security/tomoyo/domain.c

   1 /*
   2  * security/tomoyo/domain.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   7  *
   8  * Version: 2.2.0   2009/04/01
   9  *
  10  */
  11
  12 #include "common.h"
  13 #include "tomoyo.h"
  14 #include "realpath.h"
  15 #include <linux/binfmts.h>
  16
  17 /* Variables definitions.*/
  18
  19 /* The initial domain. */
  20 struct tomoyo_domain_info tomoyo_kernel_domain;
  21
  22 /*
  23  * tomoyo_domain_list is used for holding list of domains.
  24  * The ->acl_info_list of "struct tomoyo_domain_info" is used for holding
  25  * permissions (e.g. "allow_read /lib/libc-2.5.so") given to each domain.
  26  *
  27  * An entry is added by
  28  *
  29  * # ( echo "<kernel>"; echo "allow_execute /sbin/init" ) > \
  30  *                                  /sys/kernel/security/tomoyo/domain_policy
  31  *
  32  * and is deleted by
  33  *
  34  * # ( echo "<kernel>"; echo "delete allow_execute /sbin/init" ) > \
  35  *                                  /sys/kernel/security/tomoyo/domain_policy
  36  *
  37  * and all entries are retrieved by
  38  *
  39  * # cat /sys/kernel/security/tomoyo/domain_policy
  40  *
  41  * A domain is added by
  42  *
  43  * # echo "<kernel>" > /sys/kernel/security/tomoyo/domain_policy
  44  *
  45  * and is deleted by
  46  *
  47  * # echo "delete <kernel>" > /sys/kernel/security/tomoyo/domain_policy
  48  *
  49  * and all domains are retrieved by
  50  *
  51  * # grep '^<kernel>' /sys/kernel/security/tomoyo/domain_policy
  52  *
  53  * Normally, a domainname is monotonically getting longer because a domainname
  54  * which the process will belong to if an execve() operation succeeds is
  55  * defined as a concatenation of "current domainname" + "pathname passed to
  56  * execve()".
  57  * See tomoyo_domain_initializer_list and tomoyo_domain_keeper_list for
  58  * exceptions.
  59  */
  60 LIST_HEAD(tomoyo_domain_list);
  61 DECLARE_RWSEM(tomoyo_domain_list_lock);
  62
  63 /*
  64  * tomoyo_domain_initializer_entry is a structure which is used for holding
  65  * "initialize_domain" and "no_initialize_domain" entries.
  66  * It has following fields.
  67  *
  68  *  (1) "list" which is linked to tomoyo_domain_initializer_list .
  69  *  (2) "domainname" which is "a domainname" or "the last component of a
  70  *      domainname". This field is NULL if "from" clause is not specified.
  71  *  (3) "program" which is a program's pathname.
  72  *  (4) "is_deleted" is a bool which is true if marked as deleted, false
  73  *      otherwise.
  74  *  (5) "is_not" is a bool which is true if "no_initialize_domain", false
  75  *      otherwise.
  76  *  (6) "is_last_name" is a bool which is true if "domainname" is "the last
  77  *      component of a domainname", false otherwise.
  78  */
  79 struct tomoyo_domain_initializer_entry {
  80         struct list_head list;
  81         const struct tomoyo_path_info *domainname;    /* This may be NULL */
  82         const struct tomoyo_path_info *program;
  83         bool is_deleted;
  84         bool is_not;       /* True if this entry is "no_initialize_domain".  */
  85         /* True if the domainname is tomoyo_get_last_name(). */
  86         bool is_last_name;
  87 };
  88
  89 /*
  90  * tomoyo_domain_keeper_entry is a structure which is used for holding
  91  * "keep_domain" and "no_keep_domain" entries.
  92  * It has following fields.
  93  *
  94  *  (1) "list" which is linked to tomoyo_domain_keeper_list .
  95  *  (2) "domainname" which is "a domainname" or "the last component of a
  96  *      domainname".
  97  *  (3) "program" which is a program's pathname.
  98  *      This field is NULL if "from" clause is not specified.
  99  *  (4) "is_deleted" is a bool which is true if marked as deleted, false
 100  *      otherwise.
 101  *  (5) "is_not" is a bool which is true if "no_initialize_domain", false
 102  *      otherwise.
 103  *  (6) "is_last_name" is a bool which is true if "domainname" is "the last
 104  *      component of a domainname", false otherwise.
 105  */
 106 struct tomoyo_domain_keeper_entry {
 107         struct list_head list;
 108         const struct tomoyo_path_info *domainname;
 109         const struct tomoyo_path_info *program;       /* This may be NULL */
 110         bool is_deleted;
 111         bool is_not;       /* True if this entry is "no_keep_domain".        */
 112         /* True if the domainname is tomoyo_get_last_name(). */
 113         bool is_last_name;
 114 };
 115
 116 /*
 117  * tomoyo_alias_entry is a structure which is used for holding "alias" entries.
 118  * It has following fields.
 119  *
 120  *  (1) "list" which is linked to tomoyo_alias_list .
 121  *  (2) "original_name" which is a dereferenced pathname.
 122  *  (3) "aliased_name" which is a symlink's pathname.
 123  *  (4) "is_deleted" is a bool which is true if marked as deleted, false
 124  *      otherwise.
 125  */
 126 struct tomoyo_alias_entry {
 127         struct list_head list;
 128         const struct tomoyo_path_info *original_name;
 129         const struct tomoyo_path_info *aliased_name;
 130         bool is_deleted;
 131 };
 132
 133 /**
 134  * tomoyo_set_domain_flag - Set or clear domain's attribute flags.
 135  *
 136  * @domain:    Pointer to "struct tomoyo_domain_info".
 137  * @is_delete: True if it is a delete request.
 138  * @flags:     Flags to set or clear.
 139  *
 140  * Returns nothing.
 141  */
 142 void tomoyo_set_domain_flag(struct tomoyo_domain_info *domain,
 143                             const bool is_delete, const u8 flags)
 144 {
 145         /* We need to serialize because this is bitfield operation. */
 146         static DEFINE_SPINLOCK(lock);
 147         spin_lock(&lock);
 148         if (!is_delete)
 149                 domain->flags |= flags;
 150         else
 151                 domain->flags &= ~flags;
 152         spin_unlock(&lock);
 153 }
 154
 155 /**
 156  * tomoyo_get_last_name - Get last component of a domainname.
 157  *
 158  * @domain: Pointer to "struct tomoyo_domain_info".
 159  *
 160  * Returns the last component of the domainname.
 161  */
 162 const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain)
 163 {
 164         const char *cp0 = domain->domainname->name;
 165         const char *cp1 = strrchr(cp0, ' ');
 166
 167         if (cp1)
 168                 return cp1 + 1;
 169         return cp0;
 170 }
 171
 172 /*
 173  * tomoyo_domain_initializer_list is used for holding list of programs which
 174  * triggers reinitialization of domainname. Normally, a domainname is
 175  * monotonically getting longer. But sometimes, we restart daemon programs.
 176  * It would be convenient for us that "a daemon started upon system boot" and
 177  * "the daemon restarted from console" belong to the same domain. Thus, TOMOYO
 178  * provides a way to shorten domainnames.
 179  *
 180  * An entry is added by
 181  *
 182  * # echo 'initialize_domain /usr/sbin/httpd' > \
 183  *                               /sys/kernel/security/tomoyo/exception_policy
 184  *
 185  * and is deleted by
 186  *
 187  * # echo 'delete initialize_domain /usr/sbin/httpd' > \
 188  *                               /sys/kernel/security/tomoyo/exception_policy
 189  *
 190  * and all entries are retrieved by
 191  *
 192  * # grep ^initialize_domain /sys/kernel/security/tomoyo/exception_policy
 193  *
 194  * In the example above, /usr/sbin/httpd will belong to
 195  * "<kernel> /usr/sbin/httpd" domain.
 196  *
 197  * You may specify a domainname using "from" keyword.
 198  * "initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
 199  * will cause "/usr/sbin/httpd" executed from "<kernel> /etc/rc.d/init.d/httpd"
 200  * domain to belong to "<kernel> /usr/sbin/httpd" domain.
 201  *
 202  * You may add "no_" prefix to "initialize_domain".
 203  * "initialize_domain /usr/sbin/httpd" and
 204  * "no_initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
 205  * will cause "/usr/sbin/httpd" to belong to "<kernel> /usr/sbin/httpd" domain
 206  * unless executed from "<kernel> /etc/rc.d/init.d/httpd" domain.
 207  */
 208 static LIST_HEAD(tomoyo_domain_initializer_list);
 209 static DECLARE_RWSEM(tomoyo_domain_initializer_list_lock);
 210
 211 /**
 212  * tomoyo_update_domain_initializer_entry - Update "struct tomoyo_domain_initializer_entry" list.
 213  *
 214  * @domainname: The name of domain. May be NULL.
 215  * @program:    The name of program.
 216  * @is_not:     True if it is "no_initialize_domain" entry.
 217  * @is_delete:  True if it is a delete request.
 218  *
 219  * Returns 0 on success, negative value otherwise.
 220  */
 221 static int tomoyo_update_domain_initializer_entry(const char *domainname,
 222                                                   const char *program,
 223                                                   const bool is_not,
 224                                                   const bool is_delete)
 225 {
 226         struct tomoyo_domain_initializer_entry *new_entry;
 227         struct tomoyo_domain_initializer_entry *ptr;
 228         const struct tomoyo_path_info *saved_program;
 229         const struct tomoyo_path_info *saved_domainname = NULL;
 230         int error = -ENOMEM;
 231         bool is_last_name = false;
 232
 233         if (!tomoyo_is_correct_path(program, 1, -1, -1, __func__))
 234                 return -EINVAL; /* No patterns allowed. */
 235         if (domainname) {
 236                 if (!tomoyo_is_domain_def(domainname) &&
 237                     tomoyo_is_correct_path(domainname, 1, -1, -1, __func__))
 238                         is_last_name = true;
 239                 else if (!tomoyo_is_correct_domain(domainname, __func__))
 240                         return -EINVAL;
 241                 saved_domainname = tomoyo_save_name(domainname);
 242                 if (!saved_domainname)
 243                         return -ENOMEM;
 244         }
 245         saved_program = tomoyo_save_name(program);
 246         if (!saved_program)
 247                 return -ENOMEM;
 248         down_write(&tomoyo_domain_initializer_list_lock);
 249         list_for_each_entry(ptr, &tomoyo_domain_initializer_list, list) {
 250                 if (ptr->is_not != is_not ||
 251                     ptr->domainname != saved_domainname ||
 252                     ptr->program != saved_program)
 253                         continue;
 254                 ptr->is_deleted = is_delete;
 255                 error = 0;
 256                 goto out;
 257         }
 258         if (is_delete) {
 259                 error = -ENOENT;
 260                 goto out;
 261         }
 262         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 263         if (!new_entry)
 264                 goto out;
 265         new_entry->domainname = saved_domainname;
 266         new_entry->program = saved_program;
 267         new_entry->is_not = is_not;
 268         new_entry->is_last_name = is_last_name;
 269         list_add_tail(&new_entry->list, &tomoyo_domain_initializer_list);
 270         error = 0;
 271  out:
 272         up_write(&tomoyo_domain_initializer_list_lock);
 273         return error;
 274 }
 275
 276 /**
 277  * tomoyo_read_domain_initializer_policy - Read "struct tomoyo_domain_initializer_entry" list.
 278  *
 279  * @head: Pointer to "struct tomoyo_io_buffer".
 280  *
 281  * Returns true on success, false otherwise.
 282  */
 283 bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer *head)
 284 {
 285         struct list_head *pos;
 286         bool done = true;
 287
 288         down_read(&tomoyo_domain_initializer_list_lock);
 289         list_for_each_cookie(pos, head->read_var2,
 290                              &tomoyo_domain_initializer_list) {
 291                 const char *no;
 292                 const char *from = "";
 293                 const char *domain = "";
 294                 struct tomoyo_domain_initializer_entry *ptr;
 295                 ptr = list_entry(pos, struct tomoyo_domain_initializer_entry,
 296                                   list);
 297                 if (ptr->is_deleted)
 298                         continue;
 299                 no = ptr->is_not ? "no_" : "";
 300                 if (ptr->domainname) {
 301                         from = " from ";
 302                         domain = ptr->domainname->name;
 303                 }
 304                 done = tomoyo_io_printf(head,
 305                                         "%s" TOMOYO_KEYWORD_INITIALIZE_DOMAIN
 306                                         "%s%s%s\n", no, ptr->program->name,
 307                                         from, domain);
 308                 if (!done)
 309                         break;
 310         }
 311         up_read(&tomoyo_domain_initializer_list_lock);
 312         return done;
 313 }
 314
 315 /**
 316  * tomoyo_write_domain_initializer_policy - Write "struct tomoyo_domain_initializer_entry" list.
 317  *
 318  * @data:      String to parse.
 319  * @is_not:    True if it is "no_initialize_domain" entry.
 320  * @is_delete: True if it is a delete request.
 321  *
 322  * Returns 0 on success, negative value otherwise.
 323  */
 324 int tomoyo_write_domain_initializer_policy(char *data, const bool is_not,
 325                                            const bool is_delete)
 326 {
 327         char *cp = strstr(data, " from ");
 328
 329         if (cp) {
 330                 *cp = '\0';
 331                 return tomoyo_update_domain_initializer_entry(cp + 6, data,
 332                                                               is_not,
 333                                                               is_delete);
 334         }
 335         return tomoyo_update_domain_initializer_entry(NULL, data, is_not,
 336                                                       is_delete);
 337 }
 338
 339 /**
 340  * tomoyo_is_domain_initializer - Check whether the given program causes domainname reinitialization.
 341  *
 342  * @domainname: The name of domain.
 343  * @program:    The name of program.
 344  * @last_name:  The last component of @domainname.
 345  *
 346  * Returns true if executing @program reinitializes domain transition,
 347  * false otherwise.
 348  */
 349 static bool tomoyo_is_domain_initializer(const struct tomoyo_path_info *
 350                                          domainname,
 351                                          const struct tomoyo_path_info *program,
 352                                          const struct tomoyo_path_info *
 353                                          last_name)
 354 {
 355         struct tomoyo_domain_initializer_entry *ptr;
 356         bool flag = false;
 357
 358         down_read(&tomoyo_domain_initializer_list_lock);
 359         list_for_each_entry(ptr,  &tomoyo_domain_initializer_list, list) {
 360                 if (ptr->is_deleted)
 361                         continue;
 362                 if (ptr->domainname) {
 363                         if (!ptr->is_last_name) {
 364                                 if (ptr->domainname != domainname)
 365                                         continue;
 366                         } else {
 367                                 if (tomoyo_pathcmp(ptr->domainname, last_name))
 368                                         continue;
 369                         }
 370                 }
 371                 if (tomoyo_pathcmp(ptr->program, program))
 372                         continue;
 373                 if (ptr->is_not) {
 374                         flag = false;
 375                         break;
 376                 }
 377                 flag = true;
 378         }
 379         up_read(&tomoyo_domain_initializer_list_lock);
 380         return flag;
 381 }
 382
 383 /*
 384  * tomoyo_domain_keeper_list is used for holding list of domainnames which
 385  * suppresses domain transition. Normally, a domainname is monotonically
 386  * getting longer. But sometimes, we want to suppress domain transition.
 387  * It would be convenient for us that programs executed from a login session
 388  * belong to the same domain. Thus, TOMOYO provides a way to suppress domain
 389  * transition.
 390  *
 391  * An entry is added by
 392  *
 393  * # echo 'keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
 394  *                              /sys/kernel/security/tomoyo/exception_policy
 395  *
 396  * and is deleted by
 397  *
 398  * # echo 'delete keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
 399  *                              /sys/kernel/security/tomoyo/exception_policy
 400  *
 401  * and all entries are retrieved by
 402  *
 403  * # grep ^keep_domain /sys/kernel/security/tomoyo/exception_policy
 404  *
 405  * In the example above, any process which belongs to
 406  * "<kernel> /usr/sbin/sshd /bin/bash" domain will remain in that domain,
 407  * unless explicitly specified by "initialize_domain" or "no_keep_domain".
 408  *
 409  * You may specify a program using "from" keyword.
 410  * "keep_domain /bin/pwd from <kernel> /usr/sbin/sshd /bin/bash"
 411  * will cause "/bin/pwd" executed from "<kernel> /usr/sbin/sshd /bin/bash"
 412  * domain to remain in "<kernel> /usr/sbin/sshd /bin/bash" domain.
 413  *
 414  * You may add "no_" prefix to "keep_domain".
 415  * "keep_domain <kernel> /usr/sbin/sshd /bin/bash" and
 416  * "no_keep_domain /usr/bin/passwd from <kernel> /usr/sbin/sshd /bin/bash" will
 417  * cause "/usr/bin/passwd" to belong to
 418  * "<kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd" domain, unless
 419  * explicitly specified by "initialize_domain".
 420  */
 421 static LIST_HEAD(tomoyo_domain_keeper_list);
 422 static DECLARE_RWSEM(tomoyo_domain_keeper_list_lock);
 423
 424 /**
 425  * tomoyo_update_domain_keeper_entry - Update "struct tomoyo_domain_keeper_entry" list.
 426  *
 427  * @domainname: The name of domain.
 428  * @program:    The name of program. May be NULL.
 429  * @is_not:     True if it is "no_keep_domain" entry.
 430  * @is_delete:  True if it is a delete request.
 431  *
 432  * Returns 0 on success, negative value otherwise.
 433  */
 434 static int tomoyo_update_domain_keeper_entry(const char *domainname,
 435                                              const char *program,
 436                                              const bool is_not,
 437                                              const bool is_delete)
 438 {
 439         struct tomoyo_domain_keeper_entry *new_entry;
 440         struct tomoyo_domain_keeper_entry *ptr;
 441         const struct tomoyo_path_info *saved_domainname;
 442         const struct tomoyo_path_info *saved_program = NULL;
 443         int error = -ENOMEM;
 444         bool is_last_name = false;
 445
 446         if (!tomoyo_is_domain_def(domainname) &&
 447             tomoyo_is_correct_path(domainname, 1, -1, -1, __func__))
 448                 is_last_name = true;
 449         else if (!tomoyo_is_correct_domain(domainname, __func__))
 450                 return -EINVAL;
 451         if (program) {
 452                 if (!tomoyo_is_correct_path(program, 1, -1, -1, __func__))
 453                         return -EINVAL;
 454                 saved_program = tomoyo_save_name(program);
 455                 if (!saved_program)
 456                         return -ENOMEM;
 457         }
 458         saved_domainname = tomoyo_save_name(domainname);
 459         if (!saved_domainname)
 460                 return -ENOMEM;
 461         down_write(&tomoyo_domain_keeper_list_lock);
 462         list_for_each_entry(ptr, &tomoyo_domain_keeper_list, list) {
 463                 if (ptr->is_not != is_not ||
 464                     ptr->domainname != saved_domainname ||
 465                     ptr->program != saved_program)
 466                         continue;
 467                 ptr->is_deleted = is_delete;
 468                 error = 0;
 469                 goto out;
 470         }
 471         if (is_delete) {
 472                 error = -ENOENT;
 473                 goto out;
 474         }
 475         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 476         if (!new_entry)
 477                 goto out;
 478         new_entry->domainname = saved_domainname;
 479         new_entry->program = saved_program;
 480         new_entry->is_not = is_not;
 481         new_entry->is_last_name = is_last_name;
 482         list_add_tail(&new_entry->list, &tomoyo_domain_keeper_list);
 483         error = 0;
 484  out:
 485         up_write(&tomoyo_domain_keeper_list_lock);
 486         return error;
 487 }
 488
 489 /**
 490  * tomoyo_write_domain_keeper_policy - Write "struct tomoyo_domain_keeper_entry" list.
 491  *
 492  * @data:      String to parse.
 493  * @is_not:    True if it is "no_keep_domain" entry.
 494  * @is_delete: True if it is a delete request.
 495  *
 496  */
 497 int tomoyo_write_domain_keeper_policy(char *data, const bool is_not,
 498                                       const bool is_delete)
 499 {
 500         char *cp = strstr(data, " from ");
 501
 502         if (cp) {
 503                 *cp = '\0';
 504                 return tomoyo_update_domain_keeper_entry(cp + 6, data, is_not,
 505                                                          is_delete);
 506         }
 507         return tomoyo_update_domain_keeper_entry(data, NULL, is_not, is_delete);
 508 }
 509
 510 /**
 511  * tomoyo_read_domain_keeper_policy - Read "struct tomoyo_domain_keeper_entry" list.
 512  *
 513  * @head: Pointer to "struct tomoyo_io_buffer".
 514  *
 515  * Returns true on success, false otherwise.
 516  */
 517 bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer *head)
 518 {
 519         struct list_head *pos;
 520         bool done = true;
 521
 522         down_read(&tomoyo_domain_keeper_list_lock);
 523         list_for_each_cookie(pos, head->read_var2,
 524                              &tomoyo_domain_keeper_list) {
 525                 struct tomoyo_domain_keeper_entry *ptr;
 526                 const char *no;
 527                 const char *from = "";
 528                 const char *program = "";
 529
 530                 ptr = list_entry(pos, struct tomoyo_domain_keeper_entry, list);
 531                 if (ptr->is_deleted)
 532                         continue;
 533                 no = ptr->is_not ? "no_" : "";
 534                 if (ptr->program) {
 535                         from = " from ";
 536                         program = ptr->program->name;
 537                 }
 538                 done = tomoyo_io_printf(head,
 539                                         "%s" TOMOYO_KEYWORD_KEEP_DOMAIN
 540                                         "%s%s%s\n", no, program, from,
 541                                         ptr->domainname->name);
 542                 if (!done)
 543                         break;
 544         }
 545         up_read(&tomoyo_domain_keeper_list_lock);
 546         return done;
 547 }
 548
 549 /**
 550  * tomoyo_is_domain_keeper - Check whether the given program causes domain transition suppression.
 551  *
 552  * @domainname: The name of domain.
 553  * @program:    The name of program.
 554  * @last_name:  The last component of @domainname.
 555  *
 556  * Returns true if executing @program supresses domain transition,
 557  * false otherwise.
 558  */
 559 static bool tomoyo_is_domain_keeper(const struct tomoyo_path_info *domainname,
 560                                     const struct tomoyo_path_info *program,
 561                                     const struct tomoyo_path_info *last_name)
 562 {
 563         struct tomoyo_domain_keeper_entry *ptr;
 564         bool flag = false;
 565
 566         down_read(&tomoyo_domain_keeper_list_lock);
 567         list_for_each_entry(ptr, &tomoyo_domain_keeper_list, list) {
 568                 if (ptr->is_deleted)
 569                         continue;
 570                 if (!ptr->is_last_name) {
 571                         if (ptr->domainname != domainname)
 572                                 continue;
 573                 } else {
 574                         if (tomoyo_pathcmp(ptr->domainname, last_name))
 575                                 continue;
 576                 }
 577                 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
 578                         continue;
 579                 if (ptr->is_not) {
 580                         flag = false;
 581                         break;
 582                 }
 583                 flag = true;
 584         }
 585         up_read(&tomoyo_domain_keeper_list_lock);
 586         return flag;
 587 }
 588
 589 /*
 590  * tomoyo_alias_list is used for holding list of symlink's pathnames which are
 591  * allowed to be passed to an execve() request. Normally, the domainname which
 592  * the current process will belong to after execve() succeeds is calculated
 593  * using dereferenced pathnames. But some programs behave differently depending
 594  * on the name passed to argv[0]. For busybox, calculating domainname using
 595  * dereferenced pathnames will cause all programs in the busybox to belong to
 596  * the same domain. Thus, TOMOYO provides a way to allow use of symlink's
 597  * pathname for checking execve()'s permission and calculating domainname which
 598  * the current process will belong to after execve() succeeds.
 599  *
 600  * An entry is added by
 601  *
 602  * # echo 'alias /bin/busybox /bin/cat' > \
 603  *                            /sys/kernel/security/tomoyo/exception_policy
 604  *
 605  * and is deleted by
 606  *
 607  * # echo 'delete alias /bin/busybox /bin/cat' > \
 608  *                            /sys/kernel/security/tomoyo/exception_policy
 609  *
 610  * and all entries are retrieved by
 611  *
 612  * # grep ^alias /sys/kernel/security/tomoyo/exception_policy
 613  *
 614  * In the example above, if /bin/cat is a symlink to /bin/busybox and execution
 615  * of /bin/cat is requested, permission is checked for /bin/cat rather than
 616  * /bin/busybox and domainname which the current process will belong to after
 617  * execve() succeeds is calculated using /bin/cat rather than /bin/busybox .
 618  */
 619 static LIST_HEAD(tomoyo_alias_list);
 620 static DECLARE_RWSEM(tomoyo_alias_list_lock);
 621
 622 /**
 623  * tomoyo_update_alias_entry - Update "struct tomoyo_alias_entry" list.
 624  *
 625  * @original_name: The original program's real name.
 626  * @aliased_name:  The symbolic program's symbolic link's name.
 627  * @is_delete:     True if it is a delete request.
 628  *
 629  * Returns 0 on success, negative value otherwise.
 630  */
 631 static int tomoyo_update_alias_entry(const char *original_name,
 632                                      const char *aliased_name,
 633                                      const bool is_delete)
 634 {
 635         struct tomoyo_alias_entry *new_entry;
 636         struct tomoyo_alias_entry *ptr;
 637         const struct tomoyo_path_info *saved_original_name;
 638         const struct tomoyo_path_info *saved_aliased_name;
 639         int error = -ENOMEM;
 640
 641         if (!tomoyo_is_correct_path(original_name, 1, -1, -1, __func__) ||
 642             !tomoyo_is_correct_path(aliased_name, 1, -1, -1, __func__))
 643                 return -EINVAL; /* No patterns allowed. */
 644         saved_original_name = tomoyo_save_name(original_name);
 645         saved_aliased_name = tomoyo_save_name(aliased_name);
 646         if (!saved_original_name || !saved_aliased_name)
 647                 return -ENOMEM;
 648         down_write(&tomoyo_alias_list_lock);
 649         list_for_each_entry(ptr, &tomoyo_alias_list, list) {
 650                 if (ptr->original_name != saved_original_name ||
 651                     ptr->aliased_name != saved_aliased_name)
 652                         continue;
 653                 ptr->is_deleted = is_delete;
 654                 error = 0;
 655                 goto out;
 656         }
 657         if (is_delete) {
 658                 error = -ENOENT;
 659                 goto out;
 660         }
 661         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 662         if (!new_entry)
 663                 goto out;
 664         new_entry->original_name = saved_original_name;
 665         new_entry->aliased_name = saved_aliased_name;
 666         list_add_tail(&new_entry->list, &tomoyo_alias_list);
 667         error = 0;
 668  out:
 669         up_write(&tomoyo_alias_list_lock);
 670         return error;
 671 }
 672
 673 /**
 674  * tomoyo_read_alias_policy - Read "struct tomoyo_alias_entry" list.
 675  *
 676  * @head: Pointer to "struct tomoyo_io_buffer".
 677  *
 678  * Returns true on success, false otherwise.
 679  */
 680 bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head)
 681 {
 682         struct list_head *pos;
 683         bool done = true;
 684
 685         down_read(&tomoyo_alias_list_lock);
 686         list_for_each_cookie(pos, head->read_var2, &tomoyo_alias_list) {
 687                 struct tomoyo_alias_entry *ptr;
 688
 689                 ptr = list_entry(pos, struct tomoyo_alias_entry, list);
 690                 if (ptr->is_deleted)
 691                         continue;
 692                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALIAS "%s %s\n",
 693                                         ptr->original_name->name,
 694                                         ptr->aliased_name->name);
 695                 if (!done)
 696                         break;
 697         }
 698         up_read(&tomoyo_alias_list_lock);
 699         return done;
 700 }
 701
 702 /**
 703  * tomoyo_write_alias_policy - Write "struct tomoyo_alias_entry" list.
 704  *
 705  * @data:      String to parse.
 706  * @is_delete: True if it is a delete request.
 707  *
 708  * Returns 0 on success, negative value otherwise.
 709  */
 710 int tomoyo_write_alias_policy(char *data, const bool is_delete)
 711 {
 712         char *cp = strchr(data, ' ');
 713
 714         if (!cp)
 715                 return -EINVAL;
 716         *cp++ = '\0';
 717         return tomoyo_update_alias_entry(data, cp, is_delete);
 718 }
 719
 720 /**
 721  * tomoyo_find_or_assign_new_domain - Create a domain.
 722  *
 723  * @domainname: The name of domain.
 724  * @profile:    Profile number to assign if the domain was newly created.
 725  *
 726  * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
 727  */
 728 struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char *
 729                                                             domainname,
 730                                                             const u8 profile)
 731 {
 732         struct tomoyo_domain_info *domain = NULL;
 733         const struct tomoyo_path_info *saved_domainname;
 734
 735         down_write(&tomoyo_domain_list_lock);
 736         domain = tomoyo_find_domain(domainname);
 737         if (domain)
 738                 goto out;
 739         if (!tomoyo_is_correct_domain(domainname, __func__))
 740                 goto out;
 741         saved_domainname = tomoyo_save_name(domainname);
 742         if (!saved_domainname)
 743                 goto out;
 744         /* Can I reuse memory of deleted domain? */
 745         list_for_each_entry(domain, &tomoyo_domain_list, list) {
 746                 struct task_struct *p;
 747                 struct tomoyo_acl_info *ptr;
 748                 bool flag;
 749                 if (!domain->is_deleted ||
 750                     domain->domainname != saved_domainname)
 751                         continue;
 752                 flag = false;
 753                 read_lock(&tasklist_lock);
 754                 for_each_process(p) {
 755                         if (tomoyo_real_domain(p) != domain)
 756                                 continue;
 757                         flag = true;
 758                         break;
 759                 }
 760                 read_unlock(&tasklist_lock);
 761                 if (flag)
 762                         continue;
 763                 list_for_each_entry(ptr, &domain->acl_info_list, list) {
 764                         ptr->type |= TOMOYO_ACL_DELETED;
 765                 }
 766                 tomoyo_set_domain_flag(domain, true, domain->flags);
 767                 domain->profile = profile;
 768                 domain->quota_warned = false;
 769                 mb(); /* Avoid out-of-order execution. */
 770                 domain->is_deleted = false;
 771                 goto out;
 772         }
 773         /* No memory reusable. Create using new memory. */
 774         domain = tomoyo_alloc_element(sizeof(*domain));
 775         if (domain) {
 776                 INIT_LIST_HEAD(&domain->acl_info_list);
 777                 domain->domainname = saved_domainname;
 778                 domain->profile = profile;
 779                 list_add_tail(&domain->list, &tomoyo_domain_list);
 780         }
 781  out:
 782         up_write(&tomoyo_domain_list_lock);
 783         return domain;
 784 }
 785
 786 /**
 787  * tomoyo_find_next_domain - Find a domain.
 788  *
 789  * @bprm: Pointer to "struct linux_binprm".
 790  *
 791  * Returns 0 on success, negative value otherwise.
 792  */
 793 int tomoyo_find_next_domain(struct linux_binprm *bprm)
 794 {
 795         /*
 796          * This function assumes that the size of buffer returned by
 797          * tomoyo_realpath() = TOMOYO_MAX_PATHNAME_LEN.
 798          */
 799         struct tomoyo_page_buffer *tmp = tomoyo_alloc(sizeof(*tmp));
 800         struct tomoyo_domain_info *old_domain = tomoyo_domain();
 801         struct tomoyo_domain_info *domain = NULL;
 802         const char *old_domain_name = old_domain->domainname->name;
 803         const char *original_name = bprm->filename;
 804         char *new_domain_name = NULL;
 805         char *real_program_name = NULL;
 806         char *symlink_program_name = NULL;
 807         const u8 mode = tomoyo_check_flags(old_domain, TOMOYO_MAC_FOR_FILE);
 808         const bool is_enforce = (mode == 3);
 809         int retval = -ENOMEM;
 810         struct tomoyo_path_info r; /* real name */
 811         struct tomoyo_path_info s; /* symlink name */
 812         struct tomoyo_path_info l; /* last name */
 813         static bool initialized;
 814
 815         if (!tmp)
 816                 goto out;
 817
 818         if (!initialized) {
 819                 /*
 820                  * Built-in initializers. This is needed because policies are
 821                  * not loaded until starting /sbin/init.
 822                  */
 823                 tomoyo_update_domain_initializer_entry(NULL, "/sbin/hotplug",
 824                                                        false, false);
 825                 tomoyo_update_domain_initializer_entry(NULL, "/sbin/modprobe",
 826                                                        false, false);
 827                 initialized = true;
 828         }
 829
 830         /* Get tomoyo_realpath of program. */
 831         retval = -ENOENT;
 832         /* I hope tomoyo_realpath() won't fail with -ENOMEM. */
 833         real_program_name = tomoyo_realpath(original_name);
 834         if (!real_program_name)
 835                 goto out;
 836         /* Get tomoyo_realpath of symbolic link. */
 837         symlink_program_name = tomoyo_realpath_nofollow(original_name);
 838         if (!symlink_program_name)
 839                 goto out;
 840
 841         r.name = real_program_name;
 842         tomoyo_fill_path_info(&r);
 843         s.name = symlink_program_name;
 844         tomoyo_fill_path_info(&s);
 845         l.name = tomoyo_get_last_name(old_domain);
 846         tomoyo_fill_path_info(&l);
 847
 848         /* Check 'alias' directive. */
 849         if (tomoyo_pathcmp(&r, &s)) {
 850                 struct tomoyo_alias_entry *ptr;
 851                 /* Is this program allowed to be called via symbolic links? */
 852                 down_read(&tomoyo_alias_list_lock);
 853                 list_for_each_entry(ptr, &tomoyo_alias_list, list) {
 854                         if (ptr->is_deleted ||
 855                             tomoyo_pathcmp(&r, ptr->original_name) ||
 856                             tomoyo_pathcmp(&s, ptr->aliased_name))
 857                                 continue;
 858                         memset(real_program_name, 0, TOMOYO_MAX_PATHNAME_LEN);
 859                         strncpy(real_program_name, ptr->aliased_name->name,
 860                                 TOMOYO_MAX_PATHNAME_LEN - 1);
 861                         tomoyo_fill_path_info(&r);
 862                         break;
 863                 }
 864                 up_read(&tomoyo_alias_list_lock);
 865         }
 866
 867         /* Check execute permission. */
 868         retval = tomoyo_check_exec_perm(old_domain, &r);
 869         if (retval < 0)
 870                 goto out;
 871
 872         new_domain_name = tmp->buffer;
 873         if (tomoyo_is_domain_initializer(old_domain->domainname, &r, &l)) {
 874                 /* Transit to the child of tomoyo_kernel_domain domain. */
 875                 snprintf(new_domain_name, TOMOYO_MAX_PATHNAME_LEN + 1,
 876                          TOMOYO_ROOT_NAME " " "%s", real_program_name);
 877         } else if (old_domain == &tomoyo_kernel_domain &&
 878                    !tomoyo_policy_loaded) {
 879                 /*
 880                  * Needn't to transit from kernel domain before starting
 881                  * /sbin/init. But transit from kernel domain if executing
 882                  * initializers because they might start before /sbin/init.
 883                  */
 884                 domain = old_domain;
 885         } else if (tomoyo_is_domain_keeper(old_domain->domainname, &r, &l)) {
 886                 /* Keep current domain. */
 887                 domain = old_domain;
 888         } else {
 889                 /* Normal domain transition. */
 890                 snprintf(new_domain_name, TOMOYO_MAX_PATHNAME_LEN + 1,
 891                          "%s %s", old_domain_name, real_program_name);
 892         }
 893         if (domain || strlen(new_domain_name) >= TOMOYO_MAX_PATHNAME_LEN)
 894                 goto done;
 895         down_read(&tomoyo_domain_list_lock);
 896         domain = tomoyo_find_domain(new_domain_name);
 897         up_read(&tomoyo_domain_list_lock);
 898         if (domain)
 899                 goto done;
 900         if (is_enforce)
 901                 goto done;
 902         domain = tomoyo_find_or_assign_new_domain(new_domain_name,
 903                                                   old_domain->profile);
 904  done:
 905         if (domain)
 906                 goto out;
 907         printk(KERN_WARNING "TOMOYO-ERROR: Domain '%s' not defined.\n",
 908                new_domain_name);
 909         if (is_enforce)
 910                 retval = -EPERM;
 911         else
 912                 tomoyo_set_domain_flag(old_domain, false,
 913                                        TOMOYO_DOMAIN_FLAGS_TRANSITION_FAILED);
 914  out:
 915         if (!domain)
 916                 domain = old_domain;
 917         bprm->cred->security = domain;
 918         tomoyo_free(real_program_name);
 919         tomoyo_free(symlink_program_name);
 920         tomoyo_free(tmp);
 921         return retval;
 922 }