blob: 75c998700190ce260f54926e2d49236c154229e6 [file] [log] [blame]
Kentaro Takedaf7433242009-02-05 17:18:16 +09001/*
2 * security/tomoyo/tomoyo.c
3 *
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +09004 * Copyright (C) 2005-2011 NTT DATA CORPORATION
Kentaro Takedaf7433242009-02-05 17:18:16 +09005 */
6
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -07007#include <linux/lsm_hooks.h>
Kentaro Takedaf7433242009-02-05 17:18:16 +09008#include "common.h"
Kentaro Takedaf7433242009-02-05 17:18:16 +09009
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +090010/**
11 * tomoyo_cred_alloc_blank - Target for security_cred_alloc_blank().
12 *
13 * @new: Pointer to "struct cred".
14 * @gfp: Memory allocation flags.
15 *
16 * Returns 0.
17 */
David Howellsee18d642009-09-02 09:14:21 +010018static int tomoyo_cred_alloc_blank(struct cred *new, gfp_t gfp)
19{
20 new->security = NULL;
21 return 0;
22}
23
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +090024/**
25 * tomoyo_cred_prepare - Target for security_prepare_creds().
26 *
27 * @new: Pointer to "struct cred".
28 * @old: Pointer to "struct cred".
29 * @gfp: Memory allocation flags.
30 *
31 * Returns 0.
32 */
Kentaro Takedaf7433242009-02-05 17:18:16 +090033static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
34 gfp_t gfp)
35{
Tetsuo Handaec8e6a42010-02-11 09:43:20 +090036 struct tomoyo_domain_info *domain = old->security;
37 new->security = domain;
38 if (domain)
39 atomic_inc(&domain->users);
Kentaro Takedaf7433242009-02-05 17:18:16 +090040 return 0;
41}
42
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +090043/**
44 * tomoyo_cred_transfer - Target for security_transfer_creds().
45 *
46 * @new: Pointer to "struct cred".
47 * @old: Pointer to "struct cred".
48 */
David Howellsee18d642009-09-02 09:14:21 +010049static void tomoyo_cred_transfer(struct cred *new, const struct cred *old)
50{
Tetsuo Handaec8e6a42010-02-11 09:43:20 +090051 tomoyo_cred_prepare(new, old, 0);
52}
53
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +090054/**
55 * tomoyo_cred_free - Target for security_cred_free().
56 *
57 * @cred: Pointer to "struct cred".
58 */
Tetsuo Handaec8e6a42010-02-11 09:43:20 +090059static void tomoyo_cred_free(struct cred *cred)
60{
61 struct tomoyo_domain_info *domain = cred->security;
62 if (domain)
63 atomic_dec(&domain->users);
David Howellsee18d642009-09-02 09:14:21 +010064}
65
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +090066/**
67 * tomoyo_bprm_set_creds - Target for security_bprm_set_creds().
68 *
69 * @bprm: Pointer to "struct linux_binprm".
70 *
71 * Returns 0 on success, negative value otherwise.
72 */
Kentaro Takedaf7433242009-02-05 17:18:16 +090073static int tomoyo_bprm_set_creds(struct linux_binprm *bprm)
74{
75 /*
76 * Do only if this function is called for the first time of an execve
77 * operation.
78 */
79 if (bprm->cred_prepared)
80 return 0;
Tetsuo Handa7986cf22011-06-29 13:07:52 +090081#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
Kentaro Takedaf7433242009-02-05 17:18:16 +090082 /*
83 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
84 * for the first time.
85 */
86 if (!tomoyo_policy_loaded)
87 tomoyo_load_policy(bprm->filename);
Tetsuo Handa7986cf22011-06-29 13:07:52 +090088#endif
Kentaro Takedaf7433242009-02-05 17:18:16 +090089 /*
Tetsuo Handaec8e6a42010-02-11 09:43:20 +090090 * Release reference to "struct tomoyo_domain_info" stored inside
91 * "bprm->cred->security". New reference to "struct tomoyo_domain_info"
92 * stored inside "bprm->cred->security" will be acquired later inside
93 * tomoyo_find_next_domain().
94 */
95 atomic_dec(&((struct tomoyo_domain_info *)
96 bprm->cred->security)->users);
97 /*
Kentaro Takedaf7433242009-02-05 17:18:16 +090098 * Tell tomoyo_bprm_check_security() is called for the first time of an
99 * execve operation.
100 */
101 bprm->cred->security = NULL;
102 return 0;
103}
104
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900105/**
106 * tomoyo_bprm_check_security - Target for security_bprm_check().
107 *
108 * @bprm: Pointer to "struct linux_binprm".
109 *
110 * Returns 0 on success, negative value otherwise.
111 */
Kentaro Takedaf7433242009-02-05 17:18:16 +0900112static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
113{
114 struct tomoyo_domain_info *domain = bprm->cred->security;
115
116 /*
117 * Execute permission is checked against pathname passed to do_execve()
118 * using current domain.
119 */
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900120 if (!domain) {
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900121 const int idx = tomoyo_read_lock();
122 const int err = tomoyo_find_next_domain(bprm);
123 tomoyo_read_unlock(idx);
124 return err;
125 }
Kentaro Takedaf7433242009-02-05 17:18:16 +0900126 /*
127 * Read permission is checked against interpreters using next domain.
Kentaro Takedaf7433242009-02-05 17:18:16 +0900128 */
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900129 return tomoyo_check_open_permission(domain, &bprm->file->f_path,
130 O_RDONLY);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900131}
132
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900133/**
134 * tomoyo_inode_getattr - Target for security_inode_getattr().
135 *
136 * @mnt: Pointer to "struct vfsmount".
137 * @dentry: Pointer to "struct dentry".
138 *
139 * Returns 0 on success, negative value otherwise.
140 */
Al Viro3f7036a2015-03-08 19:28:30 -0400141static int tomoyo_inode_getattr(const struct path *path)
Tetsuo Handa7c759642011-06-26 23:15:31 +0900142{
Al Viro3f7036a2015-03-08 19:28:30 -0400143 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
Tetsuo Handa7c759642011-06-26 23:15:31 +0900144}
145
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900146/**
147 * tomoyo_path_truncate - Target for security_path_truncate().
148 *
149 * @path: Pointer to "struct path".
150 *
151 * Returns 0 on success, negative value otherwise.
152 */
Al Viro81f4c502016-03-25 14:22:01 -0400153static int tomoyo_path_truncate(const struct path *path)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900154{
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900155 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900156}
157
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900158/**
159 * tomoyo_path_unlink - Target for security_path_unlink().
160 *
161 * @parent: Pointer to "struct path".
162 * @dentry: Pointer to "struct dentry".
163 *
164 * Returns 0 on success, negative value otherwise.
165 */
Al Viro989f74e2016-03-25 15:13:39 -0400166static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900167{
168 struct path path = { parent->mnt, dentry };
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900169 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900170}
171
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900172/**
173 * tomoyo_path_mkdir - Target for security_path_mkdir().
174 *
175 * @parent: Pointer to "struct path".
176 * @dentry: Pointer to "struct dentry".
177 * @mode: DAC permission mode.
178 *
179 * Returns 0 on success, negative value otherwise.
180 */
Al Virod3607752016-03-25 15:21:09 -0400181static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
Al Viro4572bef2011-11-21 14:56:21 -0500182 umode_t mode)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900183{
184 struct path path = { parent->mnt, dentry };
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900185 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
186 mode & S_IALLUGO);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900187}
188
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900189/**
190 * tomoyo_path_rmdir - Target for security_path_rmdir().
191 *
192 * @parent: Pointer to "struct path".
193 * @dentry: Pointer to "struct dentry".
194 *
195 * Returns 0 on success, negative value otherwise.
196 */
Al Viro989f74e2016-03-25 15:13:39 -0400197static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900198{
199 struct path path = { parent->mnt, dentry };
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900200 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900201}
202
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900203/**
204 * tomoyo_path_symlink - Target for security_path_symlink().
205 *
206 * @parent: Pointer to "struct path".
207 * @dentry: Pointer to "struct dentry".
208 * @old_name: Symlink's content.
209 *
210 * Returns 0 on success, negative value otherwise.
211 */
Al Virod3607752016-03-25 15:21:09 -0400212static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
Kentaro Takedaf7433242009-02-05 17:18:16 +0900213 const char *old_name)
214{
215 struct path path = { parent->mnt, dentry };
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900216 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900217}
218
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900219/**
220 * tomoyo_path_mknod - Target for security_path_mknod().
221 *
222 * @parent: Pointer to "struct path".
223 * @dentry: Pointer to "struct dentry".
224 * @mode: DAC permission mode.
225 * @dev: Device attributes.
226 *
227 * Returns 0 on success, negative value otherwise.
228 */
Al Virod3607752016-03-25 15:21:09 -0400229static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
Al Viro04fc66e2011-11-21 14:58:38 -0500230 umode_t mode, unsigned int dev)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900231{
232 struct path path = { parent->mnt, dentry };
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900233 int type = TOMOYO_TYPE_CREATE;
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900234 const unsigned int perm = mode & S_IALLUGO;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900235
236 switch (mode & S_IFMT) {
237 case S_IFCHR:
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900238 type = TOMOYO_TYPE_MKCHAR;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900239 break;
240 case S_IFBLK:
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900241 type = TOMOYO_TYPE_MKBLOCK;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900242 break;
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900243 default:
244 goto no_dev;
245 }
Tetsuo Handa75093152010-06-16 16:23:55 +0900246 return tomoyo_mkdev_perm(type, &path, perm, dev);
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900247 no_dev:
248 switch (mode & S_IFMT) {
Kentaro Takedaf7433242009-02-05 17:18:16 +0900249 case S_IFIFO:
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900250 type = TOMOYO_TYPE_MKFIFO;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900251 break;
252 case S_IFSOCK:
Tetsuo Handa7ef61232010-02-16 08:03:30 +0900253 type = TOMOYO_TYPE_MKSOCK;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900254 break;
255 }
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900256 return tomoyo_path_number_perm(type, &path, perm);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900257}
258
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900259/**
260 * tomoyo_path_link - Target for security_path_link().
261 *
262 * @old_dentry: Pointer to "struct dentry".
263 * @new_dir: Pointer to "struct path".
264 * @new_dentry: Pointer to "struct dentry".
265 *
266 * Returns 0 on success, negative value otherwise.
267 */
Al Viro3ccee462016-03-25 15:27:45 -0400268static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
Kentaro Takedaf7433242009-02-05 17:18:16 +0900269 struct dentry *new_dentry)
270{
271 struct path path1 = { new_dir->mnt, old_dentry };
272 struct path path2 = { new_dir->mnt, new_dentry };
Tetsuo Handa97d69312010-02-16 09:46:15 +0900273 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900274}
275
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900276/**
277 * tomoyo_path_rename - Target for security_path_rename().
278 *
279 * @old_parent: Pointer to "struct path".
280 * @old_dentry: Pointer to "struct dentry".
281 * @new_parent: Pointer to "struct path".
282 * @new_dentry: Pointer to "struct dentry".
283 *
284 * Returns 0 on success, negative value otherwise.
285 */
Al Viro3ccee462016-03-25 15:27:45 -0400286static int tomoyo_path_rename(const struct path *old_parent,
Kentaro Takedaf7433242009-02-05 17:18:16 +0900287 struct dentry *old_dentry,
Al Viro3ccee462016-03-25 15:27:45 -0400288 const struct path *new_parent,
Kentaro Takedaf7433242009-02-05 17:18:16 +0900289 struct dentry *new_dentry)
290{
291 struct path path1 = { old_parent->mnt, old_dentry };
292 struct path path2 = { new_parent->mnt, new_dentry };
Tetsuo Handa97d69312010-02-16 09:46:15 +0900293 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
Kentaro Takedaf7433242009-02-05 17:18:16 +0900294}
295
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900296/**
297 * tomoyo_file_fcntl - Target for security_file_fcntl().
298 *
299 * @file: Pointer to "struct file".
300 * @cmd: Command for fcntl().
301 * @arg: Argument for @cmd.
302 *
303 * Returns 0 on success, negative value otherwise.
304 */
Kentaro Takedaf7433242009-02-05 17:18:16 +0900305static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
306 unsigned long arg)
307{
Tetsuo Handa7c759642011-06-26 23:15:31 +0900308 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
309 return 0;
310 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path,
311 O_WRONLY | (arg & O_APPEND));
Kentaro Takedaf7433242009-02-05 17:18:16 +0900312}
313
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900314/**
Eric Paris83d49852012-04-04 13:45:40 -0400315 * tomoyo_file_open - Target for security_file_open().
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900316 *
317 * @f: Pointer to "struct file".
318 * @cred: Pointer to "struct cred".
319 *
320 * Returns 0 on success, negative value otherwise.
321 */
Eric Paris83d49852012-04-04 13:45:40 -0400322static int tomoyo_file_open(struct file *f, const struct cred *cred)
Kentaro Takedaf7433242009-02-05 17:18:16 +0900323{
324 int flags = f->f_flags;
Kentaro Takedaf7433242009-02-05 17:18:16 +0900325 /* Don't check read permission here if called from do_execve(). */
326 if (current->in_execve)
327 return 0;
328 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags);
329}
330
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900331/**
332 * tomoyo_file_ioctl - Target for security_file_ioctl().
333 *
334 * @file: Pointer to "struct file".
335 * @cmd: Command for ioctl().
336 * @arg: Argument for @cmd.
337 *
338 * Returns 0 on success, negative value otherwise.
339 */
Tetsuo Handa937bf612009-12-02 21:09:48 +0900340static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
341 unsigned long arg)
342{
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900343 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900344}
345
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900346/**
347 * tomoyo_path_chmod - Target for security_path_chmod().
348 *
Al Virocdcf1162011-12-08 10:51:53 -0500349 * @path: Pointer to "struct path".
350 * @mode: DAC permission mode.
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900351 *
352 * Returns 0 on success, negative value otherwise.
353 */
Al Virobe01f9f2016-03-25 14:56:23 -0400354static int tomoyo_path_chmod(const struct path *path, umode_t mode)
Tetsuo Handa937bf612009-12-02 21:09:48 +0900355{
Al Virocdcf1162011-12-08 10:51:53 -0500356 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
Tetsuo Handaa1f9bb62010-05-17 10:09:15 +0900357 mode & S_IALLUGO);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900358}
359
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900360/**
361 * tomoyo_path_chown - Target for security_path_chown().
362 *
363 * @path: Pointer to "struct path".
364 * @uid: Owner ID.
365 * @gid: Group ID.
366 *
367 * Returns 0 on success, negative value otherwise.
368 */
Al Viro7fd25da2016-03-25 14:44:41 -0400369static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
Tetsuo Handa937bf612009-12-02 21:09:48 +0900370{
371 int error = 0;
Eric W. Biedermand2b31ca2012-06-01 16:14:19 -0600372 if (uid_valid(uid))
373 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
374 from_kuid(&init_user_ns, uid));
375 if (!error && gid_valid(gid))
376 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path,
377 from_kgid(&init_user_ns, gid));
Tetsuo Handa937bf612009-12-02 21:09:48 +0900378 return error;
379}
380
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900381/**
382 * tomoyo_path_chroot - Target for security_path_chroot().
383 *
384 * @path: Pointer to "struct path".
385 *
386 * Returns 0 on success, negative value otherwise.
387 */
Al Viro77b286c2016-03-25 15:28:43 -0400388static int tomoyo_path_chroot(const struct path *path)
Tetsuo Handa937bf612009-12-02 21:09:48 +0900389{
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900390 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900391}
392
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900393/**
394 * tomoyo_sb_mount - Target for security_sb_mount().
395 *
396 * @dev_name: Name of device file. Maybe NULL.
397 * @path: Pointer to "struct path".
398 * @type: Name of filesystem type. Maybe NULL.
399 * @flags: Mount options.
400 * @data: Optional data. Maybe NULL.
401 *
402 * Returns 0 on success, negative value otherwise.
403 */
Al Viro8a04c432016-03-25 14:52:53 -0400404static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -0400405 const char *type, unsigned long flags, void *data)
Tetsuo Handa937bf612009-12-02 21:09:48 +0900406{
Tetsuo Handa2106ccd2010-05-17 10:10:31 +0900407 return tomoyo_mount_permission(dev_name, path, type, flags, data);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900408}
409
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900410/**
411 * tomoyo_sb_umount - Target for security_sb_umount().
412 *
413 * @mnt: Pointer to "struct vfsmount".
414 * @flags: Unmount options.
415 *
416 * Returns 0 on success, negative value otherwise.
417 */
Tetsuo Handa937bf612009-12-02 21:09:48 +0900418static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
419{
420 struct path path = { mnt, mnt->mnt_root };
Tetsuo Handa97fb35e2011-07-08 13:25:53 +0900421 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900422}
423
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900424/**
425 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
426 *
427 * @old_path: Pointer to "struct path".
428 * @new_path: Pointer to "struct path".
429 *
430 * Returns 0 on success, negative value otherwise.
431 */
Al Viro3b73b682016-03-25 15:31:19 -0400432static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
Tetsuo Handa937bf612009-12-02 21:09:48 +0900433{
Tetsuo Handa97d69312010-02-16 09:46:15 +0900434 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
Tetsuo Handa937bf612009-12-02 21:09:48 +0900435}
436
Tetsuo Handa059d84d2011-09-10 15:23:54 +0900437/**
438 * tomoyo_socket_listen - Check permission for listen().
439 *
440 * @sock: Pointer to "struct socket".
441 * @backlog: Backlog parameter.
442 *
443 * Returns 0 on success, negative value otherwise.
444 */
445static int tomoyo_socket_listen(struct socket *sock, int backlog)
446{
447 return tomoyo_socket_listen_permission(sock);
448}
449
450/**
451 * tomoyo_socket_connect - Check permission for connect().
452 *
453 * @sock: Pointer to "struct socket".
454 * @addr: Pointer to "struct sockaddr".
455 * @addr_len: Size of @addr.
456 *
457 * Returns 0 on success, negative value otherwise.
458 */
459static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
460 int addr_len)
461{
462 return tomoyo_socket_connect_permission(sock, addr, addr_len);
463}
464
465/**
466 * tomoyo_socket_bind - Check permission for bind().
467 *
468 * @sock: Pointer to "struct socket".
469 * @addr: Pointer to "struct sockaddr".
470 * @addr_len: Size of @addr.
471 *
472 * Returns 0 on success, negative value otherwise.
473 */
474static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
475 int addr_len)
476{
477 return tomoyo_socket_bind_permission(sock, addr, addr_len);
478}
479
480/**
481 * tomoyo_socket_sendmsg - Check permission for sendmsg().
482 *
483 * @sock: Pointer to "struct socket".
484 * @msg: Pointer to "struct msghdr".
485 * @size: Size of message.
486 *
487 * Returns 0 on success, negative value otherwise.
488 */
489static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
490 int size)
491{
492 return tomoyo_socket_sendmsg_permission(sock, msg, size);
493}
494
Tetsuo Handac3fa1092009-06-08 12:37:39 +0900495/*
496 * tomoyo_security_ops is a "struct security_operations" which is used for
497 * registering TOMOYO.
498 */
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700499static struct security_hook_list tomoyo_hooks[] = {
Casey Schauflere20b0432015-05-02 15:11:36 -0700500 LSM_HOOK_INIT(cred_alloc_blank, tomoyo_cred_alloc_blank),
501 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
502 LSM_HOOK_INIT(cred_transfer, tomoyo_cred_transfer),
503 LSM_HOOK_INIT(cred_free, tomoyo_cred_free),
504 LSM_HOOK_INIT(bprm_set_creds, tomoyo_bprm_set_creds),
505 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
506 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
507 LSM_HOOK_INIT(file_open, tomoyo_file_open),
508 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
509 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
510 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
511 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
512 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
513 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
514 LSM_HOOK_INIT(path_link, tomoyo_path_link),
515 LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
516 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
517 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
518 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
519 LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
520 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
521 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
522 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
523 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
524 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
525 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
526 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
527 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
Kentaro Takedaf7433242009-02-05 17:18:16 +0900528};
529
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900530/* Lock for GC. */
Lai Jiangshan505f14f2013-03-16 00:50:53 +0800531DEFINE_SRCU(tomoyo_ss);
Tetsuo Handafdb8ebb2009-12-08 09:34:43 +0900532
Tetsuo Handa0f2a55d2011-07-14 14:46:51 +0900533/**
534 * tomoyo_init - Register TOMOYO Linux as a LSM module.
535 *
536 * Returns 0.
537 */
Kentaro Takedaf7433242009-02-05 17:18:16 +0900538static int __init tomoyo_init(void)
539{
540 struct cred *cred = (struct cred *) current_cred();
541
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700542 if (!security_module_enable("tomoyo"))
Kentaro Takedaf7433242009-02-05 17:18:16 +0900543 return 0;
544 /* register ourselves with the security framework */
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -0700545 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks));
Kentaro Takedaf7433242009-02-05 17:18:16 +0900546 printk(KERN_INFO "TOMOYO Linux initialized\n");
547 cred->security = &tomoyo_kernel_domain;
Tetsuo Handac3ef1502010-05-17 10:12:46 +0900548 tomoyo_mm_init();
Kentaro Takedaf7433242009-02-05 17:18:16 +0900549 return 0;
550}
551
552security_initcall(tomoyo_init);