file.c revision 36f5e1ffbf2bb951105ae4e261bcc1de3eaf510c
1/* 2 * security/tomoyo/file.c 3 * 4 * Pathname restriction functions. 5 * 6 * Copyright (C) 2005-2010 NTT DATA CORPORATION 7 */ 8 9#include "common.h" 10#include <linux/slab.h> 11 12/* Keyword array for operations with one pathname. */ 13static const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = { 14 [TOMOYO_TYPE_READ_WRITE] = "read/write", 15 [TOMOYO_TYPE_EXECUTE] = "execute", 16 [TOMOYO_TYPE_READ] = "read", 17 [TOMOYO_TYPE_WRITE] = "write", 18 [TOMOYO_TYPE_UNLINK] = "unlink", 19 [TOMOYO_TYPE_RMDIR] = "rmdir", 20 [TOMOYO_TYPE_TRUNCATE] = "truncate", 21 [TOMOYO_TYPE_SYMLINK] = "symlink", 22 [TOMOYO_TYPE_REWRITE] = "rewrite", 23 [TOMOYO_TYPE_CHROOT] = "chroot", 24 [TOMOYO_TYPE_UMOUNT] = "unmount", 25}; 26 27/* Keyword array for operations with one pathname and three numbers. */ 28static const char *tomoyo_path_number3_keyword 29[TOMOYO_MAX_PATH_NUMBER3_OPERATION] = { 30 [TOMOYO_TYPE_MKBLOCK] = "mkblock", 31 [TOMOYO_TYPE_MKCHAR] = "mkchar", 32}; 33 34/* Keyword array for operations with two pathnames. */ 35static const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION] = { 36 [TOMOYO_TYPE_LINK] = "link", 37 [TOMOYO_TYPE_RENAME] = "rename", 38 [TOMOYO_TYPE_PIVOT_ROOT] = "pivot_root", 39}; 40 41/* Keyword array for operations with one pathname and one number. */ 42static const char *tomoyo_path_number_keyword 43[TOMOYO_MAX_PATH_NUMBER_OPERATION] = { 44 [TOMOYO_TYPE_CREATE] = "create", 45 [TOMOYO_TYPE_MKDIR] = "mkdir", 46 [TOMOYO_TYPE_MKFIFO] = "mkfifo", 47 [TOMOYO_TYPE_MKSOCK] = "mksock", 48 [TOMOYO_TYPE_IOCTL] = "ioctl", 49 [TOMOYO_TYPE_CHMOD] = "chmod", 50 [TOMOYO_TYPE_CHOWN] = "chown", 51 [TOMOYO_TYPE_CHGRP] = "chgrp", 52}; 53 54static const u8 tomoyo_p2mac[TOMOYO_MAX_PATH_OPERATION] = { 55 [TOMOYO_TYPE_READ_WRITE] = TOMOYO_MAC_FILE_OPEN, 56 [TOMOYO_TYPE_EXECUTE] = TOMOYO_MAC_FILE_EXECUTE, 57 [TOMOYO_TYPE_READ] = TOMOYO_MAC_FILE_OPEN, 58 [TOMOYO_TYPE_WRITE] = TOMOYO_MAC_FILE_OPEN, 59 [TOMOYO_TYPE_UNLINK] = TOMOYO_MAC_FILE_UNLINK, 60 [TOMOYO_TYPE_RMDIR] = TOMOYO_MAC_FILE_RMDIR, 61 [TOMOYO_TYPE_TRUNCATE] = TOMOYO_MAC_FILE_TRUNCATE, 62 [TOMOYO_TYPE_SYMLINK] = TOMOYO_MAC_FILE_SYMLINK, 63 [TOMOYO_TYPE_REWRITE] = TOMOYO_MAC_FILE_REWRITE, 64 [TOMOYO_TYPE_CHROOT] = TOMOYO_MAC_FILE_CHROOT, 65 [TOMOYO_TYPE_UMOUNT] = TOMOYO_MAC_FILE_UMOUNT, 66}; 67 68static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_PATH_NUMBER3_OPERATION] = { 69 [TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK, 70 [TOMOYO_TYPE_MKCHAR] = TOMOYO_MAC_FILE_MKCHAR, 71}; 72 73static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = { 74 [TOMOYO_TYPE_LINK] = TOMOYO_MAC_FILE_LINK, 75 [TOMOYO_TYPE_RENAME] = TOMOYO_MAC_FILE_RENAME, 76 [TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT, 77}; 78 79static const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = { 80 [TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE, 81 [TOMOYO_TYPE_MKDIR] = TOMOYO_MAC_FILE_MKDIR, 82 [TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO, 83 [TOMOYO_TYPE_MKSOCK] = TOMOYO_MAC_FILE_MKSOCK, 84 [TOMOYO_TYPE_IOCTL] = TOMOYO_MAC_FILE_IOCTL, 85 [TOMOYO_TYPE_CHMOD] = TOMOYO_MAC_FILE_CHMOD, 86 [TOMOYO_TYPE_CHOWN] = TOMOYO_MAC_FILE_CHOWN, 87 [TOMOYO_TYPE_CHGRP] = TOMOYO_MAC_FILE_CHGRP, 88}; 89 90void tomoyo_put_name_union(struct tomoyo_name_union *ptr) 91{ 92 if (!ptr) 93 return; 94 if (ptr->is_group) 95 tomoyo_put_path_group(ptr->group); 96 else 97 tomoyo_put_name(ptr->filename); 98} 99 100bool tomoyo_compare_name_union(const struct tomoyo_path_info *name, 101 const struct tomoyo_name_union *ptr) 102{ 103 if (ptr->is_group) 104 return tomoyo_path_matches_group(name, ptr->group); 105 return tomoyo_path_matches_pattern(name, ptr->filename); 106} 107 108void tomoyo_put_number_union(struct tomoyo_number_union *ptr) 109{ 110 if (ptr && ptr->is_group) 111 tomoyo_put_number_group(ptr->group); 112} 113 114bool tomoyo_compare_number_union(const unsigned long value, 115 const struct tomoyo_number_union *ptr) 116{ 117 if (ptr->is_group) 118 return tomoyo_number_matches_group(value, value, ptr->group); 119 return value >= ptr->values[0] && value <= ptr->values[1]; 120} 121 122/** 123 * tomoyo_path2keyword - Get the name of single path operation. 124 * 125 * @operation: Type of operation. 126 * 127 * Returns the name of single path operation. 128 */ 129const char *tomoyo_path2keyword(const u8 operation) 130{ 131 return (operation < TOMOYO_MAX_PATH_OPERATION) 132 ? tomoyo_path_keyword[operation] : NULL; 133} 134 135/** 136 * tomoyo_path_number32keyword - Get the name of path/number/number/number operations. 137 * 138 * @operation: Type of operation. 139 * 140 * Returns the name of path/number/number/number operation. 141 */ 142const char *tomoyo_path_number32keyword(const u8 operation) 143{ 144 return (operation < TOMOYO_MAX_PATH_NUMBER3_OPERATION) 145 ? tomoyo_path_number3_keyword[operation] : NULL; 146} 147 148/** 149 * tomoyo_path22keyword - Get the name of double path operation. 150 * 151 * @operation: Type of operation. 152 * 153 * Returns the name of double path operation. 154 */ 155const char *tomoyo_path22keyword(const u8 operation) 156{ 157 return (operation < TOMOYO_MAX_PATH2_OPERATION) 158 ? tomoyo_path2_keyword[operation] : NULL; 159} 160 161/** 162 * tomoyo_path_number2keyword - Get the name of path/number operations. 163 * 164 * @operation: Type of operation. 165 * 166 * Returns the name of path/number operation. 167 */ 168const char *tomoyo_path_number2keyword(const u8 operation) 169{ 170 return (operation < TOMOYO_MAX_PATH_NUMBER_OPERATION) 171 ? tomoyo_path_number_keyword[operation] : NULL; 172} 173 174static void tomoyo_add_slash(struct tomoyo_path_info *buf) 175{ 176 if (buf->is_dir) 177 return; 178 /* 179 * This is OK because tomoyo_encode() reserves space for appending "/". 180 */ 181 strcat((char *) buf->name, "/"); 182 tomoyo_fill_path_info(buf); 183} 184 185/** 186 * tomoyo_strendswith - Check whether the token ends with the given token. 187 * 188 * @name: The token to check. 189 * @tail: The token to find. 190 * 191 * Returns true if @name ends with @tail, false otherwise. 192 */ 193static bool tomoyo_strendswith(const char *name, const char *tail) 194{ 195 int len; 196 197 if (!name || !tail) 198 return false; 199 len = strlen(name) - strlen(tail); 200 return len >= 0 && !strcmp(name + len, tail); 201} 202 203/** 204 * tomoyo_get_realpath - Get realpath. 205 * 206 * @buf: Pointer to "struct tomoyo_path_info". 207 * @path: Pointer to "struct path". 208 * 209 * Returns true on success, false otherwise. 210 */ 211static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, struct path *path) 212{ 213 buf->name = tomoyo_realpath_from_path(path); 214 if (buf->name) { 215 tomoyo_fill_path_info(buf); 216 return true; 217 } 218 return false; 219} 220 221static int tomoyo_update_path2_acl(const u8 type, const char *filename1, 222 const char *filename2, 223 struct tomoyo_domain_info *const domain, 224 const bool is_delete); 225static int tomoyo_update_path_acl(const u8 type, const char *filename, 226 struct tomoyo_domain_info *const domain, 227 const bool is_delete); 228 229/* 230 * tomoyo_globally_readable_list is used for holding list of pathnames which 231 * are by default allowed to be open()ed for reading by any process. 232 * 233 * An entry is added by 234 * 235 * # echo 'allow_read /lib/libc-2.5.so' > \ 236 * /sys/kernel/security/tomoyo/exception_policy 237 * 238 * and is deleted by 239 * 240 * # echo 'delete allow_read /lib/libc-2.5.so' > \ 241 * /sys/kernel/security/tomoyo/exception_policy 242 * 243 * and all entries are retrieved by 244 * 245 * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy 246 * 247 * In the example above, any process is allowed to 248 * open("/lib/libc-2.5.so", O_RDONLY). 249 * One exception is, if the domain which current process belongs to is marked 250 * as "ignore_global_allow_read", current process can't do so unless explicitly 251 * given "allow_read /lib/libc-2.5.so" to the domain which current process 252 * belongs to. 253 */ 254LIST_HEAD(tomoyo_globally_readable_list); 255 256static bool tomoyo_same_globally_readable(const struct tomoyo_acl_head *a, 257 const struct tomoyo_acl_head *b) 258{ 259 return container_of(a, struct tomoyo_globally_readable_file_entry, 260 head)->filename == 261 container_of(b, struct tomoyo_globally_readable_file_entry, 262 head)->filename; 263} 264 265/** 266 * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list. 267 * 268 * @filename: Filename unconditionally permitted to open() for reading. 269 * @is_delete: True if it is a delete request. 270 * 271 * Returns 0 on success, negative value otherwise. 272 * 273 * Caller holds tomoyo_read_lock(). 274 */ 275static int tomoyo_update_globally_readable_entry(const char *filename, 276 const bool is_delete) 277{ 278 struct tomoyo_globally_readable_file_entry e = { }; 279 int error; 280 281 if (!tomoyo_is_correct_word(filename)) 282 return -EINVAL; 283 e.filename = tomoyo_get_name(filename); 284 if (!e.filename) 285 return -ENOMEM; 286 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete, 287 &tomoyo_globally_readable_list, 288 tomoyo_same_globally_readable); 289 tomoyo_put_name(e.filename); 290 return error; 291} 292 293/** 294 * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading. 295 * 296 * @filename: The filename to check. 297 * 298 * Returns true if any domain can open @filename for reading, false otherwise. 299 * 300 * Caller holds tomoyo_read_lock(). 301 */ 302static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info * 303 filename) 304{ 305 struct tomoyo_globally_readable_file_entry *ptr; 306 bool found = false; 307 308 list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, 309 head.list) { 310 if (!ptr->head.is_deleted && 311 tomoyo_path_matches_pattern(filename, ptr->filename)) { 312 found = true; 313 break; 314 } 315 } 316 return found; 317} 318 319/** 320 * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list. 321 * 322 * @data: String to parse. 323 * @is_delete: True if it is a delete request. 324 * 325 * Returns 0 on success, negative value otherwise. 326 * 327 * Caller holds tomoyo_read_lock(). 328 */ 329int tomoyo_write_globally_readable_policy(char *data, const bool is_delete) 330{ 331 return tomoyo_update_globally_readable_entry(data, is_delete); 332} 333 334/** 335 * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list. 336 * 337 * @head: Pointer to "struct tomoyo_io_buffer". 338 * 339 * Returns true on success, false otherwise. 340 * 341 * Caller holds tomoyo_read_lock(). 342 */ 343bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head) 344{ 345 struct list_head *pos; 346 bool done = true; 347 348 list_for_each_cookie(pos, head->read_var2, 349 &tomoyo_globally_readable_list) { 350 struct tomoyo_globally_readable_file_entry *ptr; 351 ptr = list_entry(pos, 352 struct tomoyo_globally_readable_file_entry, 353 head.list); 354 if (ptr->head.is_deleted) 355 continue; 356 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n", 357 ptr->filename->name); 358 if (!done) 359 break; 360 } 361 return done; 362} 363 364/* tomoyo_pattern_list is used for holding list of pathnames which are used for 365 * converting pathnames to pathname patterns during learning mode. 366 * 367 * An entry is added by 368 * 369 * # echo 'file_pattern /proc/\$/mounts' > \ 370 * /sys/kernel/security/tomoyo/exception_policy 371 * 372 * and is deleted by 373 * 374 * # echo 'delete file_pattern /proc/\$/mounts' > \ 375 * /sys/kernel/security/tomoyo/exception_policy 376 * 377 * and all entries are retrieved by 378 * 379 * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy 380 * 381 * In the example above, if a process which belongs to a domain which is in 382 * learning mode requested open("/proc/1/mounts", O_RDONLY), 383 * "allow_read /proc/\$/mounts" is automatically added to the domain which that 384 * process belongs to. 385 * 386 * It is not a desirable behavior that we have to use /proc/\$/ instead of 387 * /proc/self/ when current process needs to access only current process's 388 * information. As of now, LSM version of TOMOYO is using __d_path() for 389 * calculating pathname. Non LSM version of TOMOYO is using its own function 390 * which pretends as if /proc/self/ is not a symlink; so that we can forbid 391 * current process from accessing other process's information. 392 */ 393LIST_HEAD(tomoyo_pattern_list); 394 395static bool tomoyo_same_pattern(const struct tomoyo_acl_head *a, 396 const struct tomoyo_acl_head *b) 397{ 398 return container_of(a, struct tomoyo_pattern_entry, head)->pattern == 399 container_of(b, struct tomoyo_pattern_entry, head)->pattern; 400} 401 402/** 403 * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list. 404 * 405 * @pattern: Pathname pattern. 406 * @is_delete: True if it is a delete request. 407 * 408 * Returns 0 on success, negative value otherwise. 409 * 410 * Caller holds tomoyo_read_lock(). 411 */ 412static int tomoyo_update_file_pattern_entry(const char *pattern, 413 const bool is_delete) 414{ 415 struct tomoyo_pattern_entry e = { }; 416 int error; 417 418 if (!tomoyo_is_correct_word(pattern)) 419 return -EINVAL; 420 e.pattern = tomoyo_get_name(pattern); 421 if (!e.pattern) 422 return -ENOMEM; 423 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete, 424 &tomoyo_pattern_list, 425 tomoyo_same_pattern); 426 tomoyo_put_name(e.pattern); 427 return error; 428} 429 430/** 431 * tomoyo_file_pattern - Get patterned pathname. 432 * 433 * @filename: The filename to find patterned pathname. 434 * 435 * Returns pointer to pathname pattern if matched, @filename otherwise. 436 * 437 * Caller holds tomoyo_read_lock(). 438 */ 439const char *tomoyo_file_pattern(const struct tomoyo_path_info *filename) 440{ 441 struct tomoyo_pattern_entry *ptr; 442 const struct tomoyo_path_info *pattern = NULL; 443 444 list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, head.list) { 445 if (ptr->head.is_deleted) 446 continue; 447 if (!tomoyo_path_matches_pattern(filename, ptr->pattern)) 448 continue; 449 pattern = ptr->pattern; 450 if (tomoyo_strendswith(pattern->name, "/\\*")) { 451 /* Do nothing. Try to find the better match. */ 452 } else { 453 /* This would be the better match. Use this. */ 454 break; 455 } 456 } 457 if (pattern) 458 filename = pattern; 459 return filename->name; 460} 461 462/** 463 * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list. 464 * 465 * @data: String to parse. 466 * @is_delete: True if it is a delete request. 467 * 468 * Returns 0 on success, negative value otherwise. 469 * 470 * Caller holds tomoyo_read_lock(). 471 */ 472int tomoyo_write_pattern_policy(char *data, const bool is_delete) 473{ 474 return tomoyo_update_file_pattern_entry(data, is_delete); 475} 476 477/** 478 * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list. 479 * 480 * @head: Pointer to "struct tomoyo_io_buffer". 481 * 482 * Returns true on success, false otherwise. 483 * 484 * Caller holds tomoyo_read_lock(). 485 */ 486bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head) 487{ 488 struct list_head *pos; 489 bool done = true; 490 491 list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) { 492 struct tomoyo_pattern_entry *ptr; 493 ptr = list_entry(pos, struct tomoyo_pattern_entry, head.list); 494 if (ptr->head.is_deleted) 495 continue; 496 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN 497 "%s\n", ptr->pattern->name); 498 if (!done) 499 break; 500 } 501 return done; 502} 503 504/* 505 * tomoyo_no_rewrite_list is used for holding list of pathnames which are by 506 * default forbidden to modify already written content of a file. 507 * 508 * An entry is added by 509 * 510 * # echo 'deny_rewrite /var/log/messages' > \ 511 * /sys/kernel/security/tomoyo/exception_policy 512 * 513 * and is deleted by 514 * 515 * # echo 'delete deny_rewrite /var/log/messages' > \ 516 * /sys/kernel/security/tomoyo/exception_policy 517 * 518 * and all entries are retrieved by 519 * 520 * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy 521 * 522 * In the example above, if a process requested to rewrite /var/log/messages , 523 * the process can't rewrite unless the domain which that process belongs to 524 * has "allow_rewrite /var/log/messages" entry. 525 * 526 * It is not a desirable behavior that we have to add "\040(deleted)" suffix 527 * when we want to allow rewriting already unlink()ed file. As of now, 528 * LSM version of TOMOYO is using __d_path() for calculating pathname. 529 * Non LSM version of TOMOYO is using its own function which doesn't append 530 * " (deleted)" suffix if the file is already unlink()ed; so that we don't 531 * need to worry whether the file is already unlink()ed or not. 532 */ 533LIST_HEAD(tomoyo_no_rewrite_list); 534 535static bool tomoyo_same_no_rewrite(const struct tomoyo_acl_head *a, 536 const struct tomoyo_acl_head *b) 537{ 538 return container_of(a, struct tomoyo_no_rewrite_entry, head)->pattern 539 == container_of(b, struct tomoyo_no_rewrite_entry, head) 540 ->pattern; 541} 542 543/** 544 * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list. 545 * 546 * @pattern: Pathname pattern that are not rewritable by default. 547 * @is_delete: True if it is a delete request. 548 * 549 * Returns 0 on success, negative value otherwise. 550 * 551 * Caller holds tomoyo_read_lock(). 552 */ 553static int tomoyo_update_no_rewrite_entry(const char *pattern, 554 const bool is_delete) 555{ 556 struct tomoyo_no_rewrite_entry e = { }; 557 int error; 558 559 if (!tomoyo_is_correct_word(pattern)) 560 return -EINVAL; 561 e.pattern = tomoyo_get_name(pattern); 562 if (!e.pattern) 563 return -ENOMEM; 564 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete, 565 &tomoyo_no_rewrite_list, 566 tomoyo_same_no_rewrite); 567 tomoyo_put_name(e.pattern); 568 return error; 569} 570 571/** 572 * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited. 573 * 574 * @filename: Filename to check. 575 * 576 * Returns true if @filename is specified by "deny_rewrite" directive, 577 * false otherwise. 578 * 579 * Caller holds tomoyo_read_lock(). 580 */ 581static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename) 582{ 583 struct tomoyo_no_rewrite_entry *ptr; 584 bool found = false; 585 586 list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, head.list) { 587 if (ptr->head.is_deleted) 588 continue; 589 if (!tomoyo_path_matches_pattern(filename, ptr->pattern)) 590 continue; 591 found = true; 592 break; 593 } 594 return found; 595} 596 597/** 598 * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list. 599 * 600 * @data: String to parse. 601 * @is_delete: True if it is a delete request. 602 * 603 * Returns 0 on success, negative value otherwise. 604 * 605 * Caller holds tomoyo_read_lock(). 606 */ 607int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete) 608{ 609 return tomoyo_update_no_rewrite_entry(data, is_delete); 610} 611 612/** 613 * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list. 614 * 615 * @head: Pointer to "struct tomoyo_io_buffer". 616 * 617 * Returns true on success, false otherwise. 618 * 619 * Caller holds tomoyo_read_lock(). 620 */ 621bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head) 622{ 623 struct list_head *pos; 624 bool done = true; 625 626 list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) { 627 struct tomoyo_no_rewrite_entry *ptr; 628 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry, 629 head.list); 630 if (ptr->head.is_deleted) 631 continue; 632 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE 633 "%s\n", ptr->pattern->name); 634 if (!done) 635 break; 636 } 637 return done; 638} 639 640/** 641 * tomoyo_path_acl - Check permission for single path operation. 642 * 643 * @r: Pointer to "struct tomoyo_request_info". 644 * @filename: Filename to check. 645 * @perm: Permission. 646 * 647 * Returns 0 on success, -EPERM otherwise. 648 * 649 * Caller holds tomoyo_read_lock(). 650 */ 651static int tomoyo_path_acl(const struct tomoyo_request_info *r, 652 const struct tomoyo_path_info *filename, 653 const u32 perm) 654{ 655 struct tomoyo_domain_info *domain = r->domain; 656 struct tomoyo_acl_info *ptr; 657 int error = -EPERM; 658 659 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) { 660 struct tomoyo_path_acl *acl; 661 if (ptr->type != TOMOYO_TYPE_PATH_ACL) 662 continue; 663 acl = container_of(ptr, struct tomoyo_path_acl, head); 664 if (!(acl->perm & perm) || 665 !tomoyo_compare_name_union(filename, &acl->name)) 666 continue; 667 error = 0; 668 break; 669 } 670 return error; 671} 672 673/** 674 * tomoyo_file_perm - Check permission for opening files. 675 * 676 * @r: Pointer to "struct tomoyo_request_info". 677 * @filename: Filename to check. 678 * @mode: Mode ("read" or "write" or "read/write" or "execute"). 679 * 680 * Returns 0 on success, negative value otherwise. 681 * 682 * Caller holds tomoyo_read_lock(). 683 */ 684static int tomoyo_file_perm(struct tomoyo_request_info *r, 685 const struct tomoyo_path_info *filename, 686 const u8 mode) 687{ 688 const char *msg = "<unknown>"; 689 int error = 0; 690 u32 perm = 0; 691 692 if (!filename) 693 return 0; 694 695 if (mode == 6) { 696 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ_WRITE); 697 perm = 1 << TOMOYO_TYPE_READ_WRITE; 698 } else if (mode == 4) { 699 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ); 700 perm = 1 << TOMOYO_TYPE_READ; 701 } else if (mode == 2) { 702 msg = tomoyo_path2keyword(TOMOYO_TYPE_WRITE); 703 perm = 1 << TOMOYO_TYPE_WRITE; 704 } else if (mode == 1) { 705 msg = tomoyo_path2keyword(TOMOYO_TYPE_EXECUTE); 706 perm = 1 << TOMOYO_TYPE_EXECUTE; 707 } else 708 BUG(); 709 do { 710 error = tomoyo_path_acl(r, filename, perm); 711 if (error && mode == 4 && !r->domain->ignore_global_allow_read 712 && tomoyo_is_globally_readable_file(filename)) 713 error = 0; 714 if (!error) 715 break; 716 tomoyo_warn_log(r, "%s %s", msg, filename->name); 717 error = tomoyo_supervisor(r, "allow_%s %s\n", msg, 718 tomoyo_file_pattern(filename)); 719 /* 720 * Do not retry for execute request, for alias may have 721 * changed. 722 */ 723 } while (error == TOMOYO_RETRY_REQUEST && mode != 1); 724 if (r->mode != TOMOYO_CONFIG_ENFORCING) 725 error = 0; 726 return error; 727} 728 729static bool tomoyo_same_path_acl(const struct tomoyo_acl_info *a, 730 const struct tomoyo_acl_info *b) 731{ 732 const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head); 733 const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head); 734 return tomoyo_is_same_acl_head(&p1->head, &p2->head) && 735 tomoyo_is_same_name_union(&p1->name, &p2->name); 736} 737 738static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a, 739 struct tomoyo_acl_info *b, 740 const bool is_delete) 741{ 742 u16 * const a_perm = &container_of(a, struct tomoyo_path_acl, head) 743 ->perm; 744 u16 perm = *a_perm; 745 const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm; 746 if (is_delete) { 747 perm &= ~b_perm; 748 if ((perm & TOMOYO_RW_MASK) != TOMOYO_RW_MASK) 749 perm &= ~(1 << TOMOYO_TYPE_READ_WRITE); 750 else if (!(perm & (1 << TOMOYO_TYPE_READ_WRITE))) 751 perm &= ~TOMOYO_RW_MASK; 752 } else { 753 perm |= b_perm; 754 if ((perm & TOMOYO_RW_MASK) == TOMOYO_RW_MASK) 755 perm |= (1 << TOMOYO_TYPE_READ_WRITE); 756 else if (perm & (1 << TOMOYO_TYPE_READ_WRITE)) 757 perm |= TOMOYO_RW_MASK; 758 } 759 *a_perm = perm; 760 return !perm; 761} 762 763/** 764 * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list. 765 * 766 * @type: Type of operation. 767 * @filename: Filename. 768 * @domain: Pointer to "struct tomoyo_domain_info". 769 * @is_delete: True if it is a delete request. 770 * 771 * Returns 0 on success, negative value otherwise. 772 * 773 * Caller holds tomoyo_read_lock(). 774 */ 775static int tomoyo_update_path_acl(const u8 type, const char *filename, 776 struct tomoyo_domain_info * const domain, 777 const bool is_delete) 778{ 779 struct tomoyo_path_acl e = { 780 .head.type = TOMOYO_TYPE_PATH_ACL, 781 .perm = 1 << type 782 }; 783 int error; 784 if (e.perm == (1 << TOMOYO_TYPE_READ_WRITE)) 785 e.perm |= TOMOYO_RW_MASK; 786 if (!tomoyo_parse_name_union(filename, &e.name)) 787 return -EINVAL; 788 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain, 789 tomoyo_same_path_acl, 790 tomoyo_merge_path_acl); 791 tomoyo_put_name_union(&e.name); 792 return error; 793} 794 795static bool tomoyo_same_path_number3_acl(const struct tomoyo_acl_info *a, 796 const struct tomoyo_acl_info *b) 797{ 798 const struct tomoyo_path_number3_acl *p1 = container_of(a, typeof(*p1), 799 head); 800 const struct tomoyo_path_number3_acl *p2 = container_of(b, typeof(*p2), 801 head); 802 return tomoyo_is_same_acl_head(&p1->head, &p2->head) 803 && tomoyo_is_same_name_union(&p1->name, &p2->name) 804 && tomoyo_is_same_number_union(&p1->mode, &p2->mode) 805 && tomoyo_is_same_number_union(&p1->major, &p2->major) 806 && tomoyo_is_same_number_union(&p1->minor, &p2->minor); 807} 808 809static bool tomoyo_merge_path_number3_acl(struct tomoyo_acl_info *a, 810 struct tomoyo_acl_info *b, 811 const bool is_delete) 812{ 813 u8 *const a_perm = &container_of(a, struct tomoyo_path_number3_acl, 814 head)->perm; 815 u8 perm = *a_perm; 816 const u8 b_perm = container_of(b, struct tomoyo_path_number3_acl, head) 817 ->perm; 818 if (is_delete) 819 perm &= ~b_perm; 820 else 821 perm |= b_perm; 822 *a_perm = perm; 823 return !perm; 824} 825 826/** 827 * tomoyo_update_path_number3_acl - Update "struct tomoyo_path_number3_acl" list. 828 * 829 * @type: Type of operation. 830 * @filename: Filename. 831 * @mode: Create mode. 832 * @major: Device major number. 833 * @minor: Device minor number. 834 * @domain: Pointer to "struct tomoyo_domain_info". 835 * @is_delete: True if it is a delete request. 836 * 837 * Returns 0 on success, negative value otherwise. 838 * 839 * Caller holds tomoyo_read_lock(). 840 */ 841static int tomoyo_update_path_number3_acl(const u8 type, const char *filename, 842 char *mode, char *major, char *minor, 843 struct tomoyo_domain_info * const 844 domain, const bool is_delete) 845{ 846 struct tomoyo_path_number3_acl e = { 847 .head.type = TOMOYO_TYPE_PATH_NUMBER3_ACL, 848 .perm = 1 << type 849 }; 850 int error = is_delete ? -ENOENT : -ENOMEM; 851 if (!tomoyo_parse_name_union(filename, &e.name) || 852 !tomoyo_parse_number_union(mode, &e.mode) || 853 !tomoyo_parse_number_union(major, &e.major) || 854 !tomoyo_parse_number_union(minor, &e.minor)) 855 goto out; 856 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain, 857 tomoyo_same_path_number3_acl, 858 tomoyo_merge_path_number3_acl); 859 out: 860 tomoyo_put_name_union(&e.name); 861 tomoyo_put_number_union(&e.mode); 862 tomoyo_put_number_union(&e.major); 863 tomoyo_put_number_union(&e.minor); 864 return error; 865} 866 867static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info *a, 868 const struct tomoyo_acl_info *b) 869{ 870 const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head); 871 const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head); 872 return tomoyo_is_same_acl_head(&p1->head, &p2->head) 873 && tomoyo_is_same_name_union(&p1->name1, &p2->name1) 874 && tomoyo_is_same_name_union(&p1->name2, &p2->name2); 875} 876 877static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a, 878 struct tomoyo_acl_info *b, 879 const bool is_delete) 880{ 881 u8 * const a_perm = &container_of(a, struct tomoyo_path2_acl, head) 882 ->perm; 883 u8 perm = *a_perm; 884 const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm; 885 if (is_delete) 886 perm &= ~b_perm; 887 else 888 perm |= b_perm; 889 *a_perm = perm; 890 return !perm; 891} 892 893/** 894 * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list. 895 * 896 * @type: Type of operation. 897 * @filename1: First filename. 898 * @filename2: Second filename. 899 * @domain: Pointer to "struct tomoyo_domain_info". 900 * @is_delete: True if it is a delete request. 901 * 902 * Returns 0 on success, negative value otherwise. 903 * 904 * Caller holds tomoyo_read_lock(). 905 */ 906static int tomoyo_update_path2_acl(const u8 type, const char *filename1, 907 const char *filename2, 908 struct tomoyo_domain_info * const domain, 909 const bool is_delete) 910{ 911 struct tomoyo_path2_acl e = { 912 .head.type = TOMOYO_TYPE_PATH2_ACL, 913 .perm = 1 << type 914 }; 915 int error = is_delete ? -ENOENT : -ENOMEM; 916 if (!tomoyo_parse_name_union(filename1, &e.name1) || 917 !tomoyo_parse_name_union(filename2, &e.name2)) 918 goto out; 919 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain, 920 tomoyo_same_path2_acl, 921 tomoyo_merge_path2_acl); 922 out: 923 tomoyo_put_name_union(&e.name1); 924 tomoyo_put_name_union(&e.name2); 925 return error; 926} 927 928/** 929 * tomoyo_path_number3_acl - Check permission for path/number/number/number operation. 930 * 931 * @r: Pointer to "struct tomoyo_request_info". 932 * @filename: Filename to check. 933 * @perm: Permission. 934 * @mode: Create mode. 935 * @major: Device major number. 936 * @minor: Device minor number. 937 * 938 * Returns 0 on success, -EPERM otherwise. 939 * 940 * Caller holds tomoyo_read_lock(). 941 */ 942static int tomoyo_path_number3_acl(struct tomoyo_request_info *r, 943 const struct tomoyo_path_info *filename, 944 const u16 perm, const unsigned int mode, 945 const unsigned int major, 946 const unsigned int minor) 947{ 948 struct tomoyo_domain_info *domain = r->domain; 949 struct tomoyo_acl_info *ptr; 950 int error = -EPERM; 951 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) { 952 struct tomoyo_path_number3_acl *acl; 953 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER3_ACL) 954 continue; 955 acl = container_of(ptr, struct tomoyo_path_number3_acl, head); 956 if (!tomoyo_compare_number_union(mode, &acl->mode)) 957 continue; 958 if (!tomoyo_compare_number_union(major, &acl->major)) 959 continue; 960 if (!tomoyo_compare_number_union(minor, &acl->minor)) 961 continue; 962 if (!(acl->perm & perm)) 963 continue; 964 if (!tomoyo_compare_name_union(filename, &acl->name)) 965 continue; 966 error = 0; 967 break; 968 } 969 return error; 970} 971 972/** 973 * tomoyo_path2_acl - Check permission for double path operation. 974 * 975 * @r: Pointer to "struct tomoyo_request_info". 976 * @type: Type of operation. 977 * @filename1: First filename to check. 978 * @filename2: Second filename to check. 979 * 980 * Returns 0 on success, -EPERM otherwise. 981 * 982 * Caller holds tomoyo_read_lock(). 983 */ 984static int tomoyo_path2_acl(const struct tomoyo_request_info *r, const u8 type, 985 const struct tomoyo_path_info *filename1, 986 const struct tomoyo_path_info *filename2) 987{ 988 const struct tomoyo_domain_info *domain = r->domain; 989 struct tomoyo_acl_info *ptr; 990 const u8 perm = 1 << type; 991 int error = -EPERM; 992 993 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) { 994 struct tomoyo_path2_acl *acl; 995 if (ptr->type != TOMOYO_TYPE_PATH2_ACL) 996 continue; 997 acl = container_of(ptr, struct tomoyo_path2_acl, head); 998 if (!(acl->perm & perm)) 999 continue; 1000 if (!tomoyo_compare_name_union(filename1, &acl->name1)) 1001 continue; 1002 if (!tomoyo_compare_name_union(filename2, &acl->name2)) 1003 continue; 1004 error = 0; 1005 break; 1006 } 1007 return error; 1008} 1009 1010/** 1011 * tomoyo_path_permission - Check permission for single path operation. 1012 * 1013 * @r: Pointer to "struct tomoyo_request_info". 1014 * @operation: Type of operation. 1015 * @filename: Filename to check. 1016 * 1017 * Returns 0 on success, negative value otherwise. 1018 * 1019 * Caller holds tomoyo_read_lock(). 1020 */ 1021static int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 1022 const struct tomoyo_path_info *filename) 1023{ 1024 const char *msg; 1025 int error; 1026 1027 next: 1028 r->type = tomoyo_p2mac[operation]; 1029 r->mode = tomoyo_get_mode(r->profile, r->type); 1030 if (r->mode == TOMOYO_CONFIG_DISABLED) 1031 return 0; 1032 do { 1033 error = tomoyo_path_acl(r, filename, 1 << operation); 1034 if (!error) 1035 break; 1036 msg = tomoyo_path2keyword(operation); 1037 tomoyo_warn_log(r, "%s %s", msg, filename->name); 1038 error = tomoyo_supervisor(r, "allow_%s %s\n", msg, 1039 tomoyo_file_pattern(filename)); 1040 } while (error == TOMOYO_RETRY_REQUEST); 1041 if (r->mode != TOMOYO_CONFIG_ENFORCING) 1042 error = 0; 1043 /* 1044 * Since "allow_truncate" doesn't imply "allow_rewrite" permission, 1045 * we need to check "allow_rewrite" permission if the filename is 1046 * specified by "deny_rewrite" keyword. 1047 */ 1048 if (!error && operation == TOMOYO_TYPE_TRUNCATE && 1049 tomoyo_is_no_rewrite_file(filename)) { 1050 operation = TOMOYO_TYPE_REWRITE; 1051 goto next; 1052 } 1053 return error; 1054} 1055 1056/** 1057 * tomoyo_path_number_acl - Check permission for ioctl/chmod/chown/chgrp operation. 1058 * 1059 * @r: Pointer to "struct tomoyo_request_info". 1060 * @type: Operation. 1061 * @filename: Filename to check. 1062 * @number: Number. 1063 * 1064 * Returns 0 on success, -EPERM otherwise. 1065 * 1066 * Caller holds tomoyo_read_lock(). 1067 */ 1068static int tomoyo_path_number_acl(struct tomoyo_request_info *r, const u8 type, 1069 const struct tomoyo_path_info *filename, 1070 const unsigned long number) 1071{ 1072 struct tomoyo_domain_info *domain = r->domain; 1073 struct tomoyo_acl_info *ptr; 1074 const u8 perm = 1 << type; 1075 int error = -EPERM; 1076 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) { 1077 struct tomoyo_path_number_acl *acl; 1078 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER_ACL) 1079 continue; 1080 acl = container_of(ptr, struct tomoyo_path_number_acl, 1081 head); 1082 if (!(acl->perm & perm) || 1083 !tomoyo_compare_number_union(number, &acl->number) || 1084 !tomoyo_compare_name_union(filename, &acl->name)) 1085 continue; 1086 error = 0; 1087 break; 1088 } 1089 return error; 1090} 1091 1092static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info *a, 1093 const struct tomoyo_acl_info *b) 1094{ 1095 const struct tomoyo_path_number_acl *p1 = container_of(a, typeof(*p1), 1096 head); 1097 const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2), 1098 head); 1099 return tomoyo_is_same_acl_head(&p1->head, &p2->head) 1100 && tomoyo_is_same_name_union(&p1->name, &p2->name) 1101 && tomoyo_is_same_number_union(&p1->number, &p2->number); 1102} 1103 1104static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a, 1105 struct tomoyo_acl_info *b, 1106 const bool is_delete) 1107{ 1108 u8 * const a_perm = &container_of(a, struct tomoyo_path_number_acl, 1109 head)->perm; 1110 u8 perm = *a_perm; 1111 const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head) 1112 ->perm; 1113 if (is_delete) 1114 perm &= ~b_perm; 1115 else 1116 perm |= b_perm; 1117 *a_perm = perm; 1118 return !perm; 1119} 1120 1121/** 1122 * tomoyo_update_path_number_acl - Update ioctl/chmod/chown/chgrp ACL. 1123 * 1124 * @type: Type of operation. 1125 * @filename: Filename. 1126 * @number: Number. 1127 * @domain: Pointer to "struct tomoyo_domain_info". 1128 * @is_delete: True if it is a delete request. 1129 * 1130 * Returns 0 on success, negative value otherwise. 1131 */ 1132static int tomoyo_update_path_number_acl(const u8 type, const char *filename, 1133 char *number, 1134 struct tomoyo_domain_info * const 1135 domain, 1136 const bool is_delete) 1137{ 1138 struct tomoyo_path_number_acl e = { 1139 .head.type = TOMOYO_TYPE_PATH_NUMBER_ACL, 1140 .perm = 1 << type 1141 }; 1142 int error = is_delete ? -ENOENT : -ENOMEM; 1143 if (!tomoyo_parse_name_union(filename, &e.name)) 1144 return -EINVAL; 1145 if (!tomoyo_parse_number_union(number, &e.number)) 1146 goto out; 1147 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain, 1148 tomoyo_same_path_number_acl, 1149 tomoyo_merge_path_number_acl); 1150 out: 1151 tomoyo_put_name_union(&e.name); 1152 tomoyo_put_number_union(&e.number); 1153 return error; 1154} 1155 1156/** 1157 * tomoyo_path_number_perm2 - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp". 1158 * 1159 * @r: Pointer to "strct tomoyo_request_info". 1160 * @filename: Filename to check. 1161 * @number: Number. 1162 * 1163 * Returns 0 on success, negative value otherwise. 1164 * 1165 * Caller holds tomoyo_read_lock(). 1166 */ 1167static int tomoyo_path_number_perm2(struct tomoyo_request_info *r, 1168 const u8 type, 1169 const struct tomoyo_path_info *filename, 1170 const unsigned long number) 1171{ 1172 char buffer[64]; 1173 int error; 1174 u8 radix; 1175 const char *msg; 1176 1177 if (!filename) 1178 return 0; 1179 switch (type) { 1180 case TOMOYO_TYPE_CREATE: 1181 case TOMOYO_TYPE_MKDIR: 1182 case TOMOYO_TYPE_MKFIFO: 1183 case TOMOYO_TYPE_MKSOCK: 1184 case TOMOYO_TYPE_CHMOD: 1185 radix = TOMOYO_VALUE_TYPE_OCTAL; 1186 break; 1187 case TOMOYO_TYPE_IOCTL: 1188 radix = TOMOYO_VALUE_TYPE_HEXADECIMAL; 1189 break; 1190 default: 1191 radix = TOMOYO_VALUE_TYPE_DECIMAL; 1192 break; 1193 } 1194 tomoyo_print_ulong(buffer, sizeof(buffer), number, radix); 1195 do { 1196 error = tomoyo_path_number_acl(r, type, filename, number); 1197 if (!error) 1198 break; 1199 msg = tomoyo_path_number2keyword(type); 1200 tomoyo_warn_log(r, "%s %s %s", msg, filename->name, buffer); 1201 error = tomoyo_supervisor(r, "allow_%s %s %s\n", msg, 1202 tomoyo_file_pattern(filename), 1203 buffer); 1204 } while (error == TOMOYO_RETRY_REQUEST); 1205 if (r->mode != TOMOYO_CONFIG_ENFORCING) 1206 error = 0; 1207 return error; 1208} 1209 1210/** 1211 * tomoyo_path_number_perm - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp". 1212 * 1213 * @type: Type of operation. 1214 * @path: Pointer to "struct path". 1215 * @number: Number. 1216 * 1217 * Returns 0 on success, negative value otherwise. 1218 */ 1219int tomoyo_path_number_perm(const u8 type, struct path *path, 1220 unsigned long number) 1221{ 1222 struct tomoyo_request_info r; 1223 int error = -ENOMEM; 1224 struct tomoyo_path_info buf; 1225 int idx; 1226 1227 if (tomoyo_init_request_info(&r, NULL, tomoyo_pn2mac[type]) 1228 == TOMOYO_CONFIG_DISABLED || !path->mnt || !path->dentry) 1229 return 0; 1230 idx = tomoyo_read_lock(); 1231 if (!tomoyo_get_realpath(&buf, path)) 1232 goto out; 1233 if (type == TOMOYO_TYPE_MKDIR) 1234 tomoyo_add_slash(&buf); 1235 error = tomoyo_path_number_perm2(&r, type, &buf, number); 1236 out: 1237 kfree(buf.name); 1238 tomoyo_read_unlock(idx); 1239 if (r.mode != TOMOYO_CONFIG_ENFORCING) 1240 error = 0; 1241 return error; 1242} 1243 1244/** 1245 * tomoyo_check_exec_perm - Check permission for "execute". 1246 * 1247 * @r: Pointer to "struct tomoyo_request_info". 1248 * @filename: Check permission for "execute". 1249 * 1250 * Returns 0 on success, negativevalue otherwise. 1251 * 1252 * Caller holds tomoyo_read_lock(). 1253 */ 1254int tomoyo_check_exec_perm(struct tomoyo_request_info *r, 1255 const struct tomoyo_path_info *filename) 1256{ 1257 if (r->mode == TOMOYO_CONFIG_DISABLED) 1258 return 0; 1259 return tomoyo_file_perm(r, filename, 1); 1260} 1261 1262/** 1263 * tomoyo_check_open_permission - Check permission for "read" and "write". 1264 * 1265 * @domain: Pointer to "struct tomoyo_domain_info". 1266 * @path: Pointer to "struct path". 1267 * @flag: Flags for open(). 1268 * 1269 * Returns 0 on success, negative value otherwise. 1270 */ 1271int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 1272 struct path *path, const int flag) 1273{ 1274 const u8 acc_mode = ACC_MODE(flag); 1275 int error = -ENOMEM; 1276 struct tomoyo_path_info buf; 1277 struct tomoyo_request_info r; 1278 int idx; 1279 1280 if (!path->mnt || 1281 (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode))) 1282 return 0; 1283 buf.name = NULL; 1284 r.mode = TOMOYO_CONFIG_DISABLED; 1285 idx = tomoyo_read_lock(); 1286 if (!tomoyo_get_realpath(&buf, path)) 1287 goto out; 1288 error = 0; 1289 /* 1290 * If the filename is specified by "deny_rewrite" keyword, 1291 * we need to check "allow_rewrite" permission when the filename is not 1292 * opened for append mode or the filename is truncated at open time. 1293 */ 1294 if ((acc_mode & MAY_WRITE) && !(flag & O_APPEND) 1295 && tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_REWRITE) 1296 != TOMOYO_CONFIG_DISABLED) { 1297 if (!tomoyo_get_realpath(&buf, path)) { 1298 error = -ENOMEM; 1299 goto out; 1300 } 1301 if (tomoyo_is_no_rewrite_file(&buf)) 1302 error = tomoyo_path_permission(&r, TOMOYO_TYPE_REWRITE, 1303 &buf); 1304 } 1305 if (!error && acc_mode && 1306 tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_OPEN) 1307 != TOMOYO_CONFIG_DISABLED) { 1308 if (!buf.name && !tomoyo_get_realpath(&buf, path)) { 1309 error = -ENOMEM; 1310 goto out; 1311 } 1312 error = tomoyo_file_perm(&r, &buf, acc_mode); 1313 } 1314 out: 1315 kfree(buf.name); 1316 tomoyo_read_unlock(idx); 1317 if (r.mode != TOMOYO_CONFIG_ENFORCING) 1318 error = 0; 1319 return error; 1320} 1321 1322/** 1323 * tomoyo_path_perm - Check permission for "unlink", "rmdir", "truncate", "symlink", "rewrite", "chroot" and "unmount". 1324 * 1325 * @operation: Type of operation. 1326 * @path: Pointer to "struct path". 1327 * 1328 * Returns 0 on success, negative value otherwise. 1329 */ 1330int tomoyo_path_perm(const u8 operation, struct path *path) 1331{ 1332 int error = -ENOMEM; 1333 struct tomoyo_path_info buf; 1334 struct tomoyo_request_info r; 1335 int idx; 1336 1337 if (!path->mnt) 1338 return 0; 1339 if (tomoyo_init_request_info(&r, NULL, tomoyo_p2mac[operation]) 1340 == TOMOYO_CONFIG_DISABLED) 1341 return 0; 1342 buf.name = NULL; 1343 idx = tomoyo_read_lock(); 1344 if (!tomoyo_get_realpath(&buf, path)) 1345 goto out; 1346 switch (operation) { 1347 case TOMOYO_TYPE_REWRITE: 1348 if (!tomoyo_is_no_rewrite_file(&buf)) { 1349 error = 0; 1350 goto out; 1351 } 1352 break; 1353 case TOMOYO_TYPE_RMDIR: 1354 case TOMOYO_TYPE_CHROOT: 1355 case TOMOYO_TYPE_UMOUNT: 1356 tomoyo_add_slash(&buf); 1357 break; 1358 } 1359 error = tomoyo_path_permission(&r, operation, &buf); 1360 out: 1361 kfree(buf.name); 1362 tomoyo_read_unlock(idx); 1363 if (r.mode != TOMOYO_CONFIG_ENFORCING) 1364 error = 0; 1365 return error; 1366} 1367 1368/** 1369 * tomoyo_path_number3_perm2 - Check permission for path/number/number/number operation. 1370 * 1371 * @r: Pointer to "struct tomoyo_request_info". 1372 * @operation: Type of operation. 1373 * @filename: Filename to check. 1374 * @mode: Create mode. 1375 * @dev: Device number. 1376 * 1377 * Returns 0 on success, negative value otherwise. 1378 * 1379 * Caller holds tomoyo_read_lock(). 1380 */ 1381static int tomoyo_path_number3_perm2(struct tomoyo_request_info *r, 1382 const u8 operation, 1383 const struct tomoyo_path_info *filename, 1384 const unsigned int mode, 1385 const unsigned int dev) 1386{ 1387 int error; 1388 const char *msg; 1389 const unsigned int major = MAJOR(dev); 1390 const unsigned int minor = MINOR(dev); 1391 1392 do { 1393 error = tomoyo_path_number3_acl(r, filename, 1 << operation, 1394 mode, major, minor); 1395 if (!error) 1396 break; 1397 msg = tomoyo_path_number32keyword(operation); 1398 tomoyo_warn_log(r, "%s %s 0%o %u %u", msg, filename->name, 1399 mode, major, minor); 1400 error = tomoyo_supervisor(r, "allow_%s %s 0%o %u %u\n", msg, 1401 tomoyo_file_pattern(filename), mode, 1402 major, minor); 1403 } while (error == TOMOYO_RETRY_REQUEST); 1404 if (r->mode != TOMOYO_CONFIG_ENFORCING) 1405 error = 0; 1406 return error; 1407} 1408 1409/** 1410 * tomoyo_path_number3_perm - Check permission for "mkblock" and "mkchar". 1411 * 1412 * @operation: Type of operation. (TOMOYO_TYPE_MKCHAR or TOMOYO_TYPE_MKBLOCK) 1413 * @path: Pointer to "struct path". 1414 * @mode: Create mode. 1415 * @dev: Device number. 1416 * 1417 * Returns 0 on success, negative value otherwise. 1418 */ 1419int tomoyo_path_number3_perm(const u8 operation, struct path *path, 1420 const unsigned int mode, unsigned int dev) 1421{ 1422 struct tomoyo_request_info r; 1423 int error = -ENOMEM; 1424 struct tomoyo_path_info buf; 1425 int idx; 1426 1427 if (!path->mnt || 1428 tomoyo_init_request_info(&r, NULL, tomoyo_pnnn2mac[operation]) 1429 == TOMOYO_CONFIG_DISABLED) 1430 return 0; 1431 idx = tomoyo_read_lock(); 1432 error = -ENOMEM; 1433 if (tomoyo_get_realpath(&buf, path)) { 1434 error = tomoyo_path_number3_perm2(&r, operation, &buf, mode, 1435 new_decode_dev(dev)); 1436 kfree(buf.name); 1437 } 1438 tomoyo_read_unlock(idx); 1439 if (r.mode != TOMOYO_CONFIG_ENFORCING) 1440 error = 0; 1441 return error; 1442} 1443 1444/** 1445 * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root". 1446 * 1447 * @operation: Type of operation. 1448 * @path1: Pointer to "struct path". 1449 * @path2: Pointer to "struct path". 1450 * 1451 * Returns 0 on success, negative value otherwise. 1452 */ 1453int tomoyo_path2_perm(const u8 operation, struct path *path1, 1454 struct path *path2) 1455{ 1456 int error = -ENOMEM; 1457 const char *msg; 1458 struct tomoyo_path_info buf1; 1459 struct tomoyo_path_info buf2; 1460 struct tomoyo_request_info r; 1461 int idx; 1462 1463 if (!path1->mnt || !path2->mnt || 1464 tomoyo_init_request_info(&r, NULL, tomoyo_pp2mac[operation]) 1465 == TOMOYO_CONFIG_DISABLED) 1466 return 0; 1467 buf1.name = NULL; 1468 buf2.name = NULL; 1469 idx = tomoyo_read_lock(); 1470 if (!tomoyo_get_realpath(&buf1, path1) || 1471 !tomoyo_get_realpath(&buf2, path2)) 1472 goto out; 1473 switch (operation) { 1474 struct dentry *dentry; 1475 case TOMOYO_TYPE_RENAME: 1476 case TOMOYO_TYPE_LINK: 1477 dentry = path1->dentry; 1478 if (!dentry->d_inode || !S_ISDIR(dentry->d_inode->i_mode)) 1479 break; 1480 /* fall through */ 1481 case TOMOYO_TYPE_PIVOT_ROOT: 1482 tomoyo_add_slash(&buf1); 1483 tomoyo_add_slash(&buf2); 1484 break; 1485 } 1486 do { 1487 error = tomoyo_path2_acl(&r, operation, &buf1, &buf2); 1488 if (!error) 1489 break; 1490 msg = tomoyo_path22keyword(operation); 1491 tomoyo_warn_log(&r, "%s %s %s", msg, buf1.name, buf2.name); 1492 error = tomoyo_supervisor(&r, "allow_%s %s %s\n", msg, 1493 tomoyo_file_pattern(&buf1), 1494 tomoyo_file_pattern(&buf2)); 1495 } while (error == TOMOYO_RETRY_REQUEST); 1496 out: 1497 kfree(buf1.name); 1498 kfree(buf2.name); 1499 tomoyo_read_unlock(idx); 1500 if (r.mode != TOMOYO_CONFIG_ENFORCING) 1501 error = 0; 1502 return error; 1503} 1504 1505/** 1506 * tomoyo_write_file_policy - Update file related list. 1507 * 1508 * @data: String to parse. 1509 * @domain: Pointer to "struct tomoyo_domain_info". 1510 * @is_delete: True if it is a delete request. 1511 * 1512 * Returns 0 on success, negative value otherwise. 1513 * 1514 * Caller holds tomoyo_read_lock(). 1515 */ 1516int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain, 1517 const bool is_delete) 1518{ 1519 char *w[5]; 1520 u8 type; 1521 if (!tomoyo_tokenize(data, w, sizeof(w)) || !w[1][0]) 1522 return -EINVAL; 1523 if (strncmp(w[0], "allow_", 6)) 1524 goto out; 1525 w[0] += 6; 1526 for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) { 1527 if (strcmp(w[0], tomoyo_path_keyword[type])) 1528 continue; 1529 return tomoyo_update_path_acl(type, w[1], domain, is_delete); 1530 } 1531 if (!w[2][0]) 1532 goto out; 1533 for (type = 0; type < TOMOYO_MAX_PATH2_OPERATION; type++) { 1534 if (strcmp(w[0], tomoyo_path2_keyword[type])) 1535 continue; 1536 return tomoyo_update_path2_acl(type, w[1], w[2], domain, 1537 is_delete); 1538 } 1539 for (type = 0; type < TOMOYO_MAX_PATH_NUMBER_OPERATION; type++) { 1540 if (strcmp(w[0], tomoyo_path_number_keyword[type])) 1541 continue; 1542 return tomoyo_update_path_number_acl(type, w[1], w[2], domain, 1543 is_delete); 1544 } 1545 if (!w[3][0] || !w[4][0]) 1546 goto out; 1547 for (type = 0; type < TOMOYO_MAX_PATH_NUMBER3_OPERATION; type++) { 1548 if (strcmp(w[0], tomoyo_path_number3_keyword[type])) 1549 continue; 1550 return tomoyo_update_path_number3_acl(type, w[1], w[2], w[3], 1551 w[4], domain, is_delete); 1552 } 1553 out: 1554 return -EINVAL; 1555} 1556