1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/tomoyo.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include <linux/lsm_hooks.h>
9#include <uapi/linux/lsm.h>
10#include "common.h"
11
12/**
13 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
14 *
15 * Returns pointer to "struct tomoyo_domain_info" for current thread.
16 */
17struct tomoyo_domain_info *tomoyo_domain(void)
18{
19 struct tomoyo_task *s = tomoyo_task(current);
20
21 if (s->old_domain_info && !current->in_execve) {
22 atomic_dec(v: &s->old_domain_info->users);
23 s->old_domain_info = NULL;
24 }
25 return s->domain_info;
26}
27
28/**
29 * tomoyo_cred_prepare - Target for security_prepare_creds().
30 *
31 * @new: Pointer to "struct cred".
32 * @old: Pointer to "struct cred".
33 * @gfp: Memory allocation flags.
34 *
35 * Returns 0.
36 */
37static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
38 gfp_t gfp)
39{
40 /* Restore old_domain_info saved by previous execve() request. */
41 struct tomoyo_task *s = tomoyo_task(current);
42
43 if (s->old_domain_info && !current->in_execve) {
44 atomic_dec(v: &s->domain_info->users);
45 s->domain_info = s->old_domain_info;
46 s->old_domain_info = NULL;
47 }
48 return 0;
49}
50
51/**
52 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
53 *
54 * @bprm: Pointer to "struct linux_binprm".
55 */
56static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm)
57{
58 /* Clear old_domain_info saved by execve() request. */
59 struct tomoyo_task *s = tomoyo_task(current);
60
61 atomic_dec(v: &s->old_domain_info->users);
62 s->old_domain_info = NULL;
63}
64
65#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
66/**
67 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec().
68 *
69 * @bprm: Pointer to "struct linux_binprm".
70 *
71 * Returns 0.
72 */
73static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm)
74{
75 /*
76 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
77 * for the first time.
78 */
79 if (!tomoyo_policy_loaded)
80 tomoyo_load_policy(bprm->filename);
81 return 0;
82}
83#endif
84
85/**
86 * tomoyo_bprm_check_security - Target for security_bprm_check().
87 *
88 * @bprm: Pointer to "struct linux_binprm".
89 *
90 * Returns 0 on success, negative value otherwise.
91 */
92static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
93{
94 struct tomoyo_task *s = tomoyo_task(current);
95
96 /*
97 * Execute permission is checked against pathname passed to execve()
98 * using current domain.
99 */
100 if (!s->old_domain_info) {
101 const int idx = tomoyo_read_lock();
102 const int err = tomoyo_find_next_domain(bprm);
103
104 tomoyo_read_unlock(idx);
105 return err;
106 }
107 /*
108 * Read permission is checked against interpreters using next domain.
109 */
110 return tomoyo_check_open_permission(domain: s->domain_info,
111 path: &bprm->file->f_path, O_RDONLY);
112}
113
114/**
115 * tomoyo_inode_getattr - Target for security_inode_getattr().
116 *
117 * @path: Pointer to "struct path".
118 *
119 * Returns 0 on success, negative value otherwise.
120 */
121static int tomoyo_inode_getattr(const struct path *path)
122{
123 return tomoyo_path_perm(operation: TOMOYO_TYPE_GETATTR, path, NULL);
124}
125
126/**
127 * tomoyo_path_truncate - Target for security_path_truncate().
128 *
129 * @path: Pointer to "struct path".
130 *
131 * Returns 0 on success, negative value otherwise.
132 */
133static int tomoyo_path_truncate(const struct path *path)
134{
135 return tomoyo_path_perm(operation: TOMOYO_TYPE_TRUNCATE, path, NULL);
136}
137
138/**
139 * tomoyo_file_truncate - Target for security_file_truncate().
140 *
141 * @file: Pointer to "struct file".
142 *
143 * Returns 0 on success, negative value otherwise.
144 */
145static int tomoyo_file_truncate(struct file *file)
146{
147 return tomoyo_path_truncate(path: &file->f_path);
148}
149
150/**
151 * tomoyo_path_unlink - Target for security_path_unlink().
152 *
153 * @parent: Pointer to "struct path".
154 * @dentry: Pointer to "struct dentry".
155 *
156 * Returns 0 on success, negative value otherwise.
157 */
158static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
159{
160 struct path path = { .mnt = parent->mnt, .dentry = dentry };
161
162 return tomoyo_path_perm(operation: TOMOYO_TYPE_UNLINK, path: &path, NULL);
163}
164
165/**
166 * tomoyo_path_mkdir - Target for security_path_mkdir().
167 *
168 * @parent: Pointer to "struct path".
169 * @dentry: Pointer to "struct dentry".
170 * @mode: DAC permission mode.
171 *
172 * Returns 0 on success, negative value otherwise.
173 */
174static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
175 umode_t mode)
176{
177 struct path path = { .mnt = parent->mnt, .dentry = dentry };
178
179 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_MKDIR, path: &path,
180 number: mode & S_IALLUGO);
181}
182
183/**
184 * tomoyo_path_rmdir - Target for security_path_rmdir().
185 *
186 * @parent: Pointer to "struct path".
187 * @dentry: Pointer to "struct dentry".
188 *
189 * Returns 0 on success, negative value otherwise.
190 */
191static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
192{
193 struct path path = { .mnt = parent->mnt, .dentry = dentry };
194
195 return tomoyo_path_perm(operation: TOMOYO_TYPE_RMDIR, path: &path, NULL);
196}
197
198/**
199 * tomoyo_path_symlink - Target for security_path_symlink().
200 *
201 * @parent: Pointer to "struct path".
202 * @dentry: Pointer to "struct dentry".
203 * @old_name: Symlink's content.
204 *
205 * Returns 0 on success, negative value otherwise.
206 */
207static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
208 const char *old_name)
209{
210 struct path path = { .mnt = parent->mnt, .dentry = dentry };
211
212 return tomoyo_path_perm(operation: TOMOYO_TYPE_SYMLINK, path: &path, target: old_name);
213}
214
215/**
216 * tomoyo_path_mknod - Target for security_path_mknod().
217 *
218 * @parent: Pointer to "struct path".
219 * @dentry: Pointer to "struct dentry".
220 * @mode: DAC permission mode.
221 * @dev: Device attributes.
222 *
223 * Returns 0 on success, negative value otherwise.
224 */
225static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
226 umode_t mode, unsigned int dev)
227{
228 struct path path = { .mnt = parent->mnt, .dentry = dentry };
229 int type = TOMOYO_TYPE_CREATE;
230 const unsigned int perm = mode & S_IALLUGO;
231
232 switch (mode & S_IFMT) {
233 case S_IFCHR:
234 type = TOMOYO_TYPE_MKCHAR;
235 break;
236 case S_IFBLK:
237 type = TOMOYO_TYPE_MKBLOCK;
238 break;
239 default:
240 goto no_dev;
241 }
242 return tomoyo_mkdev_perm(operation: type, path: &path, mode: perm, dev);
243 no_dev:
244 switch (mode & S_IFMT) {
245 case S_IFIFO:
246 type = TOMOYO_TYPE_MKFIFO;
247 break;
248 case S_IFSOCK:
249 type = TOMOYO_TYPE_MKSOCK;
250 break;
251 }
252 return tomoyo_path_number_perm(operation: type, path: &path, number: perm);
253}
254
255/**
256 * tomoyo_path_link - Target for security_path_link().
257 *
258 * @old_dentry: Pointer to "struct dentry".
259 * @new_dir: Pointer to "struct path".
260 * @new_dentry: Pointer to "struct dentry".
261 *
262 * Returns 0 on success, negative value otherwise.
263 */
264static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
265 struct dentry *new_dentry)
266{
267 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
268 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
269
270 return tomoyo_path2_perm(operation: TOMOYO_TYPE_LINK, path1: &path1, path2: &path2);
271}
272
273/**
274 * tomoyo_path_rename - Target for security_path_rename().
275 *
276 * @old_parent: Pointer to "struct path".
277 * @old_dentry: Pointer to "struct dentry".
278 * @new_parent: Pointer to "struct path".
279 * @new_dentry: Pointer to "struct dentry".
280 * @flags: Rename options.
281 *
282 * Returns 0 on success, negative value otherwise.
283 */
284static int tomoyo_path_rename(const struct path *old_parent,
285 struct dentry *old_dentry,
286 const struct path *new_parent,
287 struct dentry *new_dentry,
288 const unsigned int flags)
289{
290 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
291 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
292
293 if (flags & RENAME_EXCHANGE) {
294 const int err = tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path2,
295 path2: &path1);
296
297 if (err)
298 return err;
299 }
300 return tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path1, path2: &path2);
301}
302
303/**
304 * tomoyo_file_fcntl - Target for security_file_fcntl().
305 *
306 * @file: Pointer to "struct file".
307 * @cmd: Command for fcntl().
308 * @arg: Argument for @cmd.
309 *
310 * Returns 0 on success, negative value otherwise.
311 */
312static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
313 unsigned long arg)
314{
315 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
316 return 0;
317 return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &file->f_path,
318 O_WRONLY | (arg & O_APPEND));
319}
320
321/**
322 * tomoyo_file_open - Target for security_file_open().
323 *
324 * @f: Pointer to "struct file".
325 *
326 * Returns 0 on success, negative value otherwise.
327 */
328static int tomoyo_file_open(struct file *f)
329{
330 /* Don't check read permission here if called from execve(). */
331 /* Illogically, FMODE_EXEC is in f_flags, not f_mode. */
332 if (f->f_flags & __FMODE_EXEC)
333 return 0;
334 return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &f->f_path,
335 flag: f->f_flags);
336}
337
338/**
339 * tomoyo_file_ioctl - Target for security_file_ioctl().
340 *
341 * @file: Pointer to "struct file".
342 * @cmd: Command for ioctl().
343 * @arg: Argument for @cmd.
344 *
345 * Returns 0 on success, negative value otherwise.
346 */
347static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
348 unsigned long arg)
349{
350 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_IOCTL, path: &file->f_path, number: cmd);
351}
352
353/**
354 * tomoyo_path_chmod - Target for security_path_chmod().
355 *
356 * @path: Pointer to "struct path".
357 * @mode: DAC permission mode.
358 *
359 * Returns 0 on success, negative value otherwise.
360 */
361static int tomoyo_path_chmod(const struct path *path, umode_t mode)
362{
363 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHMOD, path,
364 number: mode & S_IALLUGO);
365}
366
367/**
368 * tomoyo_path_chown - Target for security_path_chown().
369 *
370 * @path: Pointer to "struct path".
371 * @uid: Owner ID.
372 * @gid: Group ID.
373 *
374 * Returns 0 on success, negative value otherwise.
375 */
376static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
377{
378 int error = 0;
379
380 if (uid_valid(uid))
381 error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHOWN, path,
382 number: from_kuid(to: &init_user_ns, uid));
383 if (!error && gid_valid(gid))
384 error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHGRP, path,
385 number: from_kgid(to: &init_user_ns, gid));
386 return error;
387}
388
389/**
390 * tomoyo_path_chroot - Target for security_path_chroot().
391 *
392 * @path: Pointer to "struct path".
393 *
394 * Returns 0 on success, negative value otherwise.
395 */
396static int tomoyo_path_chroot(const struct path *path)
397{
398 return tomoyo_path_perm(operation: TOMOYO_TYPE_CHROOT, path, NULL);
399}
400
401/**
402 * tomoyo_sb_mount - Target for security_sb_mount().
403 *
404 * @dev_name: Name of device file. Maybe NULL.
405 * @path: Pointer to "struct path".
406 * @type: Name of filesystem type. Maybe NULL.
407 * @flags: Mount options.
408 * @data: Optional data. Maybe NULL.
409 *
410 * Returns 0 on success, negative value otherwise.
411 */
412static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
413 const char *type, unsigned long flags, void *data)
414{
415 return tomoyo_mount_permission(dev_name, path, type, flags, data_page: data);
416}
417
418/**
419 * tomoyo_sb_umount - Target for security_sb_umount().
420 *
421 * @mnt: Pointer to "struct vfsmount".
422 * @flags: Unmount options.
423 *
424 * Returns 0 on success, negative value otherwise.
425 */
426static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
427{
428 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
429
430 return tomoyo_path_perm(operation: TOMOYO_TYPE_UMOUNT, path: &path, NULL);
431}
432
433/**
434 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
435 *
436 * @old_path: Pointer to "struct path".
437 * @new_path: Pointer to "struct path".
438 *
439 * Returns 0 on success, negative value otherwise.
440 */
441static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
442{
443 return tomoyo_path2_perm(operation: TOMOYO_TYPE_PIVOT_ROOT, path1: new_path, path2: old_path);
444}
445
446/**
447 * tomoyo_socket_listen - Check permission for listen().
448 *
449 * @sock: Pointer to "struct socket".
450 * @backlog: Backlog parameter.
451 *
452 * Returns 0 on success, negative value otherwise.
453 */
454static int tomoyo_socket_listen(struct socket *sock, int backlog)
455{
456 return tomoyo_socket_listen_permission(sock);
457}
458
459/**
460 * tomoyo_socket_connect - Check permission for connect().
461 *
462 * @sock: Pointer to "struct socket".
463 * @addr: Pointer to "struct sockaddr".
464 * @addr_len: Size of @addr.
465 *
466 * Returns 0 on success, negative value otherwise.
467 */
468static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
469 int addr_len)
470{
471 return tomoyo_socket_connect_permission(sock, addr, addr_len);
472}
473
474/**
475 * tomoyo_socket_bind - Check permission for bind().
476 *
477 * @sock: Pointer to "struct socket".
478 * @addr: Pointer to "struct sockaddr".
479 * @addr_len: Size of @addr.
480 *
481 * Returns 0 on success, negative value otherwise.
482 */
483static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
484 int addr_len)
485{
486 return tomoyo_socket_bind_permission(sock, addr, addr_len);
487}
488
489/**
490 * tomoyo_socket_sendmsg - Check permission for sendmsg().
491 *
492 * @sock: Pointer to "struct socket".
493 * @msg: Pointer to "struct msghdr".
494 * @size: Size of message.
495 *
496 * Returns 0 on success, negative value otherwise.
497 */
498static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
499 int size)
500{
501 return tomoyo_socket_sendmsg_permission(sock, msg, size);
502}
503
504struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = {
505 .lbs_task = sizeof(struct tomoyo_task),
506};
507
508/**
509 * tomoyo_task_alloc - Target for security_task_alloc().
510 *
511 * @task: Pointer to "struct task_struct".
512 * @clone_flags: clone() flags.
513 *
514 * Returns 0.
515 */
516static int tomoyo_task_alloc(struct task_struct *task,
517 unsigned long clone_flags)
518{
519 struct tomoyo_task *old = tomoyo_task(current);
520 struct tomoyo_task *new = tomoyo_task(task);
521
522 new->domain_info = old->domain_info;
523 atomic_inc(v: &new->domain_info->users);
524 new->old_domain_info = NULL;
525 return 0;
526}
527
528/**
529 * tomoyo_task_free - Target for security_task_free().
530 *
531 * @task: Pointer to "struct task_struct".
532 */
533static void tomoyo_task_free(struct task_struct *task)
534{
535 struct tomoyo_task *s = tomoyo_task(task);
536
537 if (s->domain_info) {
538 atomic_dec(v: &s->domain_info->users);
539 s->domain_info = NULL;
540 }
541 if (s->old_domain_info) {
542 atomic_dec(v: &s->old_domain_info->users);
543 s->old_domain_info = NULL;
544 }
545}
546
547static const struct lsm_id tomoyo_lsmid = {
548 .name = "tomoyo",
549 .id = LSM_ID_TOMOYO,
550};
551
552/*
553 * tomoyo_security_ops is a "struct security_operations" which is used for
554 * registering TOMOYO.
555 */
556static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
557 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
558 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
559 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
560 LSM_HOOK_INIT(task_free, tomoyo_task_free),
561#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
562 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec),
563#endif
564 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
565 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
566 LSM_HOOK_INIT(file_open, tomoyo_file_open),
567 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate),
568 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
569 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
570 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
571 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
572 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
573 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
574 LSM_HOOK_INIT(path_link, tomoyo_path_link),
575 LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
576 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
577 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
578 LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl),
579 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
580 LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
581 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
582 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
583 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
584 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
585 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
586 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
587 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
588 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
589};
590
591/* Lock for GC. */
592DEFINE_SRCU(tomoyo_ss);
593
594int tomoyo_enabled __ro_after_init = 1;
595
596/**
597 * tomoyo_init - Register TOMOYO Linux as a LSM module.
598 *
599 * Returns 0.
600 */
601static int __init tomoyo_init(void)
602{
603 struct tomoyo_task *s = tomoyo_task(current);
604
605 /* register ourselves with the security framework */
606 security_add_hooks(hooks: tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks),
607 lsmid: &tomoyo_lsmid);
608 pr_info("TOMOYO Linux initialized\n");
609 s->domain_info = &tomoyo_kernel_domain;
610 atomic_inc(v: &tomoyo_kernel_domain.users);
611 s->old_domain_info = NULL;
612 tomoyo_mm_init();
613
614 return 0;
615}
616
617DEFINE_LSM(tomoyo) = {
618 .name = "tomoyo",
619 .enabled = &tomoyo_enabled,
620 .flags = LSM_FLAG_LEGACY_MAJOR,
621 .blobs = &tomoyo_blob_sizes,
622 .init = tomoyo_init,
623};
624

source code of linux/security/tomoyo/tomoyo.c