blob: 81b95165205119fb41c6508044c2729e2c48a2b6 [file] [log] [blame]
Greg Kroah-Hartmanb2441312017-11-01 15:07:57 +01001// SPDX-License-Identifier: GPL-2.0
Tetsuo Handac3ef1502010-05-17 10:12:46 +09002/*
3 * security/tomoyo/load_policy.c
4 *
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +09005 * Copyright (C) 2005-2011 NTT DATA CORPORATION
Tetsuo Handac3ef1502010-05-17 10:12:46 +09006 */
7
8#include "common.h"
9
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090010#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
11
12/*
13 * Path to the policy loader. (default = CONFIG_SECURITY_TOMOYO_POLICY_LOADER)
14 */
15static const char *tomoyo_loader;
16
17/**
18 * tomoyo_loader_setup - Set policy loader.
19 *
20 * @str: Program to use as a policy loader (e.g. /sbin/tomoyo-init ).
21 *
22 * Returns 0.
23 */
24static int __init tomoyo_loader_setup(char *str)
25{
26 tomoyo_loader = str;
27 return 0;
28}
29
30__setup("TOMOYO_loader=", tomoyo_loader_setup);
Tetsuo Handac3ef1502010-05-17 10:12:46 +090031
32/**
33 * tomoyo_policy_loader_exists - Check whether /sbin/tomoyo-init exists.
34 *
35 * Returns true if /sbin/tomoyo-init exists, false otherwise.
36 */
37static bool tomoyo_policy_loader_exists(void)
38{
Tetsuo Handac3ef1502010-05-17 10:12:46 +090039 struct path path;
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090040 if (!tomoyo_loader)
41 tomoyo_loader = CONFIG_SECURITY_TOMOYO_POLICY_LOADER;
Tetsuo Handac3ef1502010-05-17 10:12:46 +090042 if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090043 printk(KERN_INFO "Not activating Mandatory Access Control "
44 "as %s does not exist.\n", tomoyo_loader);
Tetsuo Handac3ef1502010-05-17 10:12:46 +090045 return false;
46 }
47 path_put(&path);
48 return true;
49}
50
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090051/*
52 * Path to the trigger. (default = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER)
53 */
54static const char *tomoyo_trigger;
55
56/**
57 * tomoyo_trigger_setup - Set trigger for activation.
58 *
59 * @str: Program to use as an activation trigger (e.g. /sbin/init ).
60 *
61 * Returns 0.
62 */
63static int __init tomoyo_trigger_setup(char *str)
64{
65 tomoyo_trigger = str;
66 return 0;
67}
68
69__setup("TOMOYO_trigger=", tomoyo_trigger_setup);
70
Tetsuo Handac3ef1502010-05-17 10:12:46 +090071/**
72 * tomoyo_load_policy - Run external policy loader to load policy.
73 *
74 * @filename: The program about to start.
75 *
76 * This function checks whether @filename is /sbin/init , and if so
77 * invoke /sbin/tomoyo-init and wait for the termination of /sbin/tomoyo-init
78 * and then continues invocation of /sbin/init.
79 * /sbin/tomoyo-init reads policy files in /etc/tomoyo/ directory and
80 * writes to /sys/kernel/security/tomoyo/ interfaces.
81 *
82 * Returns nothing.
83 */
84void tomoyo_load_policy(const char *filename)
85{
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090086 static bool done;
Tetsuo Handac3ef1502010-05-17 10:12:46 +090087 char *argv[2];
88 char *envp[3];
89
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090090 if (tomoyo_policy_loaded || done)
Tetsuo Handac3ef1502010-05-17 10:12:46 +090091 return;
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090092 if (!tomoyo_trigger)
93 tomoyo_trigger = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER;
94 if (strcmp(filename, tomoyo_trigger))
Tetsuo Handac3ef1502010-05-17 10:12:46 +090095 return;
96 if (!tomoyo_policy_loader_exists())
97 return;
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +090098 done = true;
Tetsuo Handac3ef1502010-05-17 10:12:46 +090099 printk(KERN_INFO "Calling %s to load policy. Please wait.\n",
100 tomoyo_loader);
101 argv[0] = (char *) tomoyo_loader;
102 argv[1] = NULL;
103 envp[0] = "HOME=/";
104 envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
105 envp[2] = NULL;
Oleg Nesterov70834d32012-03-23 15:02:46 -0700106 call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
Tetsuo Handac3ef1502010-05-17 10:12:46 +0900107 tomoyo_check_profile();
108}
Tetsuo Handa0e4ae0e2011-06-26 23:22:59 +0900109
110#endif