1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * security/tomoyo/network.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8 #include "common.h" 9 #include <linux/slab.h> 10 11 /* Structure for holding inet domain socket's address. */ 12 struct tomoyo_inet_addr_info { 13 __be16 port; /* In network byte order. */ 14 const __be32 *address; /* In network byte order. */ 15 bool is_ipv6; 16 }; 17 18 /* Structure for holding unix domain socket's address. */ 19 struct tomoyo_unix_addr_info { 20 u8 *addr; /* This may not be '\0' terminated string. */ 21 unsigned int addr_len; 22 }; 23 24 /* Structure for holding socket address. */ 25 struct tomoyo_addr_info { 26 u8 protocol; 27 u8 operation; 28 struct tomoyo_inet_addr_info inet; 29 struct tomoyo_unix_addr_info unix0; 30 }; 31 32 /* String table for socket's protocols. */ 33 const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = { 34 [SOCK_STREAM] = "stream", 35 [SOCK_DGRAM] = "dgram", 36 [SOCK_RAW] = "raw", 37 [SOCK_SEQPACKET] = "seqpacket", 38 [0] = " ", /* Dummy for avoiding NULL pointer dereference. */ 39 [4] = " ", /* Dummy for avoiding NULL pointer dereference. */ 40 }; 41 42 /** 43 * tomoyo_parse_ipaddr_union - Parse an IP address. 44 * 45 * @param: Pointer to "struct tomoyo_acl_param". 46 * @ptr: Pointer to "struct tomoyo_ipaddr_union". 47 * 48 * Returns true on success, false otherwise. 49 */ 50 bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param, 51 struct tomoyo_ipaddr_union *ptr) 52 { 53 u8 * const min = ptr->ip[0].in6_u.u6_addr8; 54 u8 * const max = ptr->ip[1].in6_u.u6_addr8; 55 char *address = tomoyo_read_token(param); 56 const char *end; 57 58 if (!strchr(address, ':') && 59 in4_pton(address, -1, min, '-', &end) > 0) { 60 ptr->is_ipv6 = false; 61 if (!*end) 62 ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0]; 63 else if (*end++ != '-' || 64 in4_pton(end, -1, max, '\0', &end) <= 0 || *end) 65 return false; 66 return true; 67 } 68 if (in6_pton(address, -1, min, '-', &end) > 0) { 69 ptr->is_ipv6 = true; 70 if (!*end) 71 memmove(max, min, sizeof(u16) * 8); 72 else if (*end++ != '-' || 73 in6_pton(end, -1, max, '\0', &end) <= 0 || *end) 74 return false; 75 return true; 76 } 77 return false; 78 } 79 80 /** 81 * tomoyo_print_ipv4 - Print an IPv4 address. 82 * 83 * @buffer: Buffer to write to. 84 * @buffer_len: Size of @buffer. 85 * @min_ip: Pointer to __be32. 86 * @max_ip: Pointer to __be32. 87 * 88 * Returns nothing. 89 */ 90 static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len, 91 const __be32 *min_ip, const __be32 *max_ip) 92 { 93 snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip, 94 *min_ip == *max_ip ? '\0' : '-', max_ip); 95 } 96 97 /** 98 * tomoyo_print_ipv6 - Print an IPv6 address. 99 * 100 * @buffer: Buffer to write to. 101 * @buffer_len: Size of @buffer. 102 * @min_ip: Pointer to "struct in6_addr". 103 * @max_ip: Pointer to "struct in6_addr". 104 * 105 * Returns nothing. 106 */ 107 static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len, 108 const struct in6_addr *min_ip, 109 const struct in6_addr *max_ip) 110 { 111 snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip, 112 !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip); 113 } 114 115 /** 116 * tomoyo_print_ip - Print an IP address. 117 * 118 * @buf: Buffer to write to. 119 * @size: Size of @buf. 120 * @ptr: Pointer to "struct ipaddr_union". 121 * 122 * Returns nothing. 123 */ 124 void tomoyo_print_ip(char *buf, const unsigned int size, 125 const struct tomoyo_ipaddr_union *ptr) 126 { 127 if (ptr->is_ipv6) 128 tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]); 129 else 130 tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0], 131 &ptr->ip[1].s6_addr32[0]); 132 } 133 134 /* 135 * Mapping table from "enum tomoyo_network_acl_index" to 136 * "enum tomoyo_mac_index" for inet domain socket. 137 */ 138 static const u8 tomoyo_inet2mac 139 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = { 140 [SOCK_STREAM] = { 141 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_STREAM_BIND, 142 [TOMOYO_NETWORK_LISTEN] = 143 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN, 144 [TOMOYO_NETWORK_CONNECT] = 145 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT, 146 }, 147 [SOCK_DGRAM] = { 148 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND, 149 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND, 150 }, 151 [SOCK_RAW] = { 152 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_RAW_BIND, 153 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_RAW_SEND, 154 }, 155 }; 156 157 /* 158 * Mapping table from "enum tomoyo_network_acl_index" to 159 * "enum tomoyo_mac_index" for unix domain socket. 160 */ 161 static const u8 tomoyo_unix2mac 162 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = { 163 [SOCK_STREAM] = { 164 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND, 165 [TOMOYO_NETWORK_LISTEN] = 166 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN, 167 [TOMOYO_NETWORK_CONNECT] = 168 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT, 169 }, 170 [SOCK_DGRAM] = { 171 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND, 172 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND, 173 }, 174 [SOCK_SEQPACKET] = { 175 [TOMOYO_NETWORK_BIND] = 176 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND, 177 [TOMOYO_NETWORK_LISTEN] = 178 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN, 179 [TOMOYO_NETWORK_CONNECT] = 180 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT, 181 }, 182 }; 183 184 /** 185 * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry. 186 * 187 * @a: Pointer to "struct tomoyo_acl_info". 188 * @b: Pointer to "struct tomoyo_acl_info". 189 * 190 * Returns true if @a == @b except permission bits, false otherwise. 191 */ 192 static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a, 193 const struct tomoyo_acl_info *b) 194 { 195 const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head); 196 const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head); 197 198 return p1->protocol == p2->protocol && 199 tomoyo_same_ipaddr_union(&p1->address, &p2->address) && 200 tomoyo_same_number_union(&p1->port, &p2->port); 201 } 202 203 /** 204 * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry. 205 * 206 * @a: Pointer to "struct tomoyo_acl_info". 207 * @b: Pointer to "struct tomoyo_acl_info". 208 * 209 * Returns true if @a == @b except permission bits, false otherwise. 210 */ 211 static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a, 212 const struct tomoyo_acl_info *b) 213 { 214 const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head); 215 const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head); 216 217 return p1->protocol == p2->protocol && 218 tomoyo_same_name_union(&p1->name, &p2->name); 219 } 220 221 /** 222 * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry. 223 * 224 * @a: Pointer to "struct tomoyo_acl_info". 225 * @b: Pointer to "struct tomoyo_acl_info". 226 * @is_delete: True for @a &= ~@b, false for @a |= @b. 227 * 228 * Returns true if @a is empty, false otherwise. 229 */ 230 static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a, 231 struct tomoyo_acl_info *b, 232 const bool is_delete) 233 { 234 u8 * const a_perm = 235 &container_of(a, struct tomoyo_inet_acl, head)->perm; 236 u8 perm = READ_ONCE(*a_perm); 237 const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm; 238 239 if (is_delete) 240 perm &= ~b_perm; 241 else 242 perm |= b_perm; 243 WRITE_ONCE(*a_perm, perm); 244 return !perm; 245 } 246 247 /** 248 * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry. 249 * 250 * @a: Pointer to "struct tomoyo_acl_info". 251 * @b: Pointer to "struct tomoyo_acl_info". 252 * @is_delete: True for @a &= ~@b, false for @a |= @b. 253 * 254 * Returns true if @a is empty, false otherwise. 255 */ 256 static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a, 257 struct tomoyo_acl_info *b, 258 const bool is_delete) 259 { 260 u8 * const a_perm = 261 &container_of(a, struct tomoyo_unix_acl, head)->perm; 262 u8 perm = READ_ONCE(*a_perm); 263 const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm; 264 265 if (is_delete) 266 perm &= ~b_perm; 267 else 268 perm |= b_perm; 269 WRITE_ONCE(*a_perm, perm); 270 return !perm; 271 } 272 273 /** 274 * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list. 275 * 276 * @param: Pointer to "struct tomoyo_acl_param". 277 * 278 * Returns 0 on success, negative value otherwise. 279 * 280 * Caller holds tomoyo_read_lock(). 281 */ 282 int tomoyo_write_inet_network(struct tomoyo_acl_param *param) 283 { 284 struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL }; 285 int error = -EINVAL; 286 u8 type; 287 const char *protocol = tomoyo_read_token(param); 288 const char *operation = tomoyo_read_token(param); 289 290 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++) 291 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol])) 292 break; 293 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++) 294 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type])) 295 e.perm |= 1 << type; 296 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm) 297 return -EINVAL; 298 if (param->data[0] == '@') { 299 param->data++; 300 e.address.group = 301 tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP); 302 if (!e.address.group) 303 return -ENOMEM; 304 } else { 305 if (!tomoyo_parse_ipaddr_union(param, &e.address)) 306 goto out; 307 } 308 if (!tomoyo_parse_number_union(param, &e.port) || 309 e.port.values[1] > 65535) 310 goto out; 311 error = tomoyo_update_domain(&e.head, sizeof(e), param, 312 tomoyo_same_inet_acl, 313 tomoyo_merge_inet_acl); 314 out: 315 tomoyo_put_group(e.address.group); 316 tomoyo_put_number_union(&e.port); 317 return error; 318 } 319 320 /** 321 * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list. 322 * 323 * @param: Pointer to "struct tomoyo_acl_param". 324 * 325 * Returns 0 on success, negative value otherwise. 326 */ 327 int tomoyo_write_unix_network(struct tomoyo_acl_param *param) 328 { 329 struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL }; 330 int error; 331 u8 type; 332 const char *protocol = tomoyo_read_token(param); 333 const char *operation = tomoyo_read_token(param); 334 335 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++) 336 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol])) 337 break; 338 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++) 339 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type])) 340 e.perm |= 1 << type; 341 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm) 342 return -EINVAL; 343 if (!tomoyo_parse_name_union(param, &e.name)) 344 return -EINVAL; 345 error = tomoyo_update_domain(&e.head, sizeof(e), param, 346 tomoyo_same_unix_acl, 347 tomoyo_merge_unix_acl); 348 tomoyo_put_name_union(&e.name); 349 return error; 350 } 351 352 /** 353 * tomoyo_audit_net_log - Audit network log. 354 * 355 * @r: Pointer to "struct tomoyo_request_info". 356 * @family: Name of socket family ("inet" or "unix"). 357 * @protocol: Name of protocol in @family. 358 * @operation: Name of socket operation. 359 * @address: Name of address. 360 * 361 * Returns 0 on success, negative value otherwise. 362 */ 363 static int tomoyo_audit_net_log(struct tomoyo_request_info *r, 364 const char *family, const u8 protocol, 365 const u8 operation, const char *address) 366 __must_hold_shared(&tomoyo_ss) 367 { 368 return tomoyo_supervisor(r, "network %s %s %s %s\n", family, 369 tomoyo_proto_keyword[protocol], 370 tomoyo_socket_keyword[operation], address); 371 } 372 373 /** 374 * tomoyo_audit_inet_log - Audit INET network log. 375 * 376 * @r: Pointer to "struct tomoyo_request_info". 377 * 378 * Returns 0 on success, negative value otherwise. 379 */ 380 static int tomoyo_audit_inet_log(struct tomoyo_request_info *r) 381 __must_hold_shared(&tomoyo_ss) 382 { 383 char buf[128]; 384 int len; 385 const __be32 *address = r->param.inet_network.address; 386 387 if (r->param.inet_network.is_ipv6) 388 tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *) 389 address, (const struct in6_addr *) address); 390 else 391 tomoyo_print_ipv4(buf, sizeof(buf), address, address); 392 len = strlen(buf); 393 snprintf(buf + len, sizeof(buf) - len, " %u", 394 r->param.inet_network.port); 395 return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol, 396 r->param.inet_network.operation, buf); 397 } 398 399 /** 400 * tomoyo_audit_unix_log - Audit UNIX network log. 401 * 402 * @r: Pointer to "struct tomoyo_request_info". 403 * 404 * Returns 0 on success, negative value otherwise. 405 */ 406 static int tomoyo_audit_unix_log(struct tomoyo_request_info *r) 407 __must_hold_shared(&tomoyo_ss) 408 { 409 return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol, 410 r->param.unix_network.operation, 411 r->param.unix_network.address->name); 412 } 413 414 /** 415 * tomoyo_check_inet_acl - Check permission for inet domain socket operation. 416 * 417 * @r: Pointer to "struct tomoyo_request_info". 418 * @ptr: Pointer to "struct tomoyo_acl_info". 419 * 420 * Returns true if granted, false otherwise. 421 */ 422 static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r, 423 const struct tomoyo_acl_info *ptr) 424 { 425 const struct tomoyo_inet_acl *acl = 426 container_of(ptr, typeof(*acl), head); 427 const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4; 428 429 if (!(acl->perm & (1 << r->param.inet_network.operation)) || 430 !tomoyo_compare_number_union(r->param.inet_network.port, 431 &acl->port)) 432 return false; 433 if (acl->address.group) 434 return tomoyo_address_matches_group 435 (r->param.inet_network.is_ipv6, 436 r->param.inet_network.address, acl->address.group); 437 return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 && 438 memcmp(&acl->address.ip[0], 439 r->param.inet_network.address, size) <= 0 && 440 memcmp(r->param.inet_network.address, 441 &acl->address.ip[1], size) <= 0; 442 } 443 444 /** 445 * tomoyo_check_unix_acl - Check permission for unix domain socket operation. 446 * 447 * @r: Pointer to "struct tomoyo_request_info". 448 * @ptr: Pointer to "struct tomoyo_acl_info". 449 * 450 * Returns true if granted, false otherwise. 451 */ 452 static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r, 453 const struct tomoyo_acl_info *ptr) 454 { 455 const struct tomoyo_unix_acl *acl = 456 container_of(ptr, typeof(*acl), head); 457 458 return (acl->perm & (1 << r->param.unix_network.operation)) && 459 tomoyo_compare_name_union(r->param.unix_network.address, 460 &acl->name); 461 } 462 463 /** 464 * tomoyo_inet_entry - Check permission for INET network operation. 465 * 466 * @address: Pointer to "struct tomoyo_addr_info". 467 * 468 * Returns 0 on success, negative value otherwise. 469 */ 470 static int tomoyo_inet_entry(const struct tomoyo_addr_info *address) 471 { 472 const int idx = tomoyo_read_lock(); 473 struct tomoyo_request_info r; 474 int error = 0; 475 const u8 type = tomoyo_inet2mac[address->protocol][address->operation]; 476 477 if (type && tomoyo_init_request_info(&r, NULL, type) 478 != TOMOYO_CONFIG_DISABLED) { 479 r.param_type = TOMOYO_TYPE_INET_ACL; 480 r.param.inet_network.protocol = address->protocol; 481 r.param.inet_network.operation = address->operation; 482 r.param.inet_network.is_ipv6 = address->inet.is_ipv6; 483 r.param.inet_network.address = address->inet.address; 484 r.param.inet_network.port = ntohs(address->inet.port); 485 do { 486 tomoyo_check_acl(&r, tomoyo_check_inet_acl); 487 error = tomoyo_audit_inet_log(&r); 488 } while (error == TOMOYO_RETRY_REQUEST); 489 } 490 tomoyo_read_unlock(idx); 491 return error; 492 } 493 494 /** 495 * tomoyo_check_inet_address - Check permission for inet domain socket's operation. 496 * 497 * @addr: Pointer to "struct sockaddr". 498 * @addr_len: Size of @addr. 499 * @port: Port number. 500 * @address: Pointer to "struct tomoyo_addr_info". 501 * 502 * Returns 0 on success, negative value otherwise. 503 */ 504 static int tomoyo_check_inet_address(const struct sockaddr *addr, 505 const unsigned int addr_len, 506 const u16 port, 507 struct tomoyo_addr_info *address) 508 { 509 struct tomoyo_inet_addr_info *i = &address->inet; 510 511 if (addr_len < offsetofend(struct sockaddr, sa_family)) 512 return 0; 513 switch (addr->sa_family) { 514 case AF_INET6: 515 if (addr_len < SIN6_LEN_RFC2133) 516 goto skip; 517 i->is_ipv6 = true; 518 i->address = (__be32 *) 519 ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr; 520 i->port = ((struct sockaddr_in6 *) addr)->sin6_port; 521 break; 522 case AF_INET: 523 if (addr_len < sizeof(struct sockaddr_in)) 524 goto skip; 525 i->is_ipv6 = false; 526 i->address = (__be32 *) 527 &((struct sockaddr_in *) addr)->sin_addr; 528 i->port = ((struct sockaddr_in *) addr)->sin_port; 529 break; 530 default: 531 goto skip; 532 } 533 if (address->protocol == SOCK_RAW) 534 i->port = htons(port); 535 return tomoyo_inet_entry(address); 536 skip: 537 return 0; 538 } 539 540 /** 541 * tomoyo_unix_entry - Check permission for UNIX network operation. 542 * 543 * @address: Pointer to "struct tomoyo_addr_info". 544 * 545 * Returns 0 on success, negative value otherwise. 546 */ 547 static int tomoyo_unix_entry(const struct tomoyo_addr_info *address) 548 { 549 const int idx = tomoyo_read_lock(); 550 struct tomoyo_request_info r; 551 int error = 0; 552 const u8 type = tomoyo_unix2mac[address->protocol][address->operation]; 553 554 if (type && tomoyo_init_request_info(&r, NULL, type) 555 != TOMOYO_CONFIG_DISABLED) { 556 char *buf = address->unix0.addr; 557 int len = address->unix0.addr_len - sizeof(sa_family_t); 558 559 if (len <= 0) { 560 buf = "anonymous"; 561 len = 9; 562 } else if (buf[0]) { 563 len = strnlen(buf, len); 564 } 565 buf = tomoyo_encode2(buf, len); 566 if (buf) { 567 struct tomoyo_path_info addr; 568 569 addr.name = buf; 570 tomoyo_fill_path_info(&addr); 571 r.param_type = TOMOYO_TYPE_UNIX_ACL; 572 r.param.unix_network.protocol = address->protocol; 573 r.param.unix_network.operation = address->operation; 574 r.param.unix_network.address = &addr; 575 do { 576 tomoyo_check_acl(&r, tomoyo_check_unix_acl); 577 error = tomoyo_audit_unix_log(&r); 578 } while (error == TOMOYO_RETRY_REQUEST); 579 kfree(buf); 580 } else 581 error = -ENOMEM; 582 } 583 tomoyo_read_unlock(idx); 584 return error; 585 } 586 587 /** 588 * tomoyo_check_unix_address - Check permission for unix domain socket's operation. 589 * 590 * @addr: Pointer to "struct sockaddr". 591 * @addr_len: Size of @addr. 592 * @address: Pointer to "struct tomoyo_addr_info". 593 * 594 * Returns 0 on success, negative value otherwise. 595 */ 596 static int tomoyo_check_unix_address(struct sockaddr *addr, 597 const unsigned int addr_len, 598 struct tomoyo_addr_info *address) 599 { 600 struct tomoyo_unix_addr_info *u = &address->unix0; 601 602 if (addr_len < offsetofend(struct sockaddr, sa_family)) 603 return 0; 604 if (addr->sa_family != AF_UNIX) 605 return 0; 606 u->addr = ((struct sockaddr_un *) addr)->sun_path; 607 u->addr_len = addr_len; 608 return tomoyo_unix_entry(address); 609 } 610 611 /** 612 * tomoyo_kernel_service - Check whether I'm kernel service or not. 613 * 614 * Returns true if I'm kernel service, false otherwise. 615 */ 616 static bool tomoyo_kernel_service(void) 617 { 618 /* Nothing to do if I am a kernel service. */ 619 return current->flags & PF_KTHREAD; 620 } 621 622 /** 623 * tomoyo_sock_family - Get socket's family. 624 * 625 * @sk: Pointer to "struct sock". 626 * 627 * Returns one of PF_INET, PF_INET6, PF_UNIX or 0. 628 */ 629 static u8 tomoyo_sock_family(struct sock *sk) 630 { 631 u8 family; 632 633 if (tomoyo_kernel_service()) 634 return 0; 635 family = sk->sk_family; 636 switch (family) { 637 case PF_INET: 638 case PF_INET6: 639 case PF_UNIX: 640 return family; 641 default: 642 return 0; 643 } 644 } 645 646 /** 647 * tomoyo_socket_listen_permission - Check permission for listening a socket. 648 * 649 * @sock: Pointer to "struct socket". 650 * 651 * Returns 0 on success, negative value otherwise. 652 */ 653 int tomoyo_socket_listen_permission(struct socket *sock) 654 { 655 struct tomoyo_addr_info address; 656 const u8 family = tomoyo_sock_family(sock->sk); 657 const unsigned int type = sock->type; 658 struct sockaddr_storage addr; 659 int addr_len; 660 661 if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET)) 662 return 0; 663 { 664 const int error = sock->ops->getname(sock, (struct sockaddr *) 665 &addr, 0); 666 667 if (error < 0) 668 return error; 669 addr_len = error; 670 } 671 address.protocol = type; 672 address.operation = TOMOYO_NETWORK_LISTEN; 673 if (family == PF_UNIX) 674 return tomoyo_check_unix_address((struct sockaddr *) &addr, 675 addr_len, &address); 676 return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len, 677 0, &address); 678 } 679 680 /** 681 * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket. 682 * 683 * @sock: Pointer to "struct socket". 684 * @addr: Pointer to "struct sockaddr". 685 * @addr_len: Size of @addr. 686 * 687 * Returns 0 on success, negative value otherwise. 688 */ 689 int tomoyo_socket_connect_permission(struct socket *sock, 690 struct sockaddr *addr, int addr_len) 691 { 692 struct tomoyo_addr_info address; 693 const u8 family = tomoyo_sock_family(sock->sk); 694 const unsigned int type = sock->type; 695 696 if (!family) 697 return 0; 698 address.protocol = type; 699 switch (type) { 700 case SOCK_DGRAM: 701 case SOCK_RAW: 702 address.operation = TOMOYO_NETWORK_SEND; 703 break; 704 case SOCK_STREAM: 705 case SOCK_SEQPACKET: 706 address.operation = TOMOYO_NETWORK_CONNECT; 707 break; 708 default: 709 return 0; 710 } 711 if (family == PF_UNIX) 712 return tomoyo_check_unix_address(addr, addr_len, &address); 713 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol, 714 &address); 715 } 716 717 /** 718 * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket. 719 * 720 * @sock: Pointer to "struct socket". 721 * @addr: Pointer to "struct sockaddr". 722 * @addr_len: Size of @addr. 723 * 724 * Returns 0 on success, negative value otherwise. 725 */ 726 int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr, 727 int addr_len) 728 { 729 struct tomoyo_addr_info address; 730 const u8 family = tomoyo_sock_family(sock->sk); 731 const unsigned int type = sock->type; 732 733 if (!family) 734 return 0; 735 switch (type) { 736 case SOCK_STREAM: 737 case SOCK_DGRAM: 738 case SOCK_RAW: 739 case SOCK_SEQPACKET: 740 address.protocol = type; 741 address.operation = TOMOYO_NETWORK_BIND; 742 break; 743 default: 744 return 0; 745 } 746 if (family == PF_UNIX) 747 return tomoyo_check_unix_address(addr, addr_len, &address); 748 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol, 749 &address); 750 } 751 752 /** 753 * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram. 754 * 755 * @sock: Pointer to "struct socket". 756 * @msg: Pointer to "struct msghdr". 757 * @size: Unused. 758 * 759 * Returns 0 on success, negative value otherwise. 760 */ 761 int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg, 762 int size) 763 { 764 struct tomoyo_addr_info address; 765 const u8 family = tomoyo_sock_family(sock->sk); 766 const unsigned int type = sock->type; 767 768 if (!msg->msg_name || !family || 769 (type != SOCK_DGRAM && type != SOCK_RAW)) 770 return 0; 771 address.protocol = type; 772 address.operation = TOMOYO_NETWORK_SEND; 773 if (family == PF_UNIX) 774 return tomoyo_check_unix_address((struct sockaddr *) 775 msg->msg_name, 776 msg->msg_namelen, &address); 777 return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name, 778 msg->msg_namelen, 779 sock->sk->sk_protocol, &address); 780 } 781