1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * security/tomoyo/tomoyo.c 4 * 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION 6 */ 7 8 #include <linux/lsm_hooks.h> 9 #include <uapi/linux/lsm.h> 10 #include "common.h" 11 12 /** 13 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 14 * 15 * Returns pointer to "struct tomoyo_domain_info" for current thread. 16 */ 17 struct tomoyo_domain_info *tomoyo_domain(void) 18 { 19 struct tomoyo_task *s = tomoyo_task(current); 20 21 if (s->old_domain_info && !current->in_execve) { 22 atomic_dec(&s->old_domain_info->users); 23 s->old_domain_info = NULL; 24 } 25 return s->domain_info; 26 } 27 28 /** 29 * tomoyo_cred_prepare - Target for security_prepare_creds(). 30 * 31 * @new: Pointer to "struct cred". 32 * @old: Pointer to "struct cred". 33 * @gfp: Memory allocation flags. 34 * 35 * Returns 0. 36 */ 37 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, 38 gfp_t gfp) 39 { 40 /* Restore old_domain_info saved by previous execve() request. */ 41 struct tomoyo_task *s = tomoyo_task(current); 42 43 if (s->old_domain_info && !current->in_execve) { 44 atomic_dec(&s->domain_info->users); 45 s->domain_info = s->old_domain_info; 46 s->old_domain_info = NULL; 47 } 48 return 0; 49 } 50 51 /** 52 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). 53 * 54 * @bprm: Pointer to "struct linux_binprm". 55 */ 56 static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm) 57 { 58 /* Clear old_domain_info saved by execve() request. */ 59 struct tomoyo_task *s = tomoyo_task(current); 60 61 atomic_dec(&s->old_domain_info->users); 62 s->old_domain_info = NULL; 63 } 64 65 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 66 /** 67 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). 68 * 69 * @bprm: Pointer to "struct linux_binprm". 70 * 71 * Returns 0. 72 */ 73 static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) 74 { 75 /* 76 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested 77 * for the first time. 78 */ 79 if (!tomoyo_policy_loaded) 80 tomoyo_load_policy(bprm->filename); 81 return 0; 82 } 83 #endif 84 85 /** 86 * tomoyo_bprm_check_security - Target for security_bprm_check(). 87 * 88 * @bprm: Pointer to "struct linux_binprm". 89 * 90 * Returns 0 on success, negative value otherwise. 91 */ 92 static int tomoyo_bprm_check_security(struct linux_binprm *bprm) 93 { 94 struct tomoyo_task *s = tomoyo_task(current); 95 96 /* 97 * Execute permission is checked against pathname passed to execve() 98 * using current domain. 99 */ 100 if (!s->old_domain_info) { 101 const int idx = tomoyo_read_lock(); 102 const int err = tomoyo_find_next_domain(bprm); 103 104 tomoyo_read_unlock(idx); 105 return err; 106 } 107 /* 108 * Read permission is checked against interpreters using next domain. 109 */ 110 return tomoyo_check_open_permission(s->domain_info, 111 &bprm->file->f_path, O_RDONLY); 112 } 113 114 /** 115 * tomoyo_inode_getattr - Target for security_inode_getattr(). 116 * 117 * @path: Pointer to "struct path". 118 * 119 * Returns 0 on success, negative value otherwise. 120 */ 121 static int tomoyo_inode_getattr(const struct path *path) 122 { 123 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); 124 } 125 126 /** 127 * tomoyo_path_truncate - Target for security_path_truncate(). 128 * 129 * @path: Pointer to "struct path". 130 * 131 * Returns 0 on success, negative value otherwise. 132 */ 133 static int tomoyo_path_truncate(const struct path *path) 134 { 135 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); 136 } 137 138 /** 139 * tomoyo_file_truncate - Target for security_file_truncate(). 140 * 141 * @file: Pointer to "struct file". 142 * 143 * Returns 0 on success, negative value otherwise. 144 */ 145 static int tomoyo_file_truncate(struct file *file) 146 { 147 return tomoyo_path_truncate(&file->f_path); 148 } 149 150 /** 151 * tomoyo_path_unlink - Target for security_path_unlink(). 152 * 153 * @parent: Pointer to "struct path". 154 * @dentry: Pointer to "struct dentry". 155 * 156 * Returns 0 on success, negative value otherwise. 157 */ 158 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) 159 { 160 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 161 162 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); 163 } 164 165 /** 166 * tomoyo_path_mkdir - Target for security_path_mkdir(). 167 * 168 * @parent: Pointer to "struct path". 169 * @dentry: Pointer to "struct dentry". 170 * @mode: DAC permission mode. 171 * 172 * Returns 0 on success, negative value otherwise. 173 */ 174 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, 175 umode_t mode) 176 { 177 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 178 179 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, 180 mode & S_IALLUGO); 181 } 182 183 /** 184 * tomoyo_path_rmdir - Target for security_path_rmdir(). 185 * 186 * @parent: Pointer to "struct path". 187 * @dentry: Pointer to "struct dentry". 188 * 189 * Returns 0 on success, negative value otherwise. 190 */ 191 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) 192 { 193 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 194 195 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); 196 } 197 198 /** 199 * tomoyo_path_symlink - Target for security_path_symlink(). 200 * 201 * @parent: Pointer to "struct path". 202 * @dentry: Pointer to "struct dentry". 203 * @old_name: Symlink's content. 204 * 205 * Returns 0 on success, negative value otherwise. 206 */ 207 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, 208 const char *old_name) 209 { 210 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 211 212 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); 213 } 214 215 /** 216 * tomoyo_path_mknod - Target for security_path_mknod(). 217 * 218 * @parent: Pointer to "struct path". 219 * @dentry: Pointer to "struct dentry". 220 * @mode: DAC permission mode. 221 * @dev: Device attributes. 222 * 223 * Returns 0 on success, negative value otherwise. 224 */ 225 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, 226 umode_t mode, unsigned int dev) 227 { 228 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 229 int type = TOMOYO_TYPE_CREATE; 230 const unsigned int perm = mode & S_IALLUGO; 231 232 switch (mode & S_IFMT) { 233 case S_IFCHR: 234 type = TOMOYO_TYPE_MKCHAR; 235 break; 236 case S_IFBLK: 237 type = TOMOYO_TYPE_MKBLOCK; 238 break; 239 default: 240 goto no_dev; 241 } 242 return tomoyo_mkdev_perm(type, &path, perm, dev); 243 no_dev: 244 switch (mode & S_IFMT) { 245 case S_IFIFO: 246 type = TOMOYO_TYPE_MKFIFO; 247 break; 248 case S_IFSOCK: 249 type = TOMOYO_TYPE_MKSOCK; 250 break; 251 } 252 return tomoyo_path_number_perm(type, &path, perm); 253 } 254 255 /** 256 * tomoyo_path_link - Target for security_path_link(). 257 * 258 * @old_dentry: Pointer to "struct dentry". 259 * @new_dir: Pointer to "struct path". 260 * @new_dentry: Pointer to "struct dentry". 261 * 262 * Returns 0 on success, negative value otherwise. 263 */ 264 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, 265 struct dentry *new_dentry) 266 { 267 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; 268 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; 269 270 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); 271 } 272 273 /** 274 * tomoyo_path_rename - Target for security_path_rename(). 275 * 276 * @old_parent: Pointer to "struct path". 277 * @old_dentry: Pointer to "struct dentry". 278 * @new_parent: Pointer to "struct path". 279 * @new_dentry: Pointer to "struct dentry". 280 * @flags: Rename options. 281 * 282 * Returns 0 on success, negative value otherwise. 283 */ 284 static int tomoyo_path_rename(const struct path *old_parent, 285 struct dentry *old_dentry, 286 const struct path *new_parent, 287 struct dentry *new_dentry, 288 const unsigned int flags) 289 { 290 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; 291 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; 292 293 if (flags & RENAME_EXCHANGE) { 294 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2, 295 &path1); 296 297 if (err) 298 return err; 299 } 300 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); 301 } 302 303 /** 304 * tomoyo_file_fcntl - Target for security_file_fcntl(). 305 * 306 * @file: Pointer to "struct file". 307 * @cmd: Command for fcntl(). 308 * @arg: Argument for @cmd. 309 * 310 * Returns 0 on success, negative value otherwise. 311 */ 312 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, 313 unsigned long arg) 314 { 315 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) 316 return 0; 317 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, 318 O_WRONLY | (arg & O_APPEND)); 319 } 320 321 /** 322 * tomoyo_file_open - Target for security_file_open(). 323 * 324 * @f: Pointer to "struct file". 325 * 326 * Returns 0 on success, negative value otherwise. 327 */ 328 static int tomoyo_file_open(struct file *f) 329 { 330 /* Don't check read permission here if called from execve(). */ 331 /* Illogically, FMODE_EXEC is in f_flags, not f_mode. */ 332 if (f->f_flags & __FMODE_EXEC) 333 return 0; 334 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, 335 f->f_flags); 336 } 337 338 /** 339 * tomoyo_file_ioctl - Target for security_file_ioctl(). 340 * 341 * @file: Pointer to "struct file". 342 * @cmd: Command for ioctl(). 343 * @arg: Argument for @cmd. 344 * 345 * Returns 0 on success, negative value otherwise. 346 */ 347 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, 348 unsigned long arg) 349 { 350 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); 351 } 352 353 /** 354 * tomoyo_path_chmod - Target for security_path_chmod(). 355 * 356 * @path: Pointer to "struct path". 357 * @mode: DAC permission mode. 358 * 359 * Returns 0 on success, negative value otherwise. 360 */ 361 static int tomoyo_path_chmod(const struct path *path, umode_t mode) 362 { 363 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, 364 mode & S_IALLUGO); 365 } 366 367 /** 368 * tomoyo_path_chown - Target for security_path_chown(). 369 * 370 * @path: Pointer to "struct path". 371 * @uid: Owner ID. 372 * @gid: Group ID. 373 * 374 * Returns 0 on success, negative value otherwise. 375 */ 376 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 377 { 378 int error = 0; 379 380 if (uid_valid(uid)) 381 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, 382 from_kuid(&init_user_ns, uid)); 383 if (!error && gid_valid(gid)) 384 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, 385 from_kgid(&init_user_ns, gid)); 386 return error; 387 } 388 389 /** 390 * tomoyo_path_chroot - Target for security_path_chroot(). 391 * 392 * @path: Pointer to "struct path". 393 * 394 * Returns 0 on success, negative value otherwise. 395 */ 396 static int tomoyo_path_chroot(const struct path *path) 397 { 398 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); 399 } 400 401 /** 402 * tomoyo_sb_mount - Target for security_sb_mount(). 403 * 404 * @dev_name: Name of device file. Maybe NULL. 405 * @path: Pointer to "struct path". 406 * @type: Name of filesystem type. Maybe NULL. 407 * @flags: Mount options. 408 * @data: Optional data. Maybe NULL. 409 * 410 * Returns 0 on success, negative value otherwise. 411 */ 412 static int tomoyo_sb_mount(const char *dev_name, const struct path *path, 413 const char *type, unsigned long flags, void *data) 414 { 415 return tomoyo_mount_permission(dev_name, path, type, flags, data); 416 } 417 418 /** 419 * tomoyo_sb_umount - Target for security_sb_umount(). 420 * 421 * @mnt: Pointer to "struct vfsmount". 422 * @flags: Unmount options. 423 * 424 * Returns 0 on success, negative value otherwise. 425 */ 426 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) 427 { 428 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; 429 430 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); 431 } 432 433 /** 434 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). 435 * 436 * @old_path: Pointer to "struct path". 437 * @new_path: Pointer to "struct path". 438 * 439 * Returns 0 on success, negative value otherwise. 440 */ 441 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) 442 { 443 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); 444 } 445 446 /** 447 * tomoyo_socket_listen - Check permission for listen(). 448 * 449 * @sock: Pointer to "struct socket". 450 * @backlog: Backlog parameter. 451 * 452 * Returns 0 on success, negative value otherwise. 453 */ 454 static int tomoyo_socket_listen(struct socket *sock, int backlog) 455 { 456 return tomoyo_socket_listen_permission(sock); 457 } 458 459 /** 460 * tomoyo_socket_connect - Check permission for connect(). 461 * 462 * @sock: Pointer to "struct socket". 463 * @addr: Pointer to "struct sockaddr". 464 * @addr_len: Size of @addr. 465 * 466 * Returns 0 on success, negative value otherwise. 467 */ 468 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, 469 int addr_len) 470 { 471 return tomoyo_socket_connect_permission(sock, addr, addr_len); 472 } 473 474 /** 475 * tomoyo_socket_bind - Check permission for bind(). 476 * 477 * @sock: Pointer to "struct socket". 478 * @addr: Pointer to "struct sockaddr". 479 * @addr_len: Size of @addr. 480 * 481 * Returns 0 on success, negative value otherwise. 482 */ 483 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, 484 int addr_len) 485 { 486 return tomoyo_socket_bind_permission(sock, addr, addr_len); 487 } 488 489 /** 490 * tomoyo_socket_sendmsg - Check permission for sendmsg(). 491 * 492 * @sock: Pointer to "struct socket". 493 * @msg: Pointer to "struct msghdr". 494 * @size: Size of message. 495 * 496 * Returns 0 on success, negative value otherwise. 497 */ 498 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, 499 int size) 500 { 501 return tomoyo_socket_sendmsg_permission(sock, msg, size); 502 } 503 504 struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = { 505 .lbs_task = sizeof(struct tomoyo_task), 506 }; 507 508 /** 509 * tomoyo_task_alloc - Target for security_task_alloc(). 510 * 511 * @task: Pointer to "struct task_struct". 512 * @clone_flags: clone() flags. 513 * 514 * Returns 0. 515 */ 516 static int tomoyo_task_alloc(struct task_struct *task, 517 unsigned long clone_flags) 518 { 519 struct tomoyo_task *old = tomoyo_task(current); 520 struct tomoyo_task *new = tomoyo_task(task); 521 522 new->domain_info = old->domain_info; 523 atomic_inc(&new->domain_info->users); 524 new->old_domain_info = NULL; 525 return 0; 526 } 527 528 /** 529 * tomoyo_task_free - Target for security_task_free(). 530 * 531 * @task: Pointer to "struct task_struct". 532 */ 533 static void tomoyo_task_free(struct task_struct *task) 534 { 535 struct tomoyo_task *s = tomoyo_task(task); 536 537 if (s->domain_info) { 538 atomic_dec(&s->domain_info->users); 539 s->domain_info = NULL; 540 } 541 if (s->old_domain_info) { 542 atomic_dec(&s->old_domain_info->users); 543 s->old_domain_info = NULL; 544 } 545 } 546 547 static const struct lsm_id tomoyo_lsmid = { 548 .name = "tomoyo", 549 .id = LSM_ID_TOMOYO, 550 }; 551 552 /* 553 * tomoyo_security_ops is a "struct security_operations" which is used for 554 * registering TOMOYO. 555 */ 556 static struct security_hook_list tomoyo_hooks[] __ro_after_init = { 557 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), 558 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), 559 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), 560 LSM_HOOK_INIT(task_free, tomoyo_task_free), 561 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER 562 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), 563 #endif 564 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), 565 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), 566 LSM_HOOK_INIT(file_open, tomoyo_file_open), 567 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate), 568 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), 569 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), 570 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), 571 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), 572 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), 573 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), 574 LSM_HOOK_INIT(path_link, tomoyo_path_link), 575 LSM_HOOK_INIT(path_rename, tomoyo_path_rename), 576 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), 577 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), 578 LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl), 579 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), 580 LSM_HOOK_INIT(path_chown, tomoyo_path_chown), 581 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), 582 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), 583 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), 584 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), 585 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), 586 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), 587 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), 588 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), 589 }; 590 591 /* Lock for GC. */ 592 DEFINE_SRCU(tomoyo_ss); 593 594 int tomoyo_enabled __ro_after_init = 1; 595 596 /** 597 * tomoyo_init - Register TOMOYO Linux as a LSM module. 598 * 599 * Returns 0. 600 */ 601 static int __init tomoyo_init(void) 602 { 603 struct tomoyo_task *s = tomoyo_task(current); 604 605 /* register ourselves with the security framework */ 606 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), 607 &tomoyo_lsmid); 608 pr_info("TOMOYO Linux initialized\n"); 609 s->domain_info = &tomoyo_kernel_domain; 610 atomic_inc(&tomoyo_kernel_domain.users); 611 s->old_domain_info = NULL; 612 tomoyo_mm_init(); 613 614 return 0; 615 } 616 617 DEFINE_LSM(tomoyo) = { 618 .name = "tomoyo", 619 .enabled = &tomoyo_enabled, 620 .flags = LSM_FLAG_LEGACY_MAJOR, 621 .blobs = &tomoyo_blob_sizes, 622 .init = tomoyo_init, 623 }; 624