1// SPDX-License-Identifier: GPL-2.0 2/* 3 * security/tomoyo/tomoyo.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8#include <linux/lsm_hooks.h> 9#include <uapi/linux/lsm.h> 10#include "common.h" 11 12/** 13 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 14 * 15 * Returns pointer to "struct tomoyo_domain_info" for current thread. 16 */ 17struct tomoyo_domain_info *tomoyo_domain(void) 18{ 19 struct tomoyo_task *s = tomoyo_task(current); 20 21 if (s->old_domain_info && !current->in_execve) { 22 atomic_dec(&s->old_domain_info->users); 23 s->old_domain_info = NULL; 24 } 25 return s->domain_info; 26} 27 28/** 29 * tomoyo_cred_prepare - Target for security_prepare_creds(). 30 * 31 * @new: Pointer to "struct cred". 32 * @old: Pointer to "struct cred". 33 * @gfp: Memory allocation flags. 34 * 35 * Returns 0. 36 */ 37static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, 38 gfp_t gfp) 39{ 40 /* Restore old_domain_info saved by previous execve() request. */ 41 struct tomoyo_task *s = tomoyo_task(current); 42 43 if (s->old_domain_info && !current->in_execve) { 44 atomic_dec(&s->domain_info->users); 45 s->domain_info = s->old_domain_info; 46 s->old_domain_info = NULL; 47 } 48 return 0; 49} 50 51/** 52 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). 53 * 54 * @bprm: Pointer to "struct linux_binprm". 55 */ 56static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm) 57{ 58 /* Clear old_domain_info saved by execve() request. */ 59 struct tomoyo_task *s = tomoyo_task(current); 60 61 atomic_dec(&s->old_domain_info->users); 62 s->old_domain_info = NULL; 63} 64 65#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 66/** 67 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). 68 * 69 * @bprm: Pointer to "struct linux_binprm". 70 * 71 * Returns 0. 72 */ 73static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) 74{ 75 /* 76 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested 77 * for the first time. 78 */ 79 if (!tomoyo_policy_loaded) 80 tomoyo_load_policy(bprm->filename); 81 return 0; 82} 83#endif 84 85/** 86 * tomoyo_bprm_check_security - Target for security_bprm_check(). 87 * 88 * @bprm: Pointer to "struct linux_binprm". 89 * 90 * Returns 0 on success, negative value otherwise. 91 */ 92static int tomoyo_bprm_check_security(struct linux_binprm *bprm) 93{ 94 struct tomoyo_task *s = tomoyo_task(current); 95 96 /* 97 * Execute permission is checked against pathname passed to execve() 98 * using current domain. 99 */ 100 if (!s->old_domain_info) { 101 const int idx = tomoyo_read_lock(); 102 const int err = tomoyo_find_next_domain(bprm); 103 104 tomoyo_read_unlock(idx); 105 return err; 106 } 107 /* 108 * Read permission is checked against interpreters using next domain. 109 */ 110 return tomoyo_check_open_permission(s->domain_info, 111 &bprm->file->f_path, O_RDONLY); 112} 113 114/** 115 * tomoyo_inode_getattr - Target for security_inode_getattr(). 116 * 117 * @path: Pointer to "struct path". 118 * 119 * Returns 0 on success, negative value otherwise. 120 */ 121static int tomoyo_inode_getattr(const struct path *path) 122{ 123 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); 124} 125 126/** 127 * tomoyo_path_truncate - Target for security_path_truncate(). 128 * 129 * @path: Pointer to "struct path". 130 * 131 * Returns 0 on success, negative value otherwise. 132 */ 133static int tomoyo_path_truncate(const struct path *path) 134{ 135 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); 136} 137 138/** 139 * tomoyo_file_truncate - Target for security_file_truncate(). 140 * 141 * @file: Pointer to "struct file". 142 * 143 * Returns 0 on success, negative value otherwise. 144 */ 145static int tomoyo_file_truncate(struct file *file) 146{ 147 return tomoyo_path_truncate(&file->f_path); 148} 149 150/** 151 * tomoyo_path_unlink - Target for security_path_unlink(). 152 * 153 * @parent: Pointer to "struct path". 154 * @dentry: Pointer to "struct dentry". 155 * 156 * Returns 0 on success, negative value otherwise. 157 */ 158static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) 159{ 160 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 161 162 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); 163} 164 165/** 166 * tomoyo_path_mkdir - Target for security_path_mkdir(). 167 * 168 * @parent: Pointer to "struct path". 169 * @dentry: Pointer to "struct dentry". 170 * @mode: DAC permission mode. 171 * 172 * Returns 0 on success, negative value otherwise. 173 */ 174static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, 175 umode_t mode) 176{ 177 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 178 179 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, 180 mode & S_IALLUGO); 181} 182 183/** 184 * tomoyo_path_rmdir - Target for security_path_rmdir(). 185 * 186 * @parent: Pointer to "struct path". 187 * @dentry: Pointer to "struct dentry". 188 * 189 * Returns 0 on success, negative value otherwise. 190 */ 191static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) 192{ 193 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 194 195 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); 196} 197 198/** 199 * tomoyo_path_symlink - Target for security_path_symlink(). 200 * 201 * @parent: Pointer to "struct path". 202 * @dentry: Pointer to "struct dentry". 203 * @old_name: Symlink's content. 204 * 205 * Returns 0 on success, negative value otherwise. 206 */ 207static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, 208 const char *old_name) 209{ 210 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 211 212 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); 213} 214 215/** 216 * tomoyo_path_mknod - Target for security_path_mknod(). 217 * 218 * @parent: Pointer to "struct path". 219 * @dentry: Pointer to "struct dentry". 220 * @mode: DAC permission mode. 221 * @dev: Device attributes. 222 * 223 * Returns 0 on success, negative value otherwise. 224 */ 225static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, 226 umode_t mode, unsigned int dev) 227{ 228 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 229 int type = TOMOYO_TYPE_CREATE; 230 const unsigned int perm = mode & S_IALLUGO; 231 232 switch (mode & S_IFMT) { 233 case S_IFCHR: 234 type = TOMOYO_TYPE_MKCHAR; 235 break; 236 case S_IFBLK: 237 type = TOMOYO_TYPE_MKBLOCK; 238 break; 239 default: 240 goto no_dev; 241 } 242 return tomoyo_mkdev_perm(type, &path, perm, dev); 243 no_dev: 244 switch (mode & S_IFMT) { 245 case S_IFIFO: 246 type = TOMOYO_TYPE_MKFIFO; 247 break; 248 case S_IFSOCK: 249 type = TOMOYO_TYPE_MKSOCK; 250 break; 251 } 252 return tomoyo_path_number_perm(type, &path, perm); 253} 254 255/** 256 * tomoyo_path_link - Target for security_path_link(). 257 * 258 * @old_dentry: Pointer to "struct dentry". 259 * @new_dir: Pointer to "struct path". 260 * @new_dentry: Pointer to "struct dentry". 261 * 262 * Returns 0 on success, negative value otherwise. 263 */ 264static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, 265 struct dentry *new_dentry) 266{ 267 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; 268 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; 269 270 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); 271} 272 273/** 274 * tomoyo_path_rename - Target for security_path_rename(). 275 * 276 * @old_parent: Pointer to "struct path". 277 * @old_dentry: Pointer to "struct dentry". 278 * @new_parent: Pointer to "struct path". 279 * @new_dentry: Pointer to "struct dentry". 280 * @flags: Rename options. 281 * 282 * Returns 0 on success, negative value otherwise. 283 */ 284static int tomoyo_path_rename(const struct path *old_parent, 285 struct dentry *old_dentry, 286 const struct path *new_parent, 287 struct dentry *new_dentry, 288 const unsigned int flags) 289{ 290 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; 291 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; 292 293 if (flags & RENAME_EXCHANGE) { 294 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2, 295 &path1); 296 297 if (err) 298 return err; 299 } 300 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); 301} 302 303/** 304 * tomoyo_file_fcntl - Target for security_file_fcntl(). 305 * 306 * @file: Pointer to "struct file". 307 * @cmd: Command for fcntl(). 308 * @arg: Argument for @cmd. 309 * 310 * Returns 0 on success, negative value otherwise. 311 */ 312static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, 313 unsigned long arg) 314{ 315 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) 316 return 0; 317 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, 318 O_WRONLY | (arg & O_APPEND)); 319} 320 321/** 322 * tomoyo_file_open - Target for security_file_open(). 323 * 324 * @f: Pointer to "struct file". 325 * 326 * Returns 0 on success, negative value otherwise. 327 */ 328static int tomoyo_file_open(struct file *f) 329{ 330 /* Don't check read permission here if called from execve(). */ 331 /* Illogically, FMODE_EXEC is in f_flags, not f_mode. */ 332 if (f->f_flags & __FMODE_EXEC) 333 return 0; 334 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, 335 f->f_flags); 336} 337 338/** 339 * tomoyo_file_ioctl - Target for security_file_ioctl(). 340 * 341 * @file: Pointer to "struct file". 342 * @cmd: Command for ioctl(). 343 * @arg: Argument for @cmd. 344 * 345 * Returns 0 on success, negative value otherwise. 346 */ 347static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, 348 unsigned long arg) 349{ 350 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); 351} 352 353/** 354 * tomoyo_path_chmod - Target for security_path_chmod(). 355 * 356 * @path: Pointer to "struct path". 357 * @mode: DAC permission mode. 358 * 359 * Returns 0 on success, negative value otherwise. 360 */ 361static int tomoyo_path_chmod(const struct path *path, umode_t mode) 362{ 363 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, 364 mode & S_IALLUGO); 365} 366 367/** 368 * tomoyo_path_chown - Target for security_path_chown(). 369 * 370 * @path: Pointer to "struct path". 371 * @uid: Owner ID. 372 * @gid: Group ID. 373 * 374 * Returns 0 on success, negative value otherwise. 375 */ 376static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 377{ 378 int error = 0; 379 380 if (uid_valid(uid)) 381 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, 382 from_kuid(&init_user_ns, uid)); 383 if (!error && gid_valid(gid)) 384 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, 385 from_kgid(&init_user_ns, gid)); 386 return error; 387} 388 389/** 390 * tomoyo_path_chroot - Target for security_path_chroot(). 391 * 392 * @path: Pointer to "struct path". 393 * 394 * Returns 0 on success, negative value otherwise. 395 */ 396static int tomoyo_path_chroot(const struct path *path) 397{ 398 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); 399} 400 401/** 402 * tomoyo_sb_mount - Target for security_sb_mount(). 403 * 404 * @dev_name: Name of device file. Maybe NULL. 405 * @path: Pointer to "struct path". 406 * @type: Name of filesystem type. Maybe NULL. 407 * @flags: Mount options. 408 * @data: Optional data. Maybe NULL. 409 * 410 * Returns 0 on success, negative value otherwise. 411 */ 412static int tomoyo_sb_mount(const char *dev_name, const struct path *path, 413 const char *type, unsigned long flags, void *data) 414{ 415 return tomoyo_mount_permission(dev_name, path, type, flags, data); 416} 417 418/** 419 * tomoyo_sb_umount - Target for security_sb_umount(). 420 * 421 * @mnt: Pointer to "struct vfsmount". 422 * @flags: Unmount options. 423 * 424 * Returns 0 on success, negative value otherwise. 425 */ 426static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) 427{ 428 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; 429 430 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); 431} 432 433/** 434 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). 435 * 436 * @old_path: Pointer to "struct path". 437 * @new_path: Pointer to "struct path". 438 * 439 * Returns 0 on success, negative value otherwise. 440 */ 441static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) 442{ 443 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); 444} 445 446/** 447 * tomoyo_socket_listen - Check permission for listen(). 448 * 449 * @sock: Pointer to "struct socket". 450 * @backlog: Backlog parameter. 451 * 452 * Returns 0 on success, negative value otherwise. 453 */ 454static int tomoyo_socket_listen(struct socket *sock, int backlog) 455{ 456 return tomoyo_socket_listen_permission(sock); 457} 458 459/** 460 * tomoyo_socket_connect - Check permission for connect(). 461 * 462 * @sock: Pointer to "struct socket". 463 * @addr: Pointer to "struct sockaddr". 464 * @addr_len: Size of @addr. 465 * 466 * Returns 0 on success, negative value otherwise. 467 */ 468static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, 469 int addr_len) 470{ 471 return tomoyo_socket_connect_permission(sock, addr, addr_len); 472} 473 474/** 475 * tomoyo_socket_bind - Check permission for bind(). 476 * 477 * @sock: Pointer to "struct socket". 478 * @addr: Pointer to "struct sockaddr". 479 * @addr_len: Size of @addr. 480 * 481 * Returns 0 on success, negative value otherwise. 482 */ 483static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, 484 int addr_len) 485{ 486 return tomoyo_socket_bind_permission(sock, addr, addr_len); 487} 488 489/** 490 * tomoyo_socket_sendmsg - Check permission for sendmsg(). 491 * 492 * @sock: Pointer to "struct socket". 493 * @msg: Pointer to "struct msghdr". 494 * @size: Size of message. 495 * 496 * Returns 0 on success, negative value otherwise. 497 */ 498static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, 499 int size) 500{ 501 return tomoyo_socket_sendmsg_permission(sock, msg, size); 502} 503 504struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = { 505 .lbs_task = sizeof(struct tomoyo_task), 506}; 507 508/** 509 * tomoyo_task_alloc - Target for security_task_alloc(). 510 * 511 * @task: Pointer to "struct task_struct". 512 * @clone_flags: clone() flags. 513 * 514 * Returns 0. 515 */ 516static int tomoyo_task_alloc(struct task_struct *task, 517 unsigned long clone_flags) 518{ 519 struct tomoyo_task *old = tomoyo_task(current); 520 struct tomoyo_task *new = tomoyo_task(task); 521 522 new->domain_info = old->domain_info; 523 atomic_inc(&new->domain_info->users); 524 new->old_domain_info = NULL; 525 return 0; 526} 527 528/** 529 * tomoyo_task_free - Target for security_task_free(). 530 * 531 * @task: Pointer to "struct task_struct". 532 */ 533static void tomoyo_task_free(struct task_struct *task) 534{ 535 struct tomoyo_task *s = tomoyo_task(task); 536 537 if (s->domain_info) { 538 atomic_dec(&s->domain_info->users); 539 s->domain_info = NULL; 540 } 541 if (s->old_domain_info) { 542 atomic_dec(&s->old_domain_info->users); 543 s->old_domain_info = NULL; 544 } 545} 546 547static const struct lsm_id tomoyo_lsmid = { 548 .name = "tomoyo", 549 .id = LSM_ID_TOMOYO, 550}; 551 552/* 553 * tomoyo_security_ops is a "struct security_operations" which is used for 554 * registering TOMOYO. 555 */ 556static struct security_hook_list tomoyo_hooks[] __ro_after_init = { 557 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), 558 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), 559 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), 560 LSM_HOOK_INIT(task_free, tomoyo_task_free), 561#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 562 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), 563#endif 564 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), 565 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), 566 LSM_HOOK_INIT(file_open, tomoyo_file_open), 567 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate), 568 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), 569 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), 570 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), 571 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), 572 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), 573 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), 574 LSM_HOOK_INIT(path_link, tomoyo_path_link), 575 LSM_HOOK_INIT(path_rename, tomoyo_path_rename), 576 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), 577 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), 578 LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl), 579 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), 580 LSM_HOOK_INIT(path_chown, tomoyo_path_chown), 581 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), 582 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), 583 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), 584 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), 585 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), 586 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), 587 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), 588 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), 589}; 590 591/* Lock for GC. */ 592DEFINE_SRCU(tomoyo_ss); 593 594int tomoyo_enabled __ro_after_init = 1; 595 596/** 597 * tomoyo_init - Register TOMOYO Linux as a LSM module. 598 * 599 * Returns 0. 600 */ 601static int __init tomoyo_init(void) 602{ 603 struct tomoyo_task *s = tomoyo_task(current); 604 605 /* register ourselves with the security framework */ 606 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), 607 &tomoyo_lsmid); 608 pr_info("TOMOYO Linux initialized\n"); 609 s->domain_info = &tomoyo_kernel_domain; 610 atomic_inc(&tomoyo_kernel_domain.users); 611 s->old_domain_info = NULL; 612 tomoyo_mm_init(); 613 614 return 0; 615} 616 617DEFINE_LSM(tomoyo) = { 618 .name = "tomoyo", 619 .enabled = &tomoyo_enabled, 620 .flags = LSM_FLAG_LEGACY_MAJOR, 621 .blobs = &tomoyo_blob_sizes, 622 .init = tomoyo_init, 623}; 624