security/tomoyo/tomoyo.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * security/tomoyo/tomoyo.c
   4  *
   5  * Copyright (C) 2005-2011  NTT DATA CORPORATION
   6  */
   7
   8 #include <linux/lsm_hooks.h>
   9 #include "common.h"
  10
  11 /**
  12  * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread.
  13  *
  14  * Returns pointer to "struct tomoyo_domain_info" for current thread.
  15  */
  16 struct tomoyo_domain_info *tomoyo_domain(void)
  17 {
  18         struct tomoyo_task *s = tomoyo_task(current);
  19
  20         if (s->old_domain_info && !current->in_execve) {
  21                 atomic_dec(&s->old_domain_info->users);
  22                 s->old_domain_info = NULL;
  23         }
  24         return s->domain_info;
  25 }
  26
  27 /**
  28  * tomoyo_cred_prepare - Target for security_prepare_creds().
  29  *
  30  * @new: Pointer to "struct cred".
  31  * @old: Pointer to "struct cred".
  32  * @gfp: Memory allocation flags.
  33  *
  34  * Returns 0.
  35  */
  36 static int tomoyo_cred_prepare(struct cred *new, const struct cred *old,
  37                                gfp_t gfp)
  38 {
  39         /* Restore old_domain_info saved by previous execve() request. */
  40         struct tomoyo_task *s = tomoyo_task(current);
  41
  42         if (s->old_domain_info && !current->in_execve) {
  43                 atomic_dec(&s->domain_info->users);
  44                 s->domain_info = s->old_domain_info;
  45                 s->old_domain_info = NULL;
  46         }
  47         return 0;
  48 }
  49
  50 /**
  51  * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds().
  52  *
  53  * @bprm: Pointer to "struct linux_binprm".
  54  */
  55 static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm)
  56 {
  57         /* Clear old_domain_info saved by execve() request. */
  58         struct tomoyo_task *s = tomoyo_task(current);
  59
  60         atomic_dec(&s->old_domain_info->users);
  61         s->old_domain_info = NULL;
  62 }
  63
  64 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
  65 /**
  66  * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec().
  67  *
  68  * @bprm: Pointer to "struct linux_binprm".
  69  *
  70  * Returns 0.
  71  */
  72 static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm)
  73 {
  74         /*
  75          * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested
  76          * for the first time.
  77          */
  78         if (!tomoyo_policy_loaded)
  79                 tomoyo_load_policy(bprm->filename);
  80         return 0;
  81 }
  82 #endif
  83
  84 /**
  85  * tomoyo_bprm_check_security - Target for security_bprm_check().
  86  *
  87  * @bprm: Pointer to "struct linux_binprm".
  88  *
  89  * Returns 0 on success, negative value otherwise.
  90  */
  91 static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
  92 {
  93         struct tomoyo_task *s = tomoyo_task(current);
  94
  95         /*
  96          * Execute permission is checked against pathname passed to execve()
  97          * using current domain.
  98          */
  99         if (!s->old_domain_info) {
 100                 const int idx = tomoyo_read_lock();
 101                 const int err = tomoyo_find_next_domain(bprm);
 102
 103                 tomoyo_read_unlock(idx);
 104                 return err;
 105         }
 106         /*
 107          * Read permission is checked against interpreters using next domain.
 108          */
 109         return tomoyo_check_open_permission(s->domain_info,
 110                                             &bprm->file->f_path, O_RDONLY);
 111 }
 112
 113 /**
 114  * tomoyo_inode_getattr - Target for security_inode_getattr().
 115  *
 116  * @path: Pointer to "struct path".
 117  *
 118  * Returns 0 on success, negative value otherwise.
 119  */
 120 static int tomoyo_inode_getattr(const struct path *path)
 121 {
 122         return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
 123 }
 124
 125 /**
 126  * tomoyo_path_truncate - Target for security_path_truncate().
 127  *
 128  * @path: Pointer to "struct path".
 129  *
 130  * Returns 0 on success, negative value otherwise.
 131  */
 132 static int tomoyo_path_truncate(const struct path *path)
 133 {
 134         return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL);
 135 }
 136
 137 /**
 138  * tomoyo_file_truncate - Target for security_file_truncate().
 139  *
 140  * @file: Pointer to "struct file".
 141  *
 142  * Returns 0 on success, negative value otherwise.
 143  */
 144 static int tomoyo_file_truncate(struct file *file)
 145 {
 146         return tomoyo_path_truncate(&file->f_path);
 147 }
 148
 149 /**
 150  * tomoyo_path_unlink - Target for security_path_unlink().
 151  *
 152  * @parent: Pointer to "struct path".
 153  * @dentry: Pointer to "struct dentry".
 154  *
 155  * Returns 0 on success, negative value otherwise.
 156  */
 157 static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
 158 {
 159         struct path path = { .mnt = parent->mnt, .dentry = dentry };
 160
 161         return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
 162 }
 163
 164 /**
 165  * tomoyo_path_mkdir - Target for security_path_mkdir().
 166  *
 167  * @parent: Pointer to "struct path".
 168  * @dentry: Pointer to "struct dentry".
 169  * @mode:   DAC permission mode.
 170  *
 171  * Returns 0 on success, negative value otherwise.
 172  */
 173 static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
 174                              umode_t mode)
 175 {
 176         struct path path = { .mnt = parent->mnt, .dentry = dentry };
 177
 178         return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
 179                                        mode & S_IALLUGO);
 180 }
 181
 182 /**
 183  * tomoyo_path_rmdir - Target for security_path_rmdir().
 184  *
 185  * @parent: Pointer to "struct path".
 186  * @dentry: Pointer to "struct dentry".
 187  *
 188  * Returns 0 on success, negative value otherwise.
 189  */
 190 static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
 191 {
 192         struct path path = { .mnt = parent->mnt, .dentry = dentry };
 193
 194         return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
 195 }
 196
 197 /**
 198  * tomoyo_path_symlink - Target for security_path_symlink().
 199  *
 200  * @parent:   Pointer to "struct path".
 201  * @dentry:   Pointer to "struct dentry".
 202  * @old_name: Symlink's content.
 203  *
 204  * Returns 0 on success, negative value otherwise.
 205  */
 206 static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
 207                                const char *old_name)
 208 {
 209         struct path path = { .mnt = parent->mnt, .dentry = dentry };
 210
 211         return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
 212 }
 213
 214 /**
 215  * tomoyo_path_mknod - Target for security_path_mknod().
 216  *
 217  * @parent: Pointer to "struct path".
 218  * @dentry: Pointer to "struct dentry".
 219  * @mode:   DAC permission mode.
 220  * @dev:    Device attributes.
 221  *
 222  * Returns 0 on success, negative value otherwise.
 223  */
 224 static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry,
 225                              umode_t mode, unsigned int dev)
 226 {
 227         struct path path = { .mnt = parent->mnt, .dentry = dentry };
 228         int type = TOMOYO_TYPE_CREATE;
 229         const unsigned int perm = mode & S_IALLUGO;
 230
 231         switch (mode & S_IFMT) {
 232         case S_IFCHR:
 233                 type = TOMOYO_TYPE_MKCHAR;
 234                 break;
 235         case S_IFBLK:
 236                 type = TOMOYO_TYPE_MKBLOCK;
 237                 break;
 238         default:
 239                 goto no_dev;
 240         }
 241         return tomoyo_mkdev_perm(type, &path, perm, dev);
 242  no_dev:
 243         switch (mode & S_IFMT) {
 244         case S_IFIFO:
 245                 type = TOMOYO_TYPE_MKFIFO;
 246                 break;
 247         case S_IFSOCK:
 248                 type = TOMOYO_TYPE_MKSOCK;
 249                 break;
 250         }
 251         return tomoyo_path_number_perm(type, &path, perm);
 252 }
 253
 254 /**
 255  * tomoyo_path_link - Target for security_path_link().
 256  *
 257  * @old_dentry: Pointer to "struct dentry".
 258  * @new_dir:    Pointer to "struct path".
 259  * @new_dentry: Pointer to "struct dentry".
 260  *
 261  * Returns 0 on success, negative value otherwise.
 262  */
 263 static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir,
 264                             struct dentry *new_dentry)
 265 {
 266         struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
 267         struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
 268
 269         return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
 270 }
 271
 272 /**
 273  * tomoyo_path_rename - Target for security_path_rename().
 274  *
 275  * @old_parent: Pointer to "struct path".
 276  * @old_dentry: Pointer to "struct dentry".
 277  * @new_parent: Pointer to "struct path".
 278  * @new_dentry: Pointer to "struct dentry".
 279  * @flags: Rename options.
 280  *
 281  * Returns 0 on success, negative value otherwise.
 282  */
 283 static int tomoyo_path_rename(const struct path *old_parent,
 284                               struct dentry *old_dentry,
 285                               const struct path *new_parent,
 286                               struct dentry *new_dentry,
 287                               const unsigned int flags)
 288 {
 289         struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
 290         struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
 291
 292         if (flags & RENAME_EXCHANGE) {
 293                 const int err = tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path2,
 294                                 &path1);
 295
 296                 if (err)
 297                         return err;
 298         }
 299         return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
 300 }
 301
 302 /**
 303  * tomoyo_file_fcntl - Target for security_file_fcntl().
 304  *
 305  * @file: Pointer to "struct file".
 306  * @cmd:  Command for fcntl().
 307  * @arg:  Argument for @cmd.
 308  *
 309  * Returns 0 on success, negative value otherwise.
 310  */
 311 static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
 312                              unsigned long arg)
 313 {
 314         if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND)))
 315                 return 0;
 316         return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path,
 317                                             O_WRONLY | (arg & O_APPEND));
 318 }
 319
 320 /**
 321  * tomoyo_file_open - Target for security_file_open().
 322  *
 323  * @f: Pointer to "struct file".
 324  *
 325  * Returns 0 on success, negative value otherwise.
 326  */
 327 static int tomoyo_file_open(struct file *f)
 328 {
 329         /* Don't check read permission here if called from execve(). */
 330         if (current->in_execve)
 331                 return 0;
 332         return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path,
 333                                             f->f_flags);
 334 }
 335
 336 /**
 337  * tomoyo_file_ioctl - Target for security_file_ioctl().
 338  *
 339  * @file: Pointer to "struct file".
 340  * @cmd:  Command for ioctl().
 341  * @arg:  Argument for @cmd.
 342  *
 343  * Returns 0 on success, negative value otherwise.
 344  */
 345 static int tomoyo_file_ioctl(struct file *file, unsigned int cmd,
 346                              unsigned long arg)
 347 {
 348         return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd);
 349 }
 350
 351 /**
 352  * tomoyo_path_chmod - Target for security_path_chmod().
 353  *
 354  * @path: Pointer to "struct path".
 355  * @mode: DAC permission mode.
 356  *
 357  * Returns 0 on success, negative value otherwise.
 358  */
 359 static int tomoyo_path_chmod(const struct path *path, umode_t mode)
 360 {
 361         return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path,
 362                                        mode & S_IALLUGO);
 363 }
 364
 365 /**
 366  * tomoyo_path_chown - Target for security_path_chown().
 367  *
 368  * @path: Pointer to "struct path".
 369  * @uid:  Owner ID.
 370  * @gid:  Group ID.
 371  *
 372  * Returns 0 on success, negative value otherwise.
 373  */
 374 static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
 375 {
 376         int error = 0;
 377
 378         if (uid_valid(uid))
 379                 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
 380                                                 from_kuid(&init_user_ns, uid));
 381         if (!error && gid_valid(gid))
 382                 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path,
 383                                                 from_kgid(&init_user_ns, gid));
 384         return error;
 385 }
 386
 387 /**
 388  * tomoyo_path_chroot - Target for security_path_chroot().
 389  *
 390  * @path: Pointer to "struct path".
 391  *
 392  * Returns 0 on success, negative value otherwise.
 393  */
 394 static int tomoyo_path_chroot(const struct path *path)
 395 {
 396         return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL);
 397 }
 398
 399 /**
 400  * tomoyo_sb_mount - Target for security_sb_mount().
 401  *
 402  * @dev_name: Name of device file. Maybe NULL.
 403  * @path:     Pointer to "struct path".
 404  * @type:     Name of filesystem type. Maybe NULL.
 405  * @flags:    Mount options.
 406  * @data:     Optional data. Maybe NULL.
 407  *
 408  * Returns 0 on success, negative value otherwise.
 409  */
 410 static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
 411                            const char *type, unsigned long flags, void *data)
 412 {
 413         return tomoyo_mount_permission(dev_name, path, type, flags, data);
 414 }
 415
 416 /**
 417  * tomoyo_sb_umount - Target for security_sb_umount().
 418  *
 419  * @mnt:   Pointer to "struct vfsmount".
 420  * @flags: Unmount options.
 421  *
 422  * Returns 0 on success, negative value otherwise.
 423  */
 424 static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
 425 {
 426         struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
 427
 428         return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
 429 }
 430
 431 /**
 432  * tomoyo_sb_pivotroot - Target for security_sb_pivotroot().
 433  *
 434  * @old_path: Pointer to "struct path".
 435  * @new_path: Pointer to "struct path".
 436  *
 437  * Returns 0 on success, negative value otherwise.
 438  */
 439 static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path)
 440 {
 441         return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
 442 }
 443
 444 /**
 445  * tomoyo_socket_listen - Check permission for listen().
 446  *
 447  * @sock:    Pointer to "struct socket".
 448  * @backlog: Backlog parameter.
 449  *
 450  * Returns 0 on success, negative value otherwise.
 451  */
 452 static int tomoyo_socket_listen(struct socket *sock, int backlog)
 453 {
 454         return tomoyo_socket_listen_permission(sock);
 455 }
 456
 457 /**
 458  * tomoyo_socket_connect - Check permission for connect().
 459  *
 460  * @sock:     Pointer to "struct socket".
 461  * @addr:     Pointer to "struct sockaddr".
 462  * @addr_len: Size of @addr.
 463  *
 464  * Returns 0 on success, negative value otherwise.
 465  */
 466 static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
 467                                  int addr_len)
 468 {
 469         return tomoyo_socket_connect_permission(sock, addr, addr_len);
 470 }
 471
 472 /**
 473  * tomoyo_socket_bind - Check permission for bind().
 474  *
 475  * @sock:     Pointer to "struct socket".
 476  * @addr:     Pointer to "struct sockaddr".
 477  * @addr_len: Size of @addr.
 478  *
 479  * Returns 0 on success, negative value otherwise.
 480  */
 481 static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
 482                               int addr_len)
 483 {
 484         return tomoyo_socket_bind_permission(sock, addr, addr_len);
 485 }
 486
 487 /**
 488  * tomoyo_socket_sendmsg - Check permission for sendmsg().
 489  *
 490  * @sock: Pointer to "struct socket".
 491  * @msg:  Pointer to "struct msghdr".
 492  * @size: Size of message.
 493  *
 494  * Returns 0 on success, negative value otherwise.
 495  */
 496 static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
 497                                  int size)
 498 {
 499         return tomoyo_socket_sendmsg_permission(sock, msg, size);
 500 }
 501
 502 struct lsm_blob_sizes tomoyo_blob_sizes __ro_after_init = {
 503         .lbs_task = sizeof(struct tomoyo_task),
 504 };
 505
 506 /**
 507  * tomoyo_task_alloc - Target for security_task_alloc().
 508  *
 509  * @task:        Pointer to "struct task_struct".
 510  * @clone_flags: clone() flags.
 511  *
 512  * Returns 0.
 513  */
 514 static int tomoyo_task_alloc(struct task_struct *task,
 515                              unsigned long clone_flags)
 516 {
 517         struct tomoyo_task *old = tomoyo_task(current);
 518         struct tomoyo_task *new = tomoyo_task(task);
 519
 520         new->domain_info = old->domain_info;
 521         atomic_inc(&new->domain_info->users);
 522         new->old_domain_info = NULL;
 523         return 0;
 524 }
 525
 526 /**
 527  * tomoyo_task_free - Target for security_task_free().
 528  *
 529  * @task: Pointer to "struct task_struct".
 530  */
 531 static void tomoyo_task_free(struct task_struct *task)
 532 {
 533         struct tomoyo_task *s = tomoyo_task(task);
 534
 535         if (s->domain_info) {
 536                 atomic_dec(&s->domain_info->users);
 537                 s->domain_info = NULL;
 538         }
 539         if (s->old_domain_info) {
 540                 atomic_dec(&s->old_domain_info->users);
 541                 s->old_domain_info = NULL;
 542         }
 543 }
 544
 545 /*
 546  * tomoyo_security_ops is a "struct security_operations" which is used for
 547  * registering TOMOYO.
 548  */
 549 static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
 550         LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
 551         LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),
 552         LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc),
 553         LSM_HOOK_INIT(task_free, tomoyo_task_free),
 554 #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
 555         LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec),
 556 #endif
 557         LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security),
 558         LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl),
 559         LSM_HOOK_INIT(file_open, tomoyo_file_open),
 560         LSM_HOOK_INIT(file_truncate, tomoyo_file_truncate),
 561         LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate),
 562         LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink),
 563         LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir),
 564         LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir),
 565         LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink),
 566         LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod),
 567         LSM_HOOK_INIT(path_link, tomoyo_path_link),
 568         LSM_HOOK_INIT(path_rename, tomoyo_path_rename),
 569         LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr),
 570         LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl),
 571         LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod),
 572         LSM_HOOK_INIT(path_chown, tomoyo_path_chown),
 573         LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot),
 574         LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount),
 575         LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount),
 576         LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot),
 577         LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind),
 578         LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect),
 579         LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen),
 580         LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg),
 581 };
 582
 583 /* Lock for GC. */
 584 DEFINE_SRCU(tomoyo_ss);
 585
 586 int tomoyo_enabled __ro_after_init = 1;
 587
 588 /**
 589  * tomoyo_init - Register TOMOYO Linux as a LSM module.
 590  *
 591  * Returns 0.
 592  */
 593 static int __init tomoyo_init(void)
 594 {
 595         struct tomoyo_task *s = tomoyo_task(current);
 596
 597         /* register ourselves with the security framework */
 598         security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
 599         pr_info("TOMOYO Linux initialized\n");
 600         s->domain_info = &tomoyo_kernel_domain;
 601         atomic_inc(&tomoyo_kernel_domain.users);
 602         s->old_domain_info = NULL;
 603         tomoyo_mm_init();
 604
 605         return 0;
 606 }
 607
 608 DEFINE_LSM(tomoyo) = {
 609         .name = "tomoyo",
 610         .enabled = &tomoyo_enabled,
 611         .flags = LSM_FLAG_LEGACY_MAJOR,
 612         .blobs = &tomoyo_blob_sizes,
 613         .init = tomoyo_init,
 614 };