blob: 09feaf24864db58c3cdc399a14c24389af789b42 [file] [log] [blame]
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001/*
2 * security/tomoyo/file.c
3 *
4 * Implementation of the Domain-Based Mandatory Access Control.
5 *
6 * Copyright (C) 2005-2009 NTT DATA CORPORATION
7 *
Tetsuo Handa39826a12009-04-08 22:31:28 +09008 * Version: 2.2.0 2009/04/01
Kentaro Takedab69a54e2009-02-05 17:18:14 +09009 *
10 */
11
12#include "common.h"
Kentaro Takedab69a54e2009-02-05 17:18:14 +090013
14/* Keyword array for single path operations. */
Tetsuo Handa7ef61232010-02-16 08:03:30 +090015static const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
16 [TOMOYO_TYPE_READ_WRITE] = "read/write",
17 [TOMOYO_TYPE_EXECUTE] = "execute",
18 [TOMOYO_TYPE_READ] = "read",
19 [TOMOYO_TYPE_WRITE] = "write",
20 [TOMOYO_TYPE_CREATE] = "create",
21 [TOMOYO_TYPE_UNLINK] = "unlink",
22 [TOMOYO_TYPE_MKDIR] = "mkdir",
23 [TOMOYO_TYPE_RMDIR] = "rmdir",
24 [TOMOYO_TYPE_MKFIFO] = "mkfifo",
25 [TOMOYO_TYPE_MKSOCK] = "mksock",
26 [TOMOYO_TYPE_MKBLOCK] = "mkblock",
27 [TOMOYO_TYPE_MKCHAR] = "mkchar",
28 [TOMOYO_TYPE_TRUNCATE] = "truncate",
29 [TOMOYO_TYPE_SYMLINK] = "symlink",
30 [TOMOYO_TYPE_REWRITE] = "rewrite",
31 [TOMOYO_TYPE_IOCTL] = "ioctl",
32 [TOMOYO_TYPE_CHMOD] = "chmod",
33 [TOMOYO_TYPE_CHOWN] = "chown",
34 [TOMOYO_TYPE_CHGRP] = "chgrp",
35 [TOMOYO_TYPE_CHROOT] = "chroot",
36 [TOMOYO_TYPE_MOUNT] = "mount",
37 [TOMOYO_TYPE_UMOUNT] = "unmount",
Kentaro Takedab69a54e2009-02-05 17:18:14 +090038};
39
40/* Keyword array for double path operations. */
Tetsuo Handa7ef61232010-02-16 08:03:30 +090041static const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION] = {
42 [TOMOYO_TYPE_LINK] = "link",
43 [TOMOYO_TYPE_RENAME] = "rename",
44 [TOMOYO_TYPE_PIVOT_ROOT] = "pivot_root",
Kentaro Takedab69a54e2009-02-05 17:18:14 +090045};
46
47/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +090048 * tomoyo_path2keyword - Get the name of single path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +090049 *
50 * @operation: Type of operation.
51 *
52 * Returns the name of single path operation.
53 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +090054const char *tomoyo_path2keyword(const u8 operation)
Kentaro Takedab69a54e2009-02-05 17:18:14 +090055{
Tetsuo Handa7ef61232010-02-16 08:03:30 +090056 return (operation < TOMOYO_MAX_PATH_OPERATION)
57 ? tomoyo_path_keyword[operation] : NULL;
Kentaro Takedab69a54e2009-02-05 17:18:14 +090058}
59
60/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +090061 * tomoyo_path22keyword - Get the name of double path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +090062 *
63 * @operation: Type of operation.
64 *
65 * Returns the name of double path operation.
66 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +090067const char *tomoyo_path22keyword(const u8 operation)
Kentaro Takedab69a54e2009-02-05 17:18:14 +090068{
Tetsuo Handa7ef61232010-02-16 08:03:30 +090069 return (operation < TOMOYO_MAX_PATH2_OPERATION)
70 ? tomoyo_path2_keyword[operation] : NULL;
Kentaro Takedab69a54e2009-02-05 17:18:14 +090071}
72
73/**
74 * tomoyo_strendswith - Check whether the token ends with the given token.
75 *
76 * @name: The token to check.
77 * @tail: The token to find.
78 *
79 * Returns true if @name ends with @tail, false otherwise.
80 */
81static bool tomoyo_strendswith(const char *name, const char *tail)
82{
83 int len;
84
85 if (!name || !tail)
86 return false;
87 len = strlen(name) - strlen(tail);
88 return len >= 0 && !strcmp(name + len, tail);
89}
90
91/**
92 * tomoyo_get_path - Get realpath.
93 *
94 * @path: Pointer to "struct path".
95 *
96 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
97 */
98static struct tomoyo_path_info *tomoyo_get_path(struct path *path)
99{
100 int error;
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +0900101 struct tomoyo_path_info_with_data *buf = kzalloc(sizeof(*buf),
102 GFP_KERNEL);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900103
104 if (!buf)
105 return NULL;
106 /* Reserve one byte for appending "/". */
107 error = tomoyo_realpath_from_path2(path, buf->body,
108 sizeof(buf->body) - 2);
109 if (!error) {
110 buf->head.name = buf->body;
111 tomoyo_fill_path_info(&buf->head);
112 return &buf->head;
113 }
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +0900114 kfree(buf);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900115 return NULL;
116}
117
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900118static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
119 const char *filename2,
120 struct tomoyo_domain_info *const domain,
121 const bool is_delete);
122static int tomoyo_update_path_acl(const u8 type, const char *filename,
123 struct tomoyo_domain_info *const domain,
124 const bool is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900125
Tetsuo Handac3fa1092009-06-08 12:37:39 +0900126/*
127 * tomoyo_globally_readable_list is used for holding list of pathnames which
128 * are by default allowed to be open()ed for reading by any process.
129 *
130 * An entry is added by
131 *
132 * # echo 'allow_read /lib/libc-2.5.so' > \
133 * /sys/kernel/security/tomoyo/exception_policy
134 *
135 * and is deleted by
136 *
137 * # echo 'delete allow_read /lib/libc-2.5.so' > \
138 * /sys/kernel/security/tomoyo/exception_policy
139 *
140 * and all entries are retrieved by
141 *
142 * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
143 *
144 * In the example above, any process is allowed to
145 * open("/lib/libc-2.5.so", O_RDONLY).
146 * One exception is, if the domain which current process belongs to is marked
147 * as "ignore_global_allow_read", current process can't do so unless explicitly
148 * given "allow_read /lib/libc-2.5.so" to the domain which current process
149 * belongs to.
150 */
Tetsuo Handa847b1732010-02-11 09:43:54 +0900151LIST_HEAD(tomoyo_globally_readable_list);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900152
153/**
154 * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
155 *
156 * @filename: Filename unconditionally permitted to open() for reading.
157 * @is_delete: True if it is a delete request.
158 *
159 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900160 *
161 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900162 */
163static int tomoyo_update_globally_readable_entry(const char *filename,
164 const bool is_delete)
165{
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900166 struct tomoyo_globally_readable_file_entry *entry = NULL;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900167 struct tomoyo_globally_readable_file_entry *ptr;
168 const struct tomoyo_path_info *saved_filename;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900169 int error = is_delete ? -ENOENT : -ENOMEM;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900170
171 if (!tomoyo_is_correct_path(filename, 1, 0, -1, __func__))
172 return -EINVAL;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900173 saved_filename = tomoyo_get_name(filename);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900174 if (!saved_filename)
175 return -ENOMEM;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900176 if (!is_delete)
177 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
Tetsuo Handaf737d952010-01-03 21:16:32 +0900178 mutex_lock(&tomoyo_policy_lock);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900179 list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900180 if (ptr->filename != saved_filename)
181 continue;
182 ptr->is_deleted = is_delete;
183 error = 0;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900184 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900185 }
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900186 if (!is_delete && error && tomoyo_memory_ok(entry)) {
187 entry->filename = saved_filename;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900188 saved_filename = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900189 list_add_tail_rcu(&entry->list, &tomoyo_globally_readable_list);
190 entry = NULL;
191 error = 0;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900192 }
Tetsuo Handaf737d952010-01-03 21:16:32 +0900193 mutex_unlock(&tomoyo_policy_lock);
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900194 tomoyo_put_name(saved_filename);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900195 kfree(entry);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900196 return error;
197}
198
199/**
200 * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
201 *
202 * @filename: The filename to check.
203 *
204 * Returns true if any domain can open @filename for reading, false otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900205 *
206 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900207 */
208static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
209 filename)
210{
211 struct tomoyo_globally_readable_file_entry *ptr;
212 bool found = false;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900213
214 list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900215 if (!ptr->is_deleted &&
216 tomoyo_path_matches_pattern(filename, ptr->filename)) {
217 found = true;
218 break;
219 }
220 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900221 return found;
222}
223
224/**
225 * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
226 *
227 * @data: String to parse.
228 * @is_delete: True if it is a delete request.
229 *
230 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900231 *
232 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900233 */
234int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
235{
236 return tomoyo_update_globally_readable_entry(data, is_delete);
237}
238
239/**
240 * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
241 *
242 * @head: Pointer to "struct tomoyo_io_buffer".
243 *
244 * Returns true on success, false otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900245 *
246 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900247 */
248bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
249{
250 struct list_head *pos;
251 bool done = true;
252
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900253 list_for_each_cookie(pos, head->read_var2,
254 &tomoyo_globally_readable_list) {
255 struct tomoyo_globally_readable_file_entry *ptr;
256 ptr = list_entry(pos,
257 struct tomoyo_globally_readable_file_entry,
258 list);
259 if (ptr->is_deleted)
260 continue;
Tetsuo Handa7d2948b2009-06-02 20:42:24 +0900261 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
262 ptr->filename->name);
263 if (!done)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900264 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900265 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900266 return done;
267}
268
Tetsuo Handac3fa1092009-06-08 12:37:39 +0900269/* tomoyo_pattern_list is used for holding list of pathnames which are used for
270 * converting pathnames to pathname patterns during learning mode.
271 *
272 * An entry is added by
273 *
274 * # echo 'file_pattern /proc/\$/mounts' > \
275 * /sys/kernel/security/tomoyo/exception_policy
276 *
277 * and is deleted by
278 *
279 * # echo 'delete file_pattern /proc/\$/mounts' > \
280 * /sys/kernel/security/tomoyo/exception_policy
281 *
282 * and all entries are retrieved by
283 *
284 * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
285 *
286 * In the example above, if a process which belongs to a domain which is in
287 * learning mode requested open("/proc/1/mounts", O_RDONLY),
288 * "allow_read /proc/\$/mounts" is automatically added to the domain which that
289 * process belongs to.
290 *
291 * It is not a desirable behavior that we have to use /proc/\$/ instead of
292 * /proc/self/ when current process needs to access only current process's
293 * information. As of now, LSM version of TOMOYO is using __d_path() for
294 * calculating pathname. Non LSM version of TOMOYO is using its own function
295 * which pretends as if /proc/self/ is not a symlink; so that we can forbid
296 * current process from accessing other process's information.
297 */
Tetsuo Handa847b1732010-02-11 09:43:54 +0900298LIST_HEAD(tomoyo_pattern_list);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900299
300/**
301 * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
302 *
303 * @pattern: Pathname pattern.
304 * @is_delete: True if it is a delete request.
305 *
306 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900307 *
308 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900309 */
310static int tomoyo_update_file_pattern_entry(const char *pattern,
311 const bool is_delete)
312{
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900313 struct tomoyo_pattern_entry *entry = NULL;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900314 struct tomoyo_pattern_entry *ptr;
315 const struct tomoyo_path_info *saved_pattern;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900316 int error = is_delete ? -ENOENT : -ENOMEM;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900317
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900318 saved_pattern = tomoyo_get_name(pattern);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900319 if (!saved_pattern)
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900320 return error;
321 if (!saved_pattern->is_patterned)
322 goto out;
323 if (!is_delete)
324 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
Tetsuo Handaf737d952010-01-03 21:16:32 +0900325 mutex_lock(&tomoyo_policy_lock);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900326 list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900327 if (saved_pattern != ptr->pattern)
328 continue;
329 ptr->is_deleted = is_delete;
330 error = 0;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900331 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900332 }
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900333 if (!is_delete && error && tomoyo_memory_ok(entry)) {
334 entry->pattern = saved_pattern;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900335 saved_pattern = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900336 list_add_tail_rcu(&entry->list, &tomoyo_pattern_list);
337 entry = NULL;
338 error = 0;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900339 }
Tetsuo Handaf737d952010-01-03 21:16:32 +0900340 mutex_unlock(&tomoyo_policy_lock);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900341 out:
342 kfree(entry);
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900343 tomoyo_put_name(saved_pattern);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900344 return error;
345}
346
347/**
348 * tomoyo_get_file_pattern - Get patterned pathname.
349 *
350 * @filename: The filename to find patterned pathname.
351 *
352 * Returns pointer to pathname pattern if matched, @filename otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900353 *
354 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900355 */
356static const struct tomoyo_path_info *
357tomoyo_get_file_pattern(const struct tomoyo_path_info *filename)
358{
359 struct tomoyo_pattern_entry *ptr;
360 const struct tomoyo_path_info *pattern = NULL;
361
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900362 list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900363 if (ptr->is_deleted)
364 continue;
365 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
366 continue;
367 pattern = ptr->pattern;
368 if (tomoyo_strendswith(pattern->name, "/\\*")) {
369 /* Do nothing. Try to find the better match. */
370 } else {
371 /* This would be the better match. Use this. */
372 break;
373 }
374 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900375 if (pattern)
376 filename = pattern;
377 return filename;
378}
379
380/**
381 * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
382 *
383 * @data: String to parse.
384 * @is_delete: True if it is a delete request.
385 *
386 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900387 *
388 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900389 */
390int tomoyo_write_pattern_policy(char *data, const bool is_delete)
391{
392 return tomoyo_update_file_pattern_entry(data, is_delete);
393}
394
395/**
396 * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
397 *
398 * @head: Pointer to "struct tomoyo_io_buffer".
399 *
400 * Returns true on success, false otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900401 *
402 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900403 */
404bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
405{
406 struct list_head *pos;
407 bool done = true;
408
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900409 list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
410 struct tomoyo_pattern_entry *ptr;
411 ptr = list_entry(pos, struct tomoyo_pattern_entry, list);
412 if (ptr->is_deleted)
413 continue;
Tetsuo Handa7d2948b2009-06-02 20:42:24 +0900414 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
415 "%s\n", ptr->pattern->name);
416 if (!done)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900417 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900418 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900419 return done;
420}
421
Tetsuo Handac3fa1092009-06-08 12:37:39 +0900422/*
423 * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
424 * default forbidden to modify already written content of a file.
425 *
426 * An entry is added by
427 *
428 * # echo 'deny_rewrite /var/log/messages' > \
429 * /sys/kernel/security/tomoyo/exception_policy
430 *
431 * and is deleted by
432 *
433 * # echo 'delete deny_rewrite /var/log/messages' > \
434 * /sys/kernel/security/tomoyo/exception_policy
435 *
436 * and all entries are retrieved by
437 *
438 * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
439 *
440 * In the example above, if a process requested to rewrite /var/log/messages ,
441 * the process can't rewrite unless the domain which that process belongs to
442 * has "allow_rewrite /var/log/messages" entry.
443 *
444 * It is not a desirable behavior that we have to add "\040(deleted)" suffix
445 * when we want to allow rewriting already unlink()ed file. As of now,
446 * LSM version of TOMOYO is using __d_path() for calculating pathname.
447 * Non LSM version of TOMOYO is using its own function which doesn't append
448 * " (deleted)" suffix if the file is already unlink()ed; so that we don't
449 * need to worry whether the file is already unlink()ed or not.
450 */
Tetsuo Handa847b1732010-02-11 09:43:54 +0900451LIST_HEAD(tomoyo_no_rewrite_list);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900452
453/**
454 * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
455 *
456 * @pattern: Pathname pattern that are not rewritable by default.
457 * @is_delete: True if it is a delete request.
458 *
459 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900460 *
461 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900462 */
463static int tomoyo_update_no_rewrite_entry(const char *pattern,
464 const bool is_delete)
465{
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900466 struct tomoyo_no_rewrite_entry *entry = NULL;
467 struct tomoyo_no_rewrite_entry *ptr;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900468 const struct tomoyo_path_info *saved_pattern;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900469 int error = is_delete ? -ENOENT : -ENOMEM;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900470
471 if (!tomoyo_is_correct_path(pattern, 0, 0, 0, __func__))
472 return -EINVAL;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900473 saved_pattern = tomoyo_get_name(pattern);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900474 if (!saved_pattern)
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900475 return error;
476 if (!is_delete)
477 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
Tetsuo Handaf737d952010-01-03 21:16:32 +0900478 mutex_lock(&tomoyo_policy_lock);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900479 list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900480 if (ptr->pattern != saved_pattern)
481 continue;
482 ptr->is_deleted = is_delete;
483 error = 0;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900484 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900485 }
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900486 if (!is_delete && error && tomoyo_memory_ok(entry)) {
487 entry->pattern = saved_pattern;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900488 saved_pattern = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900489 list_add_tail_rcu(&entry->list, &tomoyo_no_rewrite_list);
490 entry = NULL;
491 error = 0;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900492 }
Tetsuo Handaf737d952010-01-03 21:16:32 +0900493 mutex_unlock(&tomoyo_policy_lock);
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900494 tomoyo_put_name(saved_pattern);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900495 kfree(entry);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900496 return error;
497}
498
499/**
500 * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
501 *
502 * @filename: Filename to check.
503 *
504 * Returns true if @filename is specified by "deny_rewrite" directive,
505 * false otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900506 *
507 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900508 */
509static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
510{
511 struct tomoyo_no_rewrite_entry *ptr;
512 bool found = false;
513
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900514 list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900515 if (ptr->is_deleted)
516 continue;
517 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
518 continue;
519 found = true;
520 break;
521 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900522 return found;
523}
524
525/**
526 * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
527 *
528 * @data: String to parse.
529 * @is_delete: True if it is a delete request.
530 *
531 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900532 *
533 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900534 */
535int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
536{
537 return tomoyo_update_no_rewrite_entry(data, is_delete);
538}
539
540/**
541 * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
542 *
543 * @head: Pointer to "struct tomoyo_io_buffer".
544 *
545 * Returns true on success, false otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900546 *
547 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900548 */
549bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
550{
551 struct list_head *pos;
552 bool done = true;
553
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900554 list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
555 struct tomoyo_no_rewrite_entry *ptr;
556 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry, list);
557 if (ptr->is_deleted)
558 continue;
Tetsuo Handa7d2948b2009-06-02 20:42:24 +0900559 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
560 "%s\n", ptr->pattern->name);
561 if (!done)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900562 break;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900563 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900564 return done;
565}
566
567/**
568 * tomoyo_update_file_acl - Update file's read/write/execute ACL.
569 *
570 * @filename: Filename.
571 * @perm: Permission (between 1 to 7).
572 * @domain: Pointer to "struct tomoyo_domain_info".
573 * @is_delete: True if it is a delete request.
574 *
575 * Returns 0 on success, negative value otherwise.
576 *
577 * This is legacy support interface for older policy syntax.
578 * Current policy syntax uses "allow_read/write" instead of "6",
579 * "allow_read" instead of "4", "allow_write" instead of "2",
580 * "allow_execute" instead of "1".
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900581 *
582 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900583 */
584static int tomoyo_update_file_acl(const char *filename, u8 perm,
585 struct tomoyo_domain_info * const domain,
586 const bool is_delete)
587{
588 if (perm > 7 || !perm) {
589 printk(KERN_DEBUG "%s: Invalid permission '%d %s'\n",
590 __func__, perm, filename);
591 return -EINVAL;
592 }
593 if (filename[0] != '@' && tomoyo_strendswith(filename, "/"))
594 /*
595 * Only 'allow_mkdir' and 'allow_rmdir' are valid for
596 * directory permissions.
597 */
598 return 0;
599 if (perm & 4)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900600 tomoyo_update_path_acl(TOMOYO_TYPE_READ, filename, domain,
601 is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900602 if (perm & 2)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900603 tomoyo_update_path_acl(TOMOYO_TYPE_WRITE, filename, domain,
604 is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900605 if (perm & 1)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900606 tomoyo_update_path_acl(TOMOYO_TYPE_EXECUTE, filename, domain,
607 is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900608 return 0;
609}
610
611/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900612 * tomoyo_path_acl2 - Check permission for single path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900613 *
614 * @domain: Pointer to "struct tomoyo_domain_info".
615 * @filename: Filename to check.
616 * @perm: Permission.
617 * @may_use_pattern: True if patterned ACL is permitted.
618 *
619 * Returns 0 on success, -EPERM otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900620 *
621 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900622 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900623static int tomoyo_path_acl2(const struct tomoyo_domain_info *domain,
624 const struct tomoyo_path_info *filename,
625 const u32 perm, const bool may_use_pattern)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900626{
627 struct tomoyo_acl_info *ptr;
628 int error = -EPERM;
629
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900630 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900631 struct tomoyo_path_acl *acl;
632 if (ptr->type != TOMOYO_TYPE_PATH_ACL)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900633 continue;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900634 acl = container_of(ptr, struct tomoyo_path_acl, head);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900635 if (perm <= 0xFFFF) {
636 if (!(acl->perm & perm))
637 continue;
638 } else {
639 if (!(acl->perm_high & (perm >> 16)))
640 continue;
641 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900642 if (may_use_pattern || !acl->filename->is_patterned) {
643 if (!tomoyo_path_matches_pattern(filename,
644 acl->filename))
645 continue;
646 } else {
647 continue;
648 }
649 error = 0;
650 break;
651 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900652 return error;
653}
654
655/**
656 * tomoyo_check_file_acl - Check permission for opening files.
657 *
658 * @domain: Pointer to "struct tomoyo_domain_info".
659 * @filename: Filename to check.
660 * @operation: Mode ("read" or "write" or "read/write" or "execute").
661 *
662 * Returns 0 on success, -EPERM otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900663 *
664 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900665 */
666static int tomoyo_check_file_acl(const struct tomoyo_domain_info *domain,
667 const struct tomoyo_path_info *filename,
668 const u8 operation)
669{
Tetsuo Handa937bf612009-12-02 21:09:48 +0900670 u32 perm = 0;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900671
672 if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
673 return 0;
674 if (operation == 6)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900675 perm = 1 << TOMOYO_TYPE_READ_WRITE;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900676 else if (operation == 4)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900677 perm = 1 << TOMOYO_TYPE_READ;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900678 else if (operation == 2)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900679 perm = 1 << TOMOYO_TYPE_WRITE;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900680 else if (operation == 1)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900681 perm = 1 << TOMOYO_TYPE_EXECUTE;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900682 else
683 BUG();
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900684 return tomoyo_path_acl2(domain, filename, perm, operation != 1);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900685}
686
687/**
688 * tomoyo_check_file_perm2 - Check permission for opening files.
689 *
690 * @domain: Pointer to "struct tomoyo_domain_info".
691 * @filename: Filename to check.
692 * @perm: Mode ("read" or "write" or "read/write" or "execute").
693 * @operation: Operation name passed used for verbose mode.
694 * @mode: Access control mode.
695 *
696 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900697 *
698 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900699 */
700static int tomoyo_check_file_perm2(struct tomoyo_domain_info * const domain,
701 const struct tomoyo_path_info *filename,
702 const u8 perm, const char *operation,
703 const u8 mode)
704{
705 const bool is_enforce = (mode == 3);
706 const char *msg = "<unknown>";
707 int error = 0;
708
709 if (!filename)
710 return 0;
711 error = tomoyo_check_file_acl(domain, filename, perm);
Tetsuo Handaea13ddb2010-02-03 06:43:06 +0900712 if (error && perm == 4 && !domain->ignore_global_allow_read
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900713 && tomoyo_is_globally_readable_file(filename))
714 error = 0;
715 if (perm == 6)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900716 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ_WRITE);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900717 else if (perm == 4)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900718 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900719 else if (perm == 2)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900720 msg = tomoyo_path2keyword(TOMOYO_TYPE_WRITE);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900721 else if (perm == 1)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900722 msg = tomoyo_path2keyword(TOMOYO_TYPE_EXECUTE);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900723 else
724 BUG();
725 if (!error)
726 return 0;
727 if (tomoyo_verbose_mode(domain))
728 printk(KERN_WARNING "TOMOYO-%s: Access '%s(%s) %s' denied "
729 "for %s\n", tomoyo_get_msg(is_enforce), msg, operation,
730 filename->name, tomoyo_get_last_name(domain));
731 if (is_enforce)
732 return error;
733 if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
734 /* Don't use patterns for execute permission. */
735 const struct tomoyo_path_info *patterned_file = (perm != 1) ?
736 tomoyo_get_file_pattern(filename) : filename;
737 tomoyo_update_file_acl(patterned_file->name, perm,
738 domain, false);
739 }
740 return 0;
741}
742
743/**
744 * tomoyo_write_file_policy - Update file related list.
745 *
746 * @data: String to parse.
747 * @domain: Pointer to "struct tomoyo_domain_info".
748 * @is_delete: True if it is a delete request.
749 *
750 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900751 *
752 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900753 */
754int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
755 const bool is_delete)
756{
757 char *filename = strchr(data, ' ');
758 char *filename2;
759 unsigned int perm;
760 u8 type;
761
762 if (!filename)
763 return -EINVAL;
764 *filename++ = '\0';
765 if (sscanf(data, "%u", &perm) == 1)
766 return tomoyo_update_file_acl(filename, (u8) perm, domain,
767 is_delete);
768 if (strncmp(data, "allow_", 6))
769 goto out;
770 data += 6;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900771 for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) {
772 if (strcmp(data, tomoyo_path_keyword[type]))
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900773 continue;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900774 return tomoyo_update_path_acl(type, filename, domain,
775 is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900776 }
777 filename2 = strchr(filename, ' ');
778 if (!filename2)
779 goto out;
780 *filename2++ = '\0';
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900781 for (type = 0; type < TOMOYO_MAX_PATH2_OPERATION; type++) {
782 if (strcmp(data, tomoyo_path2_keyword[type]))
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900783 continue;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900784 return tomoyo_update_path2_acl(type, filename, filename2,
785 domain, is_delete);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900786 }
787 out:
788 return -EINVAL;
789}
790
791/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900792 * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list.
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900793 *
794 * @type: Type of operation.
795 * @filename: Filename.
796 * @domain: Pointer to "struct tomoyo_domain_info".
797 * @is_delete: True if it is a delete request.
798 *
799 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900800 *
801 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900802 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900803static int tomoyo_update_path_acl(const u8 type, const char *filename,
804 struct tomoyo_domain_info *const domain,
805 const bool is_delete)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900806{
Tetsuo Handa937bf612009-12-02 21:09:48 +0900807 static const u32 rw_mask =
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900808 (1 << TOMOYO_TYPE_READ) | (1 << TOMOYO_TYPE_WRITE);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900809 const struct tomoyo_path_info *saved_filename;
810 struct tomoyo_acl_info *ptr;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900811 struct tomoyo_path_acl *entry = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900812 int error = is_delete ? -ENOENT : -ENOMEM;
Tetsuo Handa937bf612009-12-02 21:09:48 +0900813 const u32 perm = 1 << type;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900814
815 if (!domain)
816 return -EINVAL;
817 if (!tomoyo_is_correct_path(filename, 0, 0, 0, __func__))
818 return -EINVAL;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900819 saved_filename = tomoyo_get_name(filename);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900820 if (!saved_filename)
821 return -ENOMEM;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900822 if (!is_delete)
823 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
Tetsuo Handaf737d952010-01-03 21:16:32 +0900824 mutex_lock(&tomoyo_policy_lock);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900825 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900826 struct tomoyo_path_acl *acl =
827 container_of(ptr, struct tomoyo_path_acl, head);
828 if (ptr->type != TOMOYO_TYPE_PATH_ACL)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900829 continue;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900830 if (acl->filename != saved_filename)
831 continue;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900832 if (is_delete) {
833 if (perm <= 0xFFFF)
834 acl->perm &= ~perm;
835 else
836 acl->perm_high &= ~(perm >> 16);
837 if ((acl->perm & rw_mask) != rw_mask)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900838 acl->perm &= ~(1 << TOMOYO_TYPE_READ_WRITE);
839 else if (!(acl->perm & (1 << TOMOYO_TYPE_READ_WRITE)))
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900840 acl->perm &= ~rw_mask;
841 } else {
842 if (perm <= 0xFFFF)
843 acl->perm |= perm;
844 else
845 acl->perm_high |= (perm >> 16);
846 if ((acl->perm & rw_mask) == rw_mask)
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900847 acl->perm |= 1 << TOMOYO_TYPE_READ_WRITE;
848 else if (acl->perm & (1 << TOMOYO_TYPE_READ_WRITE))
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900849 acl->perm |= rw_mask;
850 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900851 error = 0;
852 break;
853 }
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900854 if (!is_delete && error && tomoyo_memory_ok(entry)) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900855 entry->head.type = TOMOYO_TYPE_PATH_ACL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900856 if (perm <= 0xFFFF)
857 entry->perm = perm;
858 else
859 entry->perm_high = (perm >> 16);
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900860 if (perm == (1 << TOMOYO_TYPE_READ_WRITE))
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900861 entry->perm |= rw_mask;
862 entry->filename = saved_filename;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900863 saved_filename = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900864 list_add_tail_rcu(&entry->head.list, &domain->acl_info_list);
865 entry = NULL;
866 error = 0;
867 }
Tetsuo Handaf737d952010-01-03 21:16:32 +0900868 mutex_unlock(&tomoyo_policy_lock);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900869 kfree(entry);
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900870 tomoyo_put_name(saved_filename);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900871 return error;
872}
873
874/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900875 * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list.
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900876 *
877 * @type: Type of operation.
878 * @filename1: First filename.
879 * @filename2: Second filename.
880 * @domain: Pointer to "struct tomoyo_domain_info".
881 * @is_delete: True if it is a delete request.
882 *
883 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900884 *
885 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900886 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900887static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
888 const char *filename2,
889 struct tomoyo_domain_info *const domain,
890 const bool is_delete)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900891{
892 const struct tomoyo_path_info *saved_filename1;
893 const struct tomoyo_path_info *saved_filename2;
894 struct tomoyo_acl_info *ptr;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900895 struct tomoyo_path2_acl *entry = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900896 int error = is_delete ? -ENOENT : -ENOMEM;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900897 const u8 perm = 1 << type;
898
899 if (!domain)
900 return -EINVAL;
901 if (!tomoyo_is_correct_path(filename1, 0, 0, 0, __func__) ||
902 !tomoyo_is_correct_path(filename2, 0, 0, 0, __func__))
903 return -EINVAL;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900904 saved_filename1 = tomoyo_get_name(filename1);
905 saved_filename2 = tomoyo_get_name(filename2);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900906 if (!saved_filename1 || !saved_filename2)
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900907 goto out;
908 if (!is_delete)
909 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
Tetsuo Handaf737d952010-01-03 21:16:32 +0900910 mutex_lock(&tomoyo_policy_lock);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900911 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900912 struct tomoyo_path2_acl *acl =
913 container_of(ptr, struct tomoyo_path2_acl, head);
914 if (ptr->type != TOMOYO_TYPE_PATH2_ACL)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900915 continue;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900916 if (acl->filename1 != saved_filename1 ||
917 acl->filename2 != saved_filename2)
918 continue;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900919 if (is_delete)
920 acl->perm &= ~perm;
921 else
922 acl->perm |= perm;
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900923 error = 0;
924 break;
925 }
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900926 if (!is_delete && error && tomoyo_memory_ok(entry)) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900927 entry->head.type = TOMOYO_TYPE_PATH2_ACL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900928 entry->perm = perm;
929 entry->filename1 = saved_filename1;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900930 saved_filename1 = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900931 entry->filename2 = saved_filename2;
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900932 saved_filename2 = NULL;
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900933 list_add_tail_rcu(&entry->head.list, &domain->acl_info_list);
934 entry = NULL;
935 error = 0;
936 }
Tetsuo Handaf737d952010-01-03 21:16:32 +0900937 mutex_unlock(&tomoyo_policy_lock);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900938 out:
Tetsuo Handabf24fb02010-02-11 09:41:58 +0900939 tomoyo_put_name(saved_filename1);
940 tomoyo_put_name(saved_filename2);
Tetsuo Handaca0b7df2010-02-07 20:23:59 +0900941 kfree(entry);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900942 return error;
943}
944
945/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900946 * tomoyo_path_acl - Check permission for single path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900947 *
948 * @domain: Pointer to "struct tomoyo_domain_info".
949 * @type: Type of operation.
950 * @filename: Filename to check.
951 *
952 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900953 *
954 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900955 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900956static int tomoyo_path_acl(struct tomoyo_domain_info *domain, const u8 type,
957 const struct tomoyo_path_info *filename)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900958{
959 if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
960 return 0;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900961 return tomoyo_path_acl2(domain, filename, 1 << type, 1);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900962}
963
964/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900965 * tomoyo_path2_acl - Check permission for double path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900966 *
967 * @domain: Pointer to "struct tomoyo_domain_info".
968 * @type: Type of operation.
969 * @filename1: First filename to check.
970 * @filename2: Second filename to check.
971 *
972 * Returns 0 on success, -EPERM otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900973 *
974 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900975 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900976static int tomoyo_path2_acl(const struct tomoyo_domain_info *domain,
977 const u8 type,
978 const struct tomoyo_path_info *filename1,
979 const struct tomoyo_path_info *filename2)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900980{
981 struct tomoyo_acl_info *ptr;
982 const u8 perm = 1 << type;
983 int error = -EPERM;
984
985 if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
986 return 0;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900987 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900988 struct tomoyo_path2_acl *acl;
989 if (ptr->type != TOMOYO_TYPE_PATH2_ACL)
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900990 continue;
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900991 acl = container_of(ptr, struct tomoyo_path2_acl, head);
Kentaro Takedab69a54e2009-02-05 17:18:14 +0900992 if (!(acl->perm & perm))
993 continue;
994 if (!tomoyo_path_matches_pattern(filename1, acl->filename1))
995 continue;
996 if (!tomoyo_path_matches_pattern(filename2, acl->filename2))
997 continue;
998 error = 0;
999 break;
1000 }
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001001 return error;
1002}
1003
1004/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001005 * tomoyo_path_permission2 - Check permission for single path operation.
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001006 *
1007 * @domain: Pointer to "struct tomoyo_domain_info".
1008 * @operation: Type of operation.
1009 * @filename: Filename to check.
1010 * @mode: Access control mode.
1011 *
1012 * Returns 0 on success, negative value otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001013 *
1014 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001015 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001016static int tomoyo_path_permission2(struct tomoyo_domain_info *const domain,
1017 u8 operation,
1018 const struct tomoyo_path_info *filename,
1019 const u8 mode)
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001020{
1021 const char *msg;
1022 int error;
1023 const bool is_enforce = (mode == 3);
1024
1025 if (!mode)
1026 return 0;
1027 next:
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001028 error = tomoyo_path_acl(domain, operation, filename);
1029 msg = tomoyo_path2keyword(operation);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001030 if (!error)
1031 goto ok;
1032 if (tomoyo_verbose_mode(domain))
1033 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s' denied for %s\n",
1034 tomoyo_get_msg(is_enforce), msg, filename->name,
1035 tomoyo_get_last_name(domain));
1036 if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1037 const char *name = tomoyo_get_file_pattern(filename)->name;
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001038 tomoyo_update_path_acl(operation, name, domain, false);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001039 }
1040 if (!is_enforce)
1041 error = 0;
1042 ok:
1043 /*
1044 * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1045 * we need to check "allow_rewrite" permission if the filename is
1046 * specified by "deny_rewrite" keyword.
1047 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001048 if (!error && operation == TOMOYO_TYPE_TRUNCATE &&
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001049 tomoyo_is_no_rewrite_file(filename)) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001050 operation = TOMOYO_TYPE_REWRITE;
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001051 goto next;
1052 }
1053 return error;
1054}
1055
1056/**
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001057 * tomoyo_check_exec_perm - Check permission for "execute".
1058 *
1059 * @domain: Pointer to "struct tomoyo_domain_info".
1060 * @filename: Check permission for "execute".
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001061 *
1062 * Returns 0 on success, negativevalue otherwise.
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001063 *
1064 * Caller holds tomoyo_read_lock().
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001065 */
1066int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain,
Tetsuo Handabcb86972009-06-04 15:14:34 +09001067 const struct tomoyo_path_info *filename)
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001068{
1069 const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1070
1071 if (!mode)
1072 return 0;
1073 return tomoyo_check_file_perm2(domain, filename, 1, "do_execve", mode);
1074}
1075
1076/**
1077 * tomoyo_check_open_permission - Check permission for "read" and "write".
1078 *
1079 * @domain: Pointer to "struct tomoyo_domain_info".
1080 * @path: Pointer to "struct path".
1081 * @flag: Flags for open().
1082 *
1083 * Returns 0 on success, negative value otherwise.
1084 */
1085int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1086 struct path *path, const int flag)
1087{
1088 const u8 acc_mode = ACC_MODE(flag);
1089 int error = -ENOMEM;
1090 struct tomoyo_path_info *buf;
1091 const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1092 const bool is_enforce = (mode == 3);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001093 int idx;
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001094
1095 if (!mode || !path->mnt)
1096 return 0;
1097 if (acc_mode == 0)
1098 return 0;
1099 if (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode))
1100 /*
1101 * I don't check directories here because mkdir() and rmdir()
1102 * don't call me.
1103 */
1104 return 0;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001105 idx = tomoyo_read_lock();
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001106 buf = tomoyo_get_path(path);
1107 if (!buf)
1108 goto out;
1109 error = 0;
1110 /*
1111 * If the filename is specified by "deny_rewrite" keyword,
1112 * we need to check "allow_rewrite" permission when the filename is not
1113 * opened for append mode or the filename is truncated at open time.
1114 */
1115 if ((acc_mode & MAY_WRITE) &&
1116 ((flag & O_TRUNC) || !(flag & O_APPEND)) &&
1117 (tomoyo_is_no_rewrite_file(buf))) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001118 error = tomoyo_path_permission2(domain, TOMOYO_TYPE_REWRITE,
1119 buf, mode);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001120 }
1121 if (!error)
1122 error = tomoyo_check_file_perm2(domain, buf, acc_mode, "open",
1123 mode);
1124 if (!error && (flag & O_TRUNC))
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001125 error = tomoyo_path_permission2(domain, TOMOYO_TYPE_TRUNCATE,
1126 buf, mode);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001127 out:
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +09001128 kfree(buf);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001129 tomoyo_read_unlock(idx);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001130 if (!is_enforce)
1131 error = 0;
1132 return error;
1133}
1134
1135/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001136 * tomoyo_path_perm - Check permission for "create", "unlink", "mkdir", "rmdir", "mkfifo", "mksock", "mkblock", "mkchar", "truncate", "symlink", "ioctl", "chmod", "chown", "chgrp", "chroot", "mount" and "unmount".
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001137 *
1138 * @domain: Pointer to "struct tomoyo_domain_info".
1139 * @operation: Type of operation.
1140 * @path: Pointer to "struct path".
1141 *
1142 * Returns 0 on success, negative value otherwise.
1143 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001144int tomoyo_path_perm(struct tomoyo_domain_info *domain,
1145 const u8 operation, struct path *path)
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001146{
1147 int error = -ENOMEM;
1148 struct tomoyo_path_info *buf;
1149 const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1150 const bool is_enforce = (mode == 3);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001151 int idx;
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001152
1153 if (!mode || !path->mnt)
1154 return 0;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001155 idx = tomoyo_read_lock();
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001156 buf = tomoyo_get_path(path);
1157 if (!buf)
1158 goto out;
1159 switch (operation) {
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001160 case TOMOYO_TYPE_MKDIR:
1161 case TOMOYO_TYPE_RMDIR:
1162 case TOMOYO_TYPE_CHROOT:
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001163 if (!buf->is_dir) {
1164 /*
1165 * tomoyo_get_path() reserves space for appending "/."
1166 */
1167 strcat((char *) buf->name, "/");
1168 tomoyo_fill_path_info(buf);
1169 }
1170 }
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001171 error = tomoyo_path_permission2(domain, operation, buf, mode);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001172 out:
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +09001173 kfree(buf);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001174 tomoyo_read_unlock(idx);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001175 if (!is_enforce)
1176 error = 0;
1177 return error;
1178}
1179
1180/**
1181 * tomoyo_check_rewrite_permission - Check permission for "rewrite".
1182 *
1183 * @domain: Pointer to "struct tomoyo_domain_info".
1184 * @filp: Pointer to "struct file".
1185 *
1186 * Returns 0 on success, negative value otherwise.
1187 */
1188int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain,
1189 struct file *filp)
1190{
1191 int error = -ENOMEM;
1192 const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1193 const bool is_enforce = (mode == 3);
1194 struct tomoyo_path_info *buf;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001195 int idx;
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001196
1197 if (!mode || !filp->f_path.mnt)
1198 return 0;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001199
1200 idx = tomoyo_read_lock();
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001201 buf = tomoyo_get_path(&filp->f_path);
1202 if (!buf)
1203 goto out;
1204 if (!tomoyo_is_no_rewrite_file(buf)) {
1205 error = 0;
1206 goto out;
1207 }
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001208 error = tomoyo_path_permission2(domain, TOMOYO_TYPE_REWRITE, buf, mode);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001209 out:
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +09001210 kfree(buf);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001211 tomoyo_read_unlock(idx);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001212 if (!is_enforce)
1213 error = 0;
1214 return error;
1215}
1216
1217/**
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001218 * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root".
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001219 *
1220 * @domain: Pointer to "struct tomoyo_domain_info".
1221 * @operation: Type of operation.
1222 * @path1: Pointer to "struct path".
1223 * @path2: Pointer to "struct path".
1224 *
1225 * Returns 0 on success, negative value otherwise.
1226 */
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001227int tomoyo_path2_perm(struct tomoyo_domain_info * const domain,
1228 const u8 operation, struct path *path1,
1229 struct path *path2)
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001230{
1231 int error = -ENOMEM;
1232 struct tomoyo_path_info *buf1, *buf2;
1233 const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1234 const bool is_enforce = (mode == 3);
1235 const char *msg;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001236 int idx;
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001237
1238 if (!mode || !path1->mnt || !path2->mnt)
1239 return 0;
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001240 idx = tomoyo_read_lock();
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001241 buf1 = tomoyo_get_path(path1);
1242 buf2 = tomoyo_get_path(path2);
1243 if (!buf1 || !buf2)
1244 goto out;
1245 {
1246 struct dentry *dentry = path1->dentry;
1247 if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)) {
1248 /*
1249 * tomoyo_get_path() reserves space for appending "/."
1250 */
1251 if (!buf1->is_dir) {
1252 strcat((char *) buf1->name, "/");
1253 tomoyo_fill_path_info(buf1);
1254 }
1255 if (!buf2->is_dir) {
1256 strcat((char *) buf2->name, "/");
1257 tomoyo_fill_path_info(buf2);
1258 }
1259 }
1260 }
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001261 error = tomoyo_path2_acl(domain, operation, buf1, buf2);
1262 msg = tomoyo_path22keyword(operation);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001263 if (!error)
1264 goto out;
1265 if (tomoyo_verbose_mode(domain))
1266 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s %s' "
1267 "denied for %s\n", tomoyo_get_msg(is_enforce),
1268 msg, buf1->name, buf2->name,
1269 tomoyo_get_last_name(domain));
1270 if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1271 const char *name1 = tomoyo_get_file_pattern(buf1)->name;
1272 const char *name2 = tomoyo_get_file_pattern(buf2)->name;
Tetsuo Handa7ef61232010-02-16 08:03:30 +09001273 tomoyo_update_path2_acl(operation, name1, name2, domain,
1274 false);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001275 }
1276 out:
Tetsuo Handa8e2d39a2010-01-26 20:45:27 +09001277 kfree(buf1);
1278 kfree(buf2);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +09001279 tomoyo_read_unlock(idx);
Kentaro Takedab69a54e2009-02-05 17:18:14 +09001280 if (!is_enforce)
1281 error = 0;
1282 return error;
1283}