Loading...
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/realpath.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include "common.h"
9#include <linux/magic.h>
10#include <linux/proc_fs.h>
11
12/**
13 * tomoyo_encode2 - Encode binary string to ascii string.
14 *
15 * @str: String in binary format.
16 * @str_len: Size of @str in byte.
17 *
18 * Returns pointer to @str in ascii format on success, NULL otherwise.
19 *
20 * This function uses kzalloc(), so caller must kfree() if this function
21 * didn't return NULL.
22 */
23char *tomoyo_encode2(const char *str, int str_len)
24{
25 int i;
26 int len = 0;
27 const char *p = str;
28 char *cp;
29 char *cp0;
30
31 if (!p)
32 return NULL;
33 for (i = 0; i < str_len; i++) {
34 const unsigned char c = p[i];
35
36 if (c == '\\')
37 len += 2;
38 else if (c > ' ' && c < 127)
39 len++;
40 else
41 len += 4;
42 }
43 len++;
44 /* Reserve space for appending "/". */
45 cp = kzalloc(len + 10, GFP_NOFS);
46 if (!cp)
47 return NULL;
48 cp0 = cp;
49 p = str;
50 for (i = 0; i < str_len; i++) {
51 const unsigned char c = p[i];
52
53 if (c == '\\') {
54 *cp++ = '\\';
55 *cp++ = '\\';
56 } else if (c > ' ' && c < 127) {
57 *cp++ = c;
58 } else {
59 *cp++ = '\\';
60 *cp++ = (c >> 6) + '0';
61 *cp++ = ((c >> 3) & 7) + '0';
62 *cp++ = (c & 7) + '0';
63 }
64 }
65 return cp0;
66}
67
68/**
69 * tomoyo_encode - Encode binary string to ascii string.
70 *
71 * @str: String in binary format.
72 *
73 * Returns pointer to @str in ascii format on success, NULL otherwise.
74 *
75 * This function uses kzalloc(), so caller must kfree() if this function
76 * didn't return NULL.
77 */
78char *tomoyo_encode(const char *str)
79{
80 return str ? tomoyo_encode2(str, strlen(str)) : NULL;
81}
82
83/**
84 * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
85 *
86 * @path: Pointer to "struct path".
87 * @buffer: Pointer to buffer to return value in.
88 * @buflen: Sizeof @buffer.
89 *
90 * Returns the buffer on success, an error code otherwise.
91 *
92 * If dentry is a directory, trailing '/' is appended.
93 */
94static char *tomoyo_get_absolute_path(const struct path *path, char * const buffer,
95 const int buflen)
96{
97 char *pos = ERR_PTR(-ENOMEM);
98
99 if (buflen >= 256) {
100 /* go to whatever namespace root we are under */
101 pos = d_absolute_path(path, buffer, buflen - 1);
102 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
103 struct inode *inode = d_backing_inode(path->dentry);
104
105 if (inode && S_ISDIR(inode->i_mode)) {
106 buffer[buflen - 2] = '/';
107 buffer[buflen - 1] = '\0';
108 }
109 }
110 }
111 return pos;
112}
113
114/**
115 * tomoyo_get_dentry_path - Get the path of a dentry.
116 *
117 * @dentry: Pointer to "struct dentry".
118 * @buffer: Pointer to buffer to return value in.
119 * @buflen: Sizeof @buffer.
120 *
121 * Returns the buffer on success, an error code otherwise.
122 *
123 * If dentry is a directory, trailing '/' is appended.
124 */
125static char *tomoyo_get_dentry_path(struct dentry *dentry, char * const buffer,
126 const int buflen)
127{
128 char *pos = ERR_PTR(-ENOMEM);
129
130 if (buflen >= 256) {
131 pos = dentry_path_raw(dentry, buffer, buflen - 1);
132 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
133 struct inode *inode = d_backing_inode(dentry);
134
135 if (inode && S_ISDIR(inode->i_mode)) {
136 buffer[buflen - 2] = '/';
137 buffer[buflen - 1] = '\0';
138 }
139 }
140 }
141 return pos;
142}
143
144/**
145 * tomoyo_get_local_path - Get the path of a dentry.
146 *
147 * @dentry: Pointer to "struct dentry".
148 * @buffer: Pointer to buffer to return value in.
149 * @buflen: Sizeof @buffer.
150 *
151 * Returns the buffer on success, an error code otherwise.
152 */
153static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
154 const int buflen)
155{
156 struct super_block *sb = dentry->d_sb;
157 char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
158
159 if (IS_ERR(pos))
160 return pos;
161 /* Convert from $PID to self if $PID is current thread. */
162 if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
163 char *ep;
164 const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
165 struct pid_namespace *proc_pidns = proc_pid_ns(sb);
166
167 if (*ep == '/' && pid && pid ==
168 task_tgid_nr_ns(current, proc_pidns)) {
169 pos = ep - 5;
170 if (pos < buffer)
171 goto out;
172 memmove(pos, "/self", 5);
173 }
174 goto prepend_filesystem_name;
175 }
176 /* Use filesystem name for unnamed devices. */
177 if (!MAJOR(sb->s_dev))
178 goto prepend_filesystem_name;
179 {
180 struct inode *inode = d_backing_inode(sb->s_root);
181
182 /*
183 * Use filesystem name if filesystem does not support rename()
184 * operation.
185 */
186 if (!inode->i_op->rename)
187 goto prepend_filesystem_name;
188 }
189 /* Prepend device name. */
190 {
191 char name[64];
192 int name_len;
193 const dev_t dev = sb->s_dev;
194
195 name[sizeof(name) - 1] = '\0';
196 snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
197 MINOR(dev));
198 name_len = strlen(name);
199 pos -= name_len;
200 if (pos < buffer)
201 goto out;
202 memmove(pos, name, name_len);
203 return pos;
204 }
205 /* Prepend filesystem name. */
206prepend_filesystem_name:
207 {
208 const char *name = sb->s_type->name;
209 const int name_len = strlen(name);
210
211 pos -= name_len + 1;
212 if (pos < buffer)
213 goto out;
214 memmove(pos, name, name_len);
215 pos[name_len] = ':';
216 }
217 return pos;
218out:
219 return ERR_PTR(-ENOMEM);
220}
221
222/**
223 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
224 *
225 * @path: Pointer to "struct path".
226 *
227 * Returns the realpath of the given @path on success, NULL otherwise.
228 *
229 * If dentry is a directory, trailing '/' is appended.
230 * Characters out of 0x20 < c < 0x7F range are converted to
231 * \ooo style octal string.
232 * Character \ is converted to \\ string.
233 *
234 * These functions use kzalloc(), so the caller must call kfree()
235 * if these functions didn't return NULL.
236 */
237char *tomoyo_realpath_from_path(const struct path *path)
238{
239 char *buf = NULL;
240 char *name = NULL;
241 unsigned int buf_len = PAGE_SIZE / 2;
242 struct dentry *dentry = path->dentry;
243 struct super_block *sb = dentry->d_sb;
244
245 while (1) {
246 char *pos;
247 struct inode *inode;
248
249 buf_len <<= 1;
250 kfree(buf);
251 buf = kmalloc(buf_len, GFP_NOFS);
252 if (!buf)
253 break;
254 /* To make sure that pos is '\0' terminated. */
255 buf[buf_len - 1] = '\0';
256 /* For "pipe:[\$]" and "socket:[\$]". */
257 if (dentry->d_op && dentry->d_op->d_dname) {
258 pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
259 goto encode;
260 }
261 inode = d_backing_inode(sb->s_root);
262 /*
263 * Get local name for filesystems without rename() operation
264 */
265 if ((!inode->i_op->rename &&
266 !(sb->s_type->fs_flags & FS_REQUIRES_DEV)))
267 pos = tomoyo_get_local_path(path->dentry, buf,
268 buf_len - 1);
269 /* Get absolute name for the rest. */
270 else {
271 pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
272 /*
273 * Fall back to local name if absolute name is not
274 * available.
275 */
276 if (pos == ERR_PTR(-EINVAL))
277 pos = tomoyo_get_local_path(path->dentry, buf,
278 buf_len - 1);
279 }
280encode:
281 if (IS_ERR(pos))
282 continue;
283 name = tomoyo_encode(pos);
284 break;
285 }
286 kfree(buf);
287 if (!name)
288 tomoyo_warn_oom(__func__);
289 return name;
290}
291
292/**
293 * tomoyo_realpath_nofollow - Get realpath of a pathname.
294 *
295 * @pathname: The pathname to solve.
296 *
297 * Returns the realpath of @pathname on success, NULL otherwise.
298 */
299char *tomoyo_realpath_nofollow(const char *pathname)
300{
301 struct path path;
302
303 if (pathname && kern_path(pathname, 0, &path) == 0) {
304 char *buf = tomoyo_realpath_from_path(&path);
305
306 path_put(&path);
307 return buf;
308 }
309 return NULL;
310}
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/realpath.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include "common.h"
9#include <linux/magic.h>
10
11/**
12 * tomoyo_encode2 - Encode binary string to ascii string.
13 *
14 * @str: String in binary format.
15 * @str_len: Size of @str in byte.
16 *
17 * Returns pointer to @str in ascii format on success, NULL otherwise.
18 *
19 * This function uses kzalloc(), so caller must kfree() if this function
20 * didn't return NULL.
21 */
22char *tomoyo_encode2(const char *str, int str_len)
23{
24 int i;
25 int len = 0;
26 const char *p = str;
27 char *cp;
28 char *cp0;
29
30 if (!p)
31 return NULL;
32 for (i = 0; i < str_len; i++) {
33 const unsigned char c = p[i];
34
35 if (c == '\\')
36 len += 2;
37 else if (c > ' ' && c < 127)
38 len++;
39 else
40 len += 4;
41 }
42 len++;
43 /* Reserve space for appending "/". */
44 cp = kzalloc(len + 10, GFP_NOFS);
45 if (!cp)
46 return NULL;
47 cp0 = cp;
48 p = str;
49 for (i = 0; i < str_len; i++) {
50 const unsigned char c = p[i];
51
52 if (c == '\\') {
53 *cp++ = '\\';
54 *cp++ = '\\';
55 } else if (c > ' ' && c < 127) {
56 *cp++ = c;
57 } else {
58 *cp++ = '\\';
59 *cp++ = (c >> 6) + '0';
60 *cp++ = ((c >> 3) & 7) + '0';
61 *cp++ = (c & 7) + '0';
62 }
63 }
64 return cp0;
65}
66
67/**
68 * tomoyo_encode - Encode binary string to ascii string.
69 *
70 * @str: String in binary format.
71 *
72 * Returns pointer to @str in ascii format on success, NULL otherwise.
73 *
74 * This function uses kzalloc(), so caller must kfree() if this function
75 * didn't return NULL.
76 */
77char *tomoyo_encode(const char *str)
78{
79 return str ? tomoyo_encode2(str, strlen(str)) : NULL;
80}
81
82/**
83 * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
84 *
85 * @path: Pointer to "struct path".
86 * @buffer: Pointer to buffer to return value in.
87 * @buflen: Sizeof @buffer.
88 *
89 * Returns the buffer on success, an error code otherwise.
90 *
91 * If dentry is a directory, trailing '/' is appended.
92 */
93static char *tomoyo_get_absolute_path(const struct path *path, char * const buffer,
94 const int buflen)
95{
96 char *pos = ERR_PTR(-ENOMEM);
97 if (buflen >= 256) {
98 /* go to whatever namespace root we are under */
99 pos = d_absolute_path(path, buffer, buflen - 1);
100 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
101 struct inode *inode = d_backing_inode(path->dentry);
102 if (inode && S_ISDIR(inode->i_mode)) {
103 buffer[buflen - 2] = '/';
104 buffer[buflen - 1] = '\0';
105 }
106 }
107 }
108 return pos;
109}
110
111/**
112 * tomoyo_get_dentry_path - Get the path of a dentry.
113 *
114 * @dentry: Pointer to "struct dentry".
115 * @buffer: Pointer to buffer to return value in.
116 * @buflen: Sizeof @buffer.
117 *
118 * Returns the buffer on success, an error code otherwise.
119 *
120 * If dentry is a directory, trailing '/' is appended.
121 */
122static char *tomoyo_get_dentry_path(struct dentry *dentry, char * const buffer,
123 const int buflen)
124{
125 char *pos = ERR_PTR(-ENOMEM);
126 if (buflen >= 256) {
127 pos = dentry_path_raw(dentry, buffer, buflen - 1);
128 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
129 struct inode *inode = d_backing_inode(dentry);
130 if (inode && S_ISDIR(inode->i_mode)) {
131 buffer[buflen - 2] = '/';
132 buffer[buflen - 1] = '\0';
133 }
134 }
135 }
136 return pos;
137}
138
139/**
140 * tomoyo_get_local_path - Get the path of a dentry.
141 *
142 * @dentry: Pointer to "struct dentry".
143 * @buffer: Pointer to buffer to return value in.
144 * @buflen: Sizeof @buffer.
145 *
146 * Returns the buffer on success, an error code otherwise.
147 */
148static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
149 const int buflen)
150{
151 struct super_block *sb = dentry->d_sb;
152 char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
153 if (IS_ERR(pos))
154 return pos;
155 /* Convert from $PID to self if $PID is current thread. */
156 if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
157 char *ep;
158 const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
159 if (*ep == '/' && pid && pid ==
160 task_tgid_nr_ns(current, sb->s_fs_info)) {
161 pos = ep - 5;
162 if (pos < buffer)
163 goto out;
164 memmove(pos, "/self", 5);
165 }
166 goto prepend_filesystem_name;
167 }
168 /* Use filesystem name for unnamed devices. */
169 if (!MAJOR(sb->s_dev))
170 goto prepend_filesystem_name;
171 {
172 struct inode *inode = d_backing_inode(sb->s_root);
173 /*
174 * Use filesystem name if filesystem does not support rename()
175 * operation.
176 */
177 if (!inode->i_op->rename)
178 goto prepend_filesystem_name;
179 }
180 /* Prepend device name. */
181 {
182 char name[64];
183 int name_len;
184 const dev_t dev = sb->s_dev;
185 name[sizeof(name) - 1] = '\0';
186 snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
187 MINOR(dev));
188 name_len = strlen(name);
189 pos -= name_len;
190 if (pos < buffer)
191 goto out;
192 memmove(pos, name, name_len);
193 return pos;
194 }
195 /* Prepend filesystem name. */
196prepend_filesystem_name:
197 {
198 const char *name = sb->s_type->name;
199 const int name_len = strlen(name);
200 pos -= name_len + 1;
201 if (pos < buffer)
202 goto out;
203 memmove(pos, name, name_len);
204 pos[name_len] = ':';
205 }
206 return pos;
207out:
208 return ERR_PTR(-ENOMEM);
209}
210
211/**
212 * tomoyo_get_socket_name - Get the name of a socket.
213 *
214 * @path: Pointer to "struct path".
215 * @buffer: Pointer to buffer to return value in.
216 * @buflen: Sizeof @buffer.
217 *
218 * Returns the buffer.
219 */
220static char *tomoyo_get_socket_name(const struct path *path, char * const buffer,
221 const int buflen)
222{
223 struct inode *inode = d_backing_inode(path->dentry);
224 struct socket *sock = inode ? SOCKET_I(inode) : NULL;
225 struct sock *sk = sock ? sock->sk : NULL;
226 if (sk) {
227 snprintf(buffer, buflen, "socket:[family=%u:type=%u:"
228 "protocol=%u]", sk->sk_family, sk->sk_type,
229 sk->sk_protocol);
230 } else {
231 snprintf(buffer, buflen, "socket:[unknown]");
232 }
233 return buffer;
234}
235
236/**
237 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
238 *
239 * @path: Pointer to "struct path".
240 *
241 * Returns the realpath of the given @path on success, NULL otherwise.
242 *
243 * If dentry is a directory, trailing '/' is appended.
244 * Characters out of 0x20 < c < 0x7F range are converted to
245 * \ooo style octal string.
246 * Character \ is converted to \\ string.
247 *
248 * These functions use kzalloc(), so the caller must call kfree()
249 * if these functions didn't return NULL.
250 */
251char *tomoyo_realpath_from_path(const struct path *path)
252{
253 char *buf = NULL;
254 char *name = NULL;
255 unsigned int buf_len = PAGE_SIZE / 2;
256 struct dentry *dentry = path->dentry;
257 struct super_block *sb;
258 if (!dentry)
259 return NULL;
260 sb = dentry->d_sb;
261 while (1) {
262 char *pos;
263 struct inode *inode;
264 buf_len <<= 1;
265 kfree(buf);
266 buf = kmalloc(buf_len, GFP_NOFS);
267 if (!buf)
268 break;
269 /* To make sure that pos is '\0' terminated. */
270 buf[buf_len - 1] = '\0';
271 /* Get better name for socket. */
272 if (sb->s_magic == SOCKFS_MAGIC) {
273 pos = tomoyo_get_socket_name(path, buf, buf_len - 1);
274 goto encode;
275 }
276 /* For "pipe:[\$]". */
277 if (dentry->d_op && dentry->d_op->d_dname) {
278 pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
279 goto encode;
280 }
281 inode = d_backing_inode(sb->s_root);
282 /*
283 * Get local name for filesystems without rename() operation
284 * or dentry without vfsmount.
285 */
286 if (!path->mnt ||
287 (!inode->i_op->rename))
288 pos = tomoyo_get_local_path(path->dentry, buf,
289 buf_len - 1);
290 /* Get absolute name for the rest. */
291 else {
292 pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
293 /*
294 * Fall back to local name if absolute name is not
295 * available.
296 */
297 if (pos == ERR_PTR(-EINVAL))
298 pos = tomoyo_get_local_path(path->dentry, buf,
299 buf_len - 1);
300 }
301encode:
302 if (IS_ERR(pos))
303 continue;
304 name = tomoyo_encode(pos);
305 break;
306 }
307 kfree(buf);
308 if (!name)
309 tomoyo_warn_oom(__func__);
310 return name;
311}
312
313/**
314 * tomoyo_realpath_nofollow - Get realpath of a pathname.
315 *
316 * @pathname: The pathname to solve.
317 *
318 * Returns the realpath of @pathname on success, NULL otherwise.
319 */
320char *tomoyo_realpath_nofollow(const char *pathname)
321{
322 struct path path;
323
324 if (pathname && kern_path(pathname, 0, &path) == 0) {
325 char *buf = tomoyo_realpath_from_path(&path);
326 path_put(&path);
327 return buf;
328 }
329 return NULL;
330}