Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 1 | /* |
| 2 | * security/tomoyo/tomoyo.c |
| 3 | * |
| 4 | * LSM hooks for TOMOYO Linux. |
| 5 | * |
Tetsuo Handa | c3ef150 | 2010-05-17 10:12:46 +0900 | [diff] [blame] | 6 | * Copyright (C) 2005-2010 NTT DATA CORPORATION |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 7 | */ |
| 8 | |
| 9 | #include <linux/security.h> |
| 10 | #include "common.h" |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 11 | |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 12 | static int tomoyo_cred_alloc_blank(struct cred *new, gfp_t gfp) |
| 13 | { |
| 14 | new->security = NULL; |
| 15 | return 0; |
| 16 | } |
| 17 | |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 18 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
| 19 | gfp_t gfp) |
| 20 | { |
Tetsuo Handa | ec8e6a4 | 2010-02-11 09:43:20 +0900 | [diff] [blame] | 21 | struct tomoyo_domain_info *domain = old->security; |
| 22 | new->security = domain; |
| 23 | if (domain) |
| 24 | atomic_inc(&domain->users); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 25 | return 0; |
| 26 | } |
| 27 | |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 28 | static void tomoyo_cred_transfer(struct cred *new, const struct cred *old) |
| 29 | { |
Tetsuo Handa | ec8e6a4 | 2010-02-11 09:43:20 +0900 | [diff] [blame] | 30 | tomoyo_cred_prepare(new, old, 0); |
| 31 | } |
| 32 | |
| 33 | static void tomoyo_cred_free(struct cred *cred) |
| 34 | { |
| 35 | struct tomoyo_domain_info *domain = cred->security; |
| 36 | if (domain) |
| 37 | atomic_dec(&domain->users); |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 38 | } |
| 39 | |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 40 | static int tomoyo_bprm_set_creds(struct linux_binprm *bprm) |
| 41 | { |
Herton Ronaldo Krzesinski | b1338d1 | 2009-05-26 12:15:53 +0900 | [diff] [blame] | 42 | int rc; |
| 43 | |
| 44 | rc = cap_bprm_set_creds(bprm); |
| 45 | if (rc) |
| 46 | return rc; |
| 47 | |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 48 | /* |
| 49 | * Do only if this function is called for the first time of an execve |
| 50 | * operation. |
| 51 | */ |
| 52 | if (bprm->cred_prepared) |
| 53 | return 0; |
| 54 | /* |
| 55 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested |
| 56 | * for the first time. |
| 57 | */ |
| 58 | if (!tomoyo_policy_loaded) |
| 59 | tomoyo_load_policy(bprm->filename); |
| 60 | /* |
Tetsuo Handa | ec8e6a4 | 2010-02-11 09:43:20 +0900 | [diff] [blame] | 61 | * Release reference to "struct tomoyo_domain_info" stored inside |
| 62 | * "bprm->cred->security". New reference to "struct tomoyo_domain_info" |
| 63 | * stored inside "bprm->cred->security" will be acquired later inside |
| 64 | * tomoyo_find_next_domain(). |
| 65 | */ |
| 66 | atomic_dec(&((struct tomoyo_domain_info *) |
| 67 | bprm->cred->security)->users); |
| 68 | /* |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 69 | * Tell tomoyo_bprm_check_security() is called for the first time of an |
| 70 | * execve operation. |
| 71 | */ |
| 72 | bprm->cred->security = NULL; |
| 73 | return 0; |
| 74 | } |
| 75 | |
| 76 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
| 77 | { |
| 78 | struct tomoyo_domain_info *domain = bprm->cred->security; |
| 79 | |
| 80 | /* |
| 81 | * Execute permission is checked against pathname passed to do_execve() |
| 82 | * using current domain. |
| 83 | */ |
Tetsuo Handa | fdb8ebb | 2009-12-08 09:34:43 +0900 | [diff] [blame] | 84 | if (!domain) { |
Tetsuo Handa | fdb8ebb | 2009-12-08 09:34:43 +0900 | [diff] [blame] | 85 | const int idx = tomoyo_read_lock(); |
| 86 | const int err = tomoyo_find_next_domain(bprm); |
| 87 | tomoyo_read_unlock(idx); |
| 88 | return err; |
| 89 | } |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 90 | /* |
| 91 | * Read permission is checked against interpreters using next domain. |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 92 | */ |
Al Viro | 6d12552 | 2009-12-24 06:58:56 -0500 | [diff] [blame] | 93 | return tomoyo_check_open_permission(domain, &bprm->file->f_path, O_RDONLY); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 94 | } |
| 95 | |
Tetsuo Handa | ea0d3ab | 2010-06-02 13:24:43 +0900 | [diff] [blame^] | 96 | static int tomoyo_path_truncate(struct path *path) |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 97 | { |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 98 | return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 99 | } |
| 100 | |
| 101 | static int tomoyo_path_unlink(struct path *parent, struct dentry *dentry) |
| 102 | { |
| 103 | struct path path = { parent->mnt, dentry }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 104 | return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 105 | } |
| 106 | |
| 107 | static int tomoyo_path_mkdir(struct path *parent, struct dentry *dentry, |
| 108 | int mode) |
| 109 | { |
| 110 | struct path path = { parent->mnt, dentry }; |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 111 | return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, |
| 112 | mode & S_IALLUGO); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 113 | } |
| 114 | |
| 115 | static int tomoyo_path_rmdir(struct path *parent, struct dentry *dentry) |
| 116 | { |
| 117 | struct path path = { parent->mnt, dentry }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 118 | return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 119 | } |
| 120 | |
| 121 | static int tomoyo_path_symlink(struct path *parent, struct dentry *dentry, |
| 122 | const char *old_name) |
| 123 | { |
| 124 | struct path path = { parent->mnt, dentry }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 125 | return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 126 | } |
| 127 | |
| 128 | static int tomoyo_path_mknod(struct path *parent, struct dentry *dentry, |
| 129 | int mode, unsigned int dev) |
| 130 | { |
| 131 | struct path path = { parent->mnt, dentry }; |
Tetsuo Handa | 7ef6123 | 2010-02-16 08:03:30 +0900 | [diff] [blame] | 132 | int type = TOMOYO_TYPE_CREATE; |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 133 | const unsigned int perm = mode & S_IALLUGO; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 134 | |
| 135 | switch (mode & S_IFMT) { |
| 136 | case S_IFCHR: |
Tetsuo Handa | 7ef6123 | 2010-02-16 08:03:30 +0900 | [diff] [blame] | 137 | type = TOMOYO_TYPE_MKCHAR; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 138 | break; |
| 139 | case S_IFBLK: |
Tetsuo Handa | 7ef6123 | 2010-02-16 08:03:30 +0900 | [diff] [blame] | 140 | type = TOMOYO_TYPE_MKBLOCK; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 141 | break; |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 142 | default: |
| 143 | goto no_dev; |
| 144 | } |
| 145 | return tomoyo_path_number3_perm(type, &path, perm, dev); |
| 146 | no_dev: |
| 147 | switch (mode & S_IFMT) { |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 148 | case S_IFIFO: |
Tetsuo Handa | 7ef6123 | 2010-02-16 08:03:30 +0900 | [diff] [blame] | 149 | type = TOMOYO_TYPE_MKFIFO; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 150 | break; |
| 151 | case S_IFSOCK: |
Tetsuo Handa | 7ef6123 | 2010-02-16 08:03:30 +0900 | [diff] [blame] | 152 | type = TOMOYO_TYPE_MKSOCK; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 153 | break; |
| 154 | } |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 155 | return tomoyo_path_number_perm(type, &path, perm); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 156 | } |
| 157 | |
| 158 | static int tomoyo_path_link(struct dentry *old_dentry, struct path *new_dir, |
| 159 | struct dentry *new_dentry) |
| 160 | { |
| 161 | struct path path1 = { new_dir->mnt, old_dentry }; |
| 162 | struct path path2 = { new_dir->mnt, new_dentry }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 163 | return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 164 | } |
| 165 | |
| 166 | static int tomoyo_path_rename(struct path *old_parent, |
| 167 | struct dentry *old_dentry, |
| 168 | struct path *new_parent, |
| 169 | struct dentry *new_dentry) |
| 170 | { |
| 171 | struct path path1 = { old_parent->mnt, old_dentry }; |
| 172 | struct path path2 = { new_parent->mnt, new_dentry }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 173 | return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 174 | } |
| 175 | |
| 176 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
| 177 | unsigned long arg) |
| 178 | { |
| 179 | if (cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)) |
Tetsuo Handa | cb0abe6 | 2010-05-17 10:08:05 +0900 | [diff] [blame] | 180 | return tomoyo_path_perm(TOMOYO_TYPE_REWRITE, &file->f_path); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 181 | return 0; |
| 182 | } |
| 183 | |
| 184 | static int tomoyo_dentry_open(struct file *f, const struct cred *cred) |
| 185 | { |
| 186 | int flags = f->f_flags; |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 187 | /* Don't check read permission here if called from do_execve(). */ |
| 188 | if (current->in_execve) |
| 189 | return 0; |
| 190 | return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags); |
| 191 | } |
| 192 | |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 193 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
| 194 | unsigned long arg) |
| 195 | { |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 196 | return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 197 | } |
| 198 | |
| 199 | static int tomoyo_path_chmod(struct dentry *dentry, struct vfsmount *mnt, |
| 200 | mode_t mode) |
| 201 | { |
| 202 | struct path path = { mnt, dentry }; |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 203 | return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, &path, |
| 204 | mode & S_IALLUGO); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 205 | } |
| 206 | |
| 207 | static int tomoyo_path_chown(struct path *path, uid_t uid, gid_t gid) |
| 208 | { |
| 209 | int error = 0; |
| 210 | if (uid != (uid_t) -1) |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 211 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, uid); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 212 | if (!error && gid != (gid_t) -1) |
Tetsuo Handa | a1f9bb6 | 2010-05-17 10:09:15 +0900 | [diff] [blame] | 213 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, gid); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 214 | return error; |
| 215 | } |
| 216 | |
| 217 | static int tomoyo_path_chroot(struct path *path) |
| 218 | { |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 219 | return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 220 | } |
| 221 | |
| 222 | static int tomoyo_sb_mount(char *dev_name, struct path *path, |
| 223 | char *type, unsigned long flags, void *data) |
| 224 | { |
Tetsuo Handa | 2106ccd | 2010-05-17 10:10:31 +0900 | [diff] [blame] | 225 | return tomoyo_mount_permission(dev_name, path, type, flags, data); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 226 | } |
| 227 | |
| 228 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
| 229 | { |
| 230 | struct path path = { mnt, mnt->mnt_root }; |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 231 | return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 232 | } |
| 233 | |
| 234 | static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path) |
| 235 | { |
Tetsuo Handa | 97d6931 | 2010-02-16 09:46:15 +0900 | [diff] [blame] | 236 | return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 237 | } |
| 238 | |
Tetsuo Handa | c3fa109 | 2009-06-08 12:37:39 +0900 | [diff] [blame] | 239 | /* |
| 240 | * tomoyo_security_ops is a "struct security_operations" which is used for |
| 241 | * registering TOMOYO. |
| 242 | */ |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 243 | static struct security_operations tomoyo_security_ops = { |
| 244 | .name = "tomoyo", |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 245 | .cred_alloc_blank = tomoyo_cred_alloc_blank, |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 246 | .cred_prepare = tomoyo_cred_prepare, |
David Howells | ee18d64 | 2009-09-02 09:14:21 +0100 | [diff] [blame] | 247 | .cred_transfer = tomoyo_cred_transfer, |
Tetsuo Handa | ec8e6a4 | 2010-02-11 09:43:20 +0900 | [diff] [blame] | 248 | .cred_free = tomoyo_cred_free, |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 249 | .bprm_set_creds = tomoyo_bprm_set_creds, |
| 250 | .bprm_check_security = tomoyo_bprm_check_security, |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 251 | .file_fcntl = tomoyo_file_fcntl, |
| 252 | .dentry_open = tomoyo_dentry_open, |
| 253 | .path_truncate = tomoyo_path_truncate, |
| 254 | .path_unlink = tomoyo_path_unlink, |
| 255 | .path_mkdir = tomoyo_path_mkdir, |
| 256 | .path_rmdir = tomoyo_path_rmdir, |
| 257 | .path_symlink = tomoyo_path_symlink, |
| 258 | .path_mknod = tomoyo_path_mknod, |
| 259 | .path_link = tomoyo_path_link, |
| 260 | .path_rename = tomoyo_path_rename, |
Tetsuo Handa | 937bf61 | 2009-12-02 21:09:48 +0900 | [diff] [blame] | 261 | .file_ioctl = tomoyo_file_ioctl, |
| 262 | .path_chmod = tomoyo_path_chmod, |
| 263 | .path_chown = tomoyo_path_chown, |
| 264 | .path_chroot = tomoyo_path_chroot, |
| 265 | .sb_mount = tomoyo_sb_mount, |
| 266 | .sb_umount = tomoyo_sb_umount, |
| 267 | .sb_pivotroot = tomoyo_sb_pivotroot, |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 268 | }; |
| 269 | |
Tetsuo Handa | fdb8ebb | 2009-12-08 09:34:43 +0900 | [diff] [blame] | 270 | /* Lock for GC. */ |
| 271 | struct srcu_struct tomoyo_ss; |
| 272 | |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 273 | static int __init tomoyo_init(void) |
| 274 | { |
| 275 | struct cred *cred = (struct cred *) current_cred(); |
| 276 | |
| 277 | if (!security_module_enable(&tomoyo_security_ops)) |
| 278 | return 0; |
| 279 | /* register ourselves with the security framework */ |
Tetsuo Handa | fdb8ebb | 2009-12-08 09:34:43 +0900 | [diff] [blame] | 280 | if (register_security(&tomoyo_security_ops) || |
| 281 | init_srcu_struct(&tomoyo_ss)) |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 282 | panic("Failure registering TOMOYO Linux"); |
| 283 | printk(KERN_INFO "TOMOYO Linux initialized\n"); |
| 284 | cred->security = &tomoyo_kernel_domain; |
Tetsuo Handa | c3ef150 | 2010-05-17 10:12:46 +0900 | [diff] [blame] | 285 | tomoyo_mm_init(); |
Kentaro Takeda | f743324 | 2009-02-05 17:18:16 +0900 | [diff] [blame] | 286 | return 0; |
| 287 | } |
| 288 | |
| 289 | security_initcall(tomoyo_init); |