2 * security/tomoyo/domain.c
4 * Copyright (C) 2005-2011 NTT DATA CORPORATION
8 #include <linux/binfmts.h>
9 #include <linux/slab.h>
11 /* Variables definitions.*/
13 /* The initial domain. */
14 struct tomoyo_domain_info tomoyo_kernel_domain;
17 * tomoyo_update_policy - Update an entry for exception policy.
19 * @new_entry: Pointer to "struct tomoyo_acl_info".
20 * @size: Size of @new_entry in bytes.
21 * @param: Pointer to "struct tomoyo_acl_param".
22 * @check_duplicate: Callback function to find duplicated entry.
24 * Returns 0 on success, negative value otherwise.
26 * Caller holds tomoyo_read_lock().
28 int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
29 struct tomoyo_acl_param *param,
30 bool (*check_duplicate) (const struct tomoyo_acl_head
32 const struct tomoyo_acl_head
35 int error = param->is_delete ? -ENOENT : -ENOMEM;
36 struct tomoyo_acl_head *entry;
37 struct list_head *list = param->list;
39 if (mutex_lock_interruptible(&tomoyo_policy_lock))
41 list_for_each_entry_rcu(entry, list, list) {
42 if (!check_duplicate(entry, new_entry))
44 entry->is_deleted = param->is_delete;
48 if (error && !param->is_delete) {
49 entry = tomoyo_commit_ok(new_entry, size);
51 list_add_tail_rcu(&entry->list, list);
55 mutex_unlock(&tomoyo_policy_lock);
60 * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
62 * @a: Pointer to "struct tomoyo_acl_info".
63 * @b: Pointer to "struct tomoyo_acl_info".
65 * Returns true if @a == @b, false otherwise.
67 static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
68 const struct tomoyo_acl_info *b)
70 return a->type == b->type && a->cond == b->cond;
74 * tomoyo_update_domain - Update an entry for domain policy.
76 * @new_entry: Pointer to "struct tomoyo_acl_info".
77 * @size: Size of @new_entry in bytes.
78 * @param: Pointer to "struct tomoyo_acl_param".
79 * @check_duplicate: Callback function to find duplicated entry.
80 * @merge_duplicate: Callback function to merge duplicated entry.
82 * Returns 0 on success, negative value otherwise.
84 * Caller holds tomoyo_read_lock().
86 int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
87 struct tomoyo_acl_param *param,
88 bool (*check_duplicate) (const struct tomoyo_acl_info
90 const struct tomoyo_acl_info
92 bool (*merge_duplicate) (struct tomoyo_acl_info *,
93 struct tomoyo_acl_info *,
96 const bool is_delete = param->is_delete;
97 int error = is_delete ? -ENOENT : -ENOMEM;
98 struct tomoyo_acl_info *entry;
99 struct list_head * const list = param->list;
101 if (param->data[0]) {
102 new_entry->cond = tomoyo_get_condition(param);
103 if (!new_entry->cond)
106 if (mutex_lock_interruptible(&tomoyo_policy_lock))
108 list_for_each_entry_rcu(entry, list, list) {
109 if (!tomoyo_same_acl_head(entry, new_entry) ||
110 !check_duplicate(entry, new_entry))
113 entry->is_deleted = merge_duplicate(entry, new_entry,
116 entry->is_deleted = is_delete;
120 if (error && !is_delete) {
121 entry = tomoyo_commit_ok(new_entry, size);
123 list_add_tail_rcu(&entry->list, list);
127 mutex_unlock(&tomoyo_policy_lock);
129 tomoyo_put_condition(new_entry->cond);
134 * tomoyo_check_acl - Do permission check.
136 * @r: Pointer to "struct tomoyo_request_info".
137 * @check_entry: Callback function to check type specific parameters.
139 * Returns 0 on success, negative value otherwise.
141 * Caller holds tomoyo_read_lock().
143 void tomoyo_check_acl(struct tomoyo_request_info *r,
144 bool (*check_entry) (struct tomoyo_request_info *,
145 const struct tomoyo_acl_info *))
147 const struct tomoyo_domain_info *domain = r->domain;
148 struct tomoyo_acl_info *ptr;
149 bool retried = false;
150 const struct list_head *list = &domain->acl_info_list;
153 list_for_each_entry_rcu(ptr, list, list) {
154 if (ptr->is_deleted || ptr->type != r->param_type)
156 if (!check_entry(r, ptr))
158 if (!tomoyo_condition(r, ptr->cond))
160 r->matched_acl = ptr;
166 list = &domain->ns->acl_group[domain->group];
172 /* The list for "struct tomoyo_domain_info". */
173 LIST_HEAD(tomoyo_domain_list);
176 * tomoyo_last_word - Get last component of a domainname.
178 * @name: Domainname to check.
180 * Returns the last word of @domainname.
182 static const char *tomoyo_last_word(const char *name)
184 const char *cp = strrchr(name, ' ');
191 * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry.
193 * @a: Pointer to "struct tomoyo_acl_head".
194 * @b: Pointer to "struct tomoyo_acl_head".
196 * Returns true if @a == @b, false otherwise.
198 static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
199 const struct tomoyo_acl_head *b)
201 const struct tomoyo_transition_control *p1 = container_of(a,
204 const struct tomoyo_transition_control *p2 = container_of(b,
207 return p1->type == p2->type && p1->is_last_name == p2->is_last_name
208 && p1->domainname == p2->domainname
209 && p1->program == p2->program;
213 * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list.
215 * @param: Pointer to "struct tomoyo_acl_param".
216 * @type: Type of this entry.
218 * Returns 0 on success, negative value otherwise.
220 int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
223 struct tomoyo_transition_control e = { .type = type };
224 int error = param->is_delete ? -ENOENT : -ENOMEM;
225 char *program = param->data;
226 char *domainname = strstr(program, " from ");
230 } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP ||
231 type == TOMOYO_TRANSITION_CONTROL_KEEP) {
232 domainname = program;
235 if (program && strcmp(program, "any")) {
236 if (!tomoyo_correct_path(program))
238 e.program = tomoyo_get_name(program);
242 if (domainname && strcmp(domainname, "any")) {
243 if (!tomoyo_correct_domain(domainname)) {
244 if (!tomoyo_correct_path(domainname))
246 e.is_last_name = true;
248 e.domainname = tomoyo_get_name(domainname);
252 param->list = ¶m->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
253 error = tomoyo_update_policy(&e.head, sizeof(e), param,
254 tomoyo_same_transition_control);
256 tomoyo_put_name(e.domainname);
257 tomoyo_put_name(e.program);
262 * tomoyo_scan_transition - Try to find specific domain transition type.
264 * @list: Pointer to "struct list_head".
265 * @domainname: The name of current domain.
266 * @program: The name of requested program.
267 * @last_name: The last component of @domainname.
268 * @type: One of values in "enum tomoyo_transition_type".
270 * Returns true if found one, false otherwise.
272 * Caller holds tomoyo_read_lock().
274 static inline bool tomoyo_scan_transition
275 (const struct list_head *list, const struct tomoyo_path_info *domainname,
276 const struct tomoyo_path_info *program, const char *last_name,
277 const enum tomoyo_transition_type type)
279 const struct tomoyo_transition_control *ptr;
280 list_for_each_entry_rcu(ptr, list, head.list) {
281 if (ptr->head.is_deleted || ptr->type != type)
283 if (ptr->domainname) {
284 if (!ptr->is_last_name) {
285 if (ptr->domainname != domainname)
289 * Use direct strcmp() since this is
292 if (strcmp(ptr->domainname->name, last_name))
296 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
304 * tomoyo_transition_type - Get domain transition type.
306 * @ns: Pointer to "struct tomoyo_policy_namespace".
307 * @domainname: The name of current domain.
308 * @program: The name of requested program.
310 * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes
311 * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if
312 * executing @program reinitializes domain transition within that namespace,
313 * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname ,
316 * Caller holds tomoyo_read_lock().
318 static enum tomoyo_transition_type tomoyo_transition_type
319 (const struct tomoyo_policy_namespace *ns,
320 const struct tomoyo_path_info *domainname,
321 const struct tomoyo_path_info *program)
323 const char *last_name = tomoyo_last_word(domainname->name);
324 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
325 while (type < TOMOYO_MAX_TRANSITION_TYPE) {
326 const struct list_head * const list =
327 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
328 if (!tomoyo_scan_transition(list, domainname, program,
333 if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET &&
334 type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE)
337 * Do not check for reset_domain if no_reset_domain matched.
338 * Do not check for initialize_domain if no_initialize_domain
348 * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry.
350 * @a: Pointer to "struct tomoyo_acl_head".
351 * @b: Pointer to "struct tomoyo_acl_head".
353 * Returns true if @a == @b, false otherwise.
355 static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
356 const struct tomoyo_acl_head *b)
358 const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1),
360 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
362 return p1->original_name == p2->original_name &&
363 p1->aggregated_name == p2->aggregated_name;
367 * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list.
369 * @param: Pointer to "struct tomoyo_acl_param".
371 * Returns 0 on success, negative value otherwise.
373 * Caller holds tomoyo_read_lock().
375 int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
377 struct tomoyo_aggregator e = { };
378 int error = param->is_delete ? -ENOENT : -ENOMEM;
379 const char *original_name = tomoyo_read_token(param);
380 const char *aggregated_name = tomoyo_read_token(param);
381 if (!tomoyo_correct_word(original_name) ||
382 !tomoyo_correct_path(aggregated_name))
384 e.original_name = tomoyo_get_name(original_name);
385 e.aggregated_name = tomoyo_get_name(aggregated_name);
386 if (!e.original_name || !e.aggregated_name ||
387 e.aggregated_name->is_patterned) /* No patterns allowed. */
389 param->list = ¶m->ns->policy_list[TOMOYO_ID_AGGREGATOR];
390 error = tomoyo_update_policy(&e.head, sizeof(e), param,
391 tomoyo_same_aggregator);
393 tomoyo_put_name(e.original_name);
394 tomoyo_put_name(e.aggregated_name);
399 * tomoyo_find_namespace - Find specified namespace.
401 * @name: Name of namespace to find.
402 * @len: Length of @name.
404 * Returns pointer to "struct tomoyo_policy_namespace" if found,
407 * Caller holds tomoyo_read_lock().
409 static struct tomoyo_policy_namespace *tomoyo_find_namespace
410 (const char *name, const unsigned int len)
412 struct tomoyo_policy_namespace *ns;
413 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
414 if (strncmp(name, ns->name, len) ||
415 (name[len] && name[len] != ' '))
423 * tomoyo_assign_namespace - Create a new namespace.
425 * @domainname: Name of namespace to create.
427 * Returns pointer to "struct tomoyo_policy_namespace" on success,
430 * Caller holds tomoyo_read_lock().
432 struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
434 struct tomoyo_policy_namespace *ptr;
435 struct tomoyo_policy_namespace *entry;
436 const char *cp = domainname;
437 unsigned int len = 0;
438 while (*cp && *cp++ != ' ')
440 ptr = tomoyo_find_namespace(domainname, len);
443 if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(domainname))
445 entry = kzalloc(sizeof(*entry) + len + 1, GFP_NOFS);
448 if (mutex_lock_interruptible(&tomoyo_policy_lock))
450 ptr = tomoyo_find_namespace(domainname, len);
451 if (!ptr && tomoyo_memory_ok(entry)) {
452 char *name = (char *) (entry + 1);
454 memmove(name, domainname, len);
457 tomoyo_init_policy_namespace(entry);
460 mutex_unlock(&tomoyo_policy_lock);
467 * tomoyo_namespace_jump - Check for namespace jump.
469 * @domainname: Name of domain.
471 * Returns true if namespace differs, false otherwise.
473 static bool tomoyo_namespace_jump(const char *domainname)
475 const char *namespace = tomoyo_current_namespace()->name;
476 const int len = strlen(namespace);
477 return strncmp(domainname, namespace, len) ||
478 (domainname[len] && domainname[len] != ' ');
482 * tomoyo_assign_domain - Create a domain or a namespace.
484 * @domainname: The name of domain.
485 * @transit: True if transit to domain found or created.
487 * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
489 * Caller holds tomoyo_read_lock().
491 struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
494 struct tomoyo_domain_info e = { };
495 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
496 bool created = false;
500 * Since namespace is created at runtime, profiles may
501 * not be created by the moment the process transits to
502 * that domain. Do not perform domain transition if
503 * profile for that domain is not yet created.
505 if (!entry->ns->profile_ptr[entry->profile])
510 /* Requested domain does not exist. */
511 /* Don't create requested domain if domainname is invalid. */
512 if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 ||
513 !tomoyo_correct_domain(domainname))
516 * Since definition of profiles and acl_groups may differ across
517 * namespaces, do not inherit "use_profile" and "use_group" settings
518 * by automatically creating requested domain upon domain transition.
520 if (transit && tomoyo_namespace_jump(domainname))
522 e.ns = tomoyo_assign_namespace(domainname);
526 * "use_profile" and "use_group" settings for automatically created
527 * domains are inherited from current domain. These are 0 for manually
531 const struct tomoyo_domain_info *domain = tomoyo_domain();
532 e.profile = domain->profile;
533 e.group = domain->group;
535 e.domainname = tomoyo_get_name(domainname);
538 if (mutex_lock_interruptible(&tomoyo_policy_lock))
540 entry = tomoyo_find_domain(domainname);
542 entry = tomoyo_commit_ok(&e, sizeof(e));
544 INIT_LIST_HEAD(&entry->acl_info_list);
545 list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
549 mutex_unlock(&tomoyo_policy_lock);
551 tomoyo_put_name(e.domainname);
552 if (entry && transit) {
554 struct tomoyo_request_info r;
555 tomoyo_init_request_info(&r, entry,
556 TOMOYO_MAC_FILE_EXECUTE);
558 tomoyo_write_log(&r, "use_profile %u\n",
560 tomoyo_write_log(&r, "use_group %u\n", entry->group);
567 * tomoyo_environ - Check permission for environment variable names.
569 * @ee: Pointer to "struct tomoyo_execve".
571 * Returns 0 on success, negative value otherwise.
573 static int tomoyo_environ(struct tomoyo_execve *ee)
575 struct tomoyo_request_info *r = &ee->r;
576 struct linux_binprm *bprm = ee->bprm;
577 /* env_page.data is allocated by tomoyo_dump_page(). */
578 struct tomoyo_page_dump env_page = { };
579 char *arg_ptr; /* Size is TOMOYO_EXEC_TMPSIZE bytes */
581 unsigned long pos = bprm->p;
582 int offset = pos % PAGE_SIZE;
583 int argv_count = bprm->argc;
584 int envp_count = bprm->envc;
587 ee->r.type = TOMOYO_MAC_ENVIRON;
588 ee->r.profile = r->domain->profile;
589 ee->r.mode = tomoyo_get_mode(r->domain->ns, ee->r.profile,
591 if (!r->mode || !envp_count)
593 arg_ptr = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
596 while (error == -ENOMEM) {
597 if (!tomoyo_dump_page(bprm, pos, &env_page))
599 pos += PAGE_SIZE - offset;
601 while (argv_count && offset < PAGE_SIZE) {
602 if (!env_page.data[offset++])
609 while (offset < PAGE_SIZE) {
610 const unsigned char c = env_page.data[offset++];
612 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
614 arg_ptr[arg_len++] = '\0';
615 } else if (c == '\\') {
616 arg_ptr[arg_len++] = '\\';
617 arg_ptr[arg_len++] = '\\';
618 } else if (c > ' ' && c < 127) {
619 arg_ptr[arg_len++] = c;
621 arg_ptr[arg_len++] = '\\';
622 arg_ptr[arg_len++] = (c >> 6) + '0';
624 = ((c >> 3) & 7) + '0';
625 arg_ptr[arg_len++] = (c & 7) + '0';
628 arg_ptr[arg_len] = '\0';
632 if (tomoyo_env_perm(r, arg_ptr)) {
645 if (r->mode != TOMOYO_CONFIG_ENFORCING)
647 kfree(env_page.data);
653 * tomoyo_find_next_domain - Find a domain.
655 * @bprm: Pointer to "struct linux_binprm".
657 * Returns 0 on success, negative value otherwise.
659 * Caller holds tomoyo_read_lock().
661 int tomoyo_find_next_domain(struct linux_binprm *bprm)
663 struct tomoyo_domain_info *old_domain = tomoyo_domain();
664 struct tomoyo_domain_info *domain = NULL;
665 const char *original_name = bprm->filename;
666 int retval = -ENOMEM;
667 bool need_kfree = false;
668 bool reject_on_transition_failure = false;
669 struct tomoyo_path_info rn = { }; /* real name */
670 struct tomoyo_execve *ee = kzalloc(sizeof(*ee), GFP_NOFS);
674 ee->tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
679 /* ee->dump->data is allocated by tomoyo_dump_page(). */
680 tomoyo_init_request_info(&ee->r, NULL, TOMOYO_MAC_FILE_EXECUTE);
683 ee->r.obj = &ee->obj;
684 ee->obj.path1 = bprm->file->f_path;
690 /* Get symlink's pathname of program. */
692 rn.name = tomoyo_realpath_nofollow(original_name);
695 tomoyo_fill_path_info(&rn);
698 /* Check 'aggregator' directive. */
700 struct tomoyo_aggregator *ptr;
701 struct list_head *list =
702 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
703 /* Check 'aggregator' directive. */
704 list_for_each_entry_rcu(ptr, list, head.list) {
705 if (ptr->head.is_deleted ||
706 !tomoyo_path_matches_pattern(&rn,
711 /* This is OK because it is read only. */
712 rn = *ptr->aggregated_name;
717 /* Check execute permission. */
718 retval = tomoyo_path_permission(&ee->r, TOMOYO_TYPE_EXECUTE, &rn);
719 if (retval == TOMOYO_RETRY_REQUEST)
724 * To be able to specify domainnames with wildcards, use the
725 * pathname specified in the policy (which may contain
726 * wildcard) rather than the pathname passed to execve()
727 * (which never contains wildcard).
729 if (ee->r.param.path.matched_path) {
733 /* This is OK because it is read only. */
734 rn = *ee->r.param.path.matched_path;
737 /* Calculate domain to transit to. */
738 switch (tomoyo_transition_type(old_domain->ns, old_domain->domainname,
740 case TOMOYO_TRANSITION_CONTROL_RESET:
741 /* Transit to the root of specified namespace. */
742 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "<%s>", rn.name);
744 * Make do_execve() fail if domain transition across namespaces
747 reject_on_transition_failure = true;
749 case TOMOYO_TRANSITION_CONTROL_INITIALIZE:
750 /* Transit to the child of current namespace's root. */
751 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
752 old_domain->ns->name, rn.name);
754 case TOMOYO_TRANSITION_CONTROL_KEEP:
755 /* Keep current domain. */
759 if (old_domain == &tomoyo_kernel_domain &&
760 !tomoyo_policy_loaded) {
762 * Needn't to transit from kernel domain before
763 * starting /sbin/init. But transit from kernel domain
764 * if executing initializers because they might start
769 /* Normal domain transition. */
770 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
771 old_domain->domainname->name, rn.name);
776 domain = tomoyo_assign_domain(ee->tmp, true);
779 else if (reject_on_transition_failure) {
780 printk(KERN_WARNING "ERROR: Domain '%s' not ready.\n",
783 } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING)
787 if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) {
788 old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true;
789 ee->r.granted = false;
790 tomoyo_write_log(&ee->r, "%s", tomoyo_dif
791 [TOMOYO_DIF_TRANSITION_FAILED]);
793 "ERROR: Domain '%s' not defined.\n", ee->tmp);
799 /* Update reference count on "struct tomoyo_domain_info". */
800 atomic_inc(&domain->users);
801 bprm->cred->security = domain;
805 ee->r.domain = domain;
806 retval = tomoyo_environ(ee);
809 kfree(ee->dump.data);
815 * tomoyo_dump_page - Dump a page to buffer.
817 * @bprm: Pointer to "struct linux_binprm".
818 * @pos: Location to dump.
819 * @dump: Poiner to "struct tomoyo_page_dump".
821 * Returns true on success, false otherwise.
823 bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
824 struct tomoyo_page_dump *dump)
828 /* dump->data is released by tomoyo_find_next_domain(). */
830 dump->data = kzalloc(PAGE_SIZE, GFP_NOFS);
834 /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */
836 if (get_user_pages(current, bprm->mm, pos, 1, 0, 1, &page, NULL) <= 0)
839 page = bprm->page[pos / PAGE_SIZE];
841 if (page != dump->page) {
842 const unsigned int offset = pos % PAGE_SIZE;
844 * Maybe kmap()/kunmap() should be used here.
845 * But remove_arg_zero() uses kmap_atomic()/kunmap_atomic().
848 char *kaddr = kmap_atomic(page, KM_USER0);
851 memcpy(dump->data + offset, kaddr + offset,
853 kunmap_atomic(kaddr, KM_USER0);
855 /* Same with put_arg_page(page) in fs/exec.c */