1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * security/tomoyo/tomoyo.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8 #include <linux/lsm_hooks.h>
9 #include <uapi/linux/lsm.h>
10 #include "common.h"
11
12 /**
13 * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
14 *
15 * Returns pointer to "struct tomoyo_domain_info" for current thread.
16 */
17 struct tomoyo_domain_info *tomoyo_domain(void)
18 {
19 struct tomoyo_task *s = tomoyo_task(current);
20
21 if (s->old_domain_info && !current->in_execve) {
22 atomic_dec(&s->old_domain_info->users);
23 s->old_domain_info = NULL;
24 }
25 return s->domain_info;
26 }
27
28 /**
29 * tomoyo_cred_prepare - Target for security_prepare_creds().
30 *
31 * @new: Pointer to "struct cred".
32 * @old: Pointer to "struct cred".
33 * @gfp: Memory allocation flags.
34 *
35 * Returns 0.
36 */
37 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
38 gfp_t gfp)
39 {
40 /* Restore old_domain_info saved by previous execve() request. */
41 struct tomoyo_task *s = tomoyo_task(current);
42
43 if (s->old_domain_info && !current->in_execve) {
44 atomic_dec(&s->domain_info->users);
45 s->domain_info = s->old_domain_info;
46 s->old_domain_info = NULL;
47 }
48 return 0;
49 }
50
51 /**
52 * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
53 *
54 * @bprm: Pointer to "struct linux_binprm".
55 */
56 static void tomoyo_bprm_committed_creds(const struct linux_binprm *bprm)
57 {
58 /* Clear old_domain_info saved by execve() request. */
59 struct tomoyo_task *s = tomoyo_task(current);
60
61 atomic_dec(&s->old_domain_info->users);
62 s->old_domain_info = NULL;
63 }
64
65 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
66 /**
67 * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec().
68 *
69 * @bprm: Pointer to "struct linux_binprm".
70 *
71 * Returns 0.
72 */
73 static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm)
74 {
75 /*
76 * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
77 * for the first time.
78 */
79 if (!tomoyo_policy_loaded)
80 tomoyo_load_policy(bprm->filename);
81 return 0;
82 }
83 #endif
84
85 /**
86 * tomoyo_bprm_check_security - Target for security_bprm_check().
87 *
88 * @bprm: Pointer to "struct linux_binprm".
89 *
90 * Returns 0 on success, negative value otherwise.
91 */
92 static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
93 {
94 struct tomoyo_task *s = tomoyo_task(current);
95
96 /*
97 * Execute permission is checked against pathname passed to execve()
98 * using current domain.
99 */
100 if (!s->old_domain_info) {
101 const int idx = tomoyo_read_lock();
102 const int err = tomoyo_find_next_domain(bprm);
103
104 tomoyo_read_unlock(idx);
105 return err;
106 }
107 /*
108 * Read permission is checked against interpreters using next domain.
109 */
110 return tomoyo_check_open_permission(s->domain_info,
111 &bprm->file->f_path, O_RDONLY);
112 }
113
114 /**
115 * tomoyo_inode_getattr - Target for security_inode_getattr().
116 *
117 * @path: Pointer to "struct path".
118 *
119 * Returns 0 on success, negative value otherwise.
120 */
121 static int tomoyo_inode_getattr(const struct path *path)
122 {
123 return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
124 }
125
126 /**
127 * tomoyo_path_truncate - Target for security_path_truncate().
128 *
129 * @path: Pointer to "struct path".
130 *
131 * Returns 0 on success, negative value otherwise.
132 */
133 static int tomoyo_path_truncate(const struct path *path)
134 {
135 return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL);
136 }
137
138 /**
139 * tomoyo_file_truncate - Target for security_file_truncate().
140 *
141 * @file: Pointer to "struct file".
142 *
143 * Returns 0 on success, negative value otherwise.
144 */
145 static int tomoyo_file_truncate(struct file *file)
146 {
147 return tomoyo_path_truncate(&file->f_path);
148 }
149
150 /**
151 * tomoyo_path_unlink - Target for security_path_unlink().
152 *
153 * @parent: Pointer to "struct path".
154 * @dentry: Pointer to "struct dentry".
155 *
156 * Returns 0 on success, negative value otherwise.
157 */
158 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
159 {
160 struct path path = { .mnt = parent->mnt, .dentry = dentry };
161
162 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
163 }
164
165 /**
166 * tomoyo_path_mkdir - Target for security_path_mkdir().
167 *
168 * @parent: Pointer to "struct path".
169 * @dentry: Pointer to "struct dentry".
170 * @mode: DAC permission mode.
171 *
172 * Returns 0 on success, negative value otherwise.
173 */
174 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
175 umode_t mode)
176 {
177 struct path path = { .mnt = parent->mnt, .dentry = dentry };
178
179 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
180 mode & S_IALLUGO);
181 }
182
183 /**
184 * tomoyo_path_rmdir - Target for security_path_rmdir().
185 *
186 * @parent: Pointer to "struct path".
187 * @dentry: Pointer to "struct dentry".
188 *
189 * Returns 0 on success, negative value otherwise.
190 */
191 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
192 {
193 struct path path = { .mnt = parent->mnt, .dentry = dentry };
194
195 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
196 }
197
198 /**
199 * tomoyo_path_symlink - Target for security_path_symlink().
200 *
201 * @parent: Pointer to "struct path".
202 * @dentry: Pointer to "struct dentry".
203 * @old_name: Symlink's content.
204 *
205 * Returns 0 on success, negative value otherwise.
206 */
207 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
208 const char *old_name)
209 {
210 struct path path = { .mnt = parent->mnt, .dentry = dentry };
211
212 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
213 }
214
215 /**
216 * tomoyo_path_mknod - Target for security_path_mknod().
217 *
218 * @parent: Pointer to "struct path".
219 * @dentry: Pointer to "struct dentry".
220 * @mode: DAC permission mode.
221 * @dev: Device attributes.
222 *
223 * Returns 0 on success, negative value otherwise.
224 */
225 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
226 umode_t mode, unsigned int dev)
227 {
228 struct path path = { .mnt = parent->mnt, .dentry = dentry };
229 int type = TOMOYO_TYPE_CREATE;
230 const unsigned int perm = mode & S_IALLUGO;
231
232 switch (mode & S_IFMT) {
233 case S_IFCHR:
234 type = TOMOYO_TYPE_MKCHAR;
235 break;
236 case S_IFBLK:
237 type = TOMOYO_TYPE_MKBLOCK;
238 break;
239 default:
240 goto no_dev;
241 }
242 return tomoyo_mkdev_perm(type, &path, perm, dev);
243 no_dev:
244 switch (mode & S_IFMT) {
245 case S_IFIFO:
246 type = TOMOYO_TYPE_MKFIFO;
247 break;
248 case S_IFSOCK:
249 type = TOMOYO_TYPE_MKSOCK;
250 break;
251 }
252 return tomoyo_path_number_perm(type, &path, perm);
253 }
254
255 /**
256 * tomoyo_path_link - Target for security_path_link().
257 *
258 * @old_dentry: Pointer to "struct dentry".
259 * @new_dir: Pointer to "struct path".
260 * @new_dentry: Pointer to "struct dentry".
261 *
262 * Returns 0 on success, negative value otherwise.
263 */
264 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
265 struct dentry *new_dentry)
266 {
267 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
268 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
269
270 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
271 }
272
273 /**
274 * tomoyo_path_rename - Target for security_path_rename().
275 *
276 * @old_parent: Pointer to "struct path".
277 * @old_dentry: Pointer to "struct dentry".
278 * @new_parent: Pointer to "struct path".
279 * @new_dentry: Pointer to "struct dentry".
280 * @flags: Rename options.
281 *
282 * Returns 0 on success, negative value otherwise.
283 */
284 static int tomoyo_path_rename(const struct path *old_parent,
285 struct dentry *old_dentry,
286 const struct path *new_parent,
287 struct dentry *new_dentry,
288 const unsigned int flags)
289 {
290 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
291 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
292
293 if (flags & RENAME_EXCHANGE) {
294 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2,
295 &path1);
296
297 if (err)
298 return err;
299 }
300 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
301 }
302
303 /**
304 * tomoyo_file_fcntl - Target for security_file_fcntl().
305 *
306 * @file: Pointer to "struct file".
307 * @cmd: Command for fcntl().
308 * @arg: Argument for @cmd.
309 *
310 * Returns 0 on success, negative value otherwise.
311 */
312 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
313 unsigned long arg)
314 {
315 if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
316 return 0;
317 return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path,
318 O_WRONLY | (arg & O_APPEND));
319 }
320
321 /**
322 * tomoyo_file_open - Target for security_file_open().
323 *
324 * @f: Pointer to "struct file".
325 *
326 * Returns 0 on success, negative value otherwise.
327 */
328 static int tomoyo_file_open(struct file *f)
329 {
330 /* Don't check read permission here if called from execve(). */
331 /* Illogically, FMODE_EXEC is in f_flags, not f_mode. */
332 if (f->f_flags & __FMODE_EXEC)
333 return 0;
334 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path,
335 f->f_flags);
336 }
337
338 /**
339 * tomoyo_file_ioctl - Target for security_file_ioctl().
340 *
341 * @file: Pointer to "struct file".
342 * @cmd: Command for ioctl().
343 * @arg: Argument for @cmd.
344 *
345 * Returns 0 on success, negative value otherwise.
346 */
347 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
348 unsigned long arg)
349 {
350 return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd);
351 }
352
353 /**
354 * tomoyo_path_chmod - Target for security_path_chmod().
355 *
356 * @path: Pointer to "struct path".
357 * @mode: DAC permission mode.
358 *
359 * Returns 0 on success, negative value otherwise.
360 */
361 static int tomoyo_path_chmod(const struct path *path, umode_t mode)
362 {
363 return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
364 mode & S_IALLUGO);
365 }
366
367 /**
368 * tomoyo_path_chown - Target for security_path_chown().
369 *
370 * @path: Pointer to "struct path".
371 * @uid: Owner ID.
372 * @gid: Group ID.
373 *
374 * Returns 0 on success, negative value otherwise.
375 */
376 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
377 {
378 int error = 0;
379
380 if (uid_valid(uid))
381 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
382 from_kuid(&init_user_ns, uid));
383 if (!error && gid_valid(gid))
384 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path,
385 from_kgid(&init_user_ns, gid));
386 return error;
387 }
388
389 /**
390 * tomoyo_path_chroot - Target for security_path_chroot().
391 *
392 * @path: Pointer to "struct path".
393 *
394 * Returns 0 on success, negative value otherwise.
395 */
396 static int tomoyo_path_chroot(const struct path *path)
397 {
398 return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL);
399 }
400
401 /**
402 * tomoyo_sb_mount - Target for security_sb_mount().
403 *
404 * @dev_name: Name of device file. Maybe NULL.
405 * @path: Pointer to "struct path".
406 * @type: Name of filesystem type. Maybe NULL.
407 * @flags: Mount options.
408 * @data: Optional data. Maybe NULL.
409 *
410 * Returns 0 on success, negative value otherwise.
411 */
412 static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
413 const char *type, unsigned long flags, void *data)
414 {
415 return tomoyo_mount_permission(dev_name, path, type, flags, data);
416 }
417
418 /**
419 * tomoyo_sb_umount - Target for security_sb_umount().
420 *
421 * @mnt: Pointer to "struct vfsmount".
422 * @flags: Unmount options.
423 *
424 * Returns 0 on success, negative value otherwise.
425 */
426 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
427 {
428 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
429
430 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
431 }
432
433 /**
434 * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
435 *
436 * @old_path: Pointer to "struct path".
437 * @new_path: Pointer to "struct path".
438 *
439 * Returns 0 on success, negative value otherwise.
440 */
441 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
442 {
443 return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
444 }
445
446 /**
447 * tomoyo_socket_listen - Check permission for listen().
448 *
449 * @sock: Pointer to "struct socket".
450 * @backlog: Backlog parameter.
451 *
452 * Returns 0 on success, negative value otherwise.
453 */
454 static int tomoyo_socket_listen(struct socket *sock, int backlog)
455 {
456 return tomoyo_socket_listen_permission(sock);
457 }
458
459 /**
460 * tomoyo_socket_connect - Check permission for connect().
461 *
462 * @sock: Pointer to "struct socket".
463 * @addr: Pointer to "struct sockaddr".
464 * @addr_len: Size of @addr.
465 *
466 * Returns 0 on success, negative value otherwise.
467 */
468 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
469 int addr_len)
470 {
471 return tomoyo_socket_connect_permission(sock, addr, addr_len);
472 }
473
474 /**
475 * tomoyo_socket_bind - Check permission for bind().
476 *
477 * @sock: Pointer to "struct socket".
478 * @addr: Pointer to "struct sockaddr".
479 * @addr_len: Size of @addr.
480 *
481 * Returns 0 on success, negative value otherwise.
482 */
483 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
484 int addr_len)
485 {
486 return tomoyo_socket_bind_permission(sock, addr, addr_len);
487 }
488
489 /**
490 * tomoyo_socket_sendmsg - Check permission for sendmsg().
491 *
492 * @sock: Pointer to "struct socket".
493 * @msg: Pointer to "struct msghdr".
494 * @size: Size of message.
495 *
496 * Returns 0 on success, negative value otherwise.
497 */
498 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
499 int size)
500 {
501 return tomoyo_socket_sendmsg_permission(sock, msg, size);
502 }
503
504 struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = {
505 .lbs_task = sizeof(struct tomoyo_task),
506 };
507
508 /**
509 * tomoyo_task_alloc - Target for security_task_alloc().
510 *
511 * @task: Pointer to "struct task_struct".
512 * @clone_flags: clone() flags.
513 *
514 * Returns 0.
515 */
516 static int tomoyo_task_alloc(struct task_struct *task,
517 unsigned long clone_flags)
518 {
519 struct tomoyo_task *old = tomoyo_task(current);
520 struct tomoyo_task *new = tomoyo_task(task);
521
522 new->domain_info = old->domain_info;
523 atomic_inc(&new->domain_info->users);
524 new->old_domain_info = NULL;
525 return 0;
526 }
527
528 /**
529 * tomoyo_task_free - Target for security_task_free().
530 *
531 * @task: Pointer to "struct task_struct".
532 */
533 static void tomoyo_task_free(struct task_struct *task)
534 {
535 struct tomoyo_task *s = tomoyo_task(task);
536
537 if (s->domain_info) {
538 atomic_dec(&s->domain_info->users);
539 s->domain_info = NULL;
540 }
541 if (s->old_domain_info) {
542 atomic_dec(&s->old_domain_info->users);
543 s->old_domain_info = NULL;
544 }
545 }
546
547 static const struct lsm_id tomoyo_lsmid = {
548 .name = "tomoyo",
549 .id = LSM_ID_TOMOYO,
550 };
551
552 /*
553 * tomoyo_security_ops is a "struct security_operations" which is used for
554 * registering TOMOYO.
555 */
556 static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
557 LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
558 LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
559 LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
560 LSM_HOOK_INIT(task_free, tomoyo_task_free),
561 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
562 LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec),
563 #endif
564 LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
565 LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
566 LSM_HOOK_INIT(file_open, tomoyo_file_open),
567 LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate),
568 LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
569 LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
570 LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
571 LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
572 LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
573 LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
574 LSM_HOOK_INIT(path_link, tomoyo_path_link),
575 LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
576 LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
577 LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
578 LSM_HOOK_INIT(file_ioctl_compat, tomoyo_file_ioctl),
579 LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
580 LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
581 LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
582 LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
583 LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
584 LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
585 LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
586 LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
587 LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
588 LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
589 };
590
591 /* Lock for GC. */
592 DEFINE_SRCU(tomoyo_ss);
593
594 int tomoyo_enabled __ro_after_init = 1;
595
596 /**
597 * tomoyo_init - Register TOMOYO Linux as a LSM module.
598 *
599 * Returns 0.
600 */
601 static int __init tomoyo_init(void)
602 {
603 struct tomoyo_task *s = tomoyo_task(current);
604
605 /* register ourselves with the security framework */
606 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks),
607 &tomoyo_lsmid);
608 pr_info("TOMOYO Linux initialized\n");
609 s->domain_info = &tomoyo_kernel_domain;
610 atomic_inc(&tomoyo_kernel_domain.users);
611 s->old_domain_info = NULL;
612 tomoyo_mm_init();
613
614 return 0;
615 }
616
617 DEFINE_LSM(tomoyo) = {
618 .name = "tomoyo",
619 .enabled = &tomoyo_enabled,
620 .flags = LSM_FLAG_LEGACY_MAJOR,
621 .blobs = &tomoyo_blob_sizes,
622 .init = tomoyo_init,
623 };
624
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.