realpath.c revision bf24fb016c861b7f52be0c36c4cedd3e89afa2e2 
1/*
2 * security/tomoyo/realpath.c
3 *
4 * Get the canonicalized absolute pathnames. The basis for TOMOYO.
5 *
6 * Copyright (C) 2005-2009  NTT DATA CORPORATION
7 *
8 * Version: 2.2.0   2009/04/01
9 *
10 */
11
12#include <linux/types.h>
13#include <linux/mount.h>
14#include <linux/mnt_namespace.h>
15#include <linux/fs_struct.h>
16#include <linux/hash.h>
17#include <linux/magic.h>
18
19#include "common.h"
20#include "realpath.h"
21
22/**
23 * tomoyo_encode: Convert binary string to ascii string.
24 *
25 * @buffer:  Buffer for ASCII string.
26 * @buflen:  Size of @buffer.
27 * @str:     Binary string.
28 *
29 * Returns 0 on success, -ENOMEM otherwise.
30 */
31int tomoyo_encode(char *buffer, int buflen, const char *str)
32{
33	while (1) {
34		const unsigned char c = *(unsigned char *) str++;
35
36		if (tomoyo_is_valid(c)) {
37			if (--buflen <= 0)
38				break;
39			*buffer++ = (char) c;
40			if (c != '\\')
41				continue;
42			if (--buflen <= 0)
43				break;
44			*buffer++ = (char) c;
45			continue;
46		}
47		if (!c) {
48			if (--buflen <= 0)
49				break;
50			*buffer = '\0';
51			return 0;
52		}
53		buflen -= 4;
54		if (buflen <= 0)
55			break;
56		*buffer++ = '\\';
57		*buffer++ = (c >> 6) + '0';
58		*buffer++ = ((c >> 3) & 7) + '0';
59		*buffer++ = (c & 7) + '0';
60	}
61	return -ENOMEM;
62}
63
64/**
65 * tomoyo_realpath_from_path2 - Returns realpath(3) of the given dentry but ignores chroot'ed root.
66 *
67 * @path:        Pointer to "struct path".
68 * @newname:     Pointer to buffer to return value in.
69 * @newname_len: Size of @newname.
70 *
71 * Returns 0 on success, negative value otherwise.
72 *
73 * If dentry is a directory, trailing '/' is appended.
74 * Characters out of 0x20 < c < 0x7F range are converted to
75 * \ooo style octal string.
76 * Character \ is converted to \\ string.
77 */
78int tomoyo_realpath_from_path2(struct path *path, char *newname,
79			       int newname_len)
80{
81	int error = -ENOMEM;
82	struct dentry *dentry = path->dentry;
83	char *sp;
84
85	if (!dentry || !path->mnt || !newname || newname_len <= 2048)
86		return -EINVAL;
87	if (dentry->d_op && dentry->d_op->d_dname) {
88		/* For "socket:[\$]" and "pipe:[\$]". */
89		static const int offset = 1536;
90		sp = dentry->d_op->d_dname(dentry, newname + offset,
91					   newname_len - offset);
92	} else {
93		/* Taken from d_namespace_path(). */
94		struct path root;
95		struct path ns_root = { };
96		struct path tmp;
97
98		read_lock(&current->fs->lock);
99		root = current->fs->root;
100		path_get(&root);
101		read_unlock(&current->fs->lock);
102		spin_lock(&vfsmount_lock);
103		if (root.mnt && root.mnt->mnt_ns)
104			ns_root.mnt = mntget(root.mnt->mnt_ns->root);
105		if (ns_root.mnt)
106			ns_root.dentry = dget(ns_root.mnt->mnt_root);
107		spin_unlock(&vfsmount_lock);
108		spin_lock(&dcache_lock);
109		tmp = ns_root;
110		sp = __d_path(path, &tmp, newname, newname_len);
111		spin_unlock(&dcache_lock);
112		path_put(&root);
113		path_put(&ns_root);
114		/* Prepend "/proc" prefix if using internal proc vfs mount. */
115		if (!IS_ERR(sp) && (path->mnt->mnt_parent == path->mnt) &&
116		    (path->mnt->mnt_sb->s_magic == PROC_SUPER_MAGIC)) {
117			sp -= 5;
118			if (sp >= newname)
119				memcpy(sp, "/proc", 5);
120			else
121				sp = ERR_PTR(-ENOMEM);
122		}
123	}
124	if (IS_ERR(sp))
125		error = PTR_ERR(sp);
126	else
127		error = tomoyo_encode(newname, sp - newname, sp);
128	/* Append trailing '/' if dentry is a directory. */
129	if (!error && dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)
130	    && *newname) {
131		sp = newname + strlen(newname);
132		if (*(sp - 1) != '/') {
133			if (sp < newname + newname_len - 4) {
134				*sp++ = '/';
135				*sp = '\0';
136			} else {
137				error = -ENOMEM;
138			}
139		}
140	}
141	if (error)
142		printk(KERN_WARNING "tomoyo_realpath: Pathname too long.\n");
143	return error;
144}
145
146/**
147 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
148 *
149 * @path: Pointer to "struct path".
150 *
151 * Returns the realpath of the given @path on success, NULL otherwise.
152 *
153 * These functions use kzalloc(), so the caller must call kfree()
154 * if these functions didn't return NULL.
155 */
156char *tomoyo_realpath_from_path(struct path *path)
157{
158	char *buf = kzalloc(sizeof(struct tomoyo_page_buffer), GFP_KERNEL);
159
160	BUILD_BUG_ON(sizeof(struct tomoyo_page_buffer)
161		     <= TOMOYO_MAX_PATHNAME_LEN - 1);
162	if (!buf)
163		return NULL;
164	if (tomoyo_realpath_from_path2(path, buf,
165				       TOMOYO_MAX_PATHNAME_LEN - 1) == 0)
166		return buf;
167	kfree(buf);
168	return NULL;
169}
170
171/**
172 * tomoyo_realpath - Get realpath of a pathname.
173 *
174 * @pathname: The pathname to solve.
175 *
176 * Returns the realpath of @pathname on success, NULL otherwise.
177 */
178char *tomoyo_realpath(const char *pathname)
179{
180	struct path path;
181
182	if (pathname && kern_path(pathname, LOOKUP_FOLLOW, &path) == 0) {
183		char *buf = tomoyo_realpath_from_path(&path);
184		path_put(&path);
185		return buf;
186	}
187	return NULL;
188}
189
190/**
191 * tomoyo_realpath_nofollow - Get realpath of a pathname.
192 *
193 * @pathname: The pathname to solve.
194 *
195 * Returns the realpath of @pathname on success, NULL otherwise.
196 */
197char *tomoyo_realpath_nofollow(const char *pathname)
198{
199	struct path path;
200
201	if (pathname && kern_path(pathname, 0, &path) == 0) {
202		char *buf = tomoyo_realpath_from_path(&path);
203		path_put(&path);
204		return buf;
205	}
206	return NULL;
207}
208
209/* Memory allocated for non-string data. */
210static unsigned int tomoyo_allocated_memory_for_elements;
211/* Quota for holding non-string data. */
212static unsigned int tomoyo_quota_for_elements;
213
214/**
215 * tomoyo_memory_ok - Check memory quota.
216 *
217 * @ptr: Pointer to allocated memory.
218 *
219 * Returns true on success, false otherwise.
220 *
221 * Caller holds tomoyo_policy_lock.
222 * Memory pointed by @ptr will be zeroed on success.
223 */
224bool tomoyo_memory_ok(void *ptr)
225{
226	int allocated_len = ptr ? ksize(ptr) : 0;
227	bool result = false;
228	if (!ptr || (tomoyo_quota_for_elements &&
229		     tomoyo_allocated_memory_for_elements
230		     + allocated_len > tomoyo_quota_for_elements)) {
231		printk(KERN_WARNING "ERROR: Out of memory "
232		       "for tomoyo_alloc_element().\n");
233		if (!tomoyo_policy_loaded)
234			panic("MAC Initialization failed.\n");
235	} else {
236		result = true;
237		tomoyo_allocated_memory_for_elements += allocated_len;
238		memset(ptr, 0, allocated_len);
239	}
240	return result;
241}
242
243/* Memory allocated for string data in bytes. */
244static unsigned int tomoyo_allocated_memory_for_savename;
245/* Quota for holding string data in bytes. */
246static unsigned int tomoyo_quota_for_savename;
247
248/*
249 * TOMOYO uses this hash only when appending a string into the string
250 * table. Frequency of appending strings is very low. So we don't need
251 * large (e.g. 64k) hash size. 256 will be sufficient.
252 */
253#define TOMOYO_HASH_BITS  8
254#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
255
256/*
257 * tomoyo_name_list is used for holding string data used by TOMOYO.
258 * Since same string data is likely used for multiple times (e.g.
259 * "/lib/libc-2.5.so"), TOMOYO shares string data in the form of
260 * "const struct tomoyo_path_info *".
261 */
262static struct list_head tomoyo_name_list[TOMOYO_MAX_HASH];
263
264/**
265 * tomoyo_get_name - Allocate permanent memory for string data.
266 *
267 * @name: The string to store into the permernent memory.
268 *
269 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
270 */
271const struct tomoyo_path_info *tomoyo_get_name(const char *name)
272{
273	static DEFINE_MUTEX(lock);
274	struct tomoyo_name_entry *ptr;
275	unsigned int hash;
276	int len;
277	int allocated_len;
278	struct list_head *head;
279
280	if (!name)
281		return NULL;
282	len = strlen(name) + 1;
283	hash = full_name_hash((const unsigned char *) name, len - 1);
284	head = &tomoyo_name_list[hash_long(hash, TOMOYO_HASH_BITS)];
285	mutex_lock(&lock);
286	list_for_each_entry(ptr, head, list) {
287		if (hash != ptr->entry.hash || strcmp(name, ptr->entry.name))
288			continue;
289		atomic_inc(&ptr->users);
290		goto out;
291	}
292	ptr = kzalloc(sizeof(*ptr) + len, GFP_KERNEL);
293	allocated_len = ptr ? ksize(ptr) : 0;
294	if (!ptr || (tomoyo_quota_for_savename &&
295		     tomoyo_allocated_memory_for_savename + allocated_len
296		     > tomoyo_quota_for_savename)) {
297		kfree(ptr);
298		printk(KERN_WARNING "ERROR: Out of memory "
299		       "for tomoyo_get_name().\n");
300		if (!tomoyo_policy_loaded)
301			panic("MAC Initialization failed.\n");
302		ptr = NULL;
303		goto out;
304	}
305	tomoyo_allocated_memory_for_savename += allocated_len;
306	ptr->entry.name = ((char *) ptr) + sizeof(*ptr);
307	memmove((char *) ptr->entry.name, name, len);
308	atomic_set(&ptr->users, 1);
309	tomoyo_fill_path_info(&ptr->entry);
310	list_add_tail(&ptr->list, head);
311 out:
312	mutex_unlock(&lock);
313	return ptr ? &ptr->entry : NULL;
314}
315
316/**
317 * tomoyo_realpath_init - Initialize realpath related code.
318 */
319void __init tomoyo_realpath_init(void)
320{
321	int i;
322
323	BUILD_BUG_ON(TOMOYO_MAX_PATHNAME_LEN > PATH_MAX);
324	for (i = 0; i < TOMOYO_MAX_HASH; i++)
325		INIT_LIST_HEAD(&tomoyo_name_list[i]);
326	INIT_LIST_HEAD(&tomoyo_kernel_domain.acl_info_list);
327	tomoyo_kernel_domain.domainname = tomoyo_get_name(TOMOYO_ROOT_NAME);
328	/*
329	 * tomoyo_read_lock() is not needed because this function is
330	 * called before the first "delete" request.
331	 */
332	list_add_tail_rcu(&tomoyo_kernel_domain.list, &tomoyo_domain_list);
333	if (tomoyo_find_domain(TOMOYO_ROOT_NAME) != &tomoyo_kernel_domain)
334		panic("Can't register tomoyo_kernel_domain");
335}
336
337/**
338 * tomoyo_read_memory_counter - Check for memory usage in bytes.
339 *
340 * @head: Pointer to "struct tomoyo_io_buffer".
341 *
342 * Returns memory usage.
343 */
344int tomoyo_read_memory_counter(struct tomoyo_io_buffer *head)
345{
346	if (!head->read_eof) {
347		const unsigned int shared
348			= tomoyo_allocated_memory_for_savename;
349		const unsigned int private
350			= tomoyo_allocated_memory_for_elements;
351		char buffer[64];
352
353		memset(buffer, 0, sizeof(buffer));
354		if (tomoyo_quota_for_savename)
355			snprintf(buffer, sizeof(buffer) - 1,
356				 "   (Quota: %10u)",
357				 tomoyo_quota_for_savename);
358		else
359			buffer[0] = '\0';
360		tomoyo_io_printf(head, "Shared:  %10u%s\n", shared, buffer);
361		if (tomoyo_quota_for_elements)
362			snprintf(buffer, sizeof(buffer) - 1,
363				 "   (Quota: %10u)",
364				 tomoyo_quota_for_elements);
365		else
366			buffer[0] = '\0';
367		tomoyo_io_printf(head, "Private: %10u%s\n", private, buffer);
368		tomoyo_io_printf(head, "Total:   %10u\n", shared + private);
369		head->read_eof = true;
370	}
371	return 0;
372}
373
374/**
375 * tomoyo_write_memory_quota - Set memory quota.
376 *
377 * @head: Pointer to "struct tomoyo_io_buffer".
378 *
379 * Returns 0.
380 */
381int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head)
382{
383	char *data = head->write_buf;
384	unsigned int size;
385
386	if (sscanf(data, "Shared: %u", &size) == 1)
387		tomoyo_quota_for_savename = size;
388	else if (sscanf(data, "Private: %u", &size) == 1)
389		tomoyo_quota_for_elements = size;
390	return 0;
391}
392