1 /* 2 * security/tomoyo/network.c 3 * 4 * Copyright (C) 2005-2011 NTT DATA CORPORATION 5 */ 6 7 #include "common.h" 8 #include <linux/slab.h> 9 10 /* Structure for holding inet domain socket's address. */ 11 struct tomoyo_inet_addr_info { 12 __be16 port; /* In network byte order. */ 13 const __be32 *address; /* In network byte order. */ 14 bool is_ipv6; 15 }; 16 17 /* Structure for holding unix domain socket's address. */ 18 struct tomoyo_unix_addr_info { 19 u8 *addr; /* This may not be '\0' terminated string. */ 20 unsigned int addr_len; 21 }; 22 23 /* Structure for holding socket address. */ 24 struct tomoyo_addr_info { 25 u8 protocol; 26 u8 operation; 27 struct tomoyo_inet_addr_info inet; 28 struct tomoyo_unix_addr_info unix0; 29 }; 30 31 /* String table for socket's protocols. */ 32 const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = { 33 [SOCK_STREAM] = "stream", 34 [SOCK_DGRAM] = "dgram", 35 [SOCK_RAW] = "raw", 36 [SOCK_SEQPACKET] = "seqpacket", 37 [0] = " ", /* Dummy for avoiding NULL pointer dereference. */ 38 [4] = " ", /* Dummy for avoiding NULL pointer dereference. */ 39 }; 40 41 /** 42 * tomoyo_parse_ipaddr_union - Parse an IP address. 43 * 44 * @param: Pointer to "struct tomoyo_acl_param". 45 * @ptr: Pointer to "struct tomoyo_ipaddr_union". 46 * 47 * Returns true on success, false otherwise. 48 */ 49 bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param, 50 struct tomoyo_ipaddr_union *ptr) 51 { 52 u8 * const min = ptr->ip[0].in6_u.u6_addr8; 53 u8 * const max = ptr->ip[1].in6_u.u6_addr8; 54 char *address = tomoyo_read_token(param); 55 const char *end; 56 57 if (!strchr(address, ':') && 58 in4_pton(address, -1, min, '-', &end) > 0) { 59 ptr->is_ipv6 = false; 60 if (!*end) 61 ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0]; 62 else if (*end++ != '-' || 63 in4_pton(end, -1, max, '\0', &end) <= 0 || *end) 64 return false; 65 return true; 66 } 67 if (in6_pton(address, -1, min, '-', &end) > 0) { 68 ptr->is_ipv6 = true; 69 if (!*end) 70 memmove(max, min, sizeof(u16) * 8); 71 else if (*end++ != '-' || 72 in6_pton(end, -1, max, '\0', &end) <= 0 || *end) 73 return false; 74 return true; 75 } 76 return false; 77 } 78 79 /** 80 * tomoyo_print_ipv4 - Print an IPv4 address. 81 * 82 * @buffer: Buffer to write to. 83 * @buffer_len: Size of @buffer. 84 * @min_ip: Pointer to __be32. 85 * @max_ip: Pointer to __be32. 86 * 87 * Returns nothing. 88 */ 89 static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len, 90 const __be32 *min_ip, const __be32 *max_ip) 91 { 92 snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip, 93 *min_ip == *max_ip ? '\0' : '-', max_ip); 94 } 95 96 /** 97 * tomoyo_print_ipv6 - Print an IPv6 address. 98 * 99 * @buffer: Buffer to write to. 100 * @buffer_len: Size of @buffer. 101 * @min_ip: Pointer to "struct in6_addr". 102 * @max_ip: Pointer to "struct in6_addr". 103 * 104 * Returns nothing. 105 */ 106 static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len, 107 const struct in6_addr *min_ip, 108 const struct in6_addr *max_ip) 109 { 110 snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip, 111 !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip); 112 } 113 114 /** 115 * tomoyo_print_ip - Print an IP address. 116 * 117 * @buf: Buffer to write to. 118 * @size: Size of @buf. 119 * @ptr: Pointer to "struct ipaddr_union". 120 * 121 * Returns nothing. 122 */ 123 void tomoyo_print_ip(char *buf, const unsigned int size, 124 const struct tomoyo_ipaddr_union *ptr) 125 { 126 if (ptr->is_ipv6) 127 tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]); 128 else 129 tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0], 130 &ptr->ip[1].s6_addr32[0]); 131 } 132 133 /* 134 * Mapping table from "enum tomoyo_network_acl_index" to 135 * "enum tomoyo_mac_index" for inet domain socket. 136 */ 137 static const u8 tomoyo_inet2mac 138 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = { 139 [SOCK_STREAM] = { 140 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_STREAM_BIND, 141 [TOMOYO_NETWORK_LISTEN] = 142 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN, 143 [TOMOYO_NETWORK_CONNECT] = 144 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT, 145 }, 146 [SOCK_DGRAM] = { 147 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND, 148 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND, 149 }, 150 [SOCK_RAW] = { 151 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_RAW_BIND, 152 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_RAW_SEND, 153 }, 154 }; 155 156 /* 157 * Mapping table from "enum tomoyo_network_acl_index" to 158 * "enum tomoyo_mac_index" for unix domain socket. 159 */ 160 static const u8 tomoyo_unix2mac 161 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = { 162 [SOCK_STREAM] = { 163 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND, 164 [TOMOYO_NETWORK_LISTEN] = 165 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN, 166 [TOMOYO_NETWORK_CONNECT] = 167 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT, 168 }, 169 [SOCK_DGRAM] = { 170 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND, 171 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND, 172 }, 173 [SOCK_SEQPACKET] = { 174 [TOMOYO_NETWORK_BIND] = 175 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND, 176 [TOMOYO_NETWORK_LISTEN] = 177 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN, 178 [TOMOYO_NETWORK_CONNECT] = 179 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT, 180 }, 181 }; 182 183 /** 184 * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry. 185 * 186 * @a: Pointer to "struct tomoyo_acl_info". 187 * @b: Pointer to "struct tomoyo_acl_info". 188 * 189 * Returns true if @a == @b except permission bits, false otherwise. 190 */ 191 static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a, 192 const struct tomoyo_acl_info *b) 193 { 194 const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head); 195 const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head); 196 197 return p1->protocol == p2->protocol && 198 tomoyo_same_ipaddr_union(&p1->address, &p2->address) && 199 tomoyo_same_number_union(&p1->port, &p2->port); 200 } 201 202 /** 203 * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry. 204 * 205 * @a: Pointer to "struct tomoyo_acl_info". 206 * @b: Pointer to "struct tomoyo_acl_info". 207 * 208 * Returns true if @a == @b except permission bits, false otherwise. 209 */ 210 static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a, 211 const struct tomoyo_acl_info *b) 212 { 213 const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head); 214 const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head); 215 216 return p1->protocol == p2->protocol && 217 tomoyo_same_name_union(&p1->name, &p2->name); 218 } 219 220 /** 221 * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry. 222 * 223 * @a: Pointer to "struct tomoyo_acl_info". 224 * @b: Pointer to "struct tomoyo_acl_info". 225 * @is_delete: True for @a &= ~@b, false for @a |= @b. 226 * 227 * Returns true if @a is empty, false otherwise. 228 */ 229 static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a, 230 struct tomoyo_acl_info *b, 231 const bool is_delete) 232 { 233 u8 * const a_perm = 234 &container_of(a, struct tomoyo_inet_acl, head)->perm; 235 u8 perm = *a_perm; 236 const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm; 237 238 if (is_delete) 239 perm &= ~b_perm; 240 else 241 perm |= b_perm; 242 *a_perm = perm; 243 return !perm; 244 } 245 246 /** 247 * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry. 248 * 249 * @a: Pointer to "struct tomoyo_acl_info". 250 * @b: Pointer to "struct tomoyo_acl_info". 251 * @is_delete: True for @a &= ~@b, false for @a |= @b. 252 * 253 * Returns true if @a is empty, false otherwise. 254 */ 255 static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a, 256 struct tomoyo_acl_info *b, 257 const bool is_delete) 258 { 259 u8 * const a_perm = 260 &container_of(a, struct tomoyo_unix_acl, head)->perm; 261 u8 perm = *a_perm; 262 const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm; 263 264 if (is_delete) 265 perm &= ~b_perm; 266 else 267 perm |= b_perm; 268 *a_perm = perm; 269 return !perm; 270 } 271 272 /** 273 * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list. 274 * 275 * @param: Pointer to "struct tomoyo_acl_param". 276 * 277 * Returns 0 on success, negative value otherwise. 278 * 279 * Caller holds tomoyo_read_lock(). 280 */ 281 int tomoyo_write_inet_network(struct tomoyo_acl_param *param) 282 { 283 struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL }; 284 int error = -EINVAL; 285 u8 type; 286 const char *protocol = tomoyo_read_token(param); 287 const char *operation = tomoyo_read_token(param); 288 289 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++) 290 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol])) 291 break; 292 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++) 293 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type])) 294 e.perm |= 1 << type; 295 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm) 296 return -EINVAL; 297 if (param->data[0] == '@') { 298 param->data++; 299 e.address.group = 300 tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP); 301 if (!e.address.group) 302 return -ENOMEM; 303 } else { 304 if (!tomoyo_parse_ipaddr_union(param, &e.address)) 305 goto out; 306 } 307 if (!tomoyo_parse_number_union(param, &e.port) || 308 e.port.values[1] > 65535) 309 goto out; 310 error = tomoyo_update_domain(&e.head, sizeof(e), param, 311 tomoyo_same_inet_acl, 312 tomoyo_merge_inet_acl); 313 out: 314 tomoyo_put_group(e.address.group); 315 tomoyo_put_number_union(&e.port); 316 return error; 317 } 318 319 /** 320 * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list. 321 * 322 * @param: Pointer to "struct tomoyo_acl_param". 323 * 324 * Returns 0 on success, negative value otherwise. 325 */ 326 int tomoyo_write_unix_network(struct tomoyo_acl_param *param) 327 { 328 struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL }; 329 int error; 330 u8 type; 331 const char *protocol = tomoyo_read_token(param); 332 const char *operation = tomoyo_read_token(param); 333 334 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++) 335 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol])) 336 break; 337 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++) 338 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type])) 339 e.perm |= 1 << type; 340 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm) 341 return -EINVAL; 342 if (!tomoyo_parse_name_union(param, &e.name)) 343 return -EINVAL; 344 error = tomoyo_update_domain(&e.head, sizeof(e), param, 345 tomoyo_same_unix_acl, 346 tomoyo_merge_unix_acl); 347 tomoyo_put_name_union(&e.name); 348 return error; 349 } 350 351 /** 352 * tomoyo_audit_net_log - Audit network log. 353 * 354 * @r: Pointer to "struct tomoyo_request_info". 355 * @family: Name of socket family ("inet" or "unix"). 356 * @protocol: Name of protocol in @family. 357 * @operation: Name of socket operation. 358 * @address: Name of address. 359 * 360 * Returns 0 on success, negative value otherwise. 361 */ 362 static int tomoyo_audit_net_log(struct tomoyo_request_info *r, 363 const char *family, const u8 protocol, 364 const u8 operation, const char *address) 365 { 366 return tomoyo_supervisor(r, "network %s %s %s %s\n", family, 367 tomoyo_proto_keyword[protocol], 368 tomoyo_socket_keyword[operation], address); 369 } 370 371 /** 372 * tomoyo_audit_inet_log - Audit INET network log. 373 * 374 * @r: Pointer to "struct tomoyo_request_info". 375 * 376 * Returns 0 on success, negative value otherwise. 377 */ 378 static int tomoyo_audit_inet_log(struct tomoyo_request_info *r) 379 { 380 char buf[128]; 381 int len; 382 const __be32 *address = r->param.inet_network.address; 383 384 if (r->param.inet_network.is_ipv6) 385 tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *) 386 address, (const struct in6_addr *) address); 387 else 388 tomoyo_print_ipv4(buf, sizeof(buf), address, address); 389 len = strlen(buf); 390 snprintf(buf + len, sizeof(buf) - len, " %u", 391 r->param.inet_network.port); 392 return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol, 393 r->param.inet_network.operation, buf); 394 } 395 396 /** 397 * tomoyo_audit_unix_log - Audit UNIX network log. 398 * 399 * @r: Pointer to "struct tomoyo_request_info". 400 * 401 * Returns 0 on success, negative value otherwise. 402 */ 403 static int tomoyo_audit_unix_log(struct tomoyo_request_info *r) 404 { 405 return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol, 406 r->param.unix_network.operation, 407 r->param.unix_network.address->name); 408 } 409 410 /** 411 * tomoyo_check_inet_acl - Check permission for inet domain socket operation. 412 * 413 * @r: Pointer to "struct tomoyo_request_info". 414 * @ptr: Pointer to "struct tomoyo_acl_info". 415 * 416 * Returns true if granted, false otherwise. 417 */ 418 static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r, 419 const struct tomoyo_acl_info *ptr) 420 { 421 const struct tomoyo_inet_acl *acl = 422 container_of(ptr, typeof(*acl), head); 423 const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4; 424 425 if (!(acl->perm & (1 << r->param.inet_network.operation)) || 426 !tomoyo_compare_number_union(r->param.inet_network.port, 427 &acl->port)) 428 return false; 429 if (acl->address.group) 430 return tomoyo_address_matches_group 431 (r->param.inet_network.is_ipv6, 432 r->param.inet_network.address, acl->address.group); 433 return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 && 434 memcmp(&acl->address.ip[0], 435 r->param.inet_network.address, size) <= 0 && 436 memcmp(r->param.inet_network.address, 437 &acl->address.ip[1], size) <= 0; 438 } 439 440 /** 441 * tomoyo_check_unix_acl - Check permission for unix domain socket operation. 442 * 443 * @r: Pointer to "struct tomoyo_request_info". 444 * @ptr: Pointer to "struct tomoyo_acl_info". 445 * 446 * Returns true if granted, false otherwise. 447 */ 448 static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r, 449 const struct tomoyo_acl_info *ptr) 450 { 451 const struct tomoyo_unix_acl *acl = 452 container_of(ptr, typeof(*acl), head); 453 454 return (acl->perm & (1 << r->param.unix_network.operation)) && 455 tomoyo_compare_name_union(r->param.unix_network.address, 456 &acl->name); 457 } 458 459 /** 460 * tomoyo_inet_entry - Check permission for INET network operation. 461 * 462 * @address: Pointer to "struct tomoyo_addr_info". 463 * 464 * Returns 0 on success, negative value otherwise. 465 */ 466 static int tomoyo_inet_entry(const struct tomoyo_addr_info *address) 467 { 468 const int idx = tomoyo_read_lock(); 469 struct tomoyo_request_info r; 470 int error = 0; 471 const u8 type = tomoyo_inet2mac[address->protocol][address->operation]; 472 473 if (type && tomoyo_init_request_info(&r, NULL, type) 474 != TOMOYO_CONFIG_DISABLED) { 475 r.param_type = TOMOYO_TYPE_INET_ACL; 476 r.param.inet_network.protocol = address->protocol; 477 r.param.inet_network.operation = address->operation; 478 r.param.inet_network.is_ipv6 = address->inet.is_ipv6; 479 r.param.inet_network.address = address->inet.address; 480 r.param.inet_network.port = ntohs(address->inet.port); 481 do { 482 tomoyo_check_acl(&r, tomoyo_check_inet_acl); 483 error = tomoyo_audit_inet_log(&r); 484 } while (error == TOMOYO_RETRY_REQUEST); 485 } 486 tomoyo_read_unlock(idx); 487 return error; 488 } 489 490 /** 491 * tomoyo_check_inet_address - Check permission for inet domain socket's operation. 492 * 493 * @addr: Pointer to "struct sockaddr". 494 * @addr_len: Size of @addr. 495 * @port: Port number. 496 * @address: Pointer to "struct tomoyo_addr_info". 497 * 498 * Returns 0 on success, negative value otherwise. 499 */ 500 static int tomoyo_check_inet_address(const struct sockaddr *addr, 501 const unsigned int addr_len, 502 const u16 port, 503 struct tomoyo_addr_info *address) 504 { 505 struct tomoyo_inet_addr_info *i = &address->inet; 506 507 switch (addr->sa_family) { 508 case AF_INET6: 509 if (addr_len < SIN6_LEN_RFC2133) 510 goto skip; 511 i->is_ipv6 = true; 512 i->address = (__be32 *) 513 ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr; 514 i->port = ((struct sockaddr_in6 *) addr)->sin6_port; 515 break; 516 case AF_INET: 517 if (addr_len < sizeof(struct sockaddr_in)) 518 goto skip; 519 i->is_ipv6 = false; 520 i->address = (__be32 *) 521 &((struct sockaddr_in *) addr)->sin_addr; 522 i->port = ((struct sockaddr_in *) addr)->sin_port; 523 break; 524 default: 525 goto skip; 526 } 527 if (address->protocol == SOCK_RAW) 528 i->port = htons(port); 529 return tomoyo_inet_entry(address); 530 skip: 531 return 0; 532 } 533 534 /** 535 * tomoyo_unix_entry - Check permission for UNIX network operation. 536 * 537 * @address: Pointer to "struct tomoyo_addr_info". 538 * 539 * Returns 0 on success, negative value otherwise. 540 */ 541 static int tomoyo_unix_entry(const struct tomoyo_addr_info *address) 542 { 543 const int idx = tomoyo_read_lock(); 544 struct tomoyo_request_info r; 545 int error = 0; 546 const u8 type = tomoyo_unix2mac[address->protocol][address->operation]; 547 548 if (type && tomoyo_init_request_info(&r, NULL, type) 549 != TOMOYO_CONFIG_DISABLED) { 550 char *buf = address->unix0.addr; 551 int len = address->unix0.addr_len - sizeof(sa_family_t); 552 553 if (len <= 0) { 554 buf = "anonymous"; 555 len = 9; 556 } else if (buf[0]) { 557 len = strnlen(buf, len); 558 } 559 buf = tomoyo_encode2(buf, len); 560 if (buf) { 561 struct tomoyo_path_info addr; 562 563 addr.name = buf; 564 tomoyo_fill_path_info(&addr); 565 r.param_type = TOMOYO_TYPE_UNIX_ACL; 566 r.param.unix_network.protocol = address->protocol; 567 r.param.unix_network.operation = address->operation; 568 r.param.unix_network.address = &addr; 569 do { 570 tomoyo_check_acl(&r, tomoyo_check_unix_acl); 571 error = tomoyo_audit_unix_log(&r); 572 } while (error == TOMOYO_RETRY_REQUEST); 573 kfree(buf); 574 } else 575 error = -ENOMEM; 576 } 577 tomoyo_read_unlock(idx); 578 return error; 579 } 580 581 /** 582 * tomoyo_check_unix_address - Check permission for unix domain socket's operation. 583 * 584 * @addr: Pointer to "struct sockaddr". 585 * @addr_len: Size of @addr. 586 * @address: Pointer to "struct tomoyo_addr_info". 587 * 588 * Returns 0 on success, negative value otherwise. 589 */ 590 static int tomoyo_check_unix_address(struct sockaddr *addr, 591 const unsigned int addr_len, 592 struct tomoyo_addr_info *address) 593 { 594 struct tomoyo_unix_addr_info *u = &address->unix0; 595 596 if (addr->sa_family != AF_UNIX) 597 return 0; 598 u->addr = ((struct sockaddr_un *) addr)->sun_path; 599 u->addr_len = addr_len; 600 return tomoyo_unix_entry(address); 601 } 602 603 /** 604 * tomoyo_kernel_service - Check whether I'm kernel service or not. 605 * 606 * Returns true if I'm kernel service, false otherwise. 607 */ 608 static bool tomoyo_kernel_service(void) 609 { 610 /* Nothing to do if I am a kernel service. */ 611 return segment_eq(get_fs(), KERNEL_DS); 612 } 613 614 /** 615 * tomoyo_sock_family - Get socket's family. 616 * 617 * @sk: Pointer to "struct sock". 618 * 619 * Returns one of PF_INET, PF_INET6, PF_UNIX or 0. 620 */ 621 static u8 tomoyo_sock_family(struct sock *sk) 622 { 623 u8 family; 624 625 if (tomoyo_kernel_service()) 626 return 0; 627 family = sk->sk_family; 628 switch (family) { 629 case PF_INET: 630 case PF_INET6: 631 case PF_UNIX: 632 return family; 633 default: 634 return 0; 635 } 636 } 637 638 /** 639 * tomoyo_socket_listen_permission - Check permission for listening a socket. 640 * 641 * @sock: Pointer to "struct socket". 642 * 643 * Returns 0 on success, negative value otherwise. 644 */ 645 int tomoyo_socket_listen_permission(struct socket *sock) 646 { 647 struct tomoyo_addr_info address; 648 const u8 family = tomoyo_sock_family(sock->sk); 649 const unsigned int type = sock->type; 650 struct sockaddr_storage addr; 651 int addr_len; 652 653 if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET)) 654 return 0; 655 { 656 const int error = sock->ops->getname(sock, (struct sockaddr *) 657 &addr, &addr_len, 0); 658 659 if (error) 660 return error; 661 } 662 address.protocol = type; 663 address.operation = TOMOYO_NETWORK_LISTEN; 664 if (family == PF_UNIX) 665 return tomoyo_check_unix_address((struct sockaddr *) &addr, 666 addr_len, &address); 667 return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len, 668 0, &address); 669 } 670 671 /** 672 * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket. 673 * 674 * @sock: Pointer to "struct socket". 675 * @addr: Pointer to "struct sockaddr". 676 * @addr_len: Size of @addr. 677 * 678 * Returns 0 on success, negative value otherwise. 679 */ 680 int tomoyo_socket_connect_permission(struct socket *sock, 681 struct sockaddr *addr, int addr_len) 682 { 683 struct tomoyo_addr_info address; 684 const u8 family = tomoyo_sock_family(sock->sk); 685 const unsigned int type = sock->type; 686 687 if (!family) 688 return 0; 689 address.protocol = type; 690 switch (type) { 691 case SOCK_DGRAM: 692 case SOCK_RAW: 693 address.operation = TOMOYO_NETWORK_SEND; 694 break; 695 case SOCK_STREAM: 696 case SOCK_SEQPACKET: 697 address.operation = TOMOYO_NETWORK_CONNECT; 698 break; 699 default: 700 return 0; 701 } 702 if (family == PF_UNIX) 703 return tomoyo_check_unix_address(addr, addr_len, &address); 704 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol, 705 &address); 706 } 707 708 /** 709 * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket. 710 * 711 * @sock: Pointer to "struct socket". 712 * @addr: Pointer to "struct sockaddr". 713 * @addr_len: Size of @addr. 714 * 715 * Returns 0 on success, negative value otherwise. 716 */ 717 int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr, 718 int addr_len) 719 { 720 struct tomoyo_addr_info address; 721 const u8 family = tomoyo_sock_family(sock->sk); 722 const unsigned int type = sock->type; 723 724 if (!family) 725 return 0; 726 switch (type) { 727 case SOCK_STREAM: 728 case SOCK_DGRAM: 729 case SOCK_RAW: 730 case SOCK_SEQPACKET: 731 address.protocol = type; 732 address.operation = TOMOYO_NETWORK_BIND; 733 break; 734 default: 735 return 0; 736 } 737 if (family == PF_UNIX) 738 return tomoyo_check_unix_address(addr, addr_len, &address); 739 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol, 740 &address); 741 } 742 743 /** 744 * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram. 745 * 746 * @sock: Pointer to "struct socket". 747 * @msg: Pointer to "struct msghdr". 748 * @size: Unused. 749 * 750 * Returns 0 on success, negative value otherwise. 751 */ 752 int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg, 753 int size) 754 { 755 struct tomoyo_addr_info address; 756 const u8 family = tomoyo_sock_family(sock->sk); 757 const unsigned int type = sock->type; 758 759 if (!msg->msg_name || !family || 760 (type != SOCK_DGRAM && type != SOCK_RAW)) 761 return 0; 762 address.protocol = type; 763 address.operation = TOMOYO_NETWORK_SEND; 764 if (family == PF_UNIX) 765 return tomoyo_check_unix_address((struct sockaddr *) 766 msg->msg_name, 767 msg->msg_namelen, &address); 768 return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name, 769 msg->msg_namelen, 770 sock->sk->sk_protocol, &address); 771 } 772