The /sys/kernel/security/tomoyo/ interface

/sys/kernel/security/tomoyo/audit

This read-only interface contains the audit log. The reader process returns immediately if no audit log exists. To wait until an audit log is generated, use select(2) for readability.

This interface is dependent on how the profiles have been configured in /sys/kernel/security/tomoyo/profile. The following profile options affect it:

• grant_log
• reject_log
• max_audit_log

Also, /sys/kernel/security/tomoyo/stat affects how much memory can be assigned for audit logs.

This interface is used primarily by the userspace tool tomoyo-auditd.

/sys/kernel/security/tomoyo/domain_policy

This read/write interface contains the policy that is defined for each domain. Any lines starting with "<kernel>" indicate the start of a new block of access permissions.

The associated configuration file is "/etc/tomoyo/domain_policy.conf".

This interface is used primarily by the userspace tools tomoyo-editpolicy, tomoyo-loadpolicy and tomoyo-savepolicy.

/sys/kernel/security/tomoyo/exception_policy

This read/write interface contains the exception policy. Each line is an individual entry.

The associated configuration file is "/etc/tomoyo/exception_policy.conf".

This interface is used primarily by the userspace tools tomoyo-editpolicy, tomoyo-loadpolicy and tomoyo-savepolicy.

/sys/kernel/security/tomoyo/manager

This read/write interface contains a list of either domains or full pathnames that have been given permission to write to the "/sys/kernel/security/tomoyo/" interface.

As an exception, all domains can write to below interfaces for restricted purposes.

• /sys/kernel/security/tomoyo/.process_status for reading information of processes
• /sys/kernel/security/tomoyo/domain_policy for reading specific domain's (or specific process's) access permissions
• /sys/kernel/security/tomoyo/self_domain for changing the domain of the caller process

The associated configuration file is "/etc/tomoyo/manager.conf".

This interface is used primarily by the userspace tools tomoyo-editpolicy, tomoyo-loadpolicy and tomoyo-savepolicy.

# cat /sys/kernel/security/tomoyo/manager

/usr/sbin/tomoyo-loadpolicy
/usr/sbin/tomoyo-editpolicy
/usr/sbin/tomoyo-setlevel
/usr/sbin/tomoyo-setprofile
/usr/sbin/tomoyo-queryd

/sys/kernel/security/tomoyo/profile

This read/write interface contains the profile configuration.

The associated configuration file is "/etc/tomoyo/profile.conf".

This interface is used primarily by the userspace tools tomoyo-editpolicy, tomoyo-loadpolicy, tomoyo-savepolicy and tomoyo-setlevel.

/sys/kernel/security/tomoyo/query

This read/write interface is used to grant or reject individual access requests that occur within domains in "Enforcing Mode".

This interface is used primarily by the userspace tool tomoyo-queryd.

/sys/kernel/security/tomoyo/self_domain

This read/write interface shows the domain of the caller process.

This interface allows the caller to change the domain of the caller process if explicitly permitted by task manual_domain_transition directive.

/sys/kernel/security/tomoyo/stat

This read/write interface contains information about policy violations and memory usage in bytes.

# cat /sys/kernel/security/tomoyo/stat

Policy update:                               172 (Last: 2011/02/03 18:03:01)
Policy violation in learning mode:             0
Policy violation in permissive mode:           0
Policy violation in enforcing mode:            0
Memory used by policy:                     41792
Memory used by audit log:                 159328
Memory used by query message:                  0
Total memory used:                        201120

• Policy update shows the total number of policy updates and the last time that policy was updated.
• Policy violation in learning mode shows the total number of policy violations that have occurred in domains set to "Learning Mode" and the last time the violation occurred.
• Policy violation in permissive mode shows the total number of policy violations that have occurred in domains set to "Permissive Mode"and the last time the violation occurred.
• Policy violation in enforcing mode shows the total number of policy violations that have occurred in domains set to "Enforcing Mode"and the last time the violation occurred.
• Memory used by policy shows the memory used for holding access permissions.
• Memory used by audit log shows the memory used for holding audit logs.
• Memory used by query message shows the memory used for waiting for administrator's decision.
• Total memory used shows the total memory used.

This interface allows the administrator to configure memory quota.

The associated configuration file is "/etc/tomoyo/stat.conf".

This interface is used primarily by the userspace tools tomoyo-editpolicy, tomoyo-loadpolicy and tomoyo-savepolicy.

/sys/kernel/security/tomoyo/version

This read-only interface contains the currently running version of TOMOYO Linux.

/sys/kernel/security/tomoyo/.process_status

This read/write interface contains a list of domain names and profile numbers that the currently running process belongs to.

This interface is used primarily by the userspace tool tomoyo-pstree.