2 * security/tomoyo/domain.c
4 * Domain transition functions for TOMOYO.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
10 #include <linux/binfmts.h>
11 #include <linux/slab.h>
13 /* Variables definitions.*/
15 /* The initial domain. */
16 struct tomoyo_domain_info tomoyo_kernel_domain;
19 * tomoyo_update_policy - Update an entry for exception policy.
21 * @new_entry: Pointer to "struct tomoyo_acl_info".
22 * @size: Size of @new_entry in bytes.
23 * @param: Pointer to "struct tomoyo_acl_param".
24 * @check_duplicate: Callback function to find duplicated entry.
26 * Returns 0 on success, negative value otherwise.
28 * Caller holds tomoyo_read_lock().
30 int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
31 struct tomoyo_acl_param *param,
32 bool (*check_duplicate) (const struct tomoyo_acl_head
34 const struct tomoyo_acl_head
37 int error = param->is_delete ? -ENOENT : -ENOMEM;
38 struct tomoyo_acl_head *entry;
39 struct list_head *list = param->list;
41 if (mutex_lock_interruptible(&tomoyo_policy_lock))
43 list_for_each_entry_rcu(entry, list, list) {
44 if (!check_duplicate(entry, new_entry))
46 entry->is_deleted = param->is_delete;
50 if (error && !param->is_delete) {
51 entry = tomoyo_commit_ok(new_entry, size);
53 list_add_tail_rcu(&entry->list, list);
57 mutex_unlock(&tomoyo_policy_lock);
62 * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
64 * @a: Pointer to "struct tomoyo_acl_info".
65 * @b: Pointer to "struct tomoyo_acl_info".
67 * Returns true if @a == @b, false otherwise.
69 static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
70 const struct tomoyo_acl_info *b)
72 return a->type == b->type && a->cond == b->cond;
76 * tomoyo_update_domain - Update an entry for domain policy.
78 * @new_entry: Pointer to "struct tomoyo_acl_info".
79 * @size: Size of @new_entry in bytes.
80 * @param: Pointer to "struct tomoyo_acl_param".
81 * @check_duplicate: Callback function to find duplicated entry.
82 * @merge_duplicate: Callback function to merge duplicated entry.
84 * Returns 0 on success, negative value otherwise.
86 * Caller holds tomoyo_read_lock().
88 int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
89 struct tomoyo_acl_param *param,
90 bool (*check_duplicate) (const struct tomoyo_acl_info
92 const struct tomoyo_acl_info
94 bool (*merge_duplicate) (struct tomoyo_acl_info *,
95 struct tomoyo_acl_info *,
98 const bool is_delete = param->is_delete;
99 int error = is_delete ? -ENOENT : -ENOMEM;
100 struct tomoyo_acl_info *entry;
101 struct list_head * const list = param->list;
103 if (param->data[0]) {
104 new_entry->cond = tomoyo_get_condition(param);
105 if (!new_entry->cond)
108 if (mutex_lock_interruptible(&tomoyo_policy_lock))
110 list_for_each_entry_rcu(entry, list, list) {
111 if (!tomoyo_same_acl_head(entry, new_entry) ||
112 !check_duplicate(entry, new_entry))
115 entry->is_deleted = merge_duplicate(entry, new_entry,
118 entry->is_deleted = is_delete;
122 if (error && !is_delete) {
123 entry = tomoyo_commit_ok(new_entry, size);
125 list_add_tail_rcu(&entry->list, list);
129 mutex_unlock(&tomoyo_policy_lock);
131 tomoyo_put_condition(new_entry->cond);
136 * tomoyo_check_acl - Do permission check.
138 * @r: Pointer to "struct tomoyo_request_info".
139 * @check_entry: Callback function to check type specific parameters.
141 * Returns 0 on success, negative value otherwise.
143 * Caller holds tomoyo_read_lock().
145 void tomoyo_check_acl(struct tomoyo_request_info *r,
146 bool (*check_entry) (struct tomoyo_request_info *,
147 const struct tomoyo_acl_info *))
149 const struct tomoyo_domain_info *domain = r->domain;
150 struct tomoyo_acl_info *ptr;
151 bool retried = false;
152 const struct list_head *list = &domain->acl_info_list;
155 list_for_each_entry_rcu(ptr, list, list) {
156 if (ptr->is_deleted || ptr->type != r->param_type)
158 if (!check_entry(r, ptr))
160 if (!tomoyo_condition(r, ptr->cond))
167 list = &domain->ns->acl_group[domain->group];
173 /* The list for "struct tomoyo_domain_info". */
174 LIST_HEAD(tomoyo_domain_list);
177 * tomoyo_last_word - Get last component of a domainname.
179 * @name: Domainname to check.
181 * Returns the last word of @domainname.
183 static const char *tomoyo_last_word(const char *name)
185 const char *cp = strrchr(name, ' ');
192 * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry.
194 * @a: Pointer to "struct tomoyo_acl_head".
195 * @b: Pointer to "struct tomoyo_acl_head".
197 * Returns true if @a == @b, false otherwise.
199 static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
200 const struct tomoyo_acl_head *b)
202 const struct tomoyo_transition_control *p1 = container_of(a,
205 const struct tomoyo_transition_control *p2 = container_of(b,
208 return p1->type == p2->type && p1->is_last_name == p2->is_last_name
209 && p1->domainname == p2->domainname
210 && p1->program == p2->program;
214 * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list.
216 * @param: Pointer to "struct tomoyo_acl_param".
217 * @type: Type of this entry.
219 * Returns 0 on success, negative value otherwise.
221 int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
224 struct tomoyo_transition_control e = { .type = type };
225 int error = param->is_delete ? -ENOENT : -ENOMEM;
226 char *program = param->data;
227 char *domainname = strstr(program, " from ");
231 } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP ||
232 type == TOMOYO_TRANSITION_CONTROL_KEEP) {
233 domainname = program;
236 if (program && strcmp(program, "any")) {
237 if (!tomoyo_correct_path(program))
239 e.program = tomoyo_get_name(program);
243 if (domainname && strcmp(domainname, "any")) {
244 if (!tomoyo_correct_domain(domainname)) {
245 if (!tomoyo_correct_path(domainname))
247 e.is_last_name = true;
249 e.domainname = tomoyo_get_name(domainname);
253 param->list = ¶m->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
254 error = tomoyo_update_policy(&e.head, sizeof(e), param,
255 tomoyo_same_transition_control);
257 tomoyo_put_name(e.domainname);
258 tomoyo_put_name(e.program);
263 * tomoyo_scan_transition - Try to find specific domain transition type.
265 * @list: Pointer to "struct list_head".
266 * @domainname: The name of current domain.
267 * @program: The name of requested program.
268 * @last_name: The last component of @domainname.
269 * @type: One of values in "enum tomoyo_transition_type".
271 * Returns true if found one, false otherwise.
273 * Caller holds tomoyo_read_lock().
275 static inline bool tomoyo_scan_transition
276 (const struct list_head *list, const struct tomoyo_path_info *domainname,
277 const struct tomoyo_path_info *program, const char *last_name,
278 const enum tomoyo_transition_type type)
280 const struct tomoyo_transition_control *ptr;
281 list_for_each_entry_rcu(ptr, list, head.list) {
282 if (ptr->head.is_deleted || ptr->type != type)
284 if (ptr->domainname) {
285 if (!ptr->is_last_name) {
286 if (ptr->domainname != domainname)
290 * Use direct strcmp() since this is
293 if (strcmp(ptr->domainname->name, last_name))
297 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
305 * tomoyo_transition_type - Get domain transition type.
307 * @ns: Pointer to "struct tomoyo_policy_namespace".
308 * @domainname: The name of current domain.
309 * @program: The name of requested program.
311 * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes
312 * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if
313 * executing @program reinitializes domain transition within that namespace,
314 * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname ,
317 * Caller holds tomoyo_read_lock().
319 static enum tomoyo_transition_type tomoyo_transition_type
320 (const struct tomoyo_policy_namespace *ns,
321 const struct tomoyo_path_info *domainname,
322 const struct tomoyo_path_info *program)
324 const char *last_name = tomoyo_last_word(domainname->name);
325 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
326 while (type < TOMOYO_MAX_TRANSITION_TYPE) {
327 const struct list_head * const list =
328 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
329 if (!tomoyo_scan_transition(list, domainname, program,
334 if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET &&
335 type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE)
338 * Do not check for reset_domain if no_reset_domain matched.
339 * Do not check for initialize_domain if no_initialize_domain
349 * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry.
351 * @a: Pointer to "struct tomoyo_acl_head".
352 * @b: Pointer to "struct tomoyo_acl_head".
354 * Returns true if @a == @b, false otherwise.
356 static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
357 const struct tomoyo_acl_head *b)
359 const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1),
361 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
363 return p1->original_name == p2->original_name &&
364 p1->aggregated_name == p2->aggregated_name;
368 * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list.
370 * @param: Pointer to "struct tomoyo_acl_param".
372 * Returns 0 on success, negative value otherwise.
374 * Caller holds tomoyo_read_lock().
376 int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
378 struct tomoyo_aggregator e = { };
379 int error = param->is_delete ? -ENOENT : -ENOMEM;
380 const char *original_name = tomoyo_read_token(param);
381 const char *aggregated_name = tomoyo_read_token(param);
382 if (!tomoyo_correct_word(original_name) ||
383 !tomoyo_correct_path(aggregated_name))
385 e.original_name = tomoyo_get_name(original_name);
386 e.aggregated_name = tomoyo_get_name(aggregated_name);
387 if (!e.original_name || !e.aggregated_name ||
388 e.aggregated_name->is_patterned) /* No patterns allowed. */
390 param->list = ¶m->ns->policy_list[TOMOYO_ID_AGGREGATOR];
391 error = tomoyo_update_policy(&e.head, sizeof(e), param,
392 tomoyo_same_aggregator);
394 tomoyo_put_name(e.original_name);
395 tomoyo_put_name(e.aggregated_name);
400 * tomoyo_find_namespace - Find specified namespace.
402 * @name: Name of namespace to find.
403 * @len: Length of @name.
405 * Returns pointer to "struct tomoyo_policy_namespace" if found,
408 * Caller holds tomoyo_read_lock().
410 static struct tomoyo_policy_namespace *tomoyo_find_namespace
411 (const char *name, const unsigned int len)
413 struct tomoyo_policy_namespace *ns;
414 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
415 if (strncmp(name, ns->name, len) ||
416 (name[len] && name[len] != ' '))
424 * tomoyo_assign_namespace - Create a new namespace.
426 * @domainname: Name of namespace to create.
428 * Returns pointer to "struct tomoyo_policy_namespace" on success,
431 * Caller holds tomoyo_read_lock().
433 struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
435 struct tomoyo_policy_namespace *ptr;
436 struct tomoyo_policy_namespace *entry;
437 const char *cp = domainname;
438 unsigned int len = 0;
439 while (*cp && *cp++ != ' ')
441 ptr = tomoyo_find_namespace(domainname, len);
444 if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(domainname))
446 entry = kzalloc(sizeof(*entry) + len + 1, GFP_NOFS);
449 if (mutex_lock_interruptible(&tomoyo_policy_lock))
451 ptr = tomoyo_find_namespace(domainname, len);
452 if (!ptr && tomoyo_memory_ok(entry)) {
453 char *name = (char *) (entry + 1);
455 memmove(name, domainname, len);
458 tomoyo_init_policy_namespace(entry);
461 mutex_unlock(&tomoyo_policy_lock);
468 * tomoyo_namespace_jump - Check for namespace jump.
470 * @domainname: Name of domain.
472 * Returns true if namespace differs, false otherwise.
474 static bool tomoyo_namespace_jump(const char *domainname)
476 const char *namespace = tomoyo_current_namespace()->name;
477 const int len = strlen(namespace);
478 return strncmp(domainname, namespace, len) ||
479 (domainname[len] && domainname[len] != ' ');
483 * tomoyo_assign_domain - Create a domain or a namespace.
485 * @domainname: The name of domain.
486 * @transit: True if transit to domain found or created.
488 * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
490 * Caller holds tomoyo_read_lock().
492 struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
495 struct tomoyo_domain_info e = { };
496 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
497 bool created = false;
501 * Since namespace is created at runtime, profiles may
502 * not be created by the moment the process transits to
503 * that domain. Do not perform domain transition if
504 * profile for that domain is not yet created.
506 if (!entry->ns->profile_ptr[entry->profile])
511 /* Requested domain does not exist. */
512 /* Don't create requested domain if domainname is invalid. */
513 if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 ||
514 !tomoyo_correct_domain(domainname))
517 * Since definition of profiles and acl_groups may differ across
518 * namespaces, do not inherit "use_profile" and "use_group" settings
519 * by automatically creating requested domain upon domain transition.
521 if (transit && tomoyo_namespace_jump(domainname))
523 e.ns = tomoyo_assign_namespace(domainname);
527 * "use_profile" and "use_group" settings for automatically created
528 * domains are inherited from current domain. These are 0 for manually
532 const struct tomoyo_domain_info *domain = tomoyo_domain();
533 e.profile = domain->profile;
534 e.group = domain->group;
536 e.domainname = tomoyo_get_name(domainname);
539 if (mutex_lock_interruptible(&tomoyo_policy_lock))
541 entry = tomoyo_find_domain(domainname);
543 entry = tomoyo_commit_ok(&e, sizeof(e));
545 INIT_LIST_HEAD(&entry->acl_info_list);
546 list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
550 mutex_unlock(&tomoyo_policy_lock);
552 tomoyo_put_name(e.domainname);
553 if (entry && transit) {
555 struct tomoyo_request_info r;
556 tomoyo_init_request_info(&r, entry,
557 TOMOYO_MAC_FILE_EXECUTE);
559 tomoyo_write_log(&r, "use_profile %u\n",
561 tomoyo_write_log(&r, "use_group %u\n", entry->group);
568 * tomoyo_find_next_domain - Find a domain.
570 * @bprm: Pointer to "struct linux_binprm".
572 * Returns 0 on success, negative value otherwise.
574 * Caller holds tomoyo_read_lock().
576 int tomoyo_find_next_domain(struct linux_binprm *bprm)
578 struct tomoyo_request_info r;
579 char *tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
580 struct tomoyo_domain_info *old_domain = tomoyo_domain();
581 struct tomoyo_domain_info *domain = NULL;
582 const char *original_name = bprm->filename;
585 int retval = -ENOMEM;
586 bool need_kfree = false;
587 bool reject_on_transition_failure = false;
588 struct tomoyo_path_info rn = { }; /* real name */
590 mode = tomoyo_init_request_info(&r, NULL, TOMOYO_MAC_FILE_EXECUTE);
591 is_enforce = (mode == TOMOYO_CONFIG_ENFORCING);
600 /* Get symlink's pathname of program. */
602 rn.name = tomoyo_realpath_nofollow(original_name);
605 tomoyo_fill_path_info(&rn);
608 /* Check 'aggregator' directive. */
610 struct tomoyo_aggregator *ptr;
611 struct list_head *list =
612 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
613 /* Check 'aggregator' directive. */
614 list_for_each_entry_rcu(ptr, list, head.list) {
615 if (ptr->head.is_deleted ||
616 !tomoyo_path_matches_pattern(&rn,
621 /* This is OK because it is read only. */
622 rn = *ptr->aggregated_name;
627 /* Check execute permission. */
628 retval = tomoyo_path_permission(&r, TOMOYO_TYPE_EXECUTE, &rn);
629 if (retval == TOMOYO_RETRY_REQUEST)
634 * To be able to specify domainnames with wildcards, use the
635 * pathname specified in the policy (which may contain
636 * wildcard) rather than the pathname passed to execve()
637 * (which never contains wildcard).
639 if (r.param.path.matched_path) {
643 /* This is OK because it is read only. */
644 rn = *r.param.path.matched_path;
647 /* Calculate domain to transit to. */
648 switch (tomoyo_transition_type(old_domain->ns, old_domain->domainname,
650 case TOMOYO_TRANSITION_CONTROL_RESET:
651 /* Transit to the root of specified namespace. */
652 snprintf(tmp, TOMOYO_EXEC_TMPSIZE - 1, "<%s>", rn.name);
654 * Make do_execve() fail if domain transition across namespaces
657 reject_on_transition_failure = true;
659 case TOMOYO_TRANSITION_CONTROL_INITIALIZE:
660 /* Transit to the child of current namespace's root. */
661 snprintf(tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
662 old_domain->ns->name, rn.name);
664 case TOMOYO_TRANSITION_CONTROL_KEEP:
665 /* Keep current domain. */
669 if (old_domain == &tomoyo_kernel_domain &&
670 !tomoyo_policy_loaded) {
672 * Needn't to transit from kernel domain before
673 * starting /sbin/init. But transit from kernel domain
674 * if executing initializers because they might start
679 /* Normal domain transition. */
680 snprintf(tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
681 old_domain->domainname->name, rn.name);
686 domain = tomoyo_assign_domain(tmp, true);
689 else if (reject_on_transition_failure) {
690 printk(KERN_WARNING "ERROR: Domain '%s' not ready.\n", tmp);
692 } else if (r.mode == TOMOYO_CONFIG_ENFORCING)
696 if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) {
697 old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true;
699 tomoyo_write_log(&r, "%s", tomoyo_dif
700 [TOMOYO_DIF_TRANSITION_FAILED]);
702 "ERROR: Domain '%s' not defined.\n", tmp);
708 /* Update reference count on "struct tomoyo_domain_info". */
709 atomic_inc(&domain->users);
710 bprm->cred->security = domain;