1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* |
3 | * security/tomoyo/domain.c |
4 | * |
5 | * Copyright (C) 2005-2011 NTT DATA CORPORATION |
6 | */ |
7 | |
8 | #include "common.h" |
9 | |
10 | #include <linux/binfmts.h> |
11 | #include <linux/slab.h> |
12 | #include <linux/rculist.h> |
13 | |
14 | /* Variables definitions.*/ |
15 | |
16 | /* The initial domain. */ |
17 | struct tomoyo_domain_info tomoyo_kernel_domain; |
18 | |
19 | /** |
20 | * tomoyo_update_policy - Update an entry for exception policy. |
21 | * |
22 | * @new_entry: Pointer to "struct tomoyo_acl_info". |
23 | * @size: Size of @new_entry in bytes. |
24 | * @param: Pointer to "struct tomoyo_acl_param". |
25 | * @check_duplicate: Callback function to find duplicated entry. |
26 | * |
27 | * Returns 0 on success, negative value otherwise. |
28 | * |
29 | * Caller holds tomoyo_read_lock(). |
30 | */ |
31 | int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, |
32 | struct tomoyo_acl_param *param, |
33 | bool (*check_duplicate)(const struct tomoyo_acl_head |
34 | *, |
35 | const struct tomoyo_acl_head |
36 | *)) |
37 | { |
38 | int error = param->is_delete ? -ENOENT : -ENOMEM; |
39 | struct tomoyo_acl_head *entry; |
40 | struct list_head *list = param->list; |
41 | |
42 | if (mutex_lock_interruptible(&tomoyo_policy_lock)) |
43 | return -ENOMEM; |
44 | list_for_each_entry_rcu(entry, list, list, |
45 | srcu_read_lock_held(&tomoyo_ss)) { |
46 | if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS) |
47 | continue; |
48 | if (!check_duplicate(entry, new_entry)) |
49 | continue; |
50 | entry->is_deleted = param->is_delete; |
51 | error = 0; |
52 | break; |
53 | } |
54 | if (error && !param->is_delete) { |
55 | entry = tomoyo_commit_ok(data: new_entry, size); |
56 | if (entry) { |
57 | list_add_tail_rcu(new: &entry->list, head: list); |
58 | error = 0; |
59 | } |
60 | } |
61 | mutex_unlock(lock: &tomoyo_policy_lock); |
62 | return error; |
63 | } |
64 | |
65 | /** |
66 | * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry. |
67 | * |
68 | * @a: Pointer to "struct tomoyo_acl_info". |
69 | * @b: Pointer to "struct tomoyo_acl_info". |
70 | * |
71 | * Returns true if @a == @b, false otherwise. |
72 | */ |
73 | static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a, |
74 | const struct tomoyo_acl_info *b) |
75 | { |
76 | return a->type == b->type && a->cond == b->cond; |
77 | } |
78 | |
79 | /** |
80 | * tomoyo_update_domain - Update an entry for domain policy. |
81 | * |
82 | * @new_entry: Pointer to "struct tomoyo_acl_info". |
83 | * @size: Size of @new_entry in bytes. |
84 | * @param: Pointer to "struct tomoyo_acl_param". |
85 | * @check_duplicate: Callback function to find duplicated entry. |
86 | * @merge_duplicate: Callback function to merge duplicated entry. |
87 | * |
88 | * Returns 0 on success, negative value otherwise. |
89 | * |
90 | * Caller holds tomoyo_read_lock(). |
91 | */ |
92 | int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, |
93 | struct tomoyo_acl_param *param, |
94 | bool (*check_duplicate)(const struct tomoyo_acl_info |
95 | *, |
96 | const struct tomoyo_acl_info |
97 | *), |
98 | bool (*merge_duplicate)(struct tomoyo_acl_info *, |
99 | struct tomoyo_acl_info *, |
100 | const bool)) |
101 | { |
102 | const bool is_delete = param->is_delete; |
103 | int error = is_delete ? -ENOENT : -ENOMEM; |
104 | struct tomoyo_acl_info *entry; |
105 | struct list_head * const list = param->list; |
106 | |
107 | if (param->data[0]) { |
108 | new_entry->cond = tomoyo_get_condition(param); |
109 | if (!new_entry->cond) |
110 | return -EINVAL; |
111 | /* |
112 | * Domain transition preference is allowed for only |
113 | * "file execute" entries. |
114 | */ |
115 | if (new_entry->cond->transit && |
116 | !(new_entry->type == TOMOYO_TYPE_PATH_ACL && |
117 | container_of(new_entry, struct tomoyo_path_acl, head) |
118 | ->perm == 1 << TOMOYO_TYPE_EXECUTE)) |
119 | goto out; |
120 | } |
121 | if (mutex_lock_interruptible(&tomoyo_policy_lock)) |
122 | goto out; |
123 | list_for_each_entry_rcu(entry, list, list, |
124 | srcu_read_lock_held(&tomoyo_ss)) { |
125 | if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS) |
126 | continue; |
127 | if (!tomoyo_same_acl_head(a: entry, b: new_entry) || |
128 | !check_duplicate(entry, new_entry)) |
129 | continue; |
130 | if (merge_duplicate) |
131 | entry->is_deleted = merge_duplicate(entry, new_entry, |
132 | is_delete); |
133 | else |
134 | entry->is_deleted = is_delete; |
135 | error = 0; |
136 | break; |
137 | } |
138 | if (error && !is_delete) { |
139 | entry = tomoyo_commit_ok(data: new_entry, size); |
140 | if (entry) { |
141 | list_add_tail_rcu(new: &entry->list, head: list); |
142 | error = 0; |
143 | } |
144 | } |
145 | mutex_unlock(lock: &tomoyo_policy_lock); |
146 | out: |
147 | tomoyo_put_condition(cond: new_entry->cond); |
148 | return error; |
149 | } |
150 | |
151 | /** |
152 | * tomoyo_check_acl - Do permission check. |
153 | * |
154 | * @r: Pointer to "struct tomoyo_request_info". |
155 | * @check_entry: Callback function to check type specific parameters. |
156 | * |
157 | * Returns 0 on success, negative value otherwise. |
158 | * |
159 | * Caller holds tomoyo_read_lock(). |
160 | */ |
161 | void tomoyo_check_acl(struct tomoyo_request_info *r, |
162 | bool (*check_entry)(struct tomoyo_request_info *, |
163 | const struct tomoyo_acl_info *)) |
164 | { |
165 | const struct tomoyo_domain_info *domain = r->domain; |
166 | struct tomoyo_acl_info *ptr; |
167 | const struct list_head *list = &domain->acl_info_list; |
168 | u16 i = 0; |
169 | |
170 | retry: |
171 | list_for_each_entry_rcu(ptr, list, list, |
172 | srcu_read_lock_held(&tomoyo_ss)) { |
173 | if (ptr->is_deleted || ptr->type != r->param_type) |
174 | continue; |
175 | if (!check_entry(r, ptr)) |
176 | continue; |
177 | if (!tomoyo_condition(r, cond: ptr->cond)) |
178 | continue; |
179 | r->matched_acl = ptr; |
180 | r->granted = true; |
181 | return; |
182 | } |
183 | for (; i < TOMOYO_MAX_ACL_GROUPS; i++) { |
184 | if (!test_bit(i, domain->group)) |
185 | continue; |
186 | list = &domain->ns->acl_group[i++]; |
187 | goto retry; |
188 | } |
189 | r->granted = false; |
190 | } |
191 | |
192 | /* The list for "struct tomoyo_domain_info". */ |
193 | LIST_HEAD(tomoyo_domain_list); |
194 | |
195 | /** |
196 | * tomoyo_last_word - Get last component of a domainname. |
197 | * |
198 | * @name: Domainname to check. |
199 | * |
200 | * Returns the last word of @domainname. |
201 | */ |
202 | static const char *tomoyo_last_word(const char *name) |
203 | { |
204 | const char *cp = strrchr(name, ' '); |
205 | |
206 | if (cp) |
207 | return cp + 1; |
208 | return name; |
209 | } |
210 | |
211 | /** |
212 | * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry. |
213 | * |
214 | * @a: Pointer to "struct tomoyo_acl_head". |
215 | * @b: Pointer to "struct tomoyo_acl_head". |
216 | * |
217 | * Returns true if @a == @b, false otherwise. |
218 | */ |
219 | static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a, |
220 | const struct tomoyo_acl_head *b) |
221 | { |
222 | const struct tomoyo_transition_control *p1 = container_of(a, |
223 | typeof(*p1), |
224 | head); |
225 | const struct tomoyo_transition_control *p2 = container_of(b, |
226 | typeof(*p2), |
227 | head); |
228 | |
229 | return p1->type == p2->type && p1->is_last_name == p2->is_last_name |
230 | && p1->domainname == p2->domainname |
231 | && p1->program == p2->program; |
232 | } |
233 | |
234 | /** |
235 | * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list. |
236 | * |
237 | * @param: Pointer to "struct tomoyo_acl_param". |
238 | * @type: Type of this entry. |
239 | * |
240 | * Returns 0 on success, negative value otherwise. |
241 | */ |
242 | int tomoyo_write_transition_control(struct tomoyo_acl_param *param, |
243 | const u8 type) |
244 | { |
245 | struct tomoyo_transition_control e = { .type = type }; |
246 | int error = param->is_delete ? -ENOENT : -ENOMEM; |
247 | char *program = param->data; |
248 | char *domainname = strstr(program, " from " ); |
249 | |
250 | if (domainname) { |
251 | *domainname = '\0'; |
252 | domainname += 6; |
253 | } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP || |
254 | type == TOMOYO_TRANSITION_CONTROL_KEEP) { |
255 | domainname = program; |
256 | program = NULL; |
257 | } |
258 | if (program && strcmp(program, "any" )) { |
259 | if (!tomoyo_correct_path(filename: program)) |
260 | return -EINVAL; |
261 | e.program = tomoyo_get_name(name: program); |
262 | if (!e.program) |
263 | goto out; |
264 | } |
265 | if (domainname && strcmp(domainname, "any" )) { |
266 | if (!tomoyo_correct_domain(domainname)) { |
267 | if (!tomoyo_correct_path(filename: domainname)) |
268 | goto out; |
269 | e.is_last_name = true; |
270 | } |
271 | e.domainname = tomoyo_get_name(name: domainname); |
272 | if (!e.domainname) |
273 | goto out; |
274 | } |
275 | param->list = ¶m->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL]; |
276 | error = tomoyo_update_policy(new_entry: &e.head, size: sizeof(e), param, |
277 | check_duplicate: tomoyo_same_transition_control); |
278 | out: |
279 | tomoyo_put_name(name: e.domainname); |
280 | tomoyo_put_name(name: e.program); |
281 | return error; |
282 | } |
283 | |
284 | /** |
285 | * tomoyo_scan_transition - Try to find specific domain transition type. |
286 | * |
287 | * @list: Pointer to "struct list_head". |
288 | * @domainname: The name of current domain. |
289 | * @program: The name of requested program. |
290 | * @last_name: The last component of @domainname. |
291 | * @type: One of values in "enum tomoyo_transition_type". |
292 | * |
293 | * Returns true if found one, false otherwise. |
294 | * |
295 | * Caller holds tomoyo_read_lock(). |
296 | */ |
297 | static inline bool tomoyo_scan_transition |
298 | (const struct list_head *list, const struct tomoyo_path_info *domainname, |
299 | const struct tomoyo_path_info *program, const char *last_name, |
300 | const enum tomoyo_transition_type type) |
301 | { |
302 | const struct tomoyo_transition_control *ptr; |
303 | |
304 | list_for_each_entry_rcu(ptr, list, head.list, |
305 | srcu_read_lock_held(&tomoyo_ss)) { |
306 | if (ptr->head.is_deleted || ptr->type != type) |
307 | continue; |
308 | if (ptr->domainname) { |
309 | if (!ptr->is_last_name) { |
310 | if (ptr->domainname != domainname) |
311 | continue; |
312 | } else { |
313 | /* |
314 | * Use direct strcmp() since this is |
315 | * unlikely used. |
316 | */ |
317 | if (strcmp(ptr->domainname->name, last_name)) |
318 | continue; |
319 | } |
320 | } |
321 | if (ptr->program && tomoyo_pathcmp(a: ptr->program, b: program)) |
322 | continue; |
323 | return true; |
324 | } |
325 | return false; |
326 | } |
327 | |
328 | /** |
329 | * tomoyo_transition_type - Get domain transition type. |
330 | * |
331 | * @ns: Pointer to "struct tomoyo_policy_namespace". |
332 | * @domainname: The name of current domain. |
333 | * @program: The name of requested program. |
334 | * |
335 | * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes |
336 | * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if |
337 | * executing @program reinitializes domain transition within that namespace, |
338 | * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname , |
339 | * others otherwise. |
340 | * |
341 | * Caller holds tomoyo_read_lock(). |
342 | */ |
343 | static enum tomoyo_transition_type tomoyo_transition_type |
344 | (const struct tomoyo_policy_namespace *ns, |
345 | const struct tomoyo_path_info *domainname, |
346 | const struct tomoyo_path_info *program) |
347 | { |
348 | const char *last_name = tomoyo_last_word(name: domainname->name); |
349 | enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET; |
350 | |
351 | while (type < TOMOYO_MAX_TRANSITION_TYPE) { |
352 | const struct list_head * const list = |
353 | &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL]; |
354 | |
355 | if (!tomoyo_scan_transition(list, domainname, program, |
356 | last_name, type)) { |
357 | type++; |
358 | continue; |
359 | } |
360 | if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET && |
361 | type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE) |
362 | break; |
363 | /* |
364 | * Do not check for reset_domain if no_reset_domain matched. |
365 | * Do not check for initialize_domain if no_initialize_domain |
366 | * matched. |
367 | */ |
368 | type++; |
369 | type++; |
370 | } |
371 | return type; |
372 | } |
373 | |
374 | /** |
375 | * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry. |
376 | * |
377 | * @a: Pointer to "struct tomoyo_acl_head". |
378 | * @b: Pointer to "struct tomoyo_acl_head". |
379 | * |
380 | * Returns true if @a == @b, false otherwise. |
381 | */ |
382 | static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a, |
383 | const struct tomoyo_acl_head *b) |
384 | { |
385 | const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1), |
386 | head); |
387 | const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2), |
388 | head); |
389 | |
390 | return p1->original_name == p2->original_name && |
391 | p1->aggregated_name == p2->aggregated_name; |
392 | } |
393 | |
394 | /** |
395 | * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list. |
396 | * |
397 | * @param: Pointer to "struct tomoyo_acl_param". |
398 | * |
399 | * Returns 0 on success, negative value otherwise. |
400 | * |
401 | * Caller holds tomoyo_read_lock(). |
402 | */ |
403 | int tomoyo_write_aggregator(struct tomoyo_acl_param *param) |
404 | { |
405 | struct tomoyo_aggregator e = { }; |
406 | int error = param->is_delete ? -ENOENT : -ENOMEM; |
407 | const char *original_name = tomoyo_read_token(param); |
408 | const char *aggregated_name = tomoyo_read_token(param); |
409 | |
410 | if (!tomoyo_correct_word(string: original_name) || |
411 | !tomoyo_correct_path(filename: aggregated_name)) |
412 | return -EINVAL; |
413 | e.original_name = tomoyo_get_name(name: original_name); |
414 | e.aggregated_name = tomoyo_get_name(name: aggregated_name); |
415 | if (!e.original_name || !e.aggregated_name || |
416 | e.aggregated_name->is_patterned) /* No patterns allowed. */ |
417 | goto out; |
418 | param->list = ¶m->ns->policy_list[TOMOYO_ID_AGGREGATOR]; |
419 | error = tomoyo_update_policy(new_entry: &e.head, size: sizeof(e), param, |
420 | check_duplicate: tomoyo_same_aggregator); |
421 | out: |
422 | tomoyo_put_name(name: e.original_name); |
423 | tomoyo_put_name(name: e.aggregated_name); |
424 | return error; |
425 | } |
426 | |
427 | /** |
428 | * tomoyo_find_namespace - Find specified namespace. |
429 | * |
430 | * @name: Name of namespace to find. |
431 | * @len: Length of @name. |
432 | * |
433 | * Returns pointer to "struct tomoyo_policy_namespace" if found, |
434 | * NULL otherwise. |
435 | * |
436 | * Caller holds tomoyo_read_lock(). |
437 | */ |
438 | static struct tomoyo_policy_namespace *tomoyo_find_namespace |
439 | (const char *name, const unsigned int len) |
440 | { |
441 | struct tomoyo_policy_namespace *ns; |
442 | |
443 | list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) { |
444 | if (strncmp(name, ns->name, len) || |
445 | (name[len] && name[len] != ' ')) |
446 | continue; |
447 | return ns; |
448 | } |
449 | return NULL; |
450 | } |
451 | |
452 | /** |
453 | * tomoyo_assign_namespace - Create a new namespace. |
454 | * |
455 | * @domainname: Name of namespace to create. |
456 | * |
457 | * Returns pointer to "struct tomoyo_policy_namespace" on success, |
458 | * NULL otherwise. |
459 | * |
460 | * Caller holds tomoyo_read_lock(). |
461 | */ |
462 | struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname) |
463 | { |
464 | struct tomoyo_policy_namespace *ptr; |
465 | struct tomoyo_policy_namespace *entry; |
466 | const char *cp = domainname; |
467 | unsigned int len = 0; |
468 | |
469 | while (*cp && *cp++ != ' ') |
470 | len++; |
471 | ptr = tomoyo_find_namespace(name: domainname, len); |
472 | if (ptr) |
473 | return ptr; |
474 | if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(buffer: domainname)) |
475 | return NULL; |
476 | entry = kzalloc(size: sizeof(*entry) + len + 1, GFP_NOFS | __GFP_NOWARN); |
477 | if (mutex_lock_interruptible(&tomoyo_policy_lock)) |
478 | goto out; |
479 | ptr = tomoyo_find_namespace(name: domainname, len); |
480 | if (!ptr && tomoyo_memory_ok(ptr: entry)) { |
481 | char *name = (char *) (entry + 1); |
482 | |
483 | ptr = entry; |
484 | memmove(name, domainname, len); |
485 | name[len] = '\0'; |
486 | entry->name = name; |
487 | tomoyo_init_policy_namespace(ns: entry); |
488 | entry = NULL; |
489 | } |
490 | mutex_unlock(lock: &tomoyo_policy_lock); |
491 | out: |
492 | kfree(objp: entry); |
493 | return ptr; |
494 | } |
495 | |
496 | /** |
497 | * tomoyo_namespace_jump - Check for namespace jump. |
498 | * |
499 | * @domainname: Name of domain. |
500 | * |
501 | * Returns true if namespace differs, false otherwise. |
502 | */ |
503 | static bool tomoyo_namespace_jump(const char *domainname) |
504 | { |
505 | const char *namespace = tomoyo_current_namespace()->name; |
506 | const int len = strlen(namespace); |
507 | |
508 | return strncmp(domainname, namespace, len) || |
509 | (domainname[len] && domainname[len] != ' '); |
510 | } |
511 | |
512 | /** |
513 | * tomoyo_assign_domain - Create a domain or a namespace. |
514 | * |
515 | * @domainname: The name of domain. |
516 | * @transit: True if transit to domain found or created. |
517 | * |
518 | * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise. |
519 | * |
520 | * Caller holds tomoyo_read_lock(). |
521 | */ |
522 | struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, |
523 | const bool transit) |
524 | { |
525 | struct tomoyo_domain_info e = { }; |
526 | struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname); |
527 | bool created = false; |
528 | |
529 | if (entry) { |
530 | if (transit) { |
531 | /* |
532 | * Since namespace is created at runtime, profiles may |
533 | * not be created by the moment the process transits to |
534 | * that domain. Do not perform domain transition if |
535 | * profile for that domain is not yet created. |
536 | */ |
537 | if (tomoyo_policy_loaded && |
538 | !entry->ns->profile_ptr[entry->profile]) |
539 | return NULL; |
540 | } |
541 | return entry; |
542 | } |
543 | /* Requested domain does not exist. */ |
544 | /* Don't create requested domain if domainname is invalid. */ |
545 | if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 || |
546 | !tomoyo_correct_domain(domainname)) |
547 | return NULL; |
548 | /* |
549 | * Since definition of profiles and acl_groups may differ across |
550 | * namespaces, do not inherit "use_profile" and "use_group" settings |
551 | * by automatically creating requested domain upon domain transition. |
552 | */ |
553 | if (transit && tomoyo_namespace_jump(domainname)) |
554 | return NULL; |
555 | e.ns = tomoyo_assign_namespace(domainname); |
556 | if (!e.ns) |
557 | return NULL; |
558 | /* |
559 | * "use_profile" and "use_group" settings for automatically created |
560 | * domains are inherited from current domain. These are 0 for manually |
561 | * created domains. |
562 | */ |
563 | if (transit) { |
564 | const struct tomoyo_domain_info *domain = tomoyo_domain(); |
565 | |
566 | e.profile = domain->profile; |
567 | memcpy(e.group, domain->group, sizeof(e.group)); |
568 | } |
569 | e.domainname = tomoyo_get_name(name: domainname); |
570 | if (!e.domainname) |
571 | return NULL; |
572 | if (mutex_lock_interruptible(&tomoyo_policy_lock)) |
573 | goto out; |
574 | entry = tomoyo_find_domain(domainname); |
575 | if (!entry) { |
576 | entry = tomoyo_commit_ok(data: &e, size: sizeof(e)); |
577 | if (entry) { |
578 | INIT_LIST_HEAD(list: &entry->acl_info_list); |
579 | list_add_tail_rcu(new: &entry->list, head: &tomoyo_domain_list); |
580 | created = true; |
581 | } |
582 | } |
583 | mutex_unlock(lock: &tomoyo_policy_lock); |
584 | out: |
585 | tomoyo_put_name(name: e.domainname); |
586 | if (entry && transit) { |
587 | if (created) { |
588 | struct tomoyo_request_info r; |
589 | int i; |
590 | |
591 | tomoyo_init_request_info(r: &r, domain: entry, |
592 | index: TOMOYO_MAC_FILE_EXECUTE); |
593 | r.granted = false; |
594 | tomoyo_write_log(r: &r, fmt: "use_profile %u\n" , |
595 | entry->profile); |
596 | for (i = 0; i < TOMOYO_MAX_ACL_GROUPS; i++) |
597 | if (test_bit(i, entry->group)) |
598 | tomoyo_write_log(r: &r, fmt: "use_group %u\n" , |
599 | i); |
600 | tomoyo_update_stat(index: TOMOYO_STAT_POLICY_UPDATES); |
601 | } |
602 | } |
603 | return entry; |
604 | } |
605 | |
606 | /** |
607 | * tomoyo_environ - Check permission for environment variable names. |
608 | * |
609 | * @ee: Pointer to "struct tomoyo_execve". |
610 | * |
611 | * Returns 0 on success, negative value otherwise. |
612 | */ |
613 | static int tomoyo_environ(struct tomoyo_execve *ee) |
614 | { |
615 | struct tomoyo_request_info *r = &ee->r; |
616 | struct linux_binprm *bprm = ee->bprm; |
617 | /* env_page.data is allocated by tomoyo_dump_page(). */ |
618 | struct tomoyo_page_dump env_page = { }; |
619 | char *arg_ptr; /* Size is TOMOYO_EXEC_TMPSIZE bytes */ |
620 | int arg_len = 0; |
621 | unsigned long pos = bprm->p; |
622 | int offset = pos % PAGE_SIZE; |
623 | int argv_count = bprm->argc; |
624 | int envp_count = bprm->envc; |
625 | int error = -ENOMEM; |
626 | |
627 | ee->r.type = TOMOYO_MAC_ENVIRON; |
628 | ee->r.profile = r->domain->profile; |
629 | ee->r.mode = tomoyo_get_mode(ns: r->domain->ns, profile: ee->r.profile, |
630 | index: TOMOYO_MAC_ENVIRON); |
631 | if (!r->mode || !envp_count) |
632 | return 0; |
633 | arg_ptr = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS); |
634 | if (!arg_ptr) |
635 | goto out; |
636 | while (error == -ENOMEM) { |
637 | if (!tomoyo_dump_page(bprm, pos, dump: &env_page)) |
638 | goto out; |
639 | pos += PAGE_SIZE - offset; |
640 | /* Read. */ |
641 | while (argv_count && offset < PAGE_SIZE) { |
642 | if (!env_page.data[offset++]) |
643 | argv_count--; |
644 | } |
645 | if (argv_count) { |
646 | offset = 0; |
647 | continue; |
648 | } |
649 | while (offset < PAGE_SIZE) { |
650 | const unsigned char c = env_page.data[offset++]; |
651 | |
652 | if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) { |
653 | if (c == '=') { |
654 | arg_ptr[arg_len++] = '\0'; |
655 | } else if (c == '\\') { |
656 | arg_ptr[arg_len++] = '\\'; |
657 | arg_ptr[arg_len++] = '\\'; |
658 | } else if (c > ' ' && c < 127) { |
659 | arg_ptr[arg_len++] = c; |
660 | } else { |
661 | arg_ptr[arg_len++] = '\\'; |
662 | arg_ptr[arg_len++] = (c >> 6) + '0'; |
663 | arg_ptr[arg_len++] |
664 | = ((c >> 3) & 7) + '0'; |
665 | arg_ptr[arg_len++] = (c & 7) + '0'; |
666 | } |
667 | } else { |
668 | arg_ptr[arg_len] = '\0'; |
669 | } |
670 | if (c) |
671 | continue; |
672 | if (tomoyo_env_perm(r, env: arg_ptr)) { |
673 | error = -EPERM; |
674 | break; |
675 | } |
676 | if (!--envp_count) { |
677 | error = 0; |
678 | break; |
679 | } |
680 | arg_len = 0; |
681 | } |
682 | offset = 0; |
683 | } |
684 | out: |
685 | if (r->mode != TOMOYO_CONFIG_ENFORCING) |
686 | error = 0; |
687 | kfree(objp: env_page.data); |
688 | kfree(objp: arg_ptr); |
689 | return error; |
690 | } |
691 | |
692 | /** |
693 | * tomoyo_find_next_domain - Find a domain. |
694 | * |
695 | * @bprm: Pointer to "struct linux_binprm". |
696 | * |
697 | * Returns 0 on success, negative value otherwise. |
698 | * |
699 | * Caller holds tomoyo_read_lock(). |
700 | */ |
701 | int tomoyo_find_next_domain(struct linux_binprm *bprm) |
702 | { |
703 | struct tomoyo_domain_info *old_domain = tomoyo_domain(); |
704 | struct tomoyo_domain_info *domain = NULL; |
705 | const char *original_name = bprm->filename; |
706 | int retval = -ENOMEM; |
707 | bool reject_on_transition_failure = false; |
708 | const struct tomoyo_path_info *candidate; |
709 | struct tomoyo_path_info exename; |
710 | struct tomoyo_execve *ee = kzalloc(size: sizeof(*ee), GFP_NOFS); |
711 | |
712 | if (!ee) |
713 | return -ENOMEM; |
714 | ee->tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS); |
715 | if (!ee->tmp) { |
716 | kfree(objp: ee); |
717 | return -ENOMEM; |
718 | } |
719 | /* ee->dump->data is allocated by tomoyo_dump_page(). */ |
720 | tomoyo_init_request_info(r: &ee->r, NULL, index: TOMOYO_MAC_FILE_EXECUTE); |
721 | ee->r.ee = ee; |
722 | ee->bprm = bprm; |
723 | ee->r.obj = &ee->obj; |
724 | ee->obj.path1 = bprm->file->f_path; |
725 | /* Get symlink's pathname of program. */ |
726 | retval = -ENOENT; |
727 | exename.name = tomoyo_realpath_nofollow(pathname: original_name); |
728 | if (!exename.name) |
729 | goto out; |
730 | tomoyo_fill_path_info(ptr: &exename); |
731 | retry: |
732 | /* Check 'aggregator' directive. */ |
733 | { |
734 | struct tomoyo_aggregator *ptr; |
735 | struct list_head *list = |
736 | &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR]; |
737 | |
738 | /* Check 'aggregator' directive. */ |
739 | candidate = &exename; |
740 | list_for_each_entry_rcu(ptr, list, head.list, |
741 | srcu_read_lock_held(&tomoyo_ss)) { |
742 | if (ptr->head.is_deleted || |
743 | !tomoyo_path_matches_pattern(filename: &exename, |
744 | pattern: ptr->original_name)) |
745 | continue; |
746 | candidate = ptr->aggregated_name; |
747 | break; |
748 | } |
749 | } |
750 | |
751 | /* Check execute permission. */ |
752 | retval = tomoyo_execute_permission(r: &ee->r, filename: candidate); |
753 | if (retval == TOMOYO_RETRY_REQUEST) |
754 | goto retry; |
755 | if (retval < 0) |
756 | goto out; |
757 | /* |
758 | * To be able to specify domainnames with wildcards, use the |
759 | * pathname specified in the policy (which may contain |
760 | * wildcard) rather than the pathname passed to execve() |
761 | * (which never contains wildcard). |
762 | */ |
763 | if (ee->r.param.path.matched_path) |
764 | candidate = ee->r.param.path.matched_path; |
765 | |
766 | /* |
767 | * Check for domain transition preference if "file execute" matched. |
768 | * If preference is given, make execve() fail if domain transition |
769 | * has failed, for domain transition preference should be used with |
770 | * destination domain defined. |
771 | */ |
772 | if (ee->transition) { |
773 | const char *domainname = ee->transition->name; |
774 | |
775 | reject_on_transition_failure = true; |
776 | if (!strcmp(domainname, "keep" )) |
777 | goto force_keep_domain; |
778 | if (!strcmp(domainname, "child" )) |
779 | goto force_child_domain; |
780 | if (!strcmp(domainname, "reset" )) |
781 | goto force_reset_domain; |
782 | if (!strcmp(domainname, "initialize" )) |
783 | goto force_initialize_domain; |
784 | if (!strcmp(domainname, "parent" )) { |
785 | char *cp; |
786 | |
787 | strscpy(p: ee->tmp, q: old_domain->domainname->name, TOMOYO_EXEC_TMPSIZE); |
788 | cp = strrchr(ee->tmp, ' '); |
789 | if (cp) |
790 | *cp = '\0'; |
791 | } else if (*domainname == '<') |
792 | strscpy(p: ee->tmp, q: domainname, TOMOYO_EXEC_TMPSIZE); |
793 | else |
794 | snprintf(buf: ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, fmt: "%s %s" , |
795 | old_domain->domainname->name, domainname); |
796 | goto force_jump_domain; |
797 | } |
798 | /* |
799 | * No domain transition preference specified. |
800 | * Calculate domain to transit to. |
801 | */ |
802 | switch (tomoyo_transition_type(ns: old_domain->ns, domainname: old_domain->domainname, |
803 | program: candidate)) { |
804 | case TOMOYO_TRANSITION_CONTROL_RESET: |
805 | force_reset_domain: |
806 | /* Transit to the root of specified namespace. */ |
807 | snprintf(buf: ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, fmt: "<%s>" , |
808 | candidate->name); |
809 | /* |
810 | * Make execve() fail if domain transition across namespaces |
811 | * has failed. |
812 | */ |
813 | reject_on_transition_failure = true; |
814 | break; |
815 | case TOMOYO_TRANSITION_CONTROL_INITIALIZE: |
816 | force_initialize_domain: |
817 | /* Transit to the child of current namespace's root. */ |
818 | snprintf(buf: ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, fmt: "%s %s" , |
819 | old_domain->ns->name, candidate->name); |
820 | break; |
821 | case TOMOYO_TRANSITION_CONTROL_KEEP: |
822 | force_keep_domain: |
823 | /* Keep current domain. */ |
824 | domain = old_domain; |
825 | break; |
826 | default: |
827 | if (old_domain == &tomoyo_kernel_domain && |
828 | !tomoyo_policy_loaded) { |
829 | /* |
830 | * Needn't to transit from kernel domain before |
831 | * starting /sbin/init. But transit from kernel domain |
832 | * if executing initializers because they might start |
833 | * before /sbin/init. |
834 | */ |
835 | domain = old_domain; |
836 | break; |
837 | } |
838 | force_child_domain: |
839 | /* Normal domain transition. */ |
840 | snprintf(buf: ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, fmt: "%s %s" , |
841 | old_domain->domainname->name, candidate->name); |
842 | break; |
843 | } |
844 | force_jump_domain: |
845 | if (!domain) |
846 | domain = tomoyo_assign_domain(domainname: ee->tmp, transit: true); |
847 | if (domain) |
848 | retval = 0; |
849 | else if (reject_on_transition_failure) { |
850 | pr_warn("ERROR: Domain '%s' not ready.\n" , ee->tmp); |
851 | retval = -ENOMEM; |
852 | } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING) |
853 | retval = -ENOMEM; |
854 | else { |
855 | retval = 0; |
856 | if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) { |
857 | old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true; |
858 | ee->r.granted = false; |
859 | tomoyo_write_log(r: &ee->r, fmt: "%s" , tomoyo_dif |
860 | [TOMOYO_DIF_TRANSITION_FAILED]); |
861 | pr_warn("ERROR: Domain '%s' not defined.\n" , ee->tmp); |
862 | } |
863 | } |
864 | out: |
865 | if (!domain) |
866 | domain = old_domain; |
867 | /* Update reference count on "struct tomoyo_domain_info". */ |
868 | { |
869 | struct tomoyo_task *s = tomoyo_task(current); |
870 | |
871 | s->old_domain_info = s->domain_info; |
872 | s->domain_info = domain; |
873 | atomic_inc(v: &domain->users); |
874 | } |
875 | kfree(objp: exename.name); |
876 | if (!retval) { |
877 | ee->r.domain = domain; |
878 | retval = tomoyo_environ(ee); |
879 | } |
880 | kfree(objp: ee->tmp); |
881 | kfree(objp: ee->dump.data); |
882 | kfree(objp: ee); |
883 | return retval; |
884 | } |
885 | |
886 | /** |
887 | * tomoyo_dump_page - Dump a page to buffer. |
888 | * |
889 | * @bprm: Pointer to "struct linux_binprm". |
890 | * @pos: Location to dump. |
891 | * @dump: Pointer to "struct tomoyo_page_dump". |
892 | * |
893 | * Returns true on success, false otherwise. |
894 | */ |
895 | bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, |
896 | struct tomoyo_page_dump *dump) |
897 | { |
898 | struct page *page; |
899 | #ifdef CONFIG_MMU |
900 | int ret; |
901 | #endif |
902 | |
903 | /* dump->data is released by tomoyo_find_next_domain(). */ |
904 | if (!dump->data) { |
905 | dump->data = kzalloc(PAGE_SIZE, GFP_NOFS); |
906 | if (!dump->data) |
907 | return false; |
908 | } |
909 | /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */ |
910 | #ifdef CONFIG_MMU |
911 | /* |
912 | * This is called at execve() time in order to dig around |
913 | * in the argv/environment of the new proceess |
914 | * (represented by bprm). |
915 | */ |
916 | mmap_read_lock(mm: bprm->mm); |
917 | ret = get_user_pages_remote(mm: bprm->mm, start: pos, nr_pages: 1, |
918 | gup_flags: FOLL_FORCE, pages: &page, NULL); |
919 | mmap_read_unlock(mm: bprm->mm); |
920 | if (ret <= 0) |
921 | return false; |
922 | #else |
923 | page = bprm->page[pos / PAGE_SIZE]; |
924 | #endif |
925 | if (page != dump->page) { |
926 | const unsigned int offset = pos % PAGE_SIZE; |
927 | /* |
928 | * Maybe kmap()/kunmap() should be used here. |
929 | * But remove_arg_zero() uses kmap_atomic()/kunmap_atomic(). |
930 | * So do I. |
931 | */ |
932 | char *kaddr = kmap_atomic(page); |
933 | |
934 | dump->page = page; |
935 | memcpy(dump->data + offset, kaddr + offset, |
936 | PAGE_SIZE - offset); |
937 | kunmap_atomic(kaddr); |
938 | } |
939 | /* Same with put_arg_page(page) in fs/exec.c */ |
940 | #ifdef CONFIG_MMU |
941 | put_page(page); |
942 | #endif |
943 | return true; |
944 | } |
945 | |