Loading...
1/*
2 * security/tomoyo/domain.c
3 *
4 * Copyright (C) 2005-2011 NTT DATA CORPORATION
5 */
6
7#include "common.h"
8#include <linux/binfmts.h>
9#include <linux/slab.h>
10
11/* Variables definitions.*/
12
13/* The initial domain. */
14struct tomoyo_domain_info tomoyo_kernel_domain;
15
16/**
17 * tomoyo_update_policy - Update an entry for exception policy.
18 *
19 * @new_entry: Pointer to "struct tomoyo_acl_info".
20 * @size: Size of @new_entry in bytes.
21 * @param: Pointer to "struct tomoyo_acl_param".
22 * @check_duplicate: Callback function to find duplicated entry.
23 *
24 * Returns 0 on success, negative value otherwise.
25 *
26 * Caller holds tomoyo_read_lock().
27 */
28int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
29 struct tomoyo_acl_param *param,
30 bool (*check_duplicate) (const struct tomoyo_acl_head
31 *,
32 const struct tomoyo_acl_head
33 *))
34{
35 int error = param->is_delete ? -ENOENT : -ENOMEM;
36 struct tomoyo_acl_head *entry;
37 struct list_head *list = param->list;
38
39 if (mutex_lock_interruptible(&tomoyo_policy_lock))
40 return -ENOMEM;
41 list_for_each_entry_rcu(entry, list, list) {
42 if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS)
43 continue;
44 if (!check_duplicate(entry, new_entry))
45 continue;
46 entry->is_deleted = param->is_delete;
47 error = 0;
48 break;
49 }
50 if (error && !param->is_delete) {
51 entry = tomoyo_commit_ok(new_entry, size);
52 if (entry) {
53 list_add_tail_rcu(&entry->list, list);
54 error = 0;
55 }
56 }
57 mutex_unlock(&tomoyo_policy_lock);
58 return error;
59}
60
61/**
62 * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
63 *
64 * @a: Pointer to "struct tomoyo_acl_info".
65 * @b: Pointer to "struct tomoyo_acl_info".
66 *
67 * Returns true if @a == @b, false otherwise.
68 */
69static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
70 const struct tomoyo_acl_info *b)
71{
72 return a->type == b->type && a->cond == b->cond;
73}
74
75/**
76 * tomoyo_update_domain - Update an entry for domain policy.
77 *
78 * @new_entry: Pointer to "struct tomoyo_acl_info".
79 * @size: Size of @new_entry in bytes.
80 * @param: Pointer to "struct tomoyo_acl_param".
81 * @check_duplicate: Callback function to find duplicated entry.
82 * @merge_duplicate: Callback function to merge duplicated entry.
83 *
84 * Returns 0 on success, negative value otherwise.
85 *
86 * Caller holds tomoyo_read_lock().
87 */
88int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
89 struct tomoyo_acl_param *param,
90 bool (*check_duplicate) (const struct tomoyo_acl_info
91 *,
92 const struct tomoyo_acl_info
93 *),
94 bool (*merge_duplicate) (struct tomoyo_acl_info *,
95 struct tomoyo_acl_info *,
96 const bool))
97{
98 const bool is_delete = param->is_delete;
99 int error = is_delete ? -ENOENT : -ENOMEM;
100 struct tomoyo_acl_info *entry;
101 struct list_head * const list = param->list;
102
103 if (param->data[0]) {
104 new_entry->cond = tomoyo_get_condition(param);
105 if (!new_entry->cond)
106 return -EINVAL;
107 /*
108 * Domain transition preference is allowed for only
109 * "file execute" entries.
110 */
111 if (new_entry->cond->transit &&
112 !(new_entry->type == TOMOYO_TYPE_PATH_ACL &&
113 container_of(new_entry, struct tomoyo_path_acl, head)
114 ->perm == 1 << TOMOYO_TYPE_EXECUTE))
115 goto out;
116 }
117 if (mutex_lock_interruptible(&tomoyo_policy_lock))
118 goto out;
119 list_for_each_entry_rcu(entry, list, list) {
120 if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS)
121 continue;
122 if (!tomoyo_same_acl_head(entry, new_entry) ||
123 !check_duplicate(entry, new_entry))
124 continue;
125 if (merge_duplicate)
126 entry->is_deleted = merge_duplicate(entry, new_entry,
127 is_delete);
128 else
129 entry->is_deleted = is_delete;
130 error = 0;
131 break;
132 }
133 if (error && !is_delete) {
134 entry = tomoyo_commit_ok(new_entry, size);
135 if (entry) {
136 list_add_tail_rcu(&entry->list, list);
137 error = 0;
138 }
139 }
140 mutex_unlock(&tomoyo_policy_lock);
141out:
142 tomoyo_put_condition(new_entry->cond);
143 return error;
144}
145
146/**
147 * tomoyo_check_acl - Do permission check.
148 *
149 * @r: Pointer to "struct tomoyo_request_info".
150 * @check_entry: Callback function to check type specific parameters.
151 *
152 * Returns 0 on success, negative value otherwise.
153 *
154 * Caller holds tomoyo_read_lock().
155 */
156void tomoyo_check_acl(struct tomoyo_request_info *r,
157 bool (*check_entry) (struct tomoyo_request_info *,
158 const struct tomoyo_acl_info *))
159{
160 const struct tomoyo_domain_info *domain = r->domain;
161 struct tomoyo_acl_info *ptr;
162 bool retried = false;
163 const struct list_head *list = &domain->acl_info_list;
164
165retry:
166 list_for_each_entry_rcu(ptr, list, list) {
167 if (ptr->is_deleted || ptr->type != r->param_type)
168 continue;
169 if (!check_entry(r, ptr))
170 continue;
171 if (!tomoyo_condition(r, ptr->cond))
172 continue;
173 r->matched_acl = ptr;
174 r->granted = true;
175 return;
176 }
177 if (!retried) {
178 retried = true;
179 list = &domain->ns->acl_group[domain->group];
180 goto retry;
181 }
182 r->granted = false;
183}
184
185/* The list for "struct tomoyo_domain_info". */
186LIST_HEAD(tomoyo_domain_list);
187
188/**
189 * tomoyo_last_word - Get last component of a domainname.
190 *
191 * @name: Domainname to check.
192 *
193 * Returns the last word of @domainname.
194 */
195static const char *tomoyo_last_word(const char *name)
196{
197 const char *cp = strrchr(name, ' ');
198 if (cp)
199 return cp + 1;
200 return name;
201}
202
203/**
204 * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry.
205 *
206 * @a: Pointer to "struct tomoyo_acl_head".
207 * @b: Pointer to "struct tomoyo_acl_head".
208 *
209 * Returns true if @a == @b, false otherwise.
210 */
211static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
212 const struct tomoyo_acl_head *b)
213{
214 const struct tomoyo_transition_control *p1 = container_of(a,
215 typeof(*p1),
216 head);
217 const struct tomoyo_transition_control *p2 = container_of(b,
218 typeof(*p2),
219 head);
220 return p1->type == p2->type && p1->is_last_name == p2->is_last_name
221 && p1->domainname == p2->domainname
222 && p1->program == p2->program;
223}
224
225/**
226 * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list.
227 *
228 * @param: Pointer to "struct tomoyo_acl_param".
229 * @type: Type of this entry.
230 *
231 * Returns 0 on success, negative value otherwise.
232 */
233int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
234 const u8 type)
235{
236 struct tomoyo_transition_control e = { .type = type };
237 int error = param->is_delete ? -ENOENT : -ENOMEM;
238 char *program = param->data;
239 char *domainname = strstr(program, " from ");
240 if (domainname) {
241 *domainname = '\0';
242 domainname += 6;
243 } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP ||
244 type == TOMOYO_TRANSITION_CONTROL_KEEP) {
245 domainname = program;
246 program = NULL;
247 }
248 if (program && strcmp(program, "any")) {
249 if (!tomoyo_correct_path(program))
250 return -EINVAL;
251 e.program = tomoyo_get_name(program);
252 if (!e.program)
253 goto out;
254 }
255 if (domainname && strcmp(domainname, "any")) {
256 if (!tomoyo_correct_domain(domainname)) {
257 if (!tomoyo_correct_path(domainname))
258 goto out;
259 e.is_last_name = true;
260 }
261 e.domainname = tomoyo_get_name(domainname);
262 if (!e.domainname)
263 goto out;
264 }
265 param->list = ¶m->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
266 error = tomoyo_update_policy(&e.head, sizeof(e), param,
267 tomoyo_same_transition_control);
268out:
269 tomoyo_put_name(e.domainname);
270 tomoyo_put_name(e.program);
271 return error;
272}
273
274/**
275 * tomoyo_scan_transition - Try to find specific domain transition type.
276 *
277 * @list: Pointer to "struct list_head".
278 * @domainname: The name of current domain.
279 * @program: The name of requested program.
280 * @last_name: The last component of @domainname.
281 * @type: One of values in "enum tomoyo_transition_type".
282 *
283 * Returns true if found one, false otherwise.
284 *
285 * Caller holds tomoyo_read_lock().
286 */
287static inline bool tomoyo_scan_transition
288(const struct list_head *list, const struct tomoyo_path_info *domainname,
289 const struct tomoyo_path_info *program, const char *last_name,
290 const enum tomoyo_transition_type type)
291{
292 const struct tomoyo_transition_control *ptr;
293 list_for_each_entry_rcu(ptr, list, head.list) {
294 if (ptr->head.is_deleted || ptr->type != type)
295 continue;
296 if (ptr->domainname) {
297 if (!ptr->is_last_name) {
298 if (ptr->domainname != domainname)
299 continue;
300 } else {
301 /*
302 * Use direct strcmp() since this is
303 * unlikely used.
304 */
305 if (strcmp(ptr->domainname->name, last_name))
306 continue;
307 }
308 }
309 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
310 continue;
311 return true;
312 }
313 return false;
314}
315
316/**
317 * tomoyo_transition_type - Get domain transition type.
318 *
319 * @ns: Pointer to "struct tomoyo_policy_namespace".
320 * @domainname: The name of current domain.
321 * @program: The name of requested program.
322 *
323 * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes
324 * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if
325 * executing @program reinitializes domain transition within that namespace,
326 * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname ,
327 * others otherwise.
328 *
329 * Caller holds tomoyo_read_lock().
330 */
331static enum tomoyo_transition_type tomoyo_transition_type
332(const struct tomoyo_policy_namespace *ns,
333 const struct tomoyo_path_info *domainname,
334 const struct tomoyo_path_info *program)
335{
336 const char *last_name = tomoyo_last_word(domainname->name);
337 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
338 while (type < TOMOYO_MAX_TRANSITION_TYPE) {
339 const struct list_head * const list =
340 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
341 if (!tomoyo_scan_transition(list, domainname, program,
342 last_name, type)) {
343 type++;
344 continue;
345 }
346 if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET &&
347 type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE)
348 break;
349 /*
350 * Do not check for reset_domain if no_reset_domain matched.
351 * Do not check for initialize_domain if no_initialize_domain
352 * matched.
353 */
354 type++;
355 type++;
356 }
357 return type;
358}
359
360/**
361 * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry.
362 *
363 * @a: Pointer to "struct tomoyo_acl_head".
364 * @b: Pointer to "struct tomoyo_acl_head".
365 *
366 * Returns true if @a == @b, false otherwise.
367 */
368static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
369 const struct tomoyo_acl_head *b)
370{
371 const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1),
372 head);
373 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
374 head);
375 return p1->original_name == p2->original_name &&
376 p1->aggregated_name == p2->aggregated_name;
377}
378
379/**
380 * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list.
381 *
382 * @param: Pointer to "struct tomoyo_acl_param".
383 *
384 * Returns 0 on success, negative value otherwise.
385 *
386 * Caller holds tomoyo_read_lock().
387 */
388int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
389{
390 struct tomoyo_aggregator e = { };
391 int error = param->is_delete ? -ENOENT : -ENOMEM;
392 const char *original_name = tomoyo_read_token(param);
393 const char *aggregated_name = tomoyo_read_token(param);
394 if (!tomoyo_correct_word(original_name) ||
395 !tomoyo_correct_path(aggregated_name))
396 return -EINVAL;
397 e.original_name = tomoyo_get_name(original_name);
398 e.aggregated_name = tomoyo_get_name(aggregated_name);
399 if (!e.original_name || !e.aggregated_name ||
400 e.aggregated_name->is_patterned) /* No patterns allowed. */
401 goto out;
402 param->list = ¶m->ns->policy_list[TOMOYO_ID_AGGREGATOR];
403 error = tomoyo_update_policy(&e.head, sizeof(e), param,
404 tomoyo_same_aggregator);
405out:
406 tomoyo_put_name(e.original_name);
407 tomoyo_put_name(e.aggregated_name);
408 return error;
409}
410
411/**
412 * tomoyo_find_namespace - Find specified namespace.
413 *
414 * @name: Name of namespace to find.
415 * @len: Length of @name.
416 *
417 * Returns pointer to "struct tomoyo_policy_namespace" if found,
418 * NULL otherwise.
419 *
420 * Caller holds tomoyo_read_lock().
421 */
422static struct tomoyo_policy_namespace *tomoyo_find_namespace
423(const char *name, const unsigned int len)
424{
425 struct tomoyo_policy_namespace *ns;
426 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
427 if (strncmp(name, ns->name, len) ||
428 (name[len] && name[len] != ' '))
429 continue;
430 return ns;
431 }
432 return NULL;
433}
434
435/**
436 * tomoyo_assign_namespace - Create a new namespace.
437 *
438 * @domainname: Name of namespace to create.
439 *
440 * Returns pointer to "struct tomoyo_policy_namespace" on success,
441 * NULL otherwise.
442 *
443 * Caller holds tomoyo_read_lock().
444 */
445struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
446{
447 struct tomoyo_policy_namespace *ptr;
448 struct tomoyo_policy_namespace *entry;
449 const char *cp = domainname;
450 unsigned int len = 0;
451 while (*cp && *cp++ != ' ')
452 len++;
453 ptr = tomoyo_find_namespace(domainname, len);
454 if (ptr)
455 return ptr;
456 if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(domainname))
457 return NULL;
458 entry = kzalloc(sizeof(*entry) + len + 1, GFP_NOFS);
459 if (!entry)
460 return NULL;
461 if (mutex_lock_interruptible(&tomoyo_policy_lock))
462 goto out;
463 ptr = tomoyo_find_namespace(domainname, len);
464 if (!ptr && tomoyo_memory_ok(entry)) {
465 char *name = (char *) (entry + 1);
466 ptr = entry;
467 memmove(name, domainname, len);
468 name[len] = '\0';
469 entry->name = name;
470 tomoyo_init_policy_namespace(entry);
471 entry = NULL;
472 }
473 mutex_unlock(&tomoyo_policy_lock);
474out:
475 kfree(entry);
476 return ptr;
477}
478
479/**
480 * tomoyo_namespace_jump - Check for namespace jump.
481 *
482 * @domainname: Name of domain.
483 *
484 * Returns true if namespace differs, false otherwise.
485 */
486static bool tomoyo_namespace_jump(const char *domainname)
487{
488 const char *namespace = tomoyo_current_namespace()->name;
489 const int len = strlen(namespace);
490 return strncmp(domainname, namespace, len) ||
491 (domainname[len] && domainname[len] != ' ');
492}
493
494/**
495 * tomoyo_assign_domain - Create a domain or a namespace.
496 *
497 * @domainname: The name of domain.
498 * @transit: True if transit to domain found or created.
499 *
500 * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
501 *
502 * Caller holds tomoyo_read_lock().
503 */
504struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
505 const bool transit)
506{
507 struct tomoyo_domain_info e = { };
508 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
509 bool created = false;
510 if (entry) {
511 if (transit) {
512 /*
513 * Since namespace is created at runtime, profiles may
514 * not be created by the moment the process transits to
515 * that domain. Do not perform domain transition if
516 * profile for that domain is not yet created.
517 */
518 if (tomoyo_policy_loaded &&
519 !entry->ns->profile_ptr[entry->profile])
520 return NULL;
521 }
522 return entry;
523 }
524 /* Requested domain does not exist. */
525 /* Don't create requested domain if domainname is invalid. */
526 if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 ||
527 !tomoyo_correct_domain(domainname))
528 return NULL;
529 /*
530 * Since definition of profiles and acl_groups may differ across
531 * namespaces, do not inherit "use_profile" and "use_group" settings
532 * by automatically creating requested domain upon domain transition.
533 */
534 if (transit && tomoyo_namespace_jump(domainname))
535 return NULL;
536 e.ns = tomoyo_assign_namespace(domainname);
537 if (!e.ns)
538 return NULL;
539 /*
540 * "use_profile" and "use_group" settings for automatically created
541 * domains are inherited from current domain. These are 0 for manually
542 * created domains.
543 */
544 if (transit) {
545 const struct tomoyo_domain_info *domain = tomoyo_domain();
546 e.profile = domain->profile;
547 e.group = domain->group;
548 }
549 e.domainname = tomoyo_get_name(domainname);
550 if (!e.domainname)
551 return NULL;
552 if (mutex_lock_interruptible(&tomoyo_policy_lock))
553 goto out;
554 entry = tomoyo_find_domain(domainname);
555 if (!entry) {
556 entry = tomoyo_commit_ok(&e, sizeof(e));
557 if (entry) {
558 INIT_LIST_HEAD(&entry->acl_info_list);
559 list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
560 created = true;
561 }
562 }
563 mutex_unlock(&tomoyo_policy_lock);
564out:
565 tomoyo_put_name(e.domainname);
566 if (entry && transit) {
567 if (created) {
568 struct tomoyo_request_info r;
569 tomoyo_init_request_info(&r, entry,
570 TOMOYO_MAC_FILE_EXECUTE);
571 r.granted = false;
572 tomoyo_write_log(&r, "use_profile %u\n",
573 entry->profile);
574 tomoyo_write_log(&r, "use_group %u\n", entry->group);
575 tomoyo_update_stat(TOMOYO_STAT_POLICY_UPDATES);
576 }
577 }
578 return entry;
579}
580
581/**
582 * tomoyo_environ - Check permission for environment variable names.
583 *
584 * @ee: Pointer to "struct tomoyo_execve".
585 *
586 * Returns 0 on success, negative value otherwise.
587 */
588static int tomoyo_environ(struct tomoyo_execve *ee)
589{
590 struct tomoyo_request_info *r = &ee->r;
591 struct linux_binprm *bprm = ee->bprm;
592 /* env_page.data is allocated by tomoyo_dump_page(). */
593 struct tomoyo_page_dump env_page = { };
594 char *arg_ptr; /* Size is TOMOYO_EXEC_TMPSIZE bytes */
595 int arg_len = 0;
596 unsigned long pos = bprm->p;
597 int offset = pos % PAGE_SIZE;
598 int argv_count = bprm->argc;
599 int envp_count = bprm->envc;
600 int error = -ENOMEM;
601
602 ee->r.type = TOMOYO_MAC_ENVIRON;
603 ee->r.profile = r->domain->profile;
604 ee->r.mode = tomoyo_get_mode(r->domain->ns, ee->r.profile,
605 TOMOYO_MAC_ENVIRON);
606 if (!r->mode || !envp_count)
607 return 0;
608 arg_ptr = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
609 if (!arg_ptr)
610 goto out;
611 while (error == -ENOMEM) {
612 if (!tomoyo_dump_page(bprm, pos, &env_page))
613 goto out;
614 pos += PAGE_SIZE - offset;
615 /* Read. */
616 while (argv_count && offset < PAGE_SIZE) {
617 if (!env_page.data[offset++])
618 argv_count--;
619 }
620 if (argv_count) {
621 offset = 0;
622 continue;
623 }
624 while (offset < PAGE_SIZE) {
625 const unsigned char c = env_page.data[offset++];
626
627 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
628 if (c == '=') {
629 arg_ptr[arg_len++] = '\0';
630 } else if (c == '\\') {
631 arg_ptr[arg_len++] = '\\';
632 arg_ptr[arg_len++] = '\\';
633 } else if (c > ' ' && c < 127) {
634 arg_ptr[arg_len++] = c;
635 } else {
636 arg_ptr[arg_len++] = '\\';
637 arg_ptr[arg_len++] = (c >> 6) + '0';
638 arg_ptr[arg_len++]
639 = ((c >> 3) & 7) + '0';
640 arg_ptr[arg_len++] = (c & 7) + '0';
641 }
642 } else {
643 arg_ptr[arg_len] = '\0';
644 }
645 if (c)
646 continue;
647 if (tomoyo_env_perm(r, arg_ptr)) {
648 error = -EPERM;
649 break;
650 }
651 if (!--envp_count) {
652 error = 0;
653 break;
654 }
655 arg_len = 0;
656 }
657 offset = 0;
658 }
659out:
660 if (r->mode != TOMOYO_CONFIG_ENFORCING)
661 error = 0;
662 kfree(env_page.data);
663 kfree(arg_ptr);
664 return error;
665}
666
667/**
668 * tomoyo_find_next_domain - Find a domain.
669 *
670 * @bprm: Pointer to "struct linux_binprm".
671 *
672 * Returns 0 on success, negative value otherwise.
673 *
674 * Caller holds tomoyo_read_lock().
675 */
676int tomoyo_find_next_domain(struct linux_binprm *bprm)
677{
678 struct tomoyo_domain_info *old_domain = tomoyo_domain();
679 struct tomoyo_domain_info *domain = NULL;
680 const char *original_name = bprm->filename;
681 int retval = -ENOMEM;
682 bool reject_on_transition_failure = false;
683 const struct tomoyo_path_info *candidate;
684 struct tomoyo_path_info exename;
685 struct tomoyo_execve *ee = kzalloc(sizeof(*ee), GFP_NOFS);
686
687 if (!ee)
688 return -ENOMEM;
689 ee->tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
690 if (!ee->tmp) {
691 kfree(ee);
692 return -ENOMEM;
693 }
694 /* ee->dump->data is allocated by tomoyo_dump_page(). */
695 tomoyo_init_request_info(&ee->r, NULL, TOMOYO_MAC_FILE_EXECUTE);
696 ee->r.ee = ee;
697 ee->bprm = bprm;
698 ee->r.obj = &ee->obj;
699 ee->obj.path1 = bprm->file->f_path;
700 /* Get symlink's pathname of program. */
701 retval = -ENOENT;
702 exename.name = tomoyo_realpath_nofollow(original_name);
703 if (!exename.name)
704 goto out;
705 tomoyo_fill_path_info(&exename);
706retry:
707 /* Check 'aggregator' directive. */
708 {
709 struct tomoyo_aggregator *ptr;
710 struct list_head *list =
711 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
712 /* Check 'aggregator' directive. */
713 candidate = &exename;
714 list_for_each_entry_rcu(ptr, list, head.list) {
715 if (ptr->head.is_deleted ||
716 !tomoyo_path_matches_pattern(&exename,
717 ptr->original_name))
718 continue;
719 candidate = ptr->aggregated_name;
720 break;
721 }
722 }
723
724 /* Check execute permission. */
725 retval = tomoyo_execute_permission(&ee->r, candidate);
726 if (retval == TOMOYO_RETRY_REQUEST)
727 goto retry;
728 if (retval < 0)
729 goto out;
730 /*
731 * To be able to specify domainnames with wildcards, use the
732 * pathname specified in the policy (which may contain
733 * wildcard) rather than the pathname passed to execve()
734 * (which never contains wildcard).
735 */
736 if (ee->r.param.path.matched_path)
737 candidate = ee->r.param.path.matched_path;
738
739 /*
740 * Check for domain transition preference if "file execute" matched.
741 * If preference is given, make do_execve() fail if domain transition
742 * has failed, for domain transition preference should be used with
743 * destination domain defined.
744 */
745 if (ee->transition) {
746 const char *domainname = ee->transition->name;
747 reject_on_transition_failure = true;
748 if (!strcmp(domainname, "keep"))
749 goto force_keep_domain;
750 if (!strcmp(domainname, "child"))
751 goto force_child_domain;
752 if (!strcmp(domainname, "reset"))
753 goto force_reset_domain;
754 if (!strcmp(domainname, "initialize"))
755 goto force_initialize_domain;
756 if (!strcmp(domainname, "parent")) {
757 char *cp;
758 strncpy(ee->tmp, old_domain->domainname->name,
759 TOMOYO_EXEC_TMPSIZE - 1);
760 cp = strrchr(ee->tmp, ' ');
761 if (cp)
762 *cp = '\0';
763 } else if (*domainname == '<')
764 strncpy(ee->tmp, domainname, TOMOYO_EXEC_TMPSIZE - 1);
765 else
766 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
767 old_domain->domainname->name, domainname);
768 goto force_jump_domain;
769 }
770 /*
771 * No domain transition preference specified.
772 * Calculate domain to transit to.
773 */
774 switch (tomoyo_transition_type(old_domain->ns, old_domain->domainname,
775 candidate)) {
776 case TOMOYO_TRANSITION_CONTROL_RESET:
777force_reset_domain:
778 /* Transit to the root of specified namespace. */
779 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "<%s>",
780 candidate->name);
781 /*
782 * Make do_execve() fail if domain transition across namespaces
783 * has failed.
784 */
785 reject_on_transition_failure = true;
786 break;
787 case TOMOYO_TRANSITION_CONTROL_INITIALIZE:
788force_initialize_domain:
789 /* Transit to the child of current namespace's root. */
790 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
791 old_domain->ns->name, candidate->name);
792 break;
793 case TOMOYO_TRANSITION_CONTROL_KEEP:
794force_keep_domain:
795 /* Keep current domain. */
796 domain = old_domain;
797 break;
798 default:
799 if (old_domain == &tomoyo_kernel_domain &&
800 !tomoyo_policy_loaded) {
801 /*
802 * Needn't to transit from kernel domain before
803 * starting /sbin/init. But transit from kernel domain
804 * if executing initializers because they might start
805 * before /sbin/init.
806 */
807 domain = old_domain;
808 break;
809 }
810force_child_domain:
811 /* Normal domain transition. */
812 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
813 old_domain->domainname->name, candidate->name);
814 break;
815 }
816force_jump_domain:
817 if (!domain)
818 domain = tomoyo_assign_domain(ee->tmp, true);
819 if (domain)
820 retval = 0;
821 else if (reject_on_transition_failure) {
822 printk(KERN_WARNING "ERROR: Domain '%s' not ready.\n",
823 ee->tmp);
824 retval = -ENOMEM;
825 } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING)
826 retval = -ENOMEM;
827 else {
828 retval = 0;
829 if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) {
830 old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true;
831 ee->r.granted = false;
832 tomoyo_write_log(&ee->r, "%s", tomoyo_dif
833 [TOMOYO_DIF_TRANSITION_FAILED]);
834 printk(KERN_WARNING
835 "ERROR: Domain '%s' not defined.\n", ee->tmp);
836 }
837 }
838 out:
839 if (!domain)
840 domain = old_domain;
841 /* Update reference count on "struct tomoyo_domain_info". */
842 atomic_inc(&domain->users);
843 bprm->cred->security = domain;
844 kfree(exename.name);
845 if (!retval) {
846 ee->r.domain = domain;
847 retval = tomoyo_environ(ee);
848 }
849 kfree(ee->tmp);
850 kfree(ee->dump.data);
851 kfree(ee);
852 return retval;
853}
854
855/**
856 * tomoyo_dump_page - Dump a page to buffer.
857 *
858 * @bprm: Pointer to "struct linux_binprm".
859 * @pos: Location to dump.
860 * @dump: Poiner to "struct tomoyo_page_dump".
861 *
862 * Returns true on success, false otherwise.
863 */
864bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
865 struct tomoyo_page_dump *dump)
866{
867 struct page *page;
868
869 /* dump->data is released by tomoyo_find_next_domain(). */
870 if (!dump->data) {
871 dump->data = kzalloc(PAGE_SIZE, GFP_NOFS);
872 if (!dump->data)
873 return false;
874 }
875 /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */
876#ifdef CONFIG_MMU
877 /*
878 * This is called at execve() time in order to dig around
879 * in the argv/environment of the new proceess
880 * (represented by bprm). 'current' is the process doing
881 * the execve().
882 */
883 if (get_user_pages_remote(current, bprm->mm, pos, 1,
884 0, 1, &page, NULL) <= 0)
885 return false;
886#else
887 page = bprm->page[pos / PAGE_SIZE];
888#endif
889 if (page != dump->page) {
890 const unsigned int offset = pos % PAGE_SIZE;
891 /*
892 * Maybe kmap()/kunmap() should be used here.
893 * But remove_arg_zero() uses kmap_atomic()/kunmap_atomic().
894 * So do I.
895 */
896 char *kaddr = kmap_atomic(page);
897
898 dump->page = page;
899 memcpy(dump->data + offset, kaddr + offset,
900 PAGE_SIZE - offset);
901 kunmap_atomic(kaddr);
902 }
903 /* Same with put_arg_page(page) in fs/exec.c */
904#ifdef CONFIG_MMU
905 put_page(page);
906#endif
907 return true;
908}
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/domain.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include "common.h"
9
10#include <linux/binfmts.h>
11#include <linux/slab.h>
12#include <linux/rculist.h>
13
14/* Variables definitions.*/
15
16/* The initial domain. */
17struct tomoyo_domain_info tomoyo_kernel_domain;
18
19/**
20 * tomoyo_update_policy - Update an entry for exception policy.
21 *
22 * @new_entry: Pointer to "struct tomoyo_acl_info".
23 * @size: Size of @new_entry in bytes.
24 * @param: Pointer to "struct tomoyo_acl_param".
25 * @check_duplicate: Callback function to find duplicated entry.
26 *
27 * Returns 0 on success, negative value otherwise.
28 *
29 * Caller holds tomoyo_read_lock().
30 */
31int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
32 struct tomoyo_acl_param *param,
33 bool (*check_duplicate)(const struct tomoyo_acl_head
34 *,
35 const struct tomoyo_acl_head
36 *))
37{
38 int error = param->is_delete ? -ENOENT : -ENOMEM;
39 struct tomoyo_acl_head *entry;
40 struct list_head *list = param->list;
41
42 if (mutex_lock_interruptible(&tomoyo_policy_lock))
43 return -ENOMEM;
44 list_for_each_entry_rcu(entry, list, list,
45 srcu_read_lock_held(&tomoyo_ss)) {
46 if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS)
47 continue;
48 if (!check_duplicate(entry, new_entry))
49 continue;
50 entry->is_deleted = param->is_delete;
51 error = 0;
52 break;
53 }
54 if (error && !param->is_delete) {
55 entry = tomoyo_commit_ok(new_entry, size);
56 if (entry) {
57 list_add_tail_rcu(&entry->list, list);
58 error = 0;
59 }
60 }
61 mutex_unlock(&tomoyo_policy_lock);
62 return error;
63}
64
65/**
66 * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
67 *
68 * @a: Pointer to "struct tomoyo_acl_info".
69 * @b: Pointer to "struct tomoyo_acl_info".
70 *
71 * Returns true if @a == @b, false otherwise.
72 */
73static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
74 const struct tomoyo_acl_info *b)
75{
76 return a->type == b->type && a->cond == b->cond;
77}
78
79/**
80 * tomoyo_update_domain - Update an entry for domain policy.
81 *
82 * @new_entry: Pointer to "struct tomoyo_acl_info".
83 * @size: Size of @new_entry in bytes.
84 * @param: Pointer to "struct tomoyo_acl_param".
85 * @check_duplicate: Callback function to find duplicated entry.
86 * @merge_duplicate: Callback function to merge duplicated entry.
87 *
88 * Returns 0 on success, negative value otherwise.
89 *
90 * Caller holds tomoyo_read_lock().
91 */
92int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
93 struct tomoyo_acl_param *param,
94 bool (*check_duplicate)(const struct tomoyo_acl_info
95 *,
96 const struct tomoyo_acl_info
97 *),
98 bool (*merge_duplicate)(struct tomoyo_acl_info *,
99 struct tomoyo_acl_info *,
100 const bool))
101{
102 const bool is_delete = param->is_delete;
103 int error = is_delete ? -ENOENT : -ENOMEM;
104 struct tomoyo_acl_info *entry;
105 struct list_head * const list = param->list;
106
107 if (param->data[0]) {
108 new_entry->cond = tomoyo_get_condition(param);
109 if (!new_entry->cond)
110 return -EINVAL;
111 /*
112 * Domain transition preference is allowed for only
113 * "file execute" entries.
114 */
115 if (new_entry->cond->transit &&
116 !(new_entry->type == TOMOYO_TYPE_PATH_ACL &&
117 container_of(new_entry, struct tomoyo_path_acl, head)
118 ->perm == 1 << TOMOYO_TYPE_EXECUTE))
119 goto out;
120 }
121 if (mutex_lock_interruptible(&tomoyo_policy_lock))
122 goto out;
123 list_for_each_entry_rcu(entry, list, list,
124 srcu_read_lock_held(&tomoyo_ss)) {
125 if (entry->is_deleted == TOMOYO_GC_IN_PROGRESS)
126 continue;
127 if (!tomoyo_same_acl_head(entry, new_entry) ||
128 !check_duplicate(entry, new_entry))
129 continue;
130 if (merge_duplicate)
131 entry->is_deleted = merge_duplicate(entry, new_entry,
132 is_delete);
133 else
134 entry->is_deleted = is_delete;
135 error = 0;
136 break;
137 }
138 if (error && !is_delete) {
139 entry = tomoyo_commit_ok(new_entry, size);
140 if (entry) {
141 list_add_tail_rcu(&entry->list, list);
142 error = 0;
143 }
144 }
145 mutex_unlock(&tomoyo_policy_lock);
146out:
147 tomoyo_put_condition(new_entry->cond);
148 return error;
149}
150
151/**
152 * tomoyo_check_acl - Do permission check.
153 *
154 * @r: Pointer to "struct tomoyo_request_info".
155 * @check_entry: Callback function to check type specific parameters.
156 *
157 * Returns 0 on success, negative value otherwise.
158 *
159 * Caller holds tomoyo_read_lock().
160 */
161void tomoyo_check_acl(struct tomoyo_request_info *r,
162 bool (*check_entry)(struct tomoyo_request_info *,
163 const struct tomoyo_acl_info *))
164{
165 const struct tomoyo_domain_info *domain = r->domain;
166 struct tomoyo_acl_info *ptr;
167 const struct list_head *list = &domain->acl_info_list;
168 u16 i = 0;
169
170retry:
171 list_for_each_entry_rcu(ptr, list, list,
172 srcu_read_lock_held(&tomoyo_ss)) {
173 if (ptr->is_deleted || ptr->type != r->param_type)
174 continue;
175 if (!check_entry(r, ptr))
176 continue;
177 if (!tomoyo_condition(r, ptr->cond))
178 continue;
179 r->matched_acl = ptr;
180 r->granted = true;
181 return;
182 }
183 for (; i < TOMOYO_MAX_ACL_GROUPS; i++) {
184 if (!test_bit(i, domain->group))
185 continue;
186 list = &domain->ns->acl_group[i++];
187 goto retry;
188 }
189 r->granted = false;
190}
191
192/* The list for "struct tomoyo_domain_info". */
193LIST_HEAD(tomoyo_domain_list);
194
195/**
196 * tomoyo_last_word - Get last component of a domainname.
197 *
198 * @name: Domainname to check.
199 *
200 * Returns the last word of @domainname.
201 */
202static const char *tomoyo_last_word(const char *name)
203{
204 const char *cp = strrchr(name, ' ');
205
206 if (cp)
207 return cp + 1;
208 return name;
209}
210
211/**
212 * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry.
213 *
214 * @a: Pointer to "struct tomoyo_acl_head".
215 * @b: Pointer to "struct tomoyo_acl_head".
216 *
217 * Returns true if @a == @b, false otherwise.
218 */
219static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
220 const struct tomoyo_acl_head *b)
221{
222 const struct tomoyo_transition_control *p1 = container_of(a,
223 typeof(*p1),
224 head);
225 const struct tomoyo_transition_control *p2 = container_of(b,
226 typeof(*p2),
227 head);
228
229 return p1->type == p2->type && p1->is_last_name == p2->is_last_name
230 && p1->domainname == p2->domainname
231 && p1->program == p2->program;
232}
233
234/**
235 * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list.
236 *
237 * @param: Pointer to "struct tomoyo_acl_param".
238 * @type: Type of this entry.
239 *
240 * Returns 0 on success, negative value otherwise.
241 */
242int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
243 const u8 type)
244{
245 struct tomoyo_transition_control e = { .type = type };
246 int error = param->is_delete ? -ENOENT : -ENOMEM;
247 char *program = param->data;
248 char *domainname = strstr(program, " from ");
249
250 if (domainname) {
251 *domainname = '\0';
252 domainname += 6;
253 } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP ||
254 type == TOMOYO_TRANSITION_CONTROL_KEEP) {
255 domainname = program;
256 program = NULL;
257 }
258 if (program && strcmp(program, "any")) {
259 if (!tomoyo_correct_path(program))
260 return -EINVAL;
261 e.program = tomoyo_get_name(program);
262 if (!e.program)
263 goto out;
264 }
265 if (domainname && strcmp(domainname, "any")) {
266 if (!tomoyo_correct_domain(domainname)) {
267 if (!tomoyo_correct_path(domainname))
268 goto out;
269 e.is_last_name = true;
270 }
271 e.domainname = tomoyo_get_name(domainname);
272 if (!e.domainname)
273 goto out;
274 }
275 param->list = ¶m->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
276 error = tomoyo_update_policy(&e.head, sizeof(e), param,
277 tomoyo_same_transition_control);
278out:
279 tomoyo_put_name(e.domainname);
280 tomoyo_put_name(e.program);
281 return error;
282}
283
284/**
285 * tomoyo_scan_transition - Try to find specific domain transition type.
286 *
287 * @list: Pointer to "struct list_head".
288 * @domainname: The name of current domain.
289 * @program: The name of requested program.
290 * @last_name: The last component of @domainname.
291 * @type: One of values in "enum tomoyo_transition_type".
292 *
293 * Returns true if found one, false otherwise.
294 *
295 * Caller holds tomoyo_read_lock().
296 */
297static inline bool tomoyo_scan_transition
298(const struct list_head *list, const struct tomoyo_path_info *domainname,
299 const struct tomoyo_path_info *program, const char *last_name,
300 const enum tomoyo_transition_type type)
301{
302 const struct tomoyo_transition_control *ptr;
303
304 list_for_each_entry_rcu(ptr, list, head.list,
305 srcu_read_lock_held(&tomoyo_ss)) {
306 if (ptr->head.is_deleted || ptr->type != type)
307 continue;
308 if (ptr->domainname) {
309 if (!ptr->is_last_name) {
310 if (ptr->domainname != domainname)
311 continue;
312 } else {
313 /*
314 * Use direct strcmp() since this is
315 * unlikely used.
316 */
317 if (strcmp(ptr->domainname->name, last_name))
318 continue;
319 }
320 }
321 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
322 continue;
323 return true;
324 }
325 return false;
326}
327
328/**
329 * tomoyo_transition_type - Get domain transition type.
330 *
331 * @ns: Pointer to "struct tomoyo_policy_namespace".
332 * @domainname: The name of current domain.
333 * @program: The name of requested program.
334 *
335 * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes
336 * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if
337 * executing @program reinitializes domain transition within that namespace,
338 * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname ,
339 * others otherwise.
340 *
341 * Caller holds tomoyo_read_lock().
342 */
343static enum tomoyo_transition_type tomoyo_transition_type
344(const struct tomoyo_policy_namespace *ns,
345 const struct tomoyo_path_info *domainname,
346 const struct tomoyo_path_info *program)
347{
348 const char *last_name = tomoyo_last_word(domainname->name);
349 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
350
351 while (type < TOMOYO_MAX_TRANSITION_TYPE) {
352 const struct list_head * const list =
353 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
354
355 if (!tomoyo_scan_transition(list, domainname, program,
356 last_name, type)) {
357 type++;
358 continue;
359 }
360 if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET &&
361 type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE)
362 break;
363 /*
364 * Do not check for reset_domain if no_reset_domain matched.
365 * Do not check for initialize_domain if no_initialize_domain
366 * matched.
367 */
368 type++;
369 type++;
370 }
371 return type;
372}
373
374/**
375 * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry.
376 *
377 * @a: Pointer to "struct tomoyo_acl_head".
378 * @b: Pointer to "struct tomoyo_acl_head".
379 *
380 * Returns true if @a == @b, false otherwise.
381 */
382static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
383 const struct tomoyo_acl_head *b)
384{
385 const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1),
386 head);
387 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
388 head);
389
390 return p1->original_name == p2->original_name &&
391 p1->aggregated_name == p2->aggregated_name;
392}
393
394/**
395 * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list.
396 *
397 * @param: Pointer to "struct tomoyo_acl_param".
398 *
399 * Returns 0 on success, negative value otherwise.
400 *
401 * Caller holds tomoyo_read_lock().
402 */
403int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
404{
405 struct tomoyo_aggregator e = { };
406 int error = param->is_delete ? -ENOENT : -ENOMEM;
407 const char *original_name = tomoyo_read_token(param);
408 const char *aggregated_name = tomoyo_read_token(param);
409
410 if (!tomoyo_correct_word(original_name) ||
411 !tomoyo_correct_path(aggregated_name))
412 return -EINVAL;
413 e.original_name = tomoyo_get_name(original_name);
414 e.aggregated_name = tomoyo_get_name(aggregated_name);
415 if (!e.original_name || !e.aggregated_name ||
416 e.aggregated_name->is_patterned) /* No patterns allowed. */
417 goto out;
418 param->list = ¶m->ns->policy_list[TOMOYO_ID_AGGREGATOR];
419 error = tomoyo_update_policy(&e.head, sizeof(e), param,
420 tomoyo_same_aggregator);
421out:
422 tomoyo_put_name(e.original_name);
423 tomoyo_put_name(e.aggregated_name);
424 return error;
425}
426
427/**
428 * tomoyo_find_namespace - Find specified namespace.
429 *
430 * @name: Name of namespace to find.
431 * @len: Length of @name.
432 *
433 * Returns pointer to "struct tomoyo_policy_namespace" if found,
434 * NULL otherwise.
435 *
436 * Caller holds tomoyo_read_lock().
437 */
438static struct tomoyo_policy_namespace *tomoyo_find_namespace
439(const char *name, const unsigned int len)
440{
441 struct tomoyo_policy_namespace *ns;
442
443 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
444 if (strncmp(name, ns->name, len) ||
445 (name[len] && name[len] != ' '))
446 continue;
447 return ns;
448 }
449 return NULL;
450}
451
452/**
453 * tomoyo_assign_namespace - Create a new namespace.
454 *
455 * @domainname: Name of namespace to create.
456 *
457 * Returns pointer to "struct tomoyo_policy_namespace" on success,
458 * NULL otherwise.
459 *
460 * Caller holds tomoyo_read_lock().
461 */
462struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
463{
464 struct tomoyo_policy_namespace *ptr;
465 struct tomoyo_policy_namespace *entry;
466 const char *cp = domainname;
467 unsigned int len = 0;
468
469 while (*cp && *cp++ != ' ')
470 len++;
471 ptr = tomoyo_find_namespace(domainname, len);
472 if (ptr)
473 return ptr;
474 if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(domainname))
475 return NULL;
476 entry = kzalloc(sizeof(*entry) + len + 1, GFP_NOFS | __GFP_NOWARN);
477 if (mutex_lock_interruptible(&tomoyo_policy_lock))
478 goto out;
479 ptr = tomoyo_find_namespace(domainname, len);
480 if (!ptr && tomoyo_memory_ok(entry)) {
481 char *name = (char *) (entry + 1);
482
483 ptr = entry;
484 memmove(name, domainname, len);
485 name[len] = '\0';
486 entry->name = name;
487 tomoyo_init_policy_namespace(entry);
488 entry = NULL;
489 }
490 mutex_unlock(&tomoyo_policy_lock);
491out:
492 kfree(entry);
493 return ptr;
494}
495
496/**
497 * tomoyo_namespace_jump - Check for namespace jump.
498 *
499 * @domainname: Name of domain.
500 *
501 * Returns true if namespace differs, false otherwise.
502 */
503static bool tomoyo_namespace_jump(const char *domainname)
504{
505 const char *namespace = tomoyo_current_namespace()->name;
506 const int len = strlen(namespace);
507
508 return strncmp(domainname, namespace, len) ||
509 (domainname[len] && domainname[len] != ' ');
510}
511
512/**
513 * tomoyo_assign_domain - Create a domain or a namespace.
514 *
515 * @domainname: The name of domain.
516 * @transit: True if transit to domain found or created.
517 *
518 * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
519 *
520 * Caller holds tomoyo_read_lock().
521 */
522struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
523 const bool transit)
524{
525 struct tomoyo_domain_info e = { };
526 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
527 bool created = false;
528
529 if (entry) {
530 if (transit) {
531 /*
532 * Since namespace is created at runtime, profiles may
533 * not be created by the moment the process transits to
534 * that domain. Do not perform domain transition if
535 * profile for that domain is not yet created.
536 */
537 if (tomoyo_policy_loaded &&
538 !entry->ns->profile_ptr[entry->profile])
539 return NULL;
540 }
541 return entry;
542 }
543 /* Requested domain does not exist. */
544 /* Don't create requested domain if domainname is invalid. */
545 if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 ||
546 !tomoyo_correct_domain(domainname))
547 return NULL;
548 /*
549 * Since definition of profiles and acl_groups may differ across
550 * namespaces, do not inherit "use_profile" and "use_group" settings
551 * by automatically creating requested domain upon domain transition.
552 */
553 if (transit && tomoyo_namespace_jump(domainname))
554 return NULL;
555 e.ns = tomoyo_assign_namespace(domainname);
556 if (!e.ns)
557 return NULL;
558 /*
559 * "use_profile" and "use_group" settings for automatically created
560 * domains are inherited from current domain. These are 0 for manually
561 * created domains.
562 */
563 if (transit) {
564 const struct tomoyo_domain_info *domain = tomoyo_domain();
565
566 e.profile = domain->profile;
567 memcpy(e.group, domain->group, sizeof(e.group));
568 }
569 e.domainname = tomoyo_get_name(domainname);
570 if (!e.domainname)
571 return NULL;
572 if (mutex_lock_interruptible(&tomoyo_policy_lock))
573 goto out;
574 entry = tomoyo_find_domain(domainname);
575 if (!entry) {
576 entry = tomoyo_commit_ok(&e, sizeof(e));
577 if (entry) {
578 INIT_LIST_HEAD(&entry->acl_info_list);
579 list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
580 created = true;
581 }
582 }
583 mutex_unlock(&tomoyo_policy_lock);
584out:
585 tomoyo_put_name(e.domainname);
586 if (entry && transit) {
587 if (created) {
588 struct tomoyo_request_info r;
589 int i;
590
591 tomoyo_init_request_info(&r, entry,
592 TOMOYO_MAC_FILE_EXECUTE);
593 r.granted = false;
594 tomoyo_write_log(&r, "use_profile %u\n",
595 entry->profile);
596 for (i = 0; i < TOMOYO_MAX_ACL_GROUPS; i++)
597 if (test_bit(i, entry->group))
598 tomoyo_write_log(&r, "use_group %u\n",
599 i);
600 tomoyo_update_stat(TOMOYO_STAT_POLICY_UPDATES);
601 }
602 }
603 return entry;
604}
605
606/**
607 * tomoyo_environ - Check permission for environment variable names.
608 *
609 * @ee: Pointer to "struct tomoyo_execve".
610 *
611 * Returns 0 on success, negative value otherwise.
612 */
613static int tomoyo_environ(struct tomoyo_execve *ee)
614{
615 struct tomoyo_request_info *r = &ee->r;
616 struct linux_binprm *bprm = ee->bprm;
617 /* env_page.data is allocated by tomoyo_dump_page(). */
618 struct tomoyo_page_dump env_page = { };
619 char *arg_ptr; /* Size is TOMOYO_EXEC_TMPSIZE bytes */
620 int arg_len = 0;
621 unsigned long pos = bprm->p;
622 int offset = pos % PAGE_SIZE;
623 int argv_count = bprm->argc;
624 int envp_count = bprm->envc;
625 int error = -ENOMEM;
626
627 ee->r.type = TOMOYO_MAC_ENVIRON;
628 ee->r.profile = r->domain->profile;
629 ee->r.mode = tomoyo_get_mode(r->domain->ns, ee->r.profile,
630 TOMOYO_MAC_ENVIRON);
631 if (!r->mode || !envp_count)
632 return 0;
633 arg_ptr = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
634 if (!arg_ptr)
635 goto out;
636 while (error == -ENOMEM) {
637 if (!tomoyo_dump_page(bprm, pos, &env_page))
638 goto out;
639 pos += PAGE_SIZE - offset;
640 /* Read. */
641 while (argv_count && offset < PAGE_SIZE) {
642 if (!env_page.data[offset++])
643 argv_count--;
644 }
645 if (argv_count) {
646 offset = 0;
647 continue;
648 }
649 while (offset < PAGE_SIZE) {
650 const unsigned char c = env_page.data[offset++];
651
652 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
653 if (c == '=') {
654 arg_ptr[arg_len++] = '\0';
655 } else if (c == '\\') {
656 arg_ptr[arg_len++] = '\\';
657 arg_ptr[arg_len++] = '\\';
658 } else if (c > ' ' && c < 127) {
659 arg_ptr[arg_len++] = c;
660 } else {
661 arg_ptr[arg_len++] = '\\';
662 arg_ptr[arg_len++] = (c >> 6) + '0';
663 arg_ptr[arg_len++]
664 = ((c >> 3) & 7) + '0';
665 arg_ptr[arg_len++] = (c & 7) + '0';
666 }
667 } else {
668 arg_ptr[arg_len] = '\0';
669 }
670 if (c)
671 continue;
672 if (tomoyo_env_perm(r, arg_ptr)) {
673 error = -EPERM;
674 break;
675 }
676 if (!--envp_count) {
677 error = 0;
678 break;
679 }
680 arg_len = 0;
681 }
682 offset = 0;
683 }
684out:
685 if (r->mode != TOMOYO_CONFIG_ENFORCING)
686 error = 0;
687 kfree(env_page.data);
688 kfree(arg_ptr);
689 return error;
690}
691
692/**
693 * tomoyo_find_next_domain - Find a domain.
694 *
695 * @bprm: Pointer to "struct linux_binprm".
696 *
697 * Returns 0 on success, negative value otherwise.
698 *
699 * Caller holds tomoyo_read_lock().
700 */
701int tomoyo_find_next_domain(struct linux_binprm *bprm)
702{
703 struct tomoyo_domain_info *old_domain = tomoyo_domain();
704 struct tomoyo_domain_info *domain = NULL;
705 const char *original_name = bprm->filename;
706 int retval = -ENOMEM;
707 bool reject_on_transition_failure = false;
708 const struct tomoyo_path_info *candidate;
709 struct tomoyo_path_info exename;
710 struct tomoyo_execve *ee = kzalloc(sizeof(*ee), GFP_NOFS);
711
712 if (!ee)
713 return -ENOMEM;
714 ee->tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
715 if (!ee->tmp) {
716 kfree(ee);
717 return -ENOMEM;
718 }
719 /* ee->dump->data is allocated by tomoyo_dump_page(). */
720 tomoyo_init_request_info(&ee->r, NULL, TOMOYO_MAC_FILE_EXECUTE);
721 ee->r.ee = ee;
722 ee->bprm = bprm;
723 ee->r.obj = &ee->obj;
724 ee->obj.path1 = bprm->file->f_path;
725 /* Get symlink's pathname of program. */
726 exename.name = tomoyo_realpath_nofollow(original_name);
727 if (!exename.name) {
728 /* Fallback to realpath if symlink's pathname does not exist. */
729 exename.name = tomoyo_realpath_from_path(&bprm->file->f_path);
730 if (!exename.name)
731 goto out;
732 }
733 tomoyo_fill_path_info(&exename);
734retry:
735 /* Check 'aggregator' directive. */
736 {
737 struct tomoyo_aggregator *ptr;
738 struct list_head *list =
739 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
740
741 /* Check 'aggregator' directive. */
742 candidate = &exename;
743 list_for_each_entry_rcu(ptr, list, head.list,
744 srcu_read_lock_held(&tomoyo_ss)) {
745 if (ptr->head.is_deleted ||
746 !tomoyo_path_matches_pattern(&exename,
747 ptr->original_name))
748 continue;
749 candidate = ptr->aggregated_name;
750 break;
751 }
752 }
753
754 /* Check execute permission. */
755 retval = tomoyo_execute_permission(&ee->r, candidate);
756 if (retval == TOMOYO_RETRY_REQUEST)
757 goto retry;
758 if (retval < 0)
759 goto out;
760 /*
761 * To be able to specify domainnames with wildcards, use the
762 * pathname specified in the policy (which may contain
763 * wildcard) rather than the pathname passed to execve()
764 * (which never contains wildcard).
765 */
766 if (ee->r.param.path.matched_path)
767 candidate = ee->r.param.path.matched_path;
768
769 /*
770 * Check for domain transition preference if "file execute" matched.
771 * If preference is given, make execve() fail if domain transition
772 * has failed, for domain transition preference should be used with
773 * destination domain defined.
774 */
775 if (ee->transition) {
776 const char *domainname = ee->transition->name;
777
778 reject_on_transition_failure = true;
779 if (!strcmp(domainname, "keep"))
780 goto force_keep_domain;
781 if (!strcmp(domainname, "child"))
782 goto force_child_domain;
783 if (!strcmp(domainname, "reset"))
784 goto force_reset_domain;
785 if (!strcmp(domainname, "initialize"))
786 goto force_initialize_domain;
787 if (!strcmp(domainname, "parent")) {
788 char *cp;
789
790 strscpy(ee->tmp, old_domain->domainname->name, TOMOYO_EXEC_TMPSIZE);
791 cp = strrchr(ee->tmp, ' ');
792 if (cp)
793 *cp = '\0';
794 } else if (*domainname == '<')
795 strscpy(ee->tmp, domainname, TOMOYO_EXEC_TMPSIZE);
796 else
797 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
798 old_domain->domainname->name, domainname);
799 goto force_jump_domain;
800 }
801 /*
802 * No domain transition preference specified.
803 * Calculate domain to transit to.
804 */
805 switch (tomoyo_transition_type(old_domain->ns, old_domain->domainname,
806 candidate)) {
807 case TOMOYO_TRANSITION_CONTROL_RESET:
808force_reset_domain:
809 /* Transit to the root of specified namespace. */
810 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "<%s>",
811 candidate->name);
812 /*
813 * Make execve() fail if domain transition across namespaces
814 * has failed.
815 */
816 reject_on_transition_failure = true;
817 break;
818 case TOMOYO_TRANSITION_CONTROL_INITIALIZE:
819force_initialize_domain:
820 /* Transit to the child of current namespace's root. */
821 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
822 old_domain->ns->name, candidate->name);
823 break;
824 case TOMOYO_TRANSITION_CONTROL_KEEP:
825force_keep_domain:
826 /* Keep current domain. */
827 domain = old_domain;
828 break;
829 default:
830 if (old_domain == &tomoyo_kernel_domain &&
831 !tomoyo_policy_loaded) {
832 /*
833 * Needn't to transit from kernel domain before
834 * starting /sbin/init. But transit from kernel domain
835 * if executing initializers because they might start
836 * before /sbin/init.
837 */
838 domain = old_domain;
839 break;
840 }
841force_child_domain:
842 /* Normal domain transition. */
843 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
844 old_domain->domainname->name, candidate->name);
845 break;
846 }
847force_jump_domain:
848 if (!domain)
849 domain = tomoyo_assign_domain(ee->tmp, true);
850 if (domain)
851 retval = 0;
852 else if (reject_on_transition_failure) {
853 pr_warn("ERROR: Domain '%s' not ready.\n", ee->tmp);
854 retval = -ENOMEM;
855 } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING)
856 retval = -ENOMEM;
857 else {
858 retval = 0;
859 if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) {
860 old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true;
861 ee->r.granted = false;
862 tomoyo_write_log(&ee->r, "%s", tomoyo_dif
863 [TOMOYO_DIF_TRANSITION_FAILED]);
864 pr_warn("ERROR: Domain '%s' not defined.\n", ee->tmp);
865 }
866 }
867 out:
868 if (!domain)
869 domain = old_domain;
870 /* Update reference count on "struct tomoyo_domain_info". */
871 {
872 struct tomoyo_task *s = tomoyo_task(current);
873
874 s->old_domain_info = s->domain_info;
875 s->domain_info = domain;
876 atomic_inc(&domain->users);
877 }
878 kfree(exename.name);
879 if (!retval) {
880 ee->r.domain = domain;
881 retval = tomoyo_environ(ee);
882 }
883 kfree(ee->tmp);
884 kfree(ee->dump.data);
885 kfree(ee);
886 return retval;
887}
888
889/**
890 * tomoyo_dump_page - Dump a page to buffer.
891 *
892 * @bprm: Pointer to "struct linux_binprm".
893 * @pos: Location to dump.
894 * @dump: Pointer to "struct tomoyo_page_dump".
895 *
896 * Returns true on success, false otherwise.
897 */
898bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
899 struct tomoyo_page_dump *dump)
900{
901 struct page *page;
902#ifdef CONFIG_MMU
903 int ret;
904#endif
905
906 /* dump->data is released by tomoyo_find_next_domain(). */
907 if (!dump->data) {
908 dump->data = kzalloc(PAGE_SIZE, GFP_NOFS);
909 if (!dump->data)
910 return false;
911 }
912 /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */
913#ifdef CONFIG_MMU
914 /*
915 * This is called at execve() time in order to dig around
916 * in the argv/environment of the new proceess
917 * (represented by bprm).
918 */
919 mmap_read_lock(bprm->mm);
920 ret = get_user_pages_remote(bprm->mm, pos, 1,
921 FOLL_FORCE, &page, NULL);
922 mmap_read_unlock(bprm->mm);
923 if (ret <= 0)
924 return false;
925#else
926 page = bprm->page[pos / PAGE_SIZE];
927#endif
928 if (page != dump->page) {
929 const unsigned int offset = pos % PAGE_SIZE;
930 /*
931 * Maybe kmap()/kunmap() should be used here.
932 * But remove_arg_zero() uses kmap_atomic()/kunmap_atomic().
933 * So do I.
934 */
935 char *kaddr = kmap_atomic(page);
936
937 dump->page = page;
938 memcpy(dump->data + offset, kaddr + offset,
939 PAGE_SIZE - offset);
940 kunmap_atomic(kaddr);
941 }
942 /* Same with put_arg_page(page) in fs/exec.c */
943#ifdef CONFIG_MMU
944 put_page(page);
945#endif
946 return true;
947}