1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * security/tomoyo/condition.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8 #include "common.h" 9 #include <linux/slab.h> 10 11 /* List of "struct tomoyo_condition". */ 12 LIST_HEAD(tomoyo_condition_list); 13 14 /** 15 * tomoyo_argv - Check argv[] in "struct linux_binbrm". 16 * 17 * @index: Index number of @arg_ptr. 18 * @arg_ptr: Contents of argv[@index]. 19 * @argc: Length of @argv. 20 * @argv: Pointer to "struct tomoyo_argv". 21 * @checked: Set to true if @argv[@index] was found. 22 * 23 * Returns true on success, false otherwise. 24 */ 25 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr, 26 const int argc, const struct tomoyo_argv *argv, 27 u8 *checked) 28 { 29 int i; 30 struct tomoyo_path_info arg; 31 arg.name = arg_ptr; 32 for (i = 0; i < argc; argv++, checked++, i++) { 33 bool result; 34 if (index != argv->index) 35 continue; 36 *checked = 1; 37 tomoyo_fill_path_info(&arg); 38 result = tomoyo_path_matches_pattern(&arg, argv->value); 39 if (argv->is_not) 40 result = !result; 41 if (!result) 42 return false; 43 } 44 return true; 45 } 46 47 /** 48 * tomoyo_envp - Check envp[] in "struct linux_binbrm". 49 * 50 * @env_name: The name of environment variable. 51 * @env_value: The value of environment variable. 52 * @envc: Length of @envp. 53 * @envp: Pointer to "struct tomoyo_envp". 54 * @checked: Set to true if @envp[@env_name] was found. 55 * 56 * Returns true on success, false otherwise. 57 */ 58 static bool tomoyo_envp(const char *env_name, const char *env_value, 59 const int envc, const struct tomoyo_envp *envp, 60 u8 *checked) 61 { 62 int i; 63 struct tomoyo_path_info name; 64 struct tomoyo_path_info value; 65 name.name = env_name; 66 tomoyo_fill_path_info(&name); 67 value.name = env_value; 68 tomoyo_fill_path_info(&value); 69 for (i = 0; i < envc; envp++, checked++, i++) { 70 bool result; 71 if (!tomoyo_path_matches_pattern(&name, envp->name)) 72 continue; 73 *checked = 1; 74 if (envp->value) { 75 result = tomoyo_path_matches_pattern(&value, 76 envp->value); 77 if (envp->is_not) 78 result = !result; 79 } else { 80 result = true; 81 if (!envp->is_not) 82 result = !result; 83 } 84 if (!result) 85 return false; 86 } 87 return true; 88 } 89 90 /** 91 * tomoyo_scan_bprm - Scan "struct linux_binprm". 92 * 93 * @ee: Pointer to "struct tomoyo_execve". 94 * @argc: Length of @argc. 95 * @argv: Pointer to "struct tomoyo_argv". 96 * @envc: Length of @envp. 97 * @envp: Poiner to "struct tomoyo_envp". 98 * 99 * Returns true on success, false otherwise. 100 */ 101 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee, 102 const u16 argc, const struct tomoyo_argv *argv, 103 const u16 envc, const struct tomoyo_envp *envp) 104 { 105 struct linux_binprm *bprm = ee->bprm; 106 struct tomoyo_page_dump *dump = &ee->dump; 107 char *arg_ptr = ee->tmp; 108 int arg_len = 0; 109 unsigned long pos = bprm->p; 110 int offset = pos % PAGE_SIZE; 111 int argv_count = bprm->argc; 112 int envp_count = bprm->envc; 113 bool result = true; 114 u8 local_checked[32]; 115 u8 *checked; 116 if (argc + envc <= sizeof(local_checked)) { 117 checked = local_checked; 118 memset(local_checked, 0, sizeof(local_checked)); 119 } else { 120 checked = kzalloc(argc + envc, GFP_NOFS); 121 if (!checked) 122 return false; 123 } 124 while (argv_count || envp_count) { 125 if (!tomoyo_dump_page(bprm, pos, dump)) { 126 result = false; 127 goto out; 128 } 129 pos += PAGE_SIZE - offset; 130 while (offset < PAGE_SIZE) { 131 /* Read. */ 132 const char *kaddr = dump->data; 133 const unsigned char c = kaddr[offset++]; 134 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) { 135 if (c == '\\') { 136 arg_ptr[arg_len++] = '\\'; 137 arg_ptr[arg_len++] = '\\'; 138 } else if (c > ' ' && c < 127) { 139 arg_ptr[arg_len++] = c; 140 } else { 141 arg_ptr[arg_len++] = '\\'; 142 arg_ptr[arg_len++] = (c >> 6) + '0'; 143 arg_ptr[arg_len++] = 144 ((c >> 3) & 7) + '0'; 145 arg_ptr[arg_len++] = (c & 7) + '0'; 146 } 147 } else { 148 arg_ptr[arg_len] = '\0'; 149 } 150 if (c) 151 continue; 152 /* Check. */ 153 if (argv_count) { 154 if (!tomoyo_argv(bprm->argc - argv_count, 155 arg_ptr, argc, argv, 156 checked)) { 157 result = false; 158 break; 159 } 160 argv_count--; 161 } else if (envp_count) { 162 char *cp = strchr(arg_ptr, '='); 163 if (cp) { 164 *cp = '\0'; 165 if (!tomoyo_envp(arg_ptr, cp + 1, 166 envc, envp, 167 checked + argc)) { 168 result = false; 169 break; 170 } 171 } 172 envp_count--; 173 } else { 174 break; 175 } 176 arg_len = 0; 177 } 178 offset = 0; 179 if (!result) 180 break; 181 } 182 out: 183 if (result) { 184 int i; 185 /* Check not-yet-checked entries. */ 186 for (i = 0; i < argc; i++) { 187 if (checked[i]) 188 continue; 189 /* 190 * Return true only if all unchecked indexes in 191 * bprm->argv[] are not matched. 192 */ 193 if (argv[i].is_not) 194 continue; 195 result = false; 196 break; 197 } 198 for (i = 0; i < envc; envp++, i++) { 199 if (checked[argc + i]) 200 continue; 201 /* 202 * Return true only if all unchecked environ variables 203 * in bprm->envp[] are either undefined or not matched. 204 */ 205 if ((!envp->value && !envp->is_not) || 206 (envp->value && envp->is_not)) 207 continue; 208 result = false; 209 break; 210 } 211 } 212 if (checked != local_checked) 213 kfree(checked); 214 return result; 215 } 216 217 /** 218 * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition". 219 * 220 * @file: Pointer to "struct file". 221 * @ptr: Pointer to "struct tomoyo_name_union". 222 * @match: True if "exec.realpath=", false if "exec.realpath!=". 223 * 224 * Returns true on success, false otherwise. 225 */ 226 static bool tomoyo_scan_exec_realpath(struct file *file, 227 const struct tomoyo_name_union *ptr, 228 const bool match) 229 { 230 bool result; 231 struct tomoyo_path_info exe; 232 if (!file) 233 return false; 234 exe.name = tomoyo_realpath_from_path(&file->f_path); 235 if (!exe.name) 236 return false; 237 tomoyo_fill_path_info(&exe); 238 result = tomoyo_compare_name_union(&exe, ptr); 239 kfree(exe.name); 240 return result == match; 241 } 242 243 /** 244 * tomoyo_get_dqword - tomoyo_get_name() for a quoted string. 245 * 246 * @start: String to save. 247 * 248 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise. 249 */ 250 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start) 251 { 252 char *cp = start + strlen(start) - 1; 253 if (cp == start || *start++ != '"' || *cp != '"') 254 return NULL; 255 *cp = '\0'; 256 if (*start && !tomoyo_correct_word(start)) 257 return NULL; 258 return tomoyo_get_name(start); 259 } 260 261 /** 262 * tomoyo_parse_name_union_quoted - Parse a quoted word. 263 * 264 * @param: Pointer to "struct tomoyo_acl_param". 265 * @ptr: Pointer to "struct tomoyo_name_union". 266 * 267 * Returns true on success, false otherwise. 268 */ 269 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param, 270 struct tomoyo_name_union *ptr) 271 { 272 char *filename = param->data; 273 if (*filename == '@') 274 return tomoyo_parse_name_union(param, ptr); 275 ptr->filename = tomoyo_get_dqword(filename); 276 return ptr->filename != NULL; 277 } 278 279 /** 280 * tomoyo_parse_argv - Parse an argv[] condition part. 281 * 282 * @left: Lefthand value. 283 * @right: Righthand value. 284 * @argv: Pointer to "struct tomoyo_argv". 285 * 286 * Returns true on success, false otherwise. 287 */ 288 static bool tomoyo_parse_argv(char *left, char *right, 289 struct tomoyo_argv *argv) 290 { 291 if (tomoyo_parse_ulong(&argv->index, &left) != 292 TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left) 293 return false; 294 argv->value = tomoyo_get_dqword(right); 295 return argv->value != NULL; 296 } 297 298 /** 299 * tomoyo_parse_envp - Parse an envp[] condition part. 300 * 301 * @left: Lefthand value. 302 * @right: Righthand value. 303 * @envp: Pointer to "struct tomoyo_envp". 304 * 305 * Returns true on success, false otherwise. 306 */ 307 static bool tomoyo_parse_envp(char *left, char *right, 308 struct tomoyo_envp *envp) 309 { 310 const struct tomoyo_path_info *name; 311 const struct tomoyo_path_info *value; 312 char *cp = left + strlen(left) - 1; 313 if (*cp-- != ']' || *cp != '"') 314 goto out; 315 *cp = '\0'; 316 if (!tomoyo_correct_word(left)) 317 goto out; 318 name = tomoyo_get_name(left); 319 if (!name) 320 goto out; 321 if (!strcmp(right, "NULL")) { 322 value = NULL; 323 } else { 324 value = tomoyo_get_dqword(right); 325 if (!value) { 326 tomoyo_put_name(name); 327 goto out; 328 } 329 } 330 envp->name = name; 331 envp->value = value; 332 return true; 333 out: 334 return false; 335 } 336 337 /** 338 * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry. 339 * 340 * @a: Pointer to "struct tomoyo_condition". 341 * @b: Pointer to "struct tomoyo_condition". 342 * 343 * Returns true if @a == @b, false otherwise. 344 */ 345 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a, 346 const struct tomoyo_condition *b) 347 { 348 return a->size == b->size && a->condc == b->condc && 349 a->numbers_count == b->numbers_count && 350 a->names_count == b->names_count && 351 a->argc == b->argc && a->envc == b->envc && 352 a->grant_log == b->grant_log && a->transit == b->transit && 353 !memcmp(a + 1, b + 1, a->size - sizeof(*a)); 354 } 355 356 /** 357 * tomoyo_condition_type - Get condition type. 358 * 359 * @word: Keyword string. 360 * 361 * Returns one of values in "enum tomoyo_conditions_index" on success, 362 * TOMOYO_MAX_CONDITION_KEYWORD otherwise. 363 */ 364 static u8 tomoyo_condition_type(const char *word) 365 { 366 u8 i; 367 for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) { 368 if (!strcmp(word, tomoyo_condition_keyword[i])) 369 break; 370 } 371 return i; 372 } 373 374 /* Define this to enable debug mode. */ 375 /* #define DEBUG_CONDITION */ 376 377 #ifdef DEBUG_CONDITION 378 #define dprintk printk 379 #else 380 #define dprintk(...) do { } while (0) 381 #endif 382 383 /** 384 * tomoyo_commit_condition - Commit "struct tomoyo_condition". 385 * 386 * @entry: Pointer to "struct tomoyo_condition". 387 * 388 * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise. 389 * 390 * This function merges duplicated entries. This function returns NULL if 391 * @entry is not duplicated but memory quota for policy has exceeded. 392 */ 393 static struct tomoyo_condition *tomoyo_commit_condition 394 (struct tomoyo_condition *entry) 395 { 396 struct tomoyo_condition *ptr; 397 bool found = false; 398 if (mutex_lock_interruptible(&tomoyo_policy_lock)) { 399 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__); 400 ptr = NULL; 401 found = true; 402 goto out; 403 } 404 list_for_each_entry(ptr, &tomoyo_condition_list, head.list) { 405 if (!tomoyo_same_condition(ptr, entry) || 406 atomic_read(&ptr->head.users) == TOMOYO_GC_IN_PROGRESS) 407 continue; 408 /* Same entry found. Share this entry. */ 409 atomic_inc(&ptr->head.users); 410 found = true; 411 break; 412 } 413 if (!found) { 414 if (tomoyo_memory_ok(entry)) { 415 atomic_set(&entry->head.users, 1); 416 list_add(&entry->head.list, &tomoyo_condition_list); 417 } else { 418 found = true; 419 ptr = NULL; 420 } 421 } 422 mutex_unlock(&tomoyo_policy_lock); 423 out: 424 if (found) { 425 tomoyo_del_condition(&entry->head.list); 426 kfree(entry); 427 entry = ptr; 428 } 429 return entry; 430 } 431 432 /** 433 * tomoyo_get_transit_preference - Parse domain transition preference for execve(). 434 * 435 * @param: Pointer to "struct tomoyo_acl_param". 436 * @e: Pointer to "struct tomoyo_condition". 437 * 438 * Returns the condition string part. 439 */ 440 static char *tomoyo_get_transit_preference(struct tomoyo_acl_param *param, 441 struct tomoyo_condition *e) 442 { 443 char * const pos = param->data; 444 bool flag; 445 if (*pos == '<') { 446 e->transit = tomoyo_get_domainname(param); 447 goto done; 448 } 449 { 450 char *cp = strchr(pos, ' '); 451 if (cp) 452 *cp = '\0'; 453 flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") || 454 !strcmp(pos, "initialize") || !strcmp(pos, "reset") || 455 !strcmp(pos, "child") || !strcmp(pos, "parent"); 456 if (cp) 457 *cp = ' '; 458 } 459 if (!flag) 460 return pos; 461 e->transit = tomoyo_get_name(tomoyo_read_token(param)); 462 done: 463 if (e->transit) 464 return param->data; 465 /* 466 * Return a bad read-only condition string that will let 467 * tomoyo_get_condition() return NULL. 468 */ 469 return "/"; 470 } 471 472 /** 473 * tomoyo_get_condition - Parse condition part. 474 * 475 * @param: Pointer to "struct tomoyo_acl_param". 476 * 477 * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise. 478 */ 479 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param) 480 { 481 struct tomoyo_condition *entry = NULL; 482 struct tomoyo_condition_element *condp = NULL; 483 struct tomoyo_number_union *numbers_p = NULL; 484 struct tomoyo_name_union *names_p = NULL; 485 struct tomoyo_argv *argv = NULL; 486 struct tomoyo_envp *envp = NULL; 487 struct tomoyo_condition e = { }; 488 char * const start_of_string = 489 tomoyo_get_transit_preference(param, &e); 490 char * const end_of_string = start_of_string + strlen(start_of_string); 491 char *pos; 492 rerun: 493 pos = start_of_string; 494 while (1) { 495 u8 left = -1; 496 u8 right = -1; 497 char *left_word = pos; 498 char *cp; 499 char *right_word; 500 bool is_not; 501 if (!*left_word) 502 break; 503 /* 504 * Since left-hand condition does not allow use of "path_group" 505 * or "number_group" and environment variable's names do not 506 * accept '=', it is guaranteed that the original line consists 507 * of one or more repetition of $left$operator$right blocks 508 * where "$left is free from '=' and ' '" and "$operator is 509 * either '=' or '!='" and "$right is free from ' '". 510 * Therefore, we can reconstruct the original line at the end 511 * of dry run even if we overwrite $operator with '\0'. 512 */ 513 cp = strchr(pos, ' '); 514 if (cp) { 515 *cp = '\0'; /* Will restore later. */ 516 pos = cp + 1; 517 } else { 518 pos = ""; 519 } 520 right_word = strchr(left_word, '='); 521 if (!right_word || right_word == left_word) 522 goto out; 523 is_not = *(right_word - 1) == '!'; 524 if (is_not) 525 *(right_word++ - 1) = '\0'; /* Will restore later. */ 526 else if (*(right_word + 1) != '=') 527 *right_word++ = '\0'; /* Will restore later. */ 528 else 529 goto out; 530 dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word, 531 is_not ? "!" : "", right_word); 532 if (!strcmp(left_word, "grant_log")) { 533 if (entry) { 534 if (is_not || 535 entry->grant_log != TOMOYO_GRANTLOG_AUTO) 536 goto out; 537 else if (!strcmp(right_word, "yes")) 538 entry->grant_log = TOMOYO_GRANTLOG_YES; 539 else if (!strcmp(right_word, "no")) 540 entry->grant_log = TOMOYO_GRANTLOG_NO; 541 else 542 goto out; 543 } 544 continue; 545 } 546 if (!strncmp(left_word, "exec.argv[", 10)) { 547 if (!argv) { 548 e.argc++; 549 e.condc++; 550 } else { 551 e.argc--; 552 e.condc--; 553 left = TOMOYO_ARGV_ENTRY; 554 argv->is_not = is_not; 555 if (!tomoyo_parse_argv(left_word + 10, 556 right_word, argv++)) 557 goto out; 558 } 559 goto store_value; 560 } 561 if (!strncmp(left_word, "exec.envp[\"", 11)) { 562 if (!envp) { 563 e.envc++; 564 e.condc++; 565 } else { 566 e.envc--; 567 e.condc--; 568 left = TOMOYO_ENVP_ENTRY; 569 envp->is_not = is_not; 570 if (!tomoyo_parse_envp(left_word + 11, 571 right_word, envp++)) 572 goto out; 573 } 574 goto store_value; 575 } 576 left = tomoyo_condition_type(left_word); 577 dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word, 578 left); 579 if (left == TOMOYO_MAX_CONDITION_KEYWORD) { 580 if (!numbers_p) { 581 e.numbers_count++; 582 } else { 583 e.numbers_count--; 584 left = TOMOYO_NUMBER_UNION; 585 param->data = left_word; 586 if (*left_word == '@' || 587 !tomoyo_parse_number_union(param, 588 numbers_p++)) 589 goto out; 590 } 591 } 592 if (!condp) 593 e.condc++; 594 else 595 e.condc--; 596 if (left == TOMOYO_EXEC_REALPATH || 597 left == TOMOYO_SYMLINK_TARGET) { 598 if (!names_p) { 599 e.names_count++; 600 } else { 601 e.names_count--; 602 right = TOMOYO_NAME_UNION; 603 param->data = right_word; 604 if (!tomoyo_parse_name_union_quoted(param, 605 names_p++)) 606 goto out; 607 } 608 goto store_value; 609 } 610 right = tomoyo_condition_type(right_word); 611 if (right == TOMOYO_MAX_CONDITION_KEYWORD) { 612 if (!numbers_p) { 613 e.numbers_count++; 614 } else { 615 e.numbers_count--; 616 right = TOMOYO_NUMBER_UNION; 617 param->data = right_word; 618 if (!tomoyo_parse_number_union(param, 619 numbers_p++)) 620 goto out; 621 } 622 } 623 store_value: 624 if (!condp) { 625 dprintk(KERN_WARNING "%u: dry_run left=%u right=%u " 626 "match=%u\n", __LINE__, left, right, !is_not); 627 continue; 628 } 629 condp->left = left; 630 condp->right = right; 631 condp->equals = !is_not; 632 dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n", 633 __LINE__, condp->left, condp->right, 634 condp->equals); 635 condp++; 636 } 637 dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n", 638 __LINE__, e.condc, e.numbers_count, e.names_count, e.argc, 639 e.envc); 640 if (entry) { 641 BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc | 642 e.condc); 643 return tomoyo_commit_condition(entry); 644 } 645 e.size = sizeof(*entry) 646 + e.condc * sizeof(struct tomoyo_condition_element) 647 + e.numbers_count * sizeof(struct tomoyo_number_union) 648 + e.names_count * sizeof(struct tomoyo_name_union) 649 + e.argc * sizeof(struct tomoyo_argv) 650 + e.envc * sizeof(struct tomoyo_envp); 651 entry = kzalloc(e.size, GFP_NOFS); 652 if (!entry) 653 goto out2; 654 *entry = e; 655 e.transit = NULL; 656 condp = (struct tomoyo_condition_element *) (entry + 1); 657 numbers_p = (struct tomoyo_number_union *) (condp + e.condc); 658 names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count); 659 argv = (struct tomoyo_argv *) (names_p + e.names_count); 660 envp = (struct tomoyo_envp *) (argv + e.argc); 661 { 662 bool flag = false; 663 for (pos = start_of_string; pos < end_of_string; pos++) { 664 if (*pos) 665 continue; 666 if (flag) /* Restore " ". */ 667 *pos = ' '; 668 else if (*(pos + 1) == '=') /* Restore "!=". */ 669 *pos = '!'; 670 else /* Restore "=". */ 671 *pos = '='; 672 flag = !flag; 673 } 674 } 675 goto rerun; 676 out: 677 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__); 678 if (entry) { 679 tomoyo_del_condition(&entry->head.list); 680 kfree(entry); 681 } 682 out2: 683 tomoyo_put_name(e.transit); 684 return NULL; 685 } 686 687 /** 688 * tomoyo_get_attributes - Revalidate "struct inode". 689 * 690 * @obj: Pointer to "struct tomoyo_obj_info". 691 * 692 * Returns nothing. 693 */ 694 void tomoyo_get_attributes(struct tomoyo_obj_info *obj) 695 { 696 u8 i; 697 struct dentry *dentry = NULL; 698 699 for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) { 700 struct inode *inode; 701 switch (i) { 702 case TOMOYO_PATH1: 703 dentry = obj->path1.dentry; 704 if (!dentry) 705 continue; 706 break; 707 case TOMOYO_PATH2: 708 dentry = obj->path2.dentry; 709 if (!dentry) 710 continue; 711 break; 712 default: 713 if (!dentry) 714 continue; 715 dentry = dget_parent(dentry); 716 break; 717 } 718 inode = d_backing_inode(dentry); 719 if (inode) { 720 struct tomoyo_mini_stat *stat = &obj->stat[i]; 721 stat->uid = inode->i_uid; 722 stat->gid = inode->i_gid; 723 stat->ino = inode->i_ino; 724 stat->mode = inode->i_mode; 725 stat->dev = inode->i_sb->s_dev; 726 stat->rdev = inode->i_rdev; 727 obj->stat_valid[i] = true; 728 } 729 if (i & 1) /* i == TOMOYO_PATH1_PARENT || 730 i == TOMOYO_PATH2_PARENT */ 731 dput(dentry); 732 } 733 } 734 735 /** 736 * tomoyo_condition - Check condition part. 737 * 738 * @r: Pointer to "struct tomoyo_request_info". 739 * @cond: Pointer to "struct tomoyo_condition". Maybe NULL. 740 * 741 * Returns true on success, false otherwise. 742 * 743 * Caller holds tomoyo_read_lock(). 744 */ 745 bool tomoyo_condition(struct tomoyo_request_info *r, 746 const struct tomoyo_condition *cond) 747 { 748 u32 i; 749 unsigned long min_v[2] = { 0, 0 }; 750 unsigned long max_v[2] = { 0, 0 }; 751 const struct tomoyo_condition_element *condp; 752 const struct tomoyo_number_union *numbers_p; 753 const struct tomoyo_name_union *names_p; 754 const struct tomoyo_argv *argv; 755 const struct tomoyo_envp *envp; 756 struct tomoyo_obj_info *obj; 757 u16 condc; 758 u16 argc; 759 u16 envc; 760 struct linux_binprm *bprm = NULL; 761 if (!cond) 762 return true; 763 condc = cond->condc; 764 argc = cond->argc; 765 envc = cond->envc; 766 obj = r->obj; 767 if (r->ee) 768 bprm = r->ee->bprm; 769 if (!bprm && (argc || envc)) 770 return false; 771 condp = (struct tomoyo_condition_element *) (cond + 1); 772 numbers_p = (const struct tomoyo_number_union *) (condp + condc); 773 names_p = (const struct tomoyo_name_union *) 774 (numbers_p + cond->numbers_count); 775 argv = (const struct tomoyo_argv *) (names_p + cond->names_count); 776 envp = (const struct tomoyo_envp *) (argv + argc); 777 for (i = 0; i < condc; i++) { 778 const bool match = condp->equals; 779 const u8 left = condp->left; 780 const u8 right = condp->right; 781 bool is_bitop[2] = { false, false }; 782 u8 j; 783 condp++; 784 /* Check argv[] and envp[] later. */ 785 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY) 786 continue; 787 /* Check string expressions. */ 788 if (right == TOMOYO_NAME_UNION) { 789 const struct tomoyo_name_union *ptr = names_p++; 790 switch (left) { 791 struct tomoyo_path_info *symlink; 792 struct tomoyo_execve *ee; 793 struct file *file; 794 case TOMOYO_SYMLINK_TARGET: 795 symlink = obj ? obj->symlink_target : NULL; 796 if (!symlink || 797 !tomoyo_compare_name_union(symlink, ptr) 798 == match) 799 goto out; 800 break; 801 case TOMOYO_EXEC_REALPATH: 802 ee = r->ee; 803 file = ee ? ee->bprm->file : NULL; 804 if (!tomoyo_scan_exec_realpath(file, ptr, 805 match)) 806 goto out; 807 break; 808 } 809 continue; 810 } 811 /* Check numeric or bit-op expressions. */ 812 for (j = 0; j < 2; j++) { 813 const u8 index = j ? right : left; 814 unsigned long value = 0; 815 switch (index) { 816 case TOMOYO_TASK_UID: 817 value = from_kuid(&init_user_ns, current_uid()); 818 break; 819 case TOMOYO_TASK_EUID: 820 value = from_kuid(&init_user_ns, current_euid()); 821 break; 822 case TOMOYO_TASK_SUID: 823 value = from_kuid(&init_user_ns, current_suid()); 824 break; 825 case TOMOYO_TASK_FSUID: 826 value = from_kuid(&init_user_ns, current_fsuid()); 827 break; 828 case TOMOYO_TASK_GID: 829 value = from_kgid(&init_user_ns, current_gid()); 830 break; 831 case TOMOYO_TASK_EGID: 832 value = from_kgid(&init_user_ns, current_egid()); 833 break; 834 case TOMOYO_TASK_SGID: 835 value = from_kgid(&init_user_ns, current_sgid()); 836 break; 837 case TOMOYO_TASK_FSGID: 838 value = from_kgid(&init_user_ns, current_fsgid()); 839 break; 840 case TOMOYO_TASK_PID: 841 value = tomoyo_sys_getpid(); 842 break; 843 case TOMOYO_TASK_PPID: 844 value = tomoyo_sys_getppid(); 845 break; 846 case TOMOYO_TYPE_IS_SOCKET: 847 value = S_IFSOCK; 848 break; 849 case TOMOYO_TYPE_IS_SYMLINK: 850 value = S_IFLNK; 851 break; 852 case TOMOYO_TYPE_IS_FILE: 853 value = S_IFREG; 854 break; 855 case TOMOYO_TYPE_IS_BLOCK_DEV: 856 value = S_IFBLK; 857 break; 858 case TOMOYO_TYPE_IS_DIRECTORY: 859 value = S_IFDIR; 860 break; 861 case TOMOYO_TYPE_IS_CHAR_DEV: 862 value = S_IFCHR; 863 break; 864 case TOMOYO_TYPE_IS_FIFO: 865 value = S_IFIFO; 866 break; 867 case TOMOYO_MODE_SETUID: 868 value = S_ISUID; 869 break; 870 case TOMOYO_MODE_SETGID: 871 value = S_ISGID; 872 break; 873 case TOMOYO_MODE_STICKY: 874 value = S_ISVTX; 875 break; 876 case TOMOYO_MODE_OWNER_READ: 877 value = S_IRUSR; 878 break; 879 case TOMOYO_MODE_OWNER_WRITE: 880 value = S_IWUSR; 881 break; 882 case TOMOYO_MODE_OWNER_EXECUTE: 883 value = S_IXUSR; 884 break; 885 case TOMOYO_MODE_GROUP_READ: 886 value = S_IRGRP; 887 break; 888 case TOMOYO_MODE_GROUP_WRITE: 889 value = S_IWGRP; 890 break; 891 case TOMOYO_MODE_GROUP_EXECUTE: 892 value = S_IXGRP; 893 break; 894 case TOMOYO_MODE_OTHERS_READ: 895 value = S_IROTH; 896 break; 897 case TOMOYO_MODE_OTHERS_WRITE: 898 value = S_IWOTH; 899 break; 900 case TOMOYO_MODE_OTHERS_EXECUTE: 901 value = S_IXOTH; 902 break; 903 case TOMOYO_EXEC_ARGC: 904 if (!bprm) 905 goto out; 906 value = bprm->argc; 907 break; 908 case TOMOYO_EXEC_ENVC: 909 if (!bprm) 910 goto out; 911 value = bprm->envc; 912 break; 913 case TOMOYO_NUMBER_UNION: 914 /* Fetch values later. */ 915 break; 916 default: 917 if (!obj) 918 goto out; 919 if (!obj->validate_done) { 920 tomoyo_get_attributes(obj); 921 obj->validate_done = true; 922 } 923 { 924 u8 stat_index; 925 struct tomoyo_mini_stat *stat; 926 switch (index) { 927 case TOMOYO_PATH1_UID: 928 case TOMOYO_PATH1_GID: 929 case TOMOYO_PATH1_INO: 930 case TOMOYO_PATH1_MAJOR: 931 case TOMOYO_PATH1_MINOR: 932 case TOMOYO_PATH1_TYPE: 933 case TOMOYO_PATH1_DEV_MAJOR: 934 case TOMOYO_PATH1_DEV_MINOR: 935 case TOMOYO_PATH1_PERM: 936 stat_index = TOMOYO_PATH1; 937 break; 938 case TOMOYO_PATH2_UID: 939 case TOMOYO_PATH2_GID: 940 case TOMOYO_PATH2_INO: 941 case TOMOYO_PATH2_MAJOR: 942 case TOMOYO_PATH2_MINOR: 943 case TOMOYO_PATH2_TYPE: 944 case TOMOYO_PATH2_DEV_MAJOR: 945 case TOMOYO_PATH2_DEV_MINOR: 946 case TOMOYO_PATH2_PERM: 947 stat_index = TOMOYO_PATH2; 948 break; 949 case TOMOYO_PATH1_PARENT_UID: 950 case TOMOYO_PATH1_PARENT_GID: 951 case TOMOYO_PATH1_PARENT_INO: 952 case TOMOYO_PATH1_PARENT_PERM: 953 stat_index = 954 TOMOYO_PATH1_PARENT; 955 break; 956 case TOMOYO_PATH2_PARENT_UID: 957 case TOMOYO_PATH2_PARENT_GID: 958 case TOMOYO_PATH2_PARENT_INO: 959 case TOMOYO_PATH2_PARENT_PERM: 960 stat_index = 961 TOMOYO_PATH2_PARENT; 962 break; 963 default: 964 goto out; 965 } 966 if (!obj->stat_valid[stat_index]) 967 goto out; 968 stat = &obj->stat[stat_index]; 969 switch (index) { 970 case TOMOYO_PATH1_UID: 971 case TOMOYO_PATH2_UID: 972 case TOMOYO_PATH1_PARENT_UID: 973 case TOMOYO_PATH2_PARENT_UID: 974 value = from_kuid(&init_user_ns, stat->uid); 975 break; 976 case TOMOYO_PATH1_GID: 977 case TOMOYO_PATH2_GID: 978 case TOMOYO_PATH1_PARENT_GID: 979 case TOMOYO_PATH2_PARENT_GID: 980 value = from_kgid(&init_user_ns, stat->gid); 981 break; 982 case TOMOYO_PATH1_INO: 983 case TOMOYO_PATH2_INO: 984 case TOMOYO_PATH1_PARENT_INO: 985 case TOMOYO_PATH2_PARENT_INO: 986 value = stat->ino; 987 break; 988 case TOMOYO_PATH1_MAJOR: 989 case TOMOYO_PATH2_MAJOR: 990 value = MAJOR(stat->dev); 991 break; 992 case TOMOYO_PATH1_MINOR: 993 case TOMOYO_PATH2_MINOR: 994 value = MINOR(stat->dev); 995 break; 996 case TOMOYO_PATH1_TYPE: 997 case TOMOYO_PATH2_TYPE: 998 value = stat->mode & S_IFMT; 999 break; 1000 case TOMOYO_PATH1_DEV_MAJOR: 1001 case TOMOYO_PATH2_DEV_MAJOR: 1002 value = MAJOR(stat->rdev); 1003 break; 1004 case TOMOYO_PATH1_DEV_MINOR: 1005 case TOMOYO_PATH2_DEV_MINOR: 1006 value = MINOR(stat->rdev); 1007 break; 1008 case TOMOYO_PATH1_PERM: 1009 case TOMOYO_PATH2_PERM: 1010 case TOMOYO_PATH1_PARENT_PERM: 1011 case TOMOYO_PATH2_PARENT_PERM: 1012 value = stat->mode & S_IALLUGO; 1013 break; 1014 } 1015 } 1016 break; 1017 } 1018 max_v[j] = value; 1019 min_v[j] = value; 1020 switch (index) { 1021 case TOMOYO_MODE_SETUID: 1022 case TOMOYO_MODE_SETGID: 1023 case TOMOYO_MODE_STICKY: 1024 case TOMOYO_MODE_OWNER_READ: 1025 case TOMOYO_MODE_OWNER_WRITE: 1026 case TOMOYO_MODE_OWNER_EXECUTE: 1027 case TOMOYO_MODE_GROUP_READ: 1028 case TOMOYO_MODE_GROUP_WRITE: 1029 case TOMOYO_MODE_GROUP_EXECUTE: 1030 case TOMOYO_MODE_OTHERS_READ: 1031 case TOMOYO_MODE_OTHERS_WRITE: 1032 case TOMOYO_MODE_OTHERS_EXECUTE: 1033 is_bitop[j] = true; 1034 } 1035 } 1036 if (left == TOMOYO_NUMBER_UNION) { 1037 /* Fetch values now. */ 1038 const struct tomoyo_number_union *ptr = numbers_p++; 1039 min_v[0] = ptr->values[0]; 1040 max_v[0] = ptr->values[1]; 1041 } 1042 if (right == TOMOYO_NUMBER_UNION) { 1043 /* Fetch values now. */ 1044 const struct tomoyo_number_union *ptr = numbers_p++; 1045 if (ptr->group) { 1046 if (tomoyo_number_matches_group(min_v[0], 1047 max_v[0], 1048 ptr->group) 1049 == match) 1050 continue; 1051 } else { 1052 if ((min_v[0] <= ptr->values[1] && 1053 max_v[0] >= ptr->values[0]) == match) 1054 continue; 1055 } 1056 goto out; 1057 } 1058 /* 1059 * Bit operation is valid only when counterpart value 1060 * represents permission. 1061 */ 1062 if (is_bitop[0] && is_bitop[1]) { 1063 goto out; 1064 } else if (is_bitop[0]) { 1065 switch (right) { 1066 case TOMOYO_PATH1_PERM: 1067 case TOMOYO_PATH1_PARENT_PERM: 1068 case TOMOYO_PATH2_PERM: 1069 case TOMOYO_PATH2_PARENT_PERM: 1070 if (!(max_v[0] & max_v[1]) == !match) 1071 continue; 1072 } 1073 goto out; 1074 } else if (is_bitop[1]) { 1075 switch (left) { 1076 case TOMOYO_PATH1_PERM: 1077 case TOMOYO_PATH1_PARENT_PERM: 1078 case TOMOYO_PATH2_PERM: 1079 case TOMOYO_PATH2_PARENT_PERM: 1080 if (!(max_v[0] & max_v[1]) == !match) 1081 continue; 1082 } 1083 goto out; 1084 } 1085 /* Normal value range comparison. */ 1086 if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match) 1087 continue; 1088 out: 1089 return false; 1090 } 1091 /* Check argv[] and envp[] now. */ 1092 if (r->ee && (argc || envc)) 1093 return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp); 1094 return true; 1095 } 1096