realpath.c revision 67fa4880c5e059428392ca6f7c2f9c38e8546fea
1/* 2 * security/tomoyo/realpath.c 3 * 4 * Get the canonicalized absolute pathnames. The basis for TOMOYO. 5 * 6 * Copyright (C) 2005-2009 NTT DATA CORPORATION 7 * 8 * Version: 2.2.0 2009/04/01 9 * 10 */ 11 12#include <linux/types.h> 13#include <linux/mount.h> 14#include <linux/mnt_namespace.h> 15#include <linux/fs_struct.h> 16#include <linux/hash.h> 17#include <linux/magic.h> 18 19#include "common.h" 20#include "realpath.h" 21 22/** 23 * tomoyo_encode: Convert binary string to ascii string. 24 * 25 * @buffer: Buffer for ASCII string. 26 * @buflen: Size of @buffer. 27 * @str: Binary string. 28 * 29 * Returns 0 on success, -ENOMEM otherwise. 30 */ 31int tomoyo_encode(char *buffer, int buflen, const char *str) 32{ 33 while (1) { 34 const unsigned char c = *(unsigned char *) str++; 35 36 if (tomoyo_is_valid(c)) { 37 if (--buflen <= 0) 38 break; 39 *buffer++ = (char) c; 40 if (c != '\\') 41 continue; 42 if (--buflen <= 0) 43 break; 44 *buffer++ = (char) c; 45 continue; 46 } 47 if (!c) { 48 if (--buflen <= 0) 49 break; 50 *buffer = '\0'; 51 return 0; 52 } 53 buflen -= 4; 54 if (buflen <= 0) 55 break; 56 *buffer++ = '\\'; 57 *buffer++ = (c >> 6) + '0'; 58 *buffer++ = ((c >> 3) & 7) + '0'; 59 *buffer++ = (c & 7) + '0'; 60 } 61 return -ENOMEM; 62} 63 64/** 65 * tomoyo_realpath_from_path2 - Returns realpath(3) of the given dentry but ignores chroot'ed root. 66 * 67 * @path: Pointer to "struct path". 68 * @newname: Pointer to buffer to return value in. 69 * @newname_len: Size of @newname. 70 * 71 * Returns 0 on success, negative value otherwise. 72 * 73 * If dentry is a directory, trailing '/' is appended. 74 * Characters out of 0x20 < c < 0x7F range are converted to 75 * \ooo style octal string. 76 * Character \ is converted to \\ string. 77 */ 78int tomoyo_realpath_from_path2(struct path *path, char *newname, 79 int newname_len) 80{ 81 int error = -ENOMEM; 82 struct dentry *dentry = path->dentry; 83 char *sp; 84 85 if (!dentry || !path->mnt || !newname || newname_len <= 2048) 86 return -EINVAL; 87 if (dentry->d_op && dentry->d_op->d_dname) { 88 /* For "socket:[\$]" and "pipe:[\$]". */ 89 static const int offset = 1536; 90 sp = dentry->d_op->d_dname(dentry, newname + offset, 91 newname_len - offset); 92 } else { 93 /* Taken from d_namespace_path(). */ 94 struct path root; 95 struct path ns_root = { }; 96 struct path tmp; 97 98 read_lock(¤t->fs->lock); 99 root = current->fs->root; 100 path_get(&root); 101 read_unlock(¤t->fs->lock); 102 spin_lock(&vfsmount_lock); 103 if (root.mnt && root.mnt->mnt_ns) 104 ns_root.mnt = mntget(root.mnt->mnt_ns->root); 105 if (ns_root.mnt) 106 ns_root.dentry = dget(ns_root.mnt->mnt_root); 107 spin_unlock(&vfsmount_lock); 108 spin_lock(&dcache_lock); 109 tmp = ns_root; 110 sp = __d_path(path, &tmp, newname, newname_len); 111 spin_unlock(&dcache_lock); 112 path_put(&root); 113 path_put(&ns_root); 114 /* Prepend "/proc" prefix if using internal proc vfs mount. */ 115 if (!IS_ERR(sp) && (path->mnt->mnt_parent == path->mnt) && 116 (path->mnt->mnt_sb->s_magic == PROC_SUPER_MAGIC)) { 117 sp -= 5; 118 if (sp >= newname) 119 memcpy(sp, "/proc", 5); 120 else 121 sp = ERR_PTR(-ENOMEM); 122 } 123 } 124 if (IS_ERR(sp)) 125 error = PTR_ERR(sp); 126 else 127 error = tomoyo_encode(newname, sp - newname, sp); 128 /* Append trailing '/' if dentry is a directory. */ 129 if (!error && dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode) 130 && *newname) { 131 sp = newname + strlen(newname); 132 if (*(sp - 1) != '/') { 133 if (sp < newname + newname_len - 4) { 134 *sp++ = '/'; 135 *sp = '\0'; 136 } else { 137 error = -ENOMEM; 138 } 139 } 140 } 141 if (error) 142 printk(KERN_WARNING "tomoyo_realpath: Pathname too long.\n"); 143 return error; 144} 145 146/** 147 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root. 148 * 149 * @path: Pointer to "struct path". 150 * 151 * Returns the realpath of the given @path on success, NULL otherwise. 152 * 153 * These functions use tomoyo_alloc(), so the caller must call tomoyo_free() 154 * if these functions didn't return NULL. 155 */ 156char *tomoyo_realpath_from_path(struct path *path) 157{ 158 char *buf = tomoyo_alloc(sizeof(struct tomoyo_page_buffer)); 159 160 BUILD_BUG_ON(sizeof(struct tomoyo_page_buffer) 161 <= TOMOYO_MAX_PATHNAME_LEN - 1); 162 if (!buf) 163 return NULL; 164 if (tomoyo_realpath_from_path2(path, buf, 165 TOMOYO_MAX_PATHNAME_LEN - 1) == 0) 166 return buf; 167 tomoyo_free(buf); 168 return NULL; 169} 170 171/** 172 * tomoyo_realpath - Get realpath of a pathname. 173 * 174 * @pathname: The pathname to solve. 175 * 176 * Returns the realpath of @pathname on success, NULL otherwise. 177 */ 178char *tomoyo_realpath(const char *pathname) 179{ 180 struct path path; 181 182 if (pathname && kern_path(pathname, LOOKUP_FOLLOW, &path) == 0) { 183 char *buf = tomoyo_realpath_from_path(&path); 184 path_put(&path); 185 return buf; 186 } 187 return NULL; 188} 189 190/** 191 * tomoyo_realpath_nofollow - Get realpath of a pathname. 192 * 193 * @pathname: The pathname to solve. 194 * 195 * Returns the realpath of @pathname on success, NULL otherwise. 196 */ 197char *tomoyo_realpath_nofollow(const char *pathname) 198{ 199 struct path path; 200 201 if (pathname && kern_path(pathname, 0, &path) == 0) { 202 char *buf = tomoyo_realpath_from_path(&path); 203 path_put(&path); 204 return buf; 205 } 206 return NULL; 207} 208 209/* Memory allocated for non-string data. */ 210static unsigned int tomoyo_allocated_memory_for_elements; 211/* Quota for holding non-string data. */ 212static unsigned int tomoyo_quota_for_elements; 213 214/** 215 * tomoyo_alloc_element - Allocate permanent memory for structures. 216 * 217 * @size: Size in bytes. 218 * 219 * Returns pointer to allocated memory on success, NULL otherwise. 220 * 221 * Memory has to be zeroed. 222 * The RAM is chunked, so NEVER try to kfree() the returned pointer. 223 */ 224void *tomoyo_alloc_element(const unsigned int size) 225{ 226 static char *buf; 227 static DEFINE_MUTEX(lock); 228 static unsigned int buf_used_len = PATH_MAX; 229 char *ptr = NULL; 230 /*Assumes sizeof(void *) >= sizeof(long) is true. */ 231 const unsigned int word_aligned_size 232 = roundup(size, max(sizeof(void *), sizeof(long))); 233 if (word_aligned_size > PATH_MAX) 234 return NULL; 235 mutex_lock(&lock); 236 if (buf_used_len + word_aligned_size > PATH_MAX) { 237 if (!tomoyo_quota_for_elements || 238 tomoyo_allocated_memory_for_elements 239 + PATH_MAX <= tomoyo_quota_for_elements) 240 ptr = kzalloc(PATH_MAX, GFP_KERNEL); 241 if (!ptr) { 242 printk(KERN_WARNING "ERROR: Out of memory " 243 "for tomoyo_alloc_element().\n"); 244 if (!tomoyo_policy_loaded) 245 panic("MAC Initialization failed.\n"); 246 } else { 247 buf = ptr; 248 tomoyo_allocated_memory_for_elements += PATH_MAX; 249 buf_used_len = word_aligned_size; 250 ptr = buf; 251 } 252 } else if (word_aligned_size) { 253 int i; 254 ptr = buf + buf_used_len; 255 buf_used_len += word_aligned_size; 256 for (i = 0; i < word_aligned_size; i++) { 257 if (!ptr[i]) 258 continue; 259 printk(KERN_ERR "WARNING: Reserved memory was tainted! " 260 "The system might go wrong.\n"); 261 ptr[i] = '\0'; 262 } 263 } 264 mutex_unlock(&lock); 265 return ptr; 266} 267 268/* Memory allocated for string data in bytes. */ 269static unsigned int tomoyo_allocated_memory_for_savename; 270/* Quota for holding string data in bytes. */ 271static unsigned int tomoyo_quota_for_savename; 272 273/* 274 * TOMOYO uses this hash only when appending a string into the string 275 * table. Frequency of appending strings is very low. So we don't need 276 * large (e.g. 64k) hash size. 256 will be sufficient. 277 */ 278#define TOMOYO_HASH_BITS 8 279#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 280 281/* 282 * tomoyo_name_entry is a structure which is used for linking 283 * "struct tomoyo_path_info" into tomoyo_name_list . 284 * 285 * Since tomoyo_name_list manages a list of strings which are shared by 286 * multiple processes (whereas "struct tomoyo_path_info" inside 287 * "struct tomoyo_path_info_with_data" is not shared), a reference counter will 288 * be added to "struct tomoyo_name_entry" rather than "struct tomoyo_path_info" 289 * when TOMOYO starts supporting garbage collector. 290 */ 291struct tomoyo_name_entry { 292 struct list_head list; 293 struct tomoyo_path_info entry; 294}; 295 296/* Structure for available memory region. */ 297struct tomoyo_free_memory_block_list { 298 struct list_head list; 299 char *ptr; /* Pointer to a free area. */ 300 int len; /* Length of the area. */ 301}; 302 303/* 304 * tomoyo_name_list is used for holding string data used by TOMOYO. 305 * Since same string data is likely used for multiple times (e.g. 306 * "/lib/libc-2.5.so"), TOMOYO shares string data in the form of 307 * "const struct tomoyo_path_info *". 308 */ 309static struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 310 311/** 312 * tomoyo_save_name - Allocate permanent memory for string data. 313 * 314 * @name: The string to store into the permernent memory. 315 * 316 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise. 317 * 318 * The RAM is shared, so NEVER try to modify or kfree() the returned name. 319 */ 320const struct tomoyo_path_info *tomoyo_save_name(const char *name) 321{ 322 static LIST_HEAD(fmb_list); 323 static DEFINE_MUTEX(lock); 324 struct tomoyo_name_entry *ptr; 325 unsigned int hash; 326 /* fmb contains available size in bytes. 327 fmb is removed from the fmb_list when fmb->len becomes 0. */ 328 struct tomoyo_free_memory_block_list *fmb; 329 int len; 330 char *cp; 331 struct list_head *head; 332 333 if (!name) 334 return NULL; 335 len = strlen(name) + 1; 336 if (len > TOMOYO_MAX_PATHNAME_LEN) { 337 printk(KERN_WARNING "ERROR: Name too long " 338 "for tomoyo_save_name().\n"); 339 return NULL; 340 } 341 hash = full_name_hash((const unsigned char *) name, len - 1); 342 head = &tomoyo_name_list[hash_long(hash, TOMOYO_HASH_BITS)]; 343 344 mutex_lock(&lock); 345 list_for_each_entry(ptr, head, list) { 346 if (hash == ptr->entry.hash && !strcmp(name, ptr->entry.name)) 347 goto out; 348 } 349 list_for_each_entry(fmb, &fmb_list, list) { 350 if (len <= fmb->len) 351 goto ready; 352 } 353 if (!tomoyo_quota_for_savename || 354 tomoyo_allocated_memory_for_savename + PATH_MAX 355 <= tomoyo_quota_for_savename) 356 cp = kzalloc(PATH_MAX, GFP_KERNEL); 357 else 358 cp = NULL; 359 fmb = kzalloc(sizeof(*fmb), GFP_KERNEL); 360 if (!cp || !fmb) { 361 kfree(cp); 362 kfree(fmb); 363 printk(KERN_WARNING "ERROR: Out of memory " 364 "for tomoyo_save_name().\n"); 365 if (!tomoyo_policy_loaded) 366 panic("MAC Initialization failed.\n"); 367 ptr = NULL; 368 goto out; 369 } 370 tomoyo_allocated_memory_for_savename += PATH_MAX; 371 list_add(&fmb->list, &fmb_list); 372 fmb->ptr = cp; 373 fmb->len = PATH_MAX; 374 ready: 375 ptr = tomoyo_alloc_element(sizeof(*ptr)); 376 if (!ptr) 377 goto out; 378 ptr->entry.name = fmb->ptr; 379 memmove(fmb->ptr, name, len); 380 tomoyo_fill_path_info(&ptr->entry); 381 fmb->ptr += len; 382 fmb->len -= len; 383 list_add_tail(&ptr->list, head); 384 if (fmb->len == 0) { 385 list_del(&fmb->list); 386 kfree(fmb); 387 } 388 out: 389 mutex_unlock(&lock); 390 return ptr ? &ptr->entry : NULL; 391} 392 393/** 394 * tomoyo_realpath_init - Initialize realpath related code. 395 */ 396void __init tomoyo_realpath_init(void) 397{ 398 int i; 399 400 BUILD_BUG_ON(TOMOYO_MAX_PATHNAME_LEN > PATH_MAX); 401 for (i = 0; i < TOMOYO_MAX_HASH; i++) 402 INIT_LIST_HEAD(&tomoyo_name_list[i]); 403 INIT_LIST_HEAD(&tomoyo_kernel_domain.acl_info_list); 404 tomoyo_kernel_domain.domainname = tomoyo_save_name(TOMOYO_ROOT_NAME); 405 list_add_tail(&tomoyo_kernel_domain.list, &tomoyo_domain_list); 406 down_read(&tomoyo_domain_list_lock); 407 if (tomoyo_find_domain(TOMOYO_ROOT_NAME) != &tomoyo_kernel_domain) 408 panic("Can't register tomoyo_kernel_domain"); 409 up_read(&tomoyo_domain_list_lock); 410} 411 412/* Memory allocated for temporary purpose. */ 413static atomic_t tomoyo_dynamic_memory_size; 414 415/** 416 * tomoyo_alloc - Allocate memory for temporary purpose. 417 * 418 * @size: Size in bytes. 419 * 420 * Returns pointer to allocated memory on success, NULL otherwise. 421 */ 422void *tomoyo_alloc(const size_t size) 423{ 424 void *p = kzalloc(size, GFP_KERNEL); 425 if (p) 426 atomic_add(ksize(p), &tomoyo_dynamic_memory_size); 427 return p; 428} 429 430/** 431 * tomoyo_free - Release memory allocated by tomoyo_alloc(). 432 * 433 * @p: Pointer returned by tomoyo_alloc(). May be NULL. 434 * 435 * Returns nothing. 436 */ 437void tomoyo_free(const void *p) 438{ 439 if (p) { 440 atomic_sub(ksize(p), &tomoyo_dynamic_memory_size); 441 kfree(p); 442 } 443} 444 445/** 446 * tomoyo_read_memory_counter - Check for memory usage in bytes. 447 * 448 * @head: Pointer to "struct tomoyo_io_buffer". 449 * 450 * Returns memory usage. 451 */ 452int tomoyo_read_memory_counter(struct tomoyo_io_buffer *head) 453{ 454 if (!head->read_eof) { 455 const unsigned int shared 456 = tomoyo_allocated_memory_for_savename; 457 const unsigned int private 458 = tomoyo_allocated_memory_for_elements; 459 const unsigned int dynamic 460 = atomic_read(&tomoyo_dynamic_memory_size); 461 char buffer[64]; 462 463 memset(buffer, 0, sizeof(buffer)); 464 if (tomoyo_quota_for_savename) 465 snprintf(buffer, sizeof(buffer) - 1, 466 " (Quota: %10u)", 467 tomoyo_quota_for_savename); 468 else 469 buffer[0] = '\0'; 470 tomoyo_io_printf(head, "Shared: %10u%s\n", shared, buffer); 471 if (tomoyo_quota_for_elements) 472 snprintf(buffer, sizeof(buffer) - 1, 473 " (Quota: %10u)", 474 tomoyo_quota_for_elements); 475 else 476 buffer[0] = '\0'; 477 tomoyo_io_printf(head, "Private: %10u%s\n", private, buffer); 478 tomoyo_io_printf(head, "Dynamic: %10u\n", dynamic); 479 tomoyo_io_printf(head, "Total: %10u\n", 480 shared + private + dynamic); 481 head->read_eof = true; 482 } 483 return 0; 484} 485 486/** 487 * tomoyo_write_memory_quota - Set memory quota. 488 * 489 * @head: Pointer to "struct tomoyo_io_buffer". 490 * 491 * Returns 0. 492 */ 493int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head) 494{ 495 char *data = head->write_buf; 496 unsigned int size; 497 498 if (sscanf(data, "Shared: %u", &size) == 1) 499 tomoyo_quota_for_savename = size; 500 else if (sscanf(data, "Private: %u", &size) == 1) 501 tomoyo_quota_for_elements = size; 502 return 0; 503} 504