1c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/* 20f2a55d5bb2372058275b0b343d90dd5d640d045Tetsuo Handa * security/tomoyo/securityfs_if.c 3c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 40f2a55d5bb2372058275b0b343d90dd5d640d045Tetsuo Handa * Copyright (C) 2005-2011 NTT DATA CORPORATION 5c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 6c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 7c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa#include <linux/security.h> 8c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa#include "common.h" 9c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 10c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 11731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * tomoyo_check_task_acl - Check permission for task operation. 12731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 13731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @r: Pointer to "struct tomoyo_request_info". 14731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @ptr: Pointer to "struct tomoyo_acl_info". 15731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 16731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * Returns true if granted, false otherwise. 17731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa */ 18731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handastatic bool tomoyo_check_task_acl(struct tomoyo_request_info *r, 19731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa const struct tomoyo_acl_info *ptr) 20731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa{ 21731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa const struct tomoyo_task_acl *acl = container_of(ptr, typeof(*acl), 22731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa head); 23731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return !tomoyo_pathcmp(r->param.task.domainname, acl->domainname); 24731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa} 25731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa 26731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa/** 27731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * tomoyo_write_self - write() for /sys/kernel/security/tomoyo/self_domain interface. 28731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 29731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @file: Pointer to "struct file". 30731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @buf: Domainname to transit to. 31731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @count: Size of @buf. 32731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @ppos: Unused. 33731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 34731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * Returns @count on success, negative value otherwise. 35731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 36731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * If domain transition was permitted but the domain transition failed, this 37731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * function returns error rather than terminating current thread with SIGKILL. 38731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa */ 39731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handastatic ssize_t tomoyo_write_self(struct file *file, const char __user *buf, 40731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa size_t count, loff_t *ppos) 41731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa{ 42731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa char *data; 43731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa int error; 44731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (!count || count >= TOMOYO_EXEC_TMPSIZE - 10) 45731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return -ENOMEM; 46731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa data = kzalloc(count + 1, GFP_NOFS); 47731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (!data) 48731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return -ENOMEM; 49731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (copy_from_user(data, buf, count)) { 50731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = -EFAULT; 51731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa goto out; 52731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } 53731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_normalize_line(data); 54731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (tomoyo_correct_domain(data)) { 55731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa const int idx = tomoyo_read_lock(); 56731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa struct tomoyo_path_info name; 57731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa struct tomoyo_request_info r; 58731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa name.name = data; 59731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_fill_path_info(&name); 60731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa /* Check "task manual_domain_transition" permission. */ 61731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_init_request_info(&r, NULL, TOMOYO_MAC_FILE_EXECUTE); 62731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa r.param_type = TOMOYO_TYPE_MANUAL_TASK_ACL; 63731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa r.param.task.domainname = &name; 64731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_check_acl(&r, tomoyo_check_task_acl); 65731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (!r.granted) 66731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = -EPERM; 67731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa else { 68731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa struct tomoyo_domain_info *new_domain = 69731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_assign_domain(data, true); 70731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (!new_domain) { 71731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = -ENOENT; 72731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } else { 73731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa struct cred *cred = prepare_creds(); 74731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (!cred) { 75731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = -ENOMEM; 76731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } else { 77731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa struct tomoyo_domain_info *old_domain = 78731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa cred->security; 79731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa cred->security = new_domain; 80731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa atomic_inc(&new_domain->users); 81731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa atomic_dec(&old_domain->users); 82731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa commit_creds(cred); 83731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = 0; 84731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } 85731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } 86731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } 87731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa tomoyo_read_unlock(idx); 88731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa } else 89731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa error = -EINVAL; 90731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handaout: 91731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa kfree(data); 92731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return error ? error : count; 93731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa} 94731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa 95731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa/** 96731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * tomoyo_read_self - read() for /sys/kernel/security/tomoyo/self_domain interface. 97731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 98731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @file: Pointer to "struct file". 99731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @buf: Domainname which current thread belongs to. 100731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @count: Size of @buf. 101731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * @ppos: Bytes read by now. 102731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * 103731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa * Returns read size on success, negative value otherwise. 104731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa */ 105731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handastatic ssize_t tomoyo_read_self(struct file *file, char __user *buf, 106731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa size_t count, loff_t *ppos) 107731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa{ 108731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa const char *domain = tomoyo_domain()->domainname->name; 109731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa loff_t len = strlen(domain); 110731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa loff_t pos = *ppos; 111731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (pos >= len || !count) 112731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return 0; 113731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa len -= pos; 114731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (count < len) 115731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa len = count; 116731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa if (copy_to_user(buf, domain + pos, len)) 117731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return -EFAULT; 118731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa *ppos += len; 119731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa return len; 120731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa} 121731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa 122731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa/* Operations for /sys/kernel/security/tomoyo/self_domain interface. */ 123731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handastatic const struct file_operations tomoyo_self_operations = { 124731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa .write = tomoyo_write_self, 125731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa .read = tomoyo_read_self, 126731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa}; 127731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa 128731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa/** 129c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_open - open() for /sys/kernel/security/tomoyo/ interface. 130c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 131c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @inode: Pointer to "struct inode". 132c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @file: Pointer to "struct file". 133c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 134c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Returns 0 on success, negative value otherwise. 135c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 136c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic int tomoyo_open(struct inode *inode, struct file *file) 137c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 138496ad9aa8ef448058e36ca7a787c61f2e63f0f54Al Viro const int key = ((u8 *) file_inode(file)->i_private) 139c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa - ((u8 *) NULL); 140c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa return tomoyo_open_control(key, file); 141c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 142c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 143c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 144c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_release - close() for /sys/kernel/security/tomoyo/ interface. 145c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 146c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @file: Pointer to "struct file". 147c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 148c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 149c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic int tomoyo_release(struct inode *inode, struct file *file) 150c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 151e53cfda5d2c90a6dd763eb72034c775add729e40Al Viro tomoyo_close_control(file->private_data); 152e53cfda5d2c90a6dd763eb72034c775add729e40Al Viro return 0; 153c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 154c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 155c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 156b5bc60b4ce313b6dbb42e7d32915dcf0a07c2a68Tetsuo Handa * tomoyo_poll - poll() for /sys/kernel/security/tomoyo/ interface. 1570849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa * 1580849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa * @file: Pointer to "struct file". 1596041e8346f2165679c2184cab60db768d6a26a1dTetsuo Handa * @wait: Pointer to "poll_table". Maybe NULL. 1600849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa * 1616041e8346f2165679c2184cab60db768d6a26a1dTetsuo Handa * Returns POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM if ready to read/write, 1626041e8346f2165679c2184cab60db768d6a26a1dTetsuo Handa * POLLOUT | POLLWRNORM otherwise. 1630849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa */ 1640849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handastatic unsigned int tomoyo_poll(struct file *file, poll_table *wait) 1650849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa{ 1660849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa return tomoyo_poll_control(file, wait); 1670849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa} 1680849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa 1690849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa/** 170c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_read - read() for /sys/kernel/security/tomoyo/ interface. 171c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 172c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @file: Pointer to "struct file". 173c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @buf: Pointer to buffer. 174c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @count: Size of @buf. 175c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @ppos: Unused. 176c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 177c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Returns bytes read on success, negative value otherwise. 178c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 179c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic ssize_t tomoyo_read(struct file *file, char __user *buf, size_t count, 180c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa loff_t *ppos) 181c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 1820df7e8b8f1c25c10820bdc679555f2fbfb897ca0Tetsuo Handa return tomoyo_read_control(file->private_data, buf, count); 183c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 184c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 185c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 186c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_write - write() for /sys/kernel/security/tomoyo/ interface. 187c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 188c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @file: Pointer to "struct file". 189c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @buf: Pointer to buffer. 190c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @count: Size of @buf. 191c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @ppos: Unused. 192c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 193c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Returns @count on success, negative value otherwise. 194c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 195c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic ssize_t tomoyo_write(struct file *file, const char __user *buf, 196c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa size_t count, loff_t *ppos) 197c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 1980df7e8b8f1c25c10820bdc679555f2fbfb897ca0Tetsuo Handa return tomoyo_write_control(file->private_data, buf, count); 199c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 200c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 201c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/* 202c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_operations is a "struct file_operations" which is used for handling 203c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * /sys/kernel/security/tomoyo/ interface. 204c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 205c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Some files under /sys/kernel/security/tomoyo/ directory accept open(O_RDWR). 206c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * See tomoyo_io_buffer for internals. 207c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 208c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic const struct file_operations tomoyo_operations = { 209c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa .open = tomoyo_open, 210c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa .release = tomoyo_release, 2110849e3ba53c3ef603dffa9758a73e07ed186a937Tetsuo Handa .poll = tomoyo_poll, 212c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa .read = tomoyo_read, 213c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa .write = tomoyo_write, 2147e2deb7ce8f662bce877dbfd3b0053e9559c25a3Tetsuo Handa .llseek = noop_llseek, 215c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa}; 216c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 217c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 218c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_create_entry - Create interface files under /sys/kernel/security/tomoyo/ directory. 219c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 220c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @name: The name of the interface file. 221c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @mode: The permission of the interface file. 222c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @parent: The parent directory. 223c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * @key: Type of interface. 224c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 225c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Returns nothing. 226c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 22752ef0c042bf06f6aef382fade175075627beebc1Al Virostatic void __init tomoyo_create_entry(const char *name, const umode_t mode, 228c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa struct dentry *parent, const u8 key) 229c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 230c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key, 231c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa &tomoyo_operations); 232c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 233c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 234c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa/** 235c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * tomoyo_initerface_init - Initialize /sys/kernel/security/tomoyo/ interface. 236c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * 237c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa * Returns 0. 238c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa */ 239c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handastatic int __init tomoyo_initerface_init(void) 240c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa{ 241c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa struct dentry *tomoyo_dir; 242c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 243c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa /* Don't create securityfs entries unless registered. */ 244c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa if (current_cred()->security != &tomoyo_kernel_domain) 245c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa return 0; 246c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 247c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_dir = securityfs_create_dir("tomoyo", NULL); 248c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("query", 0600, tomoyo_dir, 249c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_QUERY); 250c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("domain_policy", 0600, tomoyo_dir, 251c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_DOMAINPOLICY); 252c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("exception_policy", 0600, tomoyo_dir, 253c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_EXCEPTIONPOLICY); 254eadd99cc85347b4f9eb10122ac90032eb4971b02Tetsuo Handa tomoyo_create_entry("audit", 0400, tomoyo_dir, 255eadd99cc85347b4f9eb10122ac90032eb4971b02Tetsuo Handa TOMOYO_AUDIT); 256c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry(".process_status", 0600, tomoyo_dir, 257c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_PROCESS_STATUS); 258b22b8b9fd90eecfb7133e56b4e113595f09f4492Tetsuo Handa tomoyo_create_entry("stat", 0644, tomoyo_dir, 259b22b8b9fd90eecfb7133e56b4e113595f09f4492Tetsuo Handa TOMOYO_STAT); 260c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("profile", 0600, tomoyo_dir, 261c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_PROFILE); 262c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("manager", 0600, tomoyo_dir, 263c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_MANAGER); 264c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa tomoyo_create_entry("version", 0400, tomoyo_dir, 265c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa TOMOYO_VERSION); 266731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa securityfs_create_file("self_domain", 0666, tomoyo_dir, NULL, 267731d37aa70c7b9de3be6bf2c8287366223bf5ce5Tetsuo Handa &tomoyo_self_operations); 268778c4a4d60d932c1df6d270dcbc88365823c3963Tetsuo Handa tomoyo_load_builtin_policy(); 269c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa return 0; 270c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa} 271c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handa 272c3ef1500ec833890275172c7d063333404b64d60Tetsuo Handafs_initcall(tomoyo_initerface_init); 273