1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * security/tomoyo/tomoyo.c |
4 | * |
5 | * Copyright (C) 2005-2011 NTT DATA CORPORATION |
6 | */ |
7 | |
8 | #include <linux/lsm_hooks.h> |
9 | #include <uapi/linux/lsm.h> |
10 | #include "common.h" |
11 | |
12 | /** |
13 | * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. |
14 | * |
15 | * Returns pointer to "struct tomoyo_domain_info" for current thread. |
16 | */ |
17 | struct tomoyo_domain_info *tomoyo_domain(void) |
18 | { |
19 | struct tomoyo_task *s = tomoyo_task(current); |
20 | |
21 | if (s->old_domain_info && !current->in_execve) { |
22 | atomic_dec(v: &s->old_domain_info->users); |
23 | s->old_domain_info = NULL; |
24 | } |
25 | return s->domain_info; |
26 | } |
27 | |
28 | /** |
29 | * tomoyo_cred_prepare - Target for security_prepare_creds(). |
30 | * |
31 | * @new: Pointer to "struct cred". |
32 | * @old: Pointer to "struct cred". |
33 | * @gfp: Memory allocation flags. |
34 | * |
35 | * Returns 0. |
36 | */ |
37 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
38 | gfp_t gfp) |
39 | { |
40 | /* Restore old_domain_info saved by previous execve() request. */ |
41 | struct tomoyo_task *s = tomoyo_task(current); |
42 | |
43 | if (s->old_domain_info && !current->in_execve) { |
44 | atomic_dec(v: &s->domain_info->users); |
45 | s->domain_info = s->old_domain_info; |
46 | s->old_domain_info = NULL; |
47 | } |
48 | return 0; |
49 | } |
50 | |
51 | /** |
52 | * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). |
53 | * |
54 | * @bprm: Pointer to "struct linux_binprm". |
55 | */ |
56 | static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm) |
57 | { |
58 | /* Clear old_domain_info saved by execve() request. */ |
59 | struct tomoyo_task *s = tomoyo_task(current); |
60 | |
61 | atomic_dec(v: &s->old_domain_info->users); |
62 | s->old_domain_info = NULL; |
63 | } |
64 | |
65 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
66 | /** |
67 | * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). |
68 | * |
69 | * @bprm: Pointer to "struct linux_binprm". |
70 | * |
71 | * Returns 0. |
72 | */ |
73 | static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) |
74 | { |
75 | /* |
76 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested |
77 | * for the first time. |
78 | */ |
79 | if (!tomoyo_policy_loaded) |
80 | tomoyo_load_policy(bprm->filename); |
81 | return 0; |
82 | } |
83 | #endif |
84 | |
85 | /** |
86 | * tomoyo_bprm_check_security - Target for security_bprm_check(). |
87 | * |
88 | * @bprm: Pointer to "struct linux_binprm". |
89 | * |
90 | * Returns 0 on success, negative value otherwise. |
91 | */ |
92 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
93 | { |
94 | struct tomoyo_task *s = tomoyo_task(current); |
95 | |
96 | /* |
97 | * Execute permission is checked against pathname passed to execve() |
98 | * using current domain. |
99 | */ |
100 | if (!s->old_domain_info) { |
101 | const int idx = tomoyo_read_lock(); |
102 | const int err = tomoyo_find_next_domain(bprm); |
103 | |
104 | tomoyo_read_unlock(idx); |
105 | return err; |
106 | } |
107 | /* |
108 | * Read permission is checked against interpreters using next domain. |
109 | */ |
110 | return tomoyo_check_open_permission(domain: s->domain_info, |
111 | path: &bprm->file->f_path, O_RDONLY); |
112 | } |
113 | |
114 | /** |
115 | * tomoyo_inode_getattr - Target for security_inode_getattr(). |
116 | * |
117 | * @path: Pointer to "struct path". |
118 | * |
119 | * Returns 0 on success, negative value otherwise. |
120 | */ |
121 | static int tomoyo_inode_getattr(const struct path *path) |
122 | { |
123 | return tomoyo_path_perm(operation: TOMOYO_TYPE_GETATTR, path, NULL); |
124 | } |
125 | |
126 | /** |
127 | * tomoyo_path_truncate - Target for security_path_truncate(). |
128 | * |
129 | * @path: Pointer to "struct path". |
130 | * |
131 | * Returns 0 on success, negative value otherwise. |
132 | */ |
133 | static int tomoyo_path_truncate(const struct path *path) |
134 | { |
135 | return tomoyo_path_perm(operation: TOMOYO_TYPE_TRUNCATE, path, NULL); |
136 | } |
137 | |
138 | /** |
139 | * tomoyo_file_truncate - Target for security_file_truncate(). |
140 | * |
141 | * @file: Pointer to "struct file". |
142 | * |
143 | * Returns 0 on success, negative value otherwise. |
144 | */ |
145 | static int tomoyo_file_truncate(struct file *file) |
146 | { |
147 | return tomoyo_path_truncate(path: &file->f_path); |
148 | } |
149 | |
150 | /** |
151 | * tomoyo_path_unlink - Target for security_path_unlink(). |
152 | * |
153 | * @parent: Pointer to "struct path". |
154 | * @dentry: Pointer to "struct dentry". |
155 | * |
156 | * Returns 0 on success, negative value otherwise. |
157 | */ |
158 | static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) |
159 | { |
160 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
161 | |
162 | return tomoyo_path_perm(operation: TOMOYO_TYPE_UNLINK, path: &path, NULL); |
163 | } |
164 | |
165 | /** |
166 | * tomoyo_path_mkdir - Target for security_path_mkdir(). |
167 | * |
168 | * @parent: Pointer to "struct path". |
169 | * @dentry: Pointer to "struct dentry". |
170 | * @mode: DAC permission mode. |
171 | * |
172 | * Returns 0 on success, negative value otherwise. |
173 | */ |
174 | static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, |
175 | umode_t mode) |
176 | { |
177 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
178 | |
179 | return tomoyo_path_number_perm(operation: TOMOYO_TYPE_MKDIR, path: &path, |
180 | number: mode & S_IALLUGO); |
181 | } |
182 | |
183 | /** |
184 | * tomoyo_path_rmdir - Target for security_path_rmdir(). |
185 | * |
186 | * @parent: Pointer to "struct path". |
187 | * @dentry: Pointer to "struct dentry". |
188 | * |
189 | * Returns 0 on success, negative value otherwise. |
190 | */ |
191 | static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) |
192 | { |
193 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
194 | |
195 | return tomoyo_path_perm(operation: TOMOYO_TYPE_RMDIR, path: &path, NULL); |
196 | } |
197 | |
198 | /** |
199 | * tomoyo_path_symlink - Target for security_path_symlink(). |
200 | * |
201 | * @parent: Pointer to "struct path". |
202 | * @dentry: Pointer to "struct dentry". |
203 | * @old_name: Symlink's content. |
204 | * |
205 | * Returns 0 on success, negative value otherwise. |
206 | */ |
207 | static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, |
208 | const char *old_name) |
209 | { |
210 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
211 | |
212 | return tomoyo_path_perm(operation: TOMOYO_TYPE_SYMLINK, path: &path, target: old_name); |
213 | } |
214 | |
215 | /** |
216 | * tomoyo_path_mknod - Target for security_path_mknod(). |
217 | * |
218 | * @parent: Pointer to "struct path". |
219 | * @dentry: Pointer to "struct dentry". |
220 | * @mode: DAC permission mode. |
221 | * @dev: Device attributes. |
222 | * |
223 | * Returns 0 on success, negative value otherwise. |
224 | */ |
225 | static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, |
226 | umode_t mode, unsigned int dev) |
227 | { |
228 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
229 | int type = TOMOYO_TYPE_CREATE; |
230 | const unsigned int perm = mode & S_IALLUGO; |
231 | |
232 | switch (mode & S_IFMT) { |
233 | case S_IFCHR: |
234 | type = TOMOYO_TYPE_MKCHAR; |
235 | break; |
236 | case S_IFBLK: |
237 | type = TOMOYO_TYPE_MKBLOCK; |
238 | break; |
239 | default: |
240 | goto no_dev; |
241 | } |
242 | return tomoyo_mkdev_perm(operation: type, path: &path, mode: perm, dev); |
243 | no_dev: |
244 | switch (mode & S_IFMT) { |
245 | case S_IFIFO: |
246 | type = TOMOYO_TYPE_MKFIFO; |
247 | break; |
248 | case S_IFSOCK: |
249 | type = TOMOYO_TYPE_MKSOCK; |
250 | break; |
251 | } |
252 | return tomoyo_path_number_perm(operation: type, path: &path, number: perm); |
253 | } |
254 | |
255 | /** |
256 | * tomoyo_path_link - Target for security_path_link(). |
257 | * |
258 | * @old_dentry: Pointer to "struct dentry". |
259 | * @new_dir: Pointer to "struct path". |
260 | * @new_dentry: Pointer to "struct dentry". |
261 | * |
262 | * Returns 0 on success, negative value otherwise. |
263 | */ |
264 | static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, |
265 | struct dentry *new_dentry) |
266 | { |
267 | struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; |
268 | struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; |
269 | |
270 | return tomoyo_path2_perm(operation: TOMOYO_TYPE_LINK, path1: &path1, path2: &path2); |
271 | } |
272 | |
273 | /** |
274 | * tomoyo_path_rename - Target for security_path_rename(). |
275 | * |
276 | * @old_parent: Pointer to "struct path". |
277 | * @old_dentry: Pointer to "struct dentry". |
278 | * @new_parent: Pointer to "struct path". |
279 | * @new_dentry: Pointer to "struct dentry". |
280 | * @flags: Rename options. |
281 | * |
282 | * Returns 0 on success, negative value otherwise. |
283 | */ |
284 | static int tomoyo_path_rename(const struct path *old_parent, |
285 | struct dentry *old_dentry, |
286 | const struct path *new_parent, |
287 | struct dentry *new_dentry, |
288 | const unsigned int flags) |
289 | { |
290 | struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; |
291 | struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; |
292 | |
293 | if (flags & RENAME_EXCHANGE) { |
294 | const int err = tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path2, |
295 | path2: &path1); |
296 | |
297 | if (err) |
298 | return err; |
299 | } |
300 | return tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path1, path2: &path2); |
301 | } |
302 | |
303 | /** |
304 | * tomoyo_file_fcntl - Target for security_file_fcntl(). |
305 | * |
306 | * @file: Pointer to "struct file". |
307 | * @cmd: Command for fcntl(). |
308 | * @arg: Argument for @cmd. |
309 | * |
310 | * Returns 0 on success, negative value otherwise. |
311 | */ |
312 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
313 | unsigned long arg) |
314 | { |
315 | if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) |
316 | return 0; |
317 | return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &file->f_path, |
318 | O_WRONLY | (arg & O_APPEND)); |
319 | } |
320 | |
321 | /** |
322 | * tomoyo_file_open - Target for security_file_open(). |
323 | * |
324 | * @f: Pointer to "struct file". |
325 | * |
326 | * Returns 0 on success, negative value otherwise. |
327 | */ |
328 | static int tomoyo_file_open(struct file *f) |
329 | { |
330 | /* Don't check read permission here if called from execve(). */ |
331 | /* Illogically, FMODE_EXEC is in f_flags, not f_mode. */ |
332 | if (f->f_flags & __FMODE_EXEC) |
333 | return 0; |
334 | return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &f->f_path, |
335 | flag: f->f_flags); |
336 | } |
337 | |
338 | /** |
339 | * tomoyo_file_ioctl - Target for security_file_ioctl(). |
340 | * |
341 | * @file: Pointer to "struct file". |
342 | * @cmd: Command for ioctl(). |
343 | * @arg: Argument for @cmd. |
344 | * |
345 | * Returns 0 on success, negative value otherwise. |
346 | */ |
347 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
348 | unsigned long arg) |
349 | { |
350 | return tomoyo_path_number_perm(operation: TOMOYO_TYPE_IOCTL, path: &file->f_path, number: cmd); |
351 | } |
352 | |
353 | /** |
354 | * tomoyo_path_chmod - Target for security_path_chmod(). |
355 | * |
356 | * @path: Pointer to "struct path". |
357 | * @mode: DAC permission mode. |
358 | * |
359 | * Returns 0 on success, negative value otherwise. |
360 | */ |
361 | static int tomoyo_path_chmod(const struct path *path, umode_t mode) |
362 | { |
363 | return tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHMOD, path, |
364 | number: mode & S_IALLUGO); |
365 | } |
366 | |
367 | /** |
368 | * tomoyo_path_chown - Target for security_path_chown(). |
369 | * |
370 | * @path: Pointer to "struct path". |
371 | * @uid: Owner ID. |
372 | * @gid: Group ID. |
373 | * |
374 | * Returns 0 on success, negative value otherwise. |
375 | */ |
376 | static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) |
377 | { |
378 | int error = 0; |
379 | |
380 | if (uid_valid(uid)) |
381 | error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHOWN, path, |
382 | number: from_kuid(to: &init_user_ns, uid)); |
383 | if (!error && gid_valid(gid)) |
384 | error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHGRP, path, |
385 | number: from_kgid(to: &init_user_ns, gid)); |
386 | return error; |
387 | } |
388 | |
389 | /** |
390 | * tomoyo_path_chroot - Target for security_path_chroot(). |
391 | * |
392 | * @path: Pointer to "struct path". |
393 | * |
394 | * Returns 0 on success, negative value otherwise. |
395 | */ |
396 | static int tomoyo_path_chroot(const struct path *path) |
397 | { |
398 | return tomoyo_path_perm(operation: TOMOYO_TYPE_CHROOT, path, NULL); |
399 | } |
400 | |
401 | /** |
402 | * tomoyo_sb_mount - Target for security_sb_mount(). |
403 | * |
404 | * @dev_name: Name of device file. Maybe NULL. |
405 | * @path: Pointer to "struct path". |
406 | * @type: Name of filesystem type. Maybe NULL. |
407 | * @flags: Mount options. |
408 | * @data: Optional data. Maybe NULL. |
409 | * |
410 | * Returns 0 on success, negative value otherwise. |
411 | */ |
412 | static int tomoyo_sb_mount(const char *dev_name, const struct path *path, |
413 | const char *type, unsigned long flags, void *data) |
414 | { |
415 | return tomoyo_mount_permission(dev_name, path, type, flags, data_page: data); |
416 | } |
417 | |
418 | /** |
419 | * tomoyo_sb_umount - Target for security_sb_umount(). |
420 | * |
421 | * @mnt: Pointer to "struct vfsmount". |
422 | * @flags: Unmount options. |
423 | * |
424 | * Returns 0 on success, negative value otherwise. |
425 | */ |
426 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
427 | { |
428 | struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; |
429 | |
430 | return tomoyo_path_perm(operation: TOMOYO_TYPE_UMOUNT, path: &path, NULL); |
431 | } |
432 | |
433 | /** |
434 | * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). |
435 | * |
436 | * @old_path: Pointer to "struct path". |
437 | * @new_path: Pointer to "struct path". |
438 | * |
439 | * Returns 0 on success, negative value otherwise. |
440 | */ |
441 | static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) |
442 | { |
443 | return tomoyo_path2_perm(operation: TOMOYO_TYPE_PIVOT_ROOT, path1: new_path, path2: old_path); |
444 | } |
445 | |
446 | /** |
447 | * tomoyo_socket_listen - Check permission for listen(). |
448 | * |
449 | * @sock: Pointer to "struct socket". |
450 | * @backlog: Backlog parameter. |
451 | * |
452 | * Returns 0 on success, negative value otherwise. |
453 | */ |
454 | static int tomoyo_socket_listen(struct socket *sock, int backlog) |
455 | { |
456 | return tomoyo_socket_listen_permission(sock); |
457 | } |
458 | |
459 | /** |
460 | * tomoyo_socket_connect - Check permission for connect(). |
461 | * |
462 | * @sock: Pointer to "struct socket". |
463 | * @addr: Pointer to "struct sockaddr". |
464 | * @addr_len: Size of @addr. |
465 | * |
466 | * Returns 0 on success, negative value otherwise. |
467 | */ |
468 | static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, |
469 | int addr_len) |
470 | { |
471 | return tomoyo_socket_connect_permission(sock, addr, addr_len); |
472 | } |
473 | |
474 | /** |
475 | * tomoyo_socket_bind - Check permission for bind(). |
476 | * |
477 | * @sock: Pointer to "struct socket". |
478 | * @addr: Pointer to "struct sockaddr". |
479 | * @addr_len: Size of @addr. |
480 | * |
481 | * Returns 0 on success, negative value otherwise. |
482 | */ |
483 | static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, |
484 | int addr_len) |
485 | { |
486 | return tomoyo_socket_bind_permission(sock, addr, addr_len); |
487 | } |
488 | |
489 | /** |
490 | * tomoyo_socket_sendmsg - Check permission for sendmsg(). |
491 | * |
492 | * @sock: Pointer to "struct socket". |
493 | * @msg: Pointer to "struct msghdr". |
494 | * @size: Size of message. |
495 | * |
496 | * Returns 0 on success, negative value otherwise. |
497 | */ |
498 | static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, |
499 | int size) |
500 | { |
501 | return tomoyo_socket_sendmsg_permission(sock, msg, size); |
502 | } |
503 | |
504 | struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = { |
505 | .lbs_task = sizeof(struct tomoyo_task), |
506 | }; |
507 | |
508 | /** |
509 | * tomoyo_task_alloc - Target for security_task_alloc(). |
510 | * |
511 | * @task: Pointer to "struct task_struct". |
512 | * @clone_flags: clone() flags. |
513 | * |
514 | * Returns 0. |
515 | */ |
516 | static int tomoyo_task_alloc(struct task_struct *task, |
517 | unsigned long clone_flags) |
518 | { |
519 | struct tomoyo_task *old = tomoyo_task(current); |
520 | struct tomoyo_task *new = tomoyo_task(task); |
521 | |
522 | new->domain_info = old->domain_info; |
523 | atomic_inc(v: &new->domain_info->users); |
524 | new->old_domain_info = NULL; |
525 | return 0; |
526 | } |
527 | |
528 | /** |
529 | * tomoyo_task_free - Target for security_task_free(). |
530 | * |
531 | * @task: Pointer to "struct task_struct". |
532 | */ |
533 | static void tomoyo_task_free(struct task_struct *task) |
534 | { |
535 | struct tomoyo_task *s = tomoyo_task(task); |
536 | |
537 | if (s->domain_info) { |
538 | atomic_dec(v: &s->domain_info->users); |
539 | s->domain_info = NULL; |
540 | } |
541 | if (s->old_domain_info) { |
542 | atomic_dec(v: &s->old_domain_info->users); |
543 | s->old_domain_info = NULL; |
544 | } |
545 | } |
546 | |
547 | static const struct lsm_id tomoyo_lsmid = { |
548 | .name = "tomoyo" , |
549 | .id = LSM_ID_TOMOYO, |
550 | }; |
551 | |
552 | /* |
553 | * tomoyo_security_ops is a "struct security_operations" which is used for |
554 | * registering TOMOYO. |
555 | */ |
556 | static struct security_hook_list tomoyo_hooks[] __ro_after_init = { |
557 | LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), |
558 | LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), |
559 | LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), |
560 | LSM_HOOK_INIT(task_free, tomoyo_task_free), |
561 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
562 | LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), |
563 | #endif |
564 | LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), |
565 | LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), |
566 | LSM_HOOK_INIT(file_open, tomoyo_file_open), |
567 | LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate), |
568 | LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), |
569 | LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), |
570 | LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), |
571 | LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), |
572 | LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), |
573 | LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), |
574 | LSM_HOOK_INIT(path_link, tomoyo_path_link), |
575 | LSM_HOOK_INIT(path_rename, tomoyo_path_rename), |
576 | LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), |
577 | LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), |
578 | LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl), |
579 | LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), |
580 | LSM_HOOK_INIT(path_chown, tomoyo_path_chown), |
581 | LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), |
582 | LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), |
583 | LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), |
584 | LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), |
585 | LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), |
586 | LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), |
587 | LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), |
588 | LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), |
589 | }; |
590 | |
591 | /* Lock for GC. */ |
592 | DEFINE_SRCU(tomoyo_ss); |
593 | |
594 | int tomoyo_enabled __ro_after_init = 1; |
595 | |
596 | /** |
597 | * tomoyo_init - Register TOMOYO Linux as a LSM module. |
598 | * |
599 | * Returns 0. |
600 | */ |
601 | static int __init tomoyo_init(void) |
602 | { |
603 | struct tomoyo_task *s = tomoyo_task(current); |
604 | |
605 | /* register ourselves with the security framework */ |
606 | security_add_hooks(hooks: tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), |
607 | lsmid: &tomoyo_lsmid); |
608 | pr_info("TOMOYO Linux initialized\n" ); |
609 | s->domain_info = &tomoyo_kernel_domain; |
610 | atomic_inc(v: &tomoyo_kernel_domain.users); |
611 | s->old_domain_info = NULL; |
612 | tomoyo_mm_init(); |
613 | |
614 | return 0; |
615 | } |
616 | |
617 | DEFINE_LSM(tomoyo) = { |
618 | .name = "tomoyo" , |
619 | .enabled = &tomoyo_enabled, |
620 | .flags = LSM_FLAG_LEGACY_MAJOR, |
621 | .blobs = &tomoyo_blob_sizes, |
622 | .init = tomoyo_init, |
623 | }; |
624 | |