname.
474 * Returns pointer to pathname pattern if matched, @filename otherwise.
476 * Caller holds tomoyo_read_lock().
478 const char *tomoyo_file_pattern(const struct tomoyo_path_info
*filename
)
480 struct tomoyo_pattern_entry
*ptr
;
481 const struct tomoyo_path_info
*pattern
= NULL
;
483 list_for_each_entry_rcu(ptr
, &tomoyo_pattern_list
, head
.list
) {
484 if (ptr
->head
.is_deleted
)
486 if (!tomoyo_path_matches_pattern(filename
, ptr
->pattern
))
488 pattern
= ptr
->pattern
;
489 if (tomoyo_strendswith(pattern
->name
, "/\\*")) {
490 /* Do nothing. Try to find the better match. */
492 /* This would be the better match. Use this. */
498 return filename
->name
;
502 * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
504 * @data: String to parse.
505 * @is_delete: True if it is a delete request.
507 * Returns 0 on success, negative value otherwise.
509 * Caller holds tomoyo_read_lock().
511 int tomoyo_write_pattern_policy(char *data
, const bool is_delete
)
513 return tomoyo_update_file_pattern_entry(data
, is_delete
);
517 * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
519 * @head: Pointer to "struct tomoyo_io_buffer".
521 * Returns true on success, false otherwise.
523 * Caller holds tomoyo_read_lock().
525 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer
*head
)
527 struct list_head
*pos
;
530 list_for_each_cookie(pos
, head
->read_var2
, &tomoyo_pattern_list
) {
531 struct tomoyo_pattern_entry
*ptr
;
532 ptr
= list_entry(pos
, struct tomoyo_pattern_entry
, head
.list
);
533 if (ptr
->head
.is_deleted
)
535 done
= tomoyo_io_printf(head
, TOMOYO_KEYWORD_FILE_PATTERN
536 "%s\n", ptr
->pattern
->name
);
544 * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
545 * default forbidden to modify already written content of a file.
547 * An entry is added by
549 * # echo 'deny_rewrite /var/log/messages' > \
550 * /sys/kernel/security/tomoyo/exception_policy
554 * # echo 'delete deny_rewrite /var/log/messages' > \
555 * /sys/kernel/security/tomoyo/exception_policy
557 * and all entries are retrieved by
559 * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
561 * In the example above, if a process requested to rewrite /var/log/messages ,
562 * the process can't rewrite unless the domain which that process belongs to
563 * has "allow_rewrite /var/log/messages" entry.
565 * It is not a desirable behavior that we have to add "\040(deleted)" suffix
566 * when we want to allow rewriting already unlink()ed file. As of now,
567 * LSM version of TOMOYO is using __d_path() for calculating pathname.
568 * Non LSM version of TOMOYO is using its own function which doesn't append
569 * " (deleted)" suffix if the file is already unlink()ed; so that we don't
570 * need to worry whether the file is already unlink()ed or not.
572 LIST_HEAD(tomoyo_no_rewrite_list
);
574 static bool tomoyo_same_no_rewrite(const struct tomoyo_acl_head
*a
,
575 const struct tomoyo_acl_head
*b
)
577 return container_of(a
, struct tomoyo_no_rewrite_entry
, head
)->pattern
578 == container_of(b
, struct tomoyo_no_rewrite_entry
, head
)
583 * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
585 * @pattern: Pathname pattern that are not rewritable by default.
586 * @is_delete: True if it is a delete request.
588 * Returns 0 on success, negative value otherwise.
590 * Caller holds tomoyo_read_lock().
592 static int tomoyo_update_no_rewrite_entry(const char *pattern
,
593 const bool is_delete
)
595 struct tomoyo_no_rewrite_entry e
= { };
598 if (!tomoyo_correct_word(pattern
))
600 e
.pattern
= tomoyo_get_name(pattern
);
603 error
= tomoyo_update_policy(&e
.head
, sizeof(e
), is_delete
,
604 &tomoyo_no_rewrite_list
,
605 tomoyo_same_no_rewrite
);
606 tomoyo_put_name(e
.pattern
);
611 * tomoyo_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
613 * @filename: Filename to check.
615 * Returns true if @filename is specified by "deny_rewrite" directive,
618 * Caller holds tomoyo_read_lock().
620 static bool tomoyo_no_rewrite_file(const struct tomoyo_path_info
*filename
)
622 struct tomoyo_no_rewrite_entry
*ptr
;
625 list_for_each_entry_rcu(ptr
, &tomoyo_no_rewrite_list
, head
.list
) {
626 if (ptr
->head
.is_deleted
)
628 if (!tomoyo_path_matches_pattern(filename
, ptr
->pattern
))
637 * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
639 * @data: String to parse.
640 * @is_delete: True if it is a delete request.
642 * Returns 0 on success, negative value otherwise.
644 * Caller holds tomoyo_read_lock().
646 int tomoyo_write_no_rewrite_policy(char *data
, const bool is_delete
)
648 return tomoyo_update_no_rewrite_entry(data
, is_delete
);
652 * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
654 * @head: Pointer to "struct tomoyo_io_buffer".
656 * Returns true on success, false otherwise.
658 * Caller holds tomoyo_read_lock().
660 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer
*head
)
662 struct list_head
*pos
;
665 list_for_each_cookie(pos
, head
->read_var2
, &tomoyo_no_rewrite_list
) {
666 struct tomoyo_no_rewrite_entry
*ptr
;
667 ptr
= list_entry(pos
, struct tomoyo_no_rewrite_entry
,
669 if (ptr
->head
.is_deleted
)
671 done
= tomoyo_io_printf(head
, TOMOYO_KEYWORD_DENY_REWRITE
672 "%s\n", ptr
->pattern
->name
);
679 static bool tomoyo_check_path_acl(const struct tomoyo_request_info
*r
,
680 const struct tomoyo_acl_info
*ptr
)
682 const struct tomoyo_path_acl
*acl
= container_of(ptr
, typeof(*acl
),
684 return (acl
->perm
& (1 << r
->param
.path
.operation
)) &&
685 tomoyo_compare_name_union(r
->param
.path
.filename
, &acl
->name
);
688 static bool tomoyo_check_path_number_acl(const struct tomoyo_request_info
*r
,
689 const struct tomoyo_acl_info
*ptr
)
691 const struct tomoyo_path_number_acl
*acl
=
692 container_of(ptr
, typeof(*acl
), head
);
693 return (acl
->perm
& (1 << r
->param
.path_number
.operation
)) &&
694 tomoyo_compare_number_union(r
->param
.path_number
.number
,
696 tomoyo_compare_name_union(r
->param
.path_number
.filename
,
700 static bool tomoyo_check_path2_acl(const struct tomoyo_request_info
*r
,
701 const struct tomoyo_acl_info
*ptr
)
703 const struct tomoyo_path2_acl
*acl
=
704 container_of(ptr
, typeof(*acl
), head
);
705 return (acl
->perm
& (1 << r
->param
.path2
.operation
)) &&
706 tomoyo_compare_name_union(r
->param
.path2
.filename1
, &acl
->name1
)
707 && tomoyo_compare_name_union(r
->param
.path2
.filename2
,
711 static bool tomoyo_check_mkdev_acl(const struct tomoyo_request_info
*r
,
712 const struct tomoyo_acl_info
*ptr
)
714 const struct tomoyo_mkdev_acl
*acl
=
715 container_of(ptr
, typeof(*acl
), head
);
716 return (acl
->perm
& (1 << r
->param
.mkdev
.operation
)) &&
717 tomoyo_compare_number_union(r
->param
.mkdev
.mode
,
719 tomoyo_compare_number_union(r
->param
.mkdev
.major
,
721 tomoyo_compare_number_union(r
->param
.mkdev
.minor
,
723 tomoyo_compare_name_union(r
->param
.mkdev
.filename
,
727 static bool tomoyo_same_path_acl(const struct tomoyo_acl_info
*a
,
728 const struct tomoyo_acl_info
*b
)
730 const struct tomoyo_path_acl
*p1
= container_of(a
, typeof(*p1
), head
);
731 const struct tomoyo_path_acl
*p2
= container_of(b
, typeof(*p2
), head
);
732 return tomoyo_same_acl_head(&p1
->head
, &p2
->head
) &&
733 tomoyo_same_name_union(&p1
->name
, &p2
->name
);
736 static bool tomoyo_merge_path_acl(struct tomoyo_acl_info
*a
,
737 struct tomoyo_acl_info
*b
,
738 const bool is_delete
)
740 u16
* const a_perm
= &container_of(a
, struct tomoyo_path_acl
, head
)
743 const u16 b_perm
= container_of(b
, struct tomoyo_path_acl
, head
)->perm
;
746 if ((perm
& TOMOYO_RW_MASK
) != TOMOYO_RW_MASK
)
747 perm
&= ~(1 << TOMOYO_TYPE_READ_WRITE
);
748 else if (!(perm
& (1 << TOMOYO_TYPE_READ_WRITE
)))
749 perm
&= ~TOMOYO_RW_MASK
;
752 if ((perm
& TOMOYO_RW_MASK
) == TOMOYO_RW_MASK
)
753 perm
|= (1 << TOMOYO_TYPE_READ_WRITE
);
754 else if (perm
& (1 << TOMOYO_TYPE_READ_WRITE
))
755 perm
|= TOMOYO_RW_MASK
;
762 * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list.
764 * @type: Type of operation.
765 * @filename: Filename.
766 * @domain: Pointer to "struct tomoyo_domain_info".
767 * @is_delete: True if it is a delete request.
769 * Returns 0 on success, negative value otherwise.
771 * Caller holds tomoyo_read_lock().
773 static int tomoyo_update_path_acl(const u8 type
, const char *filename
,
774 struct tomoyo_domain_info
* const domain
,
775 const bool is_delete
)
777 struct tomoyo_path_acl e
= {
778 .head
.type
= TOMOYO_TYPE_PATH_ACL
,
782 if (e
.perm
== (1 << TOMOYO_TYPE_READ_WRITE
))
783 e
.perm
|= TOMOYO_RW_MASK
;
784 if (!tomoyo_parse_name_union(filename
, &e
.name
))
786 error
= tomoyo_update_domain(&e
.head
, sizeof(e
), is_delete
, domain
,
787 tomoyo_same_path_acl
,
788 tomoyo_merge_path_acl
);
789 tomoyo_put_name_union(&e
.name
);
793 static bool tomoyo_same_mkdev_acl(const struct tomoyo_acl_info
*a
,
794 const struct tomoyo_acl_info
*b
)
796 const struct tomoyo_mkdev_acl
*p1
= container_of(a
, typeof(*p1
),
798 const struct tomoyo_mkdev_acl
*p2
= container_of(b
, typeof(*p2
),
800 return tomoyo_same_acl_head(&p1
->head
, &p2
->head
)
801 && tomoyo_same_name_union(&p1
->name
, &p2
->name
)
802 && tomoyo_same_number_union(&p1
->mode
, &p2
->mode
)
803 && tomoyo_same_number_union(&p1
->major
, &p2
->major
)
804 && tomoyo_same_number_union(&p1
->minor
, &p2
->minor
);
807 static bool tomoyo_merge_mkdev_acl(struct tomoyo_acl_info
*a
,
808 struct tomoyo_acl_info
*b
,
809 const bool is_delete
)
811 u8
*const a_perm
= &container_of(a
, struct tomoyo_mkdev_acl
,
814 const u8 b_perm
= container_of(b
, struct tomoyo_mkdev_acl
, head
)
825 * tomoyo_update_mkdev_acl - Update "struct tomoyo_mkdev_acl" list.
827 * @type: Type of operation.
828 * @filename: Filename.
829 * @mode: Create mode.
830 * @major: Device major number.
831 * @minor: Device minor number.
832 * @domain: Pointer to "struct tomoyo_domain_info".
833 * @is_delete: True if it is a delete request.
835 * Returns 0 on success, negative value otherwise.
837 * Caller holds tomoyo_read_lock().
839 static int tomoyo_update_mkdev_acl(const u8 type
, const char *filename
,
840 char *mode
, char *major
, char *minor
,
841 struct tomoyo_domain_info
* const
842 domain
, const bool is_delete
)
844 struct tomoyo_mkdev_acl e
= {
845 .head
.type
= TOMOYO_TYPE_MKDEV_ACL
,
848 int error
= is_delete
? -ENOENT
: -ENOMEM
;
849 if (!tomoyo_parse_name_union(filename
, &e
.name
) ||
850 !tomoyo_parse_number_union(mode
, &e
.mode
) ||
851 !tomoyo_parse_number_union(major
, &e
.major
) ||
852 !tomoyo_parse_number_union(minor
, &e
.minor
))
854 error
= tomoyo_update_domain(&e
.head
, sizeof(e
), is_delete
, domain
,
855 tomoyo_same_mkdev_acl
,
856 tomoyo_merge_mkdev_acl
);
858 tomoyo_put_name_union(&e
.name
);
859 tomoyo_put_number_union(&e
.mode
);
860 tomoyo_put_number_union(&e
.major
);
861 tomoyo_put_number_union(&e
.minor
);
865 static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info
*a
,
866 const struct tomoyo_acl_info
*b
)
868 const struct tomoyo_path2_acl
*p1
= container_of(a
, typeof(*p1
), head
);
869 const struct tomoyo_path2_acl
*p2
= container_of(b
, typeof(*p2
), head
);
870 return tomoyo_same_acl_head(&p1
->head
, &p2
->head
)
871 && tomoyo_same_name_union(&p1
->name1
, &p2
->name1
)
872 && tomoyo_same_name_union(&p1
->name2
, &p2
->name2
);
875 static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info
*a
,
876 struct tomoyo_acl_info
*b
,
877 const bool is_delete
)
879 u8
* const a_perm
= &container_of(a
, struct tomoyo_path2_acl
, head
)
882 const u8 b_perm
= container_of(b
, struct tomoyo_path2_acl
, head
)->perm
;
892 * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list.
894 * @type: Type of operation.
895 * @filename1: First filename.
896 * @filename2: Second filename.
897 * @domain: Pointer to "struct tomoyo_domain_info".
898 * @is_delete: True if it is a delete request.
900 * Returns 0 on success, negative value otherwise.
902 * Caller holds tomoyo_read_lock().
904 static int tomoyo_update_path2_acl(const u8 type
, const char *filename1
,
905 const char *filename2
,
906 struct tomoyo_domain_info
* const domain
,
907 const bool is_delete
)
909 struct tomoyo_path2_acl e
= {
910 .head
.type
= TOMOYO_TYPE_PATH2_ACL
,
913 int error
= is_delete
? -ENOENT
: -ENOMEM
;
914 if (!tomoyo_parse_name_union(filename1
, &e
.name1
) ||
915 !tomoyo_parse_name_union(filename2
, &e
.name2
))
917 error
= tomoyo_update_domain(&e
.head
, sizeof(e
), is_delete
, domain
,
918 tomoyo_same_path2_acl
,
919 tomoyo_merge_path2_acl
);
921 tomoyo_put_name_union(&e
.name1
);
922 tomoyo_put_name_union(&e
.name2
);
927 * tomoyo_path_permission - Check permission for single path operation.
929 * @r: Pointer to "struct tomoyo_request_info".
930 * @operation: Type of operation.
931 * @filename: Filename to check.
933 * Returns 0 on success, negative value otherwise.
935 * Caller holds tomoyo_read_lock().
937 int tomoyo_path_permission(struct tomoyo_request_info
*r
, u8 operation
,
938 const struct tomoyo_path_info
*filename
)
943 r
->type
= tomoyo_p2mac
[operation
];
944 r
->mode
= tomoyo_get_mode(r
->profile
, r
->type
);
945 if (r
->mode
== TOMOYO_CONFIG_DISABLED
)
947 r
->param_type
= TOMOYO_TYPE_PATH_ACL
;
948 r
->param
.path
.filename
= filename
;
949 r
->param
.path
.operation
= operation
;
951 tomoyo_check_acl(r
, tomoyo_check_path_acl
);
952 if (!r
->granted
&& operation
== TOMOYO_TYPE_READ
&&
953 !r
->domain
->ignore_global_allow_read
&&
954 tomoyo_globally_readable_file(filename
))
956 error
= tomoyo_audit_path_log(r
);
958 * Do not retry for execute request, for alias may have
961 } while (error
== TOMOYO_RETRY_REQUEST
&&
962 operation
!= TOMOYO_TYPE_EXECUTE
);
964 * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
965 * we need to check "allow_rewrite" permission if the filename is
966 * specified by "deny_rewrite" keyword.
968 if (!error
&& operation
== TOMOYO_TYPE_TRUNCATE
&&
969 tomoyo_no_rewrite_file(filename
)) {
970 operation
= TOMOYO_TYPE_REWRITE
;
976 static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info
*a
,
977 const struct tomoyo_acl_info
*b
)
979 const struct tomoyo_path_number_acl
*p1
= container_of(a
, typeof(*p1
),
981 const struct tomoyo_path_number_acl
*p2
= container_of(b
, typeof(*p2
),
983 return tomoyo_same_acl_head(&p1
->head
, &p2
->head
)
984 && tomoyo_same_name_union(&p1
->name
, &p2
->name
)
985 && tomoyo_same_number_union(&p1
->number
, &p2
->number
);
988 static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info
*a
,
989 struct tomoyo_acl_info
*b
,
990 const bool is_delete
)
992 u8
* const a_perm
= &container_of(a
, struct tomoyo_path_number_acl
,
995 const u8 b_perm
= container_of(b
, struct tomoyo_path_number_acl
, head
)
1006 * tomoyo_update_path_number_acl - Update ioctl/chmod/chown/chgrp ACL.
1008 * @type: Type of operation.
1009 * @filename: Filename.
1011 * @domain: Pointer to "struct tomoyo_domain_info".
1012 * @is_delete: True if it is a delete request.
1014 * Returns 0 on success, negative value otherwise.
1016 static int tomoyo_update_path_number_acl(const u8 type
, const char *filename
,
1018 struct tomoyo_domain_info
* const
1020 const bool is_delete
)
1022 struct tomoyo_path_number_acl e
= {
1023 .head
.type
= TOMOYO_TYPE_PATH_NUMBER_ACL
,
1026 int error
= is_delete
? -ENOENT
: -ENOMEM
;
1027 if (!tomoyo_parse_name_union(filename
, &e
.name
))
1029 if (!tomoyo_parse_number_union(number
, &e
.number
))
1031 error
= tomoyo_update_domain(&e
.head
, sizeof(e
), is_delete
, domain
,
1032 tomoyo_same_path_number_acl
,
1033 tomoyo_merge_path_number_acl
);
1035 tomoyo_put_name_union(&e
.name
);
1036 tomoyo_put_number_union(&e
.number
);
1041 * tomoyo_path_number_perm - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
1043 * @type: Type of operation.
1044 * @path: Pointer to "struct path".
1047 * Returns 0 on success, negative value otherwise.
1049 int tomoyo_path_number_perm(const u8 type
, struct path
*path
,
1050 unsigned long number
)
1052 struct tomoyo_request_info r
;
1053 int error
= -ENOMEM
;
1054 struct tomoyo_path_info buf
;
1057 if (tomoyo_init_request_info(&r
, NULL
, tomoyo_pn2mac
[type
])
1058 == TOMOYO_CONFIG_DISABLED
|| !path
->mnt
|| !path
->dentry
)
1060 idx
= tomoyo_read_lock();
1061 if (!tomoyo_get_realpath(&buf
, path
))
1063 if (type
== TOMOYO_TYPE_MKDIR
)
1064 tomoyo_add_slash(&buf
);
1065 r
.param_type
= TOMOYO_TYPE_PATH_NUMBER_ACL
;
1066 r
.param
.path_number
.operation
= type
;
1067 r
.param
.path_number
.filename
= &buf
;
1068 r
.param
.path_number
.number
= number
;
1070 tomoyo_check_acl(&r
, tomoyo_check_path_number_acl
);
1071 error
= tomoyo_audit_path_number_log(&r
);
1072 } while (error
== TOMOYO_RETRY_REQUEST
);
1075 tomoyo_read_unlock(idx
);
1076 if (r
.mode
!= TOMOYO_CONFIG_ENFORCING
)
1082 * tomoyo_check_open_permission - Check permission for "read" and "write".
1084 * @domain: Pointer to "struct tomoyo_domain_info".
1085 * @path: Pointer to "struct path".
1086 * @flag: Flags for open().
1088 * Returns 0 on success, negative value otherwise.
1090 int tomoyo_check_open_permission(struct tomoyo_domain_info
*domain
,
1091 struct path
*path
, const int flag
)
1093 const u8 acc_mode
= ACC_MODE(flag
);
1094 int error
= -ENOMEM
;
1095 struct tomoyo_path_info buf
;
1096 struct tomoyo_request_info r
;
1100 (path
->dentry
->d_inode
&& S_ISDIR(path
->dentry
->d_inode
->i_mode
)))
1103 r
.mode
= TOMOYO_CONFIG_DISABLED
;
1104 idx
= tomoyo_read_lock();
1105 if (!tomoyo_get_realpath(&buf
, path
))
1109 * If the filename is specified by "deny_rewrite" keyword,
1110 * we need to check "allow_rewrite" permission when the filename is not
1111 * opened for append mode or the filename is truncated at open time.
1113 if ((acc_mode
& MAY_WRITE
) && !(flag
& O_APPEND
)
1114 && tomoyo_init_request_info(&r
, domain
, TOMOYO_MAC_FILE_REWRITE
)
1115 != TOMOYO_CONFIG_DISABLED
) {
1116 if (!tomoyo_get_realpath(&buf
, path
)) {
1120 if (tomoyo_no_rewrite_file(&buf
))
1121 error
= tomoyo_path_permission(&r
, TOMOYO_TYPE_REWRITE
,
1124 if (!error
&& acc_mode
&&
1125 tomoyo_init_request_info(&r
, domain
, TOMOYO_MAC_FILE_OPEN
)
1126 != TOMOYO_CONFIG_DISABLED
) {
1128 if (!buf
.name
&& !tomoyo_get_realpath(&buf
, path
)) {
1132 if (acc_mode
== (MAY_READ
| MAY_WRITE
))
1133 operation
= TOMOYO_TYPE_READ_WRITE
;
1134 else if (acc_mode
== MAY_READ
)
1135 operation
= TOMOYO_TYPE_READ
;
1137 operation
= TOMOYO_TYPE_WRITE
;
1138 error
= tomoyo_path_permission(&r
, operation
, &buf
);
1142 tomoyo_read_unlock(idx
);
1143 if (r
.mode
!= TOMOYO_CONFIG_ENFORCING
)
1149 * tomoyo_path_perm - Check permission for "unlink", "rmdir", "truncate", "symlink", "rewrite", "chroot" and "unmount".
1151 * @operation: Type of operation.
1152 * @path: Pointer to "struct path".
1154 * Returns 0 on success, negative value otherwise.
1156 int tomoyo_path_perm(const u8 operation
, struct path
*path
)
1158 int error
= -ENOMEM
;
1159 struct tomoyo_path_info buf
;
1160 struct tomoyo_request_info r
;
1165 if (tomoyo_init_request_info(&r
, NULL
, tomoyo_p2mac
[operation
])
1166 == TOMOYO_CONFIG_DISABLED
)
1169 idx
= tomoyo_read_lock();
1170 if (!tomoyo_get_realpath(&buf
, path
))
1172 switch (operation
) {
1173 case TOMOYO_TYPE_REWRITE
:
1174 if (!tomoyo_no_rewrite_file(&buf
)) {
1179 case TOMOYO_TYPE_RMDIR
:
1180 case TOMOYO_TYPE_CHROOT
:
1181 case TOMOYO_TYPE_UMOUNT
:
1182 tomoyo_add_slash(&buf
);
1185 error
= tomoyo_path_permission(&r
, operation
, &buf
);
1188 tomoyo_read_unlock(idx
);
1189 if (r
.mode
!= TOMOYO_CONFIG_ENFORCING
)
1195 * tomoyo_mkdev_perm - Check permission for "mkblock" and "mkchar".
1197 * @operation: Type of operation. (TOMOYO_TYPE_MKCHAR or TOMOYO_TYPE_MKBLOCK)
1198 * @path: Pointer to "struct path".
1199 * @mode: Create mode.
1200 * @dev: Device number.
1202 * Returns 0 on success, negative value otherwise.
1204 int tomoyo_mkdev_perm(const u8 operation
, struct path
*path
,
1205 const unsigned int mode
, unsigned int dev
)
1207 struct tomoyo_request_info r
;
1208 int error
= -ENOMEM
;
1209 struct tomoyo_path_info buf
;
1213 tomoyo_init_request_info(&r
, NULL
, tomoyo_pnnn2mac
[operation
])
1214 == TOMOYO_CONFIG_DISABLED
)
1216 idx
= tomoyo_read_lock();
1218 if (tomoyo_get_realpath(&buf
, path
)) {
1219 dev
= new_decode_dev(dev
);
1220 r
.param_type
= TOMOYO_TYPE_MKDEV_ACL
;
1221 r
.param
.mkdev
.filename
= &buf
;
1222 r
.param
.mkdev
.operation
= operation
;
1223 r
.param
.mkdev
.mode
= mode
;
1224 r
.param
.mkdev
.major
= MAJOR(dev
);
1225 r
.param
.mkdev
.minor
= MINOR(dev
);
1226 tomoyo_check_acl(&r
, tomoyo_check_mkdev_acl
);
1227 error
= tomoyo_audit_mkdev_log(&r
);
1230 tomoyo_read_unlock(idx
);
1231 if (r
.mode
!= TOMOYO_CONFIG_ENFORCING
)
1237 * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root".
1239 * @operation: Type of operation.
1240 * @path1: Pointer to "struct path".
1241 * @path2: Pointer to "struct path".
1243 * Returns 0 on success, negative value otherwise.
1245 int tomoyo_path2_perm(const u8 operation
, struct path
*path1
,
1248 int error
= -ENOMEM
;
1249 struct tomoyo_path_info buf1
;
1250 struct tomoyo_path_info buf2
;
1251 struct tomoyo_request_info r
;
1254 if (!path1
->mnt
|| !path2
->mnt
||
1255 tomoyo_init_request_info(&r
, NULL
, tomoyo_pp2mac
[operation
])
1256 == TOMOYO_CONFIG_DISABLED
)
1260 idx
= tomoyo_read_lock();
1261 if (!tomoyo_get_realpath(&buf1
, path1
) ||
1262 !tomoyo_get_realpath(&buf2
, path2
))
1264 switch (operation
) {
1265 struct dentry
*dentry
;
1266 case TOMOYO_TYPE_RENAME
:
1267 case TOMOYO_TYPE_LINK
:
1268 dentry
= path1
->dentry
;
1269 if (!dentry
->d_inode
|| !S_ISDIR(dentry
->d_inode
->i_mode
))
1272 case TOMOYO_TYPE_PIVOT_ROOT
:
1273 tomoyo_add_slash(&buf1
);
1274 tomoyo_add_slash(&buf2
);
1277 r
.param_type
= TOMOYO_TYPE_PATH2_ACL
;
1278 r
.param
.path2
.operation
= operation
;
1279 r
.param
.path2
.filename1
= &buf1
;
1280 r
.param
.path2
.filename2
= &buf2
;
1282 tomoyo_check_acl(&r
, tomoyo_check_path2_acl
);
1283 error
= tomoyo_audit_path2_log(&r
);
1284 } while (error
== TOMOYO_RETRY_REQUEST
);
1288 tomoyo_read_unlock(idx
);
1289 if (r
.mode
!= TOMOYO_CONFIG_ENFORCING
)
1295 * tomoyo_write_file_policy - Update file related list.
1297 * @data: String to parse.
1298 * @domain: Pointer to "struct tomoyo_domain_info".
1299 * @is_delete: True if it is a delete request.
1301 * Returns 0 on success, negative value otherwise.
1303 * Caller holds tomoyo_read_lock().
1305 int tomoyo_write_file_policy(char *data
, struct tomoyo_domain_info
*domain
,
1306 const bool is_delete
)
1310 if (!tomoyo_tokenize(data
, w
, sizeof(w
)) || !w
[1][0])
1312 if (strncmp(w
[0], "allow_", 6))
1315 for (type
= 0; type
< TOMOYO_MAX_PATH_OPERATION
; type
++) {
1316 if (strcmp(w
[0], tomoyo_path_keyword
[type
]))
1318 return tomoyo_update_path_acl(type
, w
[1], domain
, is_delete
);
1322 for (type
= 0; type
< TOMOYO_MAX_PATH2_OPERATION
; type
++) {
1323 if (strcmp(w
[0], tomoyo_path2_keyword
[type
]))
1325 return tomoyo_update_path2_acl(type
, w
[1], w
[2], domain
,
1328 for (type
= 0; type
< TOMOYO_MAX_PATH_NUMBER_OPERATION
; type
++) {
1329 if (strcmp(w
[0], tomoyo_path_number_keyword
[type
]))
1331 return tomoyo_update_path_number_acl(type
, w
[1], w
[2], domain
,
1334 if (!w
[3][0] || !w
[4][0])
1336 for (type
= 0; type
< TOMOYO_MAX_MKDEV_OPERATION
; type
++) {
1337 if (strcmp(w
[0], tomoyo_mkdev_keyword
[type
]))
1339 return tomoyo_update_mkdev_acl(type
, w
[1], w
[2], w
[3],
1340 w
[4], domain
, is_delete
);