1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/tomoyo.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include <linux/lsm_hooks.h>
9#include "common.h"
10
11/**
12 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
13 *
14 * Returns pointer to "struct tomoyo_domain_info" for current thread.
15 */
16struct tomoyo_domain_info *tomoyo_domain(void)
17{
18 struct tomoyo_task *s = tomoyo_task(current);
19
20 if (s->old_domain_info && !current->in_execve) {
21 atomic_dec(v: &s->old_domain_info->users);
22 s->old_domain_info = NULL;
23 }
24 return s->domain_info;
25}
26
27/**
28 * tomoyo_cred_prepare - Target for security_prepare_creds().
29 *
30 * @new: Pointer to "struct cred".
31 * @old: Pointer to "struct cred".
32 * @gfp: Memory allocation flags.
33 *
34 * Returns 0.
35 */
36static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
37 gfp_t gfp)
38{
39 /* Restore old_domain_info saved by previous execve() request. */
40 struct tomoyo_task *s = tomoyo_task(current);
41
42 if (s->old_domain_info && !current->in_execve) {
43 atomic_dec(v: &s->domain_info->users);
44 s->domain_info = s->old_domain_info;
45 s->old_domain_info = NULL;
46 }
47 return 0;
48}
49
50/**
51 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
52 *
53 * @bprm: Pointer to "struct linux_binprm".
54 */
55static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm)
56{
57 /* Clear old_domain_info saved by execve() request. */
58 struct tomoyo_task *s = tomoyo_task(current);
59
60 atomic_dec(v: &s->old_domain_info->users);
61 s->old_domain_info = NULL;
62}
63
64#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
65/**
66 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec().
67 *
68 * @bprm: Pointer to "struct linux_binprm".
69 *
70 * Returns 0.
71 */
72static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm)
73{
74 /*
75 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
76 * for the first time.
77 */
78 if (!tomoyo_policy_loaded)
79 tomoyo_load_policy(bprm->filename);
80 return 0;
81}
82#endif
83
84/**
85 * tomoyo_bprm_check_security - Target for security_bprm_check().
86 *
87 * @bprm: Pointer to "struct linux_binprm".
88 *
89 * Returns 0 on success, negative value otherwise.
90 */
91static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
92{
93 struct tomoyo_task *s = tomoyo_task(current);
94
95 /*
96 * Execute permission is checked against pathname passed to execve()
97 * using current domain.
98 */
99 if (!s->old_domain_info) {
100 const int idx = tomoyo_read_lock();
101 const int err = tomoyo_find_next_domain(bprm);
102
103 tomoyo_read_unlock(idx);
104 return err;
105 }
106 /*
107 * Read permission is checked against interpreters using next domain.
108 */
109 return tomoyo_check_open_permission(domain: s->domain_info,
110 path: &bprm->file->f_path, O_RDONLY);
111}
112
113/**
114 * tomoyo_inode_getattr - Target for security_inode_getattr().
115 *
116 * @path: Pointer to "struct path".
117 *
118 * Returns 0 on success, negative value otherwise.
119 */
120static int tomoyo_inode_getattr(const struct path *path)
121{
122 return tomoyo_path_perm(operation: TOMOYO_TYPE_GETATTR, path, NULL);
123}
124
125/**
126 * tomoyo_path_truncate - Target for security_path_truncate().
127 *
128 * @path: Pointer to "struct path".
129 *
130 * Returns 0 on success, negative value otherwise.
131 */
132static int tomoyo_path_truncate(const struct path *path)
133{
134 return tomoyo_path_perm(operation: TOMOYO_TYPE_TRUNCATE, path, NULL);
135}
136
137/**
138 * tomoyo_file_truncate - Target for security_file_truncate().
139 *
140 * @file: Pointer to "struct file".
141 *
142 * Returns 0 on success, negative value otherwise.
143 */
144static int tomoyo_file_truncate(struct file *file)
145{
146 return tomoyo_path_truncate(path: &file->f_path);
147}
148
149/**
150 * tomoyo_path_unlink - Target for security_path_unlink().
151 *
152 * @parent: Pointer to "struct path".
153 * @dentry: Pointer to "struct dentry".
154 *
155 * Returns 0 on success, negative value otherwise.
156 */
157static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
158{
159 struct path path = { .mnt = parent->mnt, .dentry = dentry };
160
161 return tomoyo_path_perm(operation: TOMOYO_TYPE_UNLINK, path: &path, NULL);
162}
163
164/**
165 * tomoyo_path_mkdir - Target for security_path_mkdir().
166 *
167 * @parent: Pointer to "struct path".
168 * @dentry: Pointer to "struct dentry".
169 * @mode: DAC permission mode.
170 *
171 * Returns 0 on success, negative value otherwise.
172 */
173static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
174 umode_t mode)
175{
176 struct path path = { .mnt = parent->mnt, .dentry = dentry };
177
178 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_MKDIR, path: &path,
179 number: mode & S_IALLUGO);
180}
181
182/**
183 * tomoyo_path_rmdir - Target for security_path_rmdir().
184 *
185 * @parent: Pointer to "struct path".
186 * @dentry: Pointer to "struct dentry".
187 *
188 * Returns 0 on success, negative value otherwise.
189 */
190static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
191{
192 struct path path = { .mnt = parent->mnt, .dentry = dentry };
193
194 return tomoyo_path_perm(operation: TOMOYO_TYPE_RMDIR, path: &path, NULL);
195}
196
197/**
198 * tomoyo_path_symlink - Target for security_path_symlink().
199 *
200 * @parent: Pointer to "struct path".
201 * @dentry: Pointer to "struct dentry".
202 * @old_name: Symlink's content.
203 *
204 * Returns 0 on success, negative value otherwise.
205 */
206static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
207 const char *old_name)
208{
209 struct path path = { .mnt = parent->mnt, .dentry = dentry };
210
211 return tomoyo_path_perm(operation: TOMOYO_TYPE_SYMLINK, path: &path, target: old_name);
212}
213
214/**
215 * tomoyo_path_mknod - Target for security_path_mknod().
216 *
217 * @parent: Pointer to "struct path".
218 * @dentry: Pointer to "struct dentry".
219 * @mode: DAC permission mode.
220 * @dev: Device attributes.
221 *
222 * Returns 0 on success, negative value otherwise.
223 */
224static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
225 umode_t mode, unsigned int dev)
226{
227 struct path path = { .mnt = parent->mnt, .dentry = dentry };
228 int type = TOMOYO_TYPE_CREATE;
229 const unsigned int perm = mode & S_IALLUGO;
230
231 switch (mode & S_IFMT) {
232 case S_IFCHR:
233 type = TOMOYO_TYPE_MKCHAR;
234 break;
235 case S_IFBLK:
236 type = TOMOYO_TYPE_MKBLOCK;
237 break;
238 default:
239 goto no_dev;
240 }
241 return tomoyo_mkdev_perm(operation: type, path: &path, mode: perm, dev);
242 no_dev:
243 switch (mode & S_IFMT) {
244 case S_IFIFO:
245 type = TOMOYO_TYPE_MKFIFO;
246 break;
247 case S_IFSOCK:
248 type = TOMOYO_TYPE_MKSOCK;
249 break;
250 }
251 return tomoyo_path_number_perm(operation: type, path: &path, number: perm);
252}
253
254/**
255 * tomoyo_path_link - Target for security_path_link().
256 *
257 * @old_dentry: Pointer to "struct dentry".
258 * @new_dir: Pointer to "struct path".
259 * @new_dentry: Pointer to "struct dentry".
260 *
261 * Returns 0 on success, negative value otherwise.
262 */
263static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
264 struct dentry *new_dentry)
265{
266 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
267 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
268
269 return tomoyo_path2_perm(operation: TOMOYO_TYPE_LINK, path1: &path1, path2: &path2);
270}
271
272/**
273 * tomoyo_path_rename - Target for security_path_rename().
274 *
275 * @old_parent: Pointer to "struct path".
276 * @old_dentry: Pointer to "struct dentry".
277 * @new_parent: Pointer to "struct path".
278 * @new_dentry: Pointer to "struct dentry".
279 * @flags: Rename options.
280 *
281 * Returns 0 on success, negative value otherwise.
282 */
283static int tomoyo_path_rename(const struct path *old_parent,
284 struct dentry *old_dentry,
285 const struct path *new_parent,
286 struct dentry *new_dentry,
287 const unsigned int flags)
288{
289 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
290 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
291
292 if (flags & RENAME_EXCHANGE) {
293 const int err = tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path2,
294 path2: &path1);
295
296 if (err)
297 return err;
298 }
299 return tomoyo_path2_perm(operation: TOMOYO_TYPE_RENAME, path1: &path1, path2: &path2);
300}
301
302/**
303 * tomoyo_file_fcntl - Target for security_file_fcntl().
304 *
305 * @file: Pointer to "struct file".
306 * @cmd: Command for fcntl().
307 * @arg: Argument for @cmd.
308 *
309 * Returns 0 on success, negative value otherwise.
310 */
311static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
312 unsigned long arg)
313{
314 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
315 return 0;
316 return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &file->f_path,
317 O_WRONLY | (arg & O_APPEND));
318}
319
320/**
321 * tomoyo_file_open - Target for security_file_open().
322 *
323 * @f: Pointer to "struct file".
324 *
325 * Returns 0 on success, negative value otherwise.
326 */
327static int tomoyo_file_open(struct file *f)
328{
329 /* Don't check read permission here if called from execve(). */
330 if (current->in_execve)
331 return 0;
332 return tomoyo_check_open_permission(domain: tomoyo_domain(), path: &f->f_path,
333 flag: f->f_flags);
334}
335
336/**
337 * tomoyo_file_ioctl - Target for security_file_ioctl().
338 *
339 * @file: Pointer to "struct file".
340 * @cmd: Command for ioctl().
341 * @arg: Argument for @cmd.
342 *
343 * Returns 0 on success, negative value otherwise.
344 */
345static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
346 unsigned long arg)
347{
348 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_IOCTL, path: &file->f_path, number: cmd);
349}
350
351/**
352 * tomoyo_path_chmod - Target for security_path_chmod().
353 *
354 * @path: Pointer to "struct path".
355 * @mode: DAC permission mode.
356 *
357 * Returns 0 on success, negative value otherwise.
358 */
359static int tomoyo_path_chmod(const struct path *path, umode_t mode)
360{
361 return tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHMOD, path,
362 number: mode & S_IALLUGO);
363}
364
365/**
366 * tomoyo_path_chown - Target for security_path_chown().
367 *
368 * @path: Pointer to "struct path".
369 * @uid: Owner ID.
370 * @gid: Group ID.
371 *
372 * Returns 0 on success, negative value otherwise.
373 */
374static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
375{
376 int error = 0;
377
378 if (uid_valid(uid))
379 error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHOWN, path,
380 number: from_kuid(to: &init_user_ns, uid));
381 if (!error && gid_valid(gid))
382 error = tomoyo_path_number_perm(operation: TOMOYO_TYPE_CHGRP, path,
383 number: from_kgid(to: &init_user_ns, gid));
384 return error;
385}
386
387/**
388 * tomoyo_path_chroot - Target for security_path_chroot().
389 *
390 * @path: Pointer to "struct path".
391 *
392 * Returns 0 on success, negative value otherwise.
393 */
394static int tomoyo_path_chroot(const struct path *path)
395{
396 return tomoyo_path_perm(operation: TOMOYO_TYPE_CHROOT, path, NULL);
397}
398
399/**
400 * tomoyo_sb_mount - Target for security_sb_mount().
401 *
402 * @dev_name: Name of device file. Maybe NULL.
403 * @path: Pointer to "struct path".
404 * @type: Name of filesystem type. Maybe NULL.
405 * @flags: Mount options.
406 * @data: Optional data. Maybe NULL.
407 *
408 * Returns 0 on success, negative value otherwise.
409 */
410static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
411 const char *type, unsigned long flags, void *data)
412{
413 return tomoyo_mount_permission(dev_name, path, type, flags, data_page: data);
414}
415
416/**
417 * tomoyo_sb_umount - Target for security_sb_umount().
418 *
419 * @mnt: Pointer to "struct vfsmount".
420 * @flags: Unmount options.
421 *
422 * Returns 0 on success, negative value otherwise.
423 */
424static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
425{
426 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
427
428 return tomoyo_path_perm(operation: TOMOYO_TYPE_UMOUNT, path: &path, NULL);
429}
430
431/**
432 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
433 *
434 * @old_path: Pointer to "struct path".
435 * @new_path: Pointer to "struct path".
436 *
437 * Returns 0 on success, negative value otherwise.
438 */
439static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
440{
441 return tomoyo_path2_perm(operation: TOMOYO_TYPE_PIVOT_ROOT, path1: new_path, path2: old_path);
442}
443
444/**
445 * tomoyo_socket_listen - Check permission for listen().
446 *
447 * @sock: Pointer to "struct socket".
448 * @backlog: Backlog parameter.
449 *
450 * Returns 0 on success, negative value otherwise.
451 */
452static int tomoyo_socket_listen(struct socket *sock, int backlog)
453{
454 return tomoyo_socket_listen_permission(sock);
455}
456
457/**
458 * tomoyo_socket_connect - Check permission for connect().
459 *
460 * @sock: Pointer to "struct socket".
461 * @addr: Pointer to "struct sockaddr".
462 * @addr_len: Size of @addr.
463 *
464 * Returns 0 on success, negative value otherwise.
465 */
466static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
467 int addr_len)
468{
469 return tomoyo_socket_connect_permission(sock, addr, addr_len);
470}
471
472/**
473 * tomoyo_socket_bind - Check permission for bind().
474 *
475 * @sock: Pointer to "struct socket".
476 * @addr: Pointer to "struct sockaddr".
477 * @addr_len: Size of @addr.
478 *
479 * Returns 0 on success, negative value otherwise.
480 */
481static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
482 int addr_len)
483{
484 return tomoyo_socket_bind_permission(sock, addr, addr_len);
485}
486
487/**
488 * tomoyo_socket_sendmsg - Check permission for sendmsg().
489 *
490 * @sock: Pointer to "struct socket".
491 * @msg: Pointer to "struct msghdr".
492 * @size: Size of message.
493 *
494 * Returns 0 on success, negative value otherwise.
495 */
496static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
497 int size)
498{
499 return tomoyo_socket_sendmsg_permission(sock, msg, size);
500}
501
502struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = {
503 .lbs_task = sizeof(struct tomoyo_task),
504};
505
506/**
507 * tomoyo_task_alloc - Target for security_task_alloc().
508 *
509 * @task: Pointer to "struct task_struct".
510 * @clone_flags: clone() flags.
511 *
512 * Returns 0.
513 */
514static int tomoyo_task_alloc(struct task_struct *task,
515 unsigned long clone_flags)
516{
517 struct tomoyo_task *old = tomoyo_task(current);
518 struct tomoyo_task *new = tomoyo_task(task);
519
520 new->domain_info = old->domain_info;
521 atomic_inc(v: &new->domain_info->users);
522 new->old_domain_info = NULL;
523 return 0;
524}
525
526/**
527 * tomoyo_task_free - Target for security_task_free().
528 *
529 * @task: Pointer to "struct task_struct".
530 */
531static void tomoyo_task_free(struct task_struct *task)
532{
533 struct tomoyo_task *s = tomoyo_task(task);
534
535 if (s->domain_info) {
536 atomic_dec(v: &s->domain_info->users);
537 s->domain_info = NULL;
538 }
539 if (s->old_domain_info) {
540 atomic_dec(v: &s->old_domain_info->users);
541 s->old_domain_info = NULL;
542 }
543}
544
545/*
546 * tomoyo_security_ops is a "struct security_operations" which is used for
547 * registering TOMOYO.
548 */
549static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
550 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
551 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
552 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
553 LSM_HOOK_INIT(task_free, tomoyo_task_free),
554#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
555 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec),
556#endif
557 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
558 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
559 LSM_HOOK_INIT(file_open, tomoyo_file_open),
560 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate),
561 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
562 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
563 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
564 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
565 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
566 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
567 LSM_HOOK_INIT(path_link, tomoyo_path_link),
568 LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
569 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
570 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
571 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
572 LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
573 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
574 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
575 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
576 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
577 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
578 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
579 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
580 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
581};
582
583/* Lock for GC. */
584DEFINE_SRCU(tomoyo_ss);
585
586int tomoyo_enabled __ro_after_init = 1;
587
588/**
589 * tomoyo_init - Register TOMOYO Linux as a LSM module.
590 *
591 * Returns 0.
592 */
593static int __init tomoyo_init(void)
594{
595 struct tomoyo_task *s = tomoyo_task(current);
596
597 /* register ourselves with the security framework */
598 security_add_hooks(hooks: tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), lsm: "tomoyo");
599 pr_info("TOMOYO Linux initialized\n");
600 s->domain_info = &tomoyo_kernel_domain;
601 atomic_inc(v: &tomoyo_kernel_domain.users);
602 s->old_domain_info = NULL;
603 tomoyo_mm_init();
604
605 return 0;
606}
607
608DEFINE_LSM(tomoyo) = {
609 .name = "tomoyo",
610 .enabled = &tomoyo_enabled,
611 .flags = LSM_FLAG_LEGACY_MAJOR,
612 .blobs = &tomoyo_blob_sizes,
613 .init = tomoyo_init,
614};
615

source code of linux/security/tomoyo/tomoyo.c