security/tomoyo/file.c

   1 /*
   2  * security/tomoyo/file.c
   3  *
   4  * Pathname restriction functions.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  */
   8
   9 #include "common.h"
  10 #include <linux/slab.h>
  11
  12 /* Keyword array for operations with one pathname. */
  13 static const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
  14         [TOMOYO_TYPE_READ_WRITE] = "read/write",
  15         [TOMOYO_TYPE_EXECUTE]    = "execute",
  16         [TOMOYO_TYPE_READ]       = "read",
  17         [TOMOYO_TYPE_WRITE]      = "write",
  18         [TOMOYO_TYPE_UNLINK]     = "unlink",
  19         [TOMOYO_TYPE_RMDIR]      = "rmdir",
  20         [TOMOYO_TYPE_TRUNCATE]   = "truncate",
  21         [TOMOYO_TYPE_SYMLINK]    = "symlink",
  22         [TOMOYO_TYPE_REWRITE]    = "rewrite",
  23         [TOMOYO_TYPE_CHROOT]     = "chroot",
  24         [TOMOYO_TYPE_UMOUNT]     = "unmount",
  25 };
  26
  27 /* Keyword array for operations with one pathname and three numbers. */
  28 static const char *tomoyo_path_number3_keyword
  29 [TOMOYO_MAX_PATH_NUMBER3_OPERATION] = {
  30         [TOMOYO_TYPE_MKBLOCK]    = "mkblock",
  31         [TOMOYO_TYPE_MKCHAR]     = "mkchar",
  32 };
  33
  34 /* Keyword array for operations with two pathnames. */
  35 static const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION] = {
  36         [TOMOYO_TYPE_LINK]       = "link",
  37         [TOMOYO_TYPE_RENAME]     = "rename",
  38         [TOMOYO_TYPE_PIVOT_ROOT] = "pivot_root",
  39 };
  40
  41 /* Keyword array for operations with one pathname and one number. */
  42 static const char *tomoyo_path_number_keyword
  43 [TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
  44         [TOMOYO_TYPE_CREATE]     = "create",
  45         [TOMOYO_TYPE_MKDIR]      = "mkdir",
  46         [TOMOYO_TYPE_MKFIFO]     = "mkfifo",
  47         [TOMOYO_TYPE_MKSOCK]     = "mksock",
  48         [TOMOYO_TYPE_IOCTL]      = "ioctl",
  49         [TOMOYO_TYPE_CHMOD]      = "chmod",
  50         [TOMOYO_TYPE_CHOWN]      = "chown",
  51         [TOMOYO_TYPE_CHGRP]      = "chgrp",
  52 };
  53
  54 static const u8 tomoyo_p2mac[TOMOYO_MAX_PATH_OPERATION] = {
  55         [TOMOYO_TYPE_READ_WRITE] = TOMOYO_MAC_FILE_OPEN,
  56         [TOMOYO_TYPE_EXECUTE]    = TOMOYO_MAC_FILE_EXECUTE,
  57         [TOMOYO_TYPE_READ]       = TOMOYO_MAC_FILE_OPEN,
  58         [TOMOYO_TYPE_WRITE]      = TOMOYO_MAC_FILE_OPEN,
  59         [TOMOYO_TYPE_UNLINK]     = TOMOYO_MAC_FILE_UNLINK,
  60         [TOMOYO_TYPE_RMDIR]      = TOMOYO_MAC_FILE_RMDIR,
  61         [TOMOYO_TYPE_TRUNCATE]   = TOMOYO_MAC_FILE_TRUNCATE,
  62         [TOMOYO_TYPE_SYMLINK]    = TOMOYO_MAC_FILE_SYMLINK,
  63         [TOMOYO_TYPE_REWRITE]    = TOMOYO_MAC_FILE_REWRITE,
  64         [TOMOYO_TYPE_CHROOT]     = TOMOYO_MAC_FILE_CHROOT,
  65         [TOMOYO_TYPE_UMOUNT]     = TOMOYO_MAC_FILE_UMOUNT,
  66 };
  67
  68 static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_PATH_NUMBER3_OPERATION] = {
  69         [TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK,
  70         [TOMOYO_TYPE_MKCHAR]  = TOMOYO_MAC_FILE_MKCHAR,
  71 };
  72
  73 static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {
  74         [TOMOYO_TYPE_LINK]       = TOMOYO_MAC_FILE_LINK,
  75         [TOMOYO_TYPE_RENAME]     = TOMOYO_MAC_FILE_RENAME,
  76         [TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT,
  77 };
  78
  79 static const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
  80         [TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE,
  81         [TOMOYO_TYPE_MKDIR]  = TOMOYO_MAC_FILE_MKDIR,
  82         [TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO,
  83         [TOMOYO_TYPE_MKSOCK] = TOMOYO_MAC_FILE_MKSOCK,
  84         [TOMOYO_TYPE_IOCTL]  = TOMOYO_MAC_FILE_IOCTL,
  85         [TOMOYO_TYPE_CHMOD]  = TOMOYO_MAC_FILE_CHMOD,
  86         [TOMOYO_TYPE_CHOWN]  = TOMOYO_MAC_FILE_CHOWN,
  87         [TOMOYO_TYPE_CHGRP]  = TOMOYO_MAC_FILE_CHGRP,
  88 };
  89
  90 void tomoyo_put_name_union(struct tomoyo_name_union *ptr)
  91 {
  92         if (!ptr)
  93                 return;
  94         if (ptr->is_group)
  95                 tomoyo_put_path_group(ptr->group);
  96         else
  97                 tomoyo_put_name(ptr->filename);
  98 }
  99
 100 bool tomoyo_compare_name_union(const struct tomoyo_path_info *name,
 101                                const struct tomoyo_name_union *ptr)
 102 {
 103         if (ptr->is_group)
 104                 return tomoyo_path_matches_group(name, ptr->group);
 105         return tomoyo_path_matches_pattern(name, ptr->filename);
 106 }
 107
 108 void tomoyo_put_number_union(struct tomoyo_number_union *ptr)
 109 {
 110         if (ptr && ptr->is_group)
 111                 tomoyo_put_number_group(ptr->group);
 112 }
 113
 114 bool tomoyo_compare_number_union(const unsigned long value,
 115                                  const struct tomoyo_number_union *ptr)
 116 {
 117         if (ptr->is_group)
 118                 return tomoyo_number_matches_group(value, value, ptr->group);
 119         return value >= ptr->values[0] && value <= ptr->values[1];
 120 }
 121
 122 /**
 123  * tomoyo_path2keyword - Get the name of single path operation.
 124  *
 125  * @operation: Type of operation.
 126  *
 127  * Returns the name of single path operation.
 128  */
 129 const char *tomoyo_path2keyword(const u8 operation)
 130 {
 131         return (operation < TOMOYO_MAX_PATH_OPERATION)
 132                 ? tomoyo_path_keyword[operation] : NULL;
 133 }
 134
 135 /**
 136  * tomoyo_path_number32keyword - Get the name of path/number/number/number operations.
 137  *
 138  * @operation: Type of operation.
 139  *
 140  * Returns the name of path/number/number/number operation.
 141  */
 142 const char *tomoyo_path_number32keyword(const u8 operation)
 143 {
 144         return (operation < TOMOYO_MAX_PATH_NUMBER3_OPERATION)
 145                 ? tomoyo_path_number3_keyword[operation] : NULL;
 146 }
 147
 148 /**
 149  * tomoyo_path22keyword - Get the name of double path operation.
 150  *
 151  * @operation: Type of operation.
 152  *
 153  * Returns the name of double path operation.
 154  */
 155 const char *tomoyo_path22keyword(const u8 operation)
 156 {
 157         return (operation < TOMOYO_MAX_PATH2_OPERATION)
 158                 ? tomoyo_path2_keyword[operation] : NULL;
 159 }
 160
 161 /**
 162  * tomoyo_path_number2keyword - Get the name of path/number operations.
 163  *
 164  * @operation: Type of operation.
 165  *
 166  * Returns the name of path/number operation.
 167  */
 168 const char *tomoyo_path_number2keyword(const u8 operation)
 169 {
 170         return (operation < TOMOYO_MAX_PATH_NUMBER_OPERATION)
 171                 ? tomoyo_path_number_keyword[operation] : NULL;
 172 }
 173
 174 static void tomoyo_add_slash(struct tomoyo_path_info *buf)
 175 {
 176         if (buf->is_dir)
 177                 return;
 178         /*
 179          * This is OK because tomoyo_encode() reserves space for appending "/".
 180          */
 181         strcat((char *) buf->name, "/");
 182         tomoyo_fill_path_info(buf);
 183 }
 184
 185 /**
 186  * tomoyo_strendswith - Check whether the token ends with the given token.
 187  *
 188  * @name: The token to check.
 189  * @tail: The token to find.
 190  *
 191  * Returns true if @name ends with @tail, false otherwise.
 192  */
 193 static bool tomoyo_strendswith(const char *name, const char *tail)
 194 {
 195         int len;
 196
 197         if (!name || !tail)
 198                 return false;
 199         len = strlen(name) - strlen(tail);
 200         return len >= 0 && !strcmp(name + len, tail);
 201 }
 202
 203 /**
 204  * tomoyo_get_realpath - Get realpath.
 205  *
 206  * @buf:  Pointer to "struct tomoyo_path_info".
 207  * @path: Pointer to "struct path".
 208  *
 209  * Returns true on success, false otherwise.
 210  */
 211 static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, struct path *path)
 212 {
 213         buf->name = tomoyo_realpath_from_path(path);
 214         if (buf->name) {
 215                 tomoyo_fill_path_info(buf);
 216                 return true;
 217         }
 218         return false;
 219 }
 220
 221 static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
 222                                    const char *filename2,
 223                                    struct tomoyo_domain_info *const domain,
 224                                    const bool is_delete);
 225 static int tomoyo_update_path_acl(const u8 type, const char *filename,
 226                                   struct tomoyo_domain_info *const domain,
 227                                   const bool is_delete);
 228
 229 /*
 230  * tomoyo_globally_readable_list is used for holding list of pathnames which
 231  * are by default allowed to be open()ed for reading by any process.
 232  *
 233  * An entry is added by
 234  *
 235  * # echo 'allow_read /lib/libc-2.5.so' > \
 236  *                               /sys/kernel/security/tomoyo/exception_policy
 237  *
 238  * and is deleted by
 239  *
 240  * # echo 'delete allow_read /lib/libc-2.5.so' > \
 241  *                               /sys/kernel/security/tomoyo/exception_policy
 242  *
 243  * and all entries are retrieved by
 244  *
 245  * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
 246  *
 247  * In the example above, any process is allowed to
 248  * open("/lib/libc-2.5.so", O_RDONLY).
 249  * One exception is, if the domain which current process belongs to is marked
 250  * as "ignore_global_allow_read", current process can't do so unless explicitly
 251  * given "allow_read /lib/libc-2.5.so" to the domain which current process
 252  * belongs to.
 253  */
 254 LIST_HEAD(tomoyo_globally_readable_list);
 255
 256 static bool tomoyo_same_globally_readable(const struct tomoyo_acl_head *a,
 257                                           const struct tomoyo_acl_head *b)
 258 {
 259         return container_of(a, struct tomoyo_globally_readable_file_entry,
 260                             head)->filename ==
 261                 container_of(b, struct tomoyo_globally_readable_file_entry,
 262                              head)->filename;
 263 }
 264
 265 /**
 266  * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
 267  *
 268  * @filename:  Filename unconditionally permitted to open() for reading.
 269  * @is_delete: True if it is a delete request.
 270  *
 271  * Returns 0 on success, negative value otherwise.
 272  *
 273  * Caller holds tomoyo_read_lock().
 274  */
 275 static int tomoyo_update_globally_readable_entry(const char *filename,
 276                                                  const bool is_delete)
 277 {
 278         struct tomoyo_globally_readable_file_entry e = { };
 279         int error;
 280
 281         if (!tomoyo_is_correct_word(filename))
 282                 return -EINVAL;
 283         e.filename = tomoyo_get_name(filename);
 284         if (!e.filename)
 285                 return -ENOMEM;
 286         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 287                                      &tomoyo_globally_readable_list,
 288                                      tomoyo_same_globally_readable);
 289         tomoyo_put_name(e.filename);
 290         return error;
 291 }
 292
 293 /**
 294  * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
 295  *
 296  * @filename: The filename to check.
 297  *
 298  * Returns true if any domain can open @filename for reading, false otherwise.
 299  *
 300  * Caller holds tomoyo_read_lock().
 301  */
 302 static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
 303                                              filename)
 304 {
 305         struct tomoyo_globally_readable_file_entry *ptr;
 306         bool found = false;
 307
 308         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list,
 309                                 head.list) {
 310                 if (!ptr->head.is_deleted &&
 311                     tomoyo_path_matches_pattern(filename, ptr->filename)) {
 312                         found = true;
 313                         break;
 314                 }
 315         }
 316         return found;
 317 }
 318
 319 /**
 320  * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
 321  *
 322  * @data:      String to parse.
 323  * @is_delete: True if it is a delete request.
 324  *
 325  * Returns 0 on success, negative value otherwise.
 326  *
 327  * Caller holds tomoyo_read_lock().
 328  */
 329 int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
 330 {
 331         return tomoyo_update_globally_readable_entry(data, is_delete);
 332 }
 333
 334 /**
 335  * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
 336  *
 337  * @head: Pointer to "struct tomoyo_io_buffer".
 338  *
 339  * Returns true on success, false otherwise.
 340  *
 341  * Caller holds tomoyo_read_lock().
 342  */
 343 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
 344 {
 345         struct list_head *pos;
 346         bool done = true;
 347
 348         list_for_each_cookie(pos, head->read_var2,
 349                              &tomoyo_globally_readable_list) {
 350                 struct tomoyo_globally_readable_file_entry *ptr;
 351                 ptr = list_entry(pos,
 352                                  struct tomoyo_globally_readable_file_entry,
 353                                  head.list);
 354                 if (ptr->head.is_deleted)
 355                         continue;
 356                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
 357                                         ptr->filename->name);
 358                 if (!done)
 359                         break;
 360         }
 361         return done;
 362 }
 363
 364 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
 365  * converting pathnames to pathname patterns during learning mode.
 366  *
 367  * An entry is added by
 368  *
 369  * # echo 'file_pattern /proc/\$/mounts' > \
 370  *                             /sys/kernel/security/tomoyo/exception_policy
 371  *
 372  * and is deleted by
 373  *
 374  * # echo 'delete file_pattern /proc/\$/mounts' > \
 375  *                             /sys/kernel/security/tomoyo/exception_policy
 376  *
 377  * and all entries are retrieved by
 378  *
 379  * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
 380  *
 381  * In the example above, if a process which belongs to a domain which is in
 382  * learning mode requested open("/proc/1/mounts", O_RDONLY),
 383  * "allow_read /proc/\$/mounts" is automatically added to the domain which that
 384  * process belongs to.
 385  *
 386  * It is not a desirable behavior that we have to use /proc/\$/ instead of
 387  * /proc/self/ when current process needs to access only current process's
 388  * information. As of now, LSM version of TOMOYO is using __d_path() for
 389  * calculating pathname. Non LSM version of TOMOYO is using its own function
 390  * which pretends as if /proc/self/ is not a symlink; so that we can forbid
 391  * current process from accessing other process's information.
 392  */
 393 LIST_HEAD(tomoyo_pattern_list);
 394
 395 static bool tomoyo_same_pattern(const struct tomoyo_acl_head *a,
 396                                 const struct tomoyo_acl_head *b)
 397 {
 398         return container_of(a, struct tomoyo_pattern_entry, head)->pattern ==
 399                 container_of(b, struct tomoyo_pattern_entry, head)->pattern;
 400 }
 401
 402 /**
 403  * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
 404  *
 405  * @pattern:   Pathname pattern.
 406  * @is_delete: True if it is a delete request.
 407  *
 408  * Returns 0 on success, negative value otherwise.
 409  *
 410  * Caller holds tomoyo_read_lock().
 411  */
 412 static int tomoyo_update_file_pattern_entry(const char *pattern,
 413                                             const bool is_delete)
 414 {
 415         struct tomoyo_pattern_entry e = { };
 416         int error;
 417
 418         if (!tomoyo_is_correct_word(pattern))
 419                 return -EINVAL;
 420         e.pattern = tomoyo_get_name(pattern);
 421         if (!e.pattern)
 422                 return -ENOMEM;
 423         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 424                                      &tomoyo_pattern_list,
 425                                      tomoyo_same_pattern);
 426         tomoyo_put_name(e.pattern);
 427         return error;
 428 }
 429
 430 /**
 431  * tomoyo_file_pattern - Get patterned pathname.
 432  *
 433  * @filename: The filename to find patterned pathname.
 434  *
 435  * Returns pointer to pathname pattern if matched, @filename otherwise.
 436  *
 437  * Caller holds tomoyo_read_lock().
 438  */
 439 const char *tomoyo_file_pattern(const struct tomoyo_path_info *filename)
 440 {
 441         struct tomoyo_pattern_entry *ptr;
 442         const struct tomoyo_path_info *pattern = NULL;
 443
 444         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, head.list) {
 445                 if (ptr->head.is_deleted)
 446                         continue;
 447                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 448                         continue;
 449                 pattern = ptr->pattern;
 450                 if (tomoyo_strendswith(pattern->name, "/\\*")) {
 451                         /* Do nothing. Try to find the better match. */
 452                 } else {
 453                         /* This would be the better match. Use this. */
 454                         break;
 455                 }
 456         }
 457         if (pattern)
 458                 filename = pattern;
 459         return filename->name;
 460 }
 461
 462 /**
 463  * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
 464  *
 465  * @data:      String to parse.
 466  * @is_delete: True if it is a delete request.
 467  *
 468  * Returns 0 on success, negative value otherwise.
 469  *
 470  * Caller holds tomoyo_read_lock().
 471  */
 472 int tomoyo_write_pattern_policy(char *data, const bool is_delete)
 473 {
 474         return tomoyo_update_file_pattern_entry(data, is_delete);
 475 }
 476
 477 /**
 478  * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
 479  *
 480  * @head: Pointer to "struct tomoyo_io_buffer".
 481  *
 482  * Returns true on success, false otherwise.
 483  *
 484  * Caller holds tomoyo_read_lock().
 485  */
 486 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
 487 {
 488         struct list_head *pos;
 489         bool done = true;
 490
 491         list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
 492                 struct tomoyo_pattern_entry *ptr;
 493                 ptr = list_entry(pos, struct tomoyo_pattern_entry, head.list);
 494                 if (ptr->head.is_deleted)
 495                         continue;
 496                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
 497                                         "%s\n", ptr->pattern->name);
 498                 if (!done)
 499                         break;
 500         }
 501         return done;
 502 }
 503
 504 /*
 505  * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
 506  * default forbidden to modify already written content of a file.
 507  *
 508  * An entry is added by
 509  *
 510  * # echo 'deny_rewrite /var/log/messages' > \
 511  *                              /sys/kernel/security/tomoyo/exception_policy
 512  *
 513  * and is deleted by
 514  *
 515  * # echo 'delete deny_rewrite /var/log/messages' > \
 516  *                              /sys/kernel/security/tomoyo/exception_policy
 517  *
 518  * and all entries are retrieved by
 519  *
 520  * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
 521  *
 522  * In the example above, if a process requested to rewrite /var/log/messages ,
 523  * the process can't rewrite unless the domain which that process belongs to
 524  * has "allow_rewrite /var/log/messages" entry.
 525  *
 526  * It is not a desirable behavior that we have to add "\040(deleted)" suffix
 527  * when we want to allow rewriting already unlink()ed file. As of now,
 528  * LSM version of TOMOYO is using __d_path() for calculating pathname.
 529  * Non LSM version of TOMOYO is using its own function which doesn't append
 530  * " (deleted)" suffix if the file is already unlink()ed; so that we don't
 531  * need to worry whether the file is already unlink()ed or not.
 532  */
 533 LIST_HEAD(tomoyo_no_rewrite_list);
 534
 535 static bool tomoyo_same_no_rewrite(const struct tomoyo_acl_head *a,
 536                                    const struct tomoyo_acl_head *b)
 537 {
 538         return container_of(a, struct tomoyo_no_rewrite_entry, head)->pattern
 539                 == container_of(b, struct tomoyo_no_rewrite_entry, head)
 540                 ->pattern;
 541 }
 542
 543 /**
 544  * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
 545  *
 546  * @pattern:   Pathname pattern that are not rewritable by default.
 547  * @is_delete: True if it is a delete request.
 548  *
 549  * Returns 0 on success, negative value otherwise.
 550  *
 551  * Caller holds tomoyo_read_lock().
 552  */
 553 static int tomoyo_update_no_rewrite_entry(const char *pattern,
 554                                           const bool is_delete)
 555 {
 556         struct tomoyo_no_rewrite_entry e = { };
 557         int error;
 558
 559         if (!tomoyo_is_correct_word(pattern))
 560                 return -EINVAL;
 561         e.pattern = tomoyo_get_name(pattern);
 562         if (!e.pattern)
 563                 return -ENOMEM;
 564         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 565                                      &tomoyo_no_rewrite_list,
 566                                      tomoyo_same_no_rewrite);
 567         tomoyo_put_name(e.pattern);
 568         return error;
 569 }
 570
 571 /**
 572  * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
 573  *
 574  * @filename: Filename to check.
 575  *
 576  * Returns true if @filename is specified by "deny_rewrite" directive,
 577  * false otherwise.
 578  *
 579  * Caller holds tomoyo_read_lock().
 580  */
 581 static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
 582 {
 583         struct tomoyo_no_rewrite_entry *ptr;
 584         bool found = false;
 585
 586         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, head.list) {
 587                 if (ptr->head.is_deleted)
 588                         continue;
 589                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 590                         continue;
 591                 found = true;
 592                 break;
 593         }
 594         return found;
 595 }
 596
 597 /**
 598  * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
 599  *
 600  * @data:      String to parse.
 601  * @is_delete: True if it is a delete request.
 602  *
 603  * Returns 0 on success, negative value otherwise.
 604  *
 605  * Caller holds tomoyo_read_lock().
 606  */
 607 int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
 608 {
 609         return tomoyo_update_no_rewrite_entry(data, is_delete);
 610 }
 611
 612 /**
 613  * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
 614  *
 615  * @head: Pointer to "struct tomoyo_io_buffer".
 616  *
 617  * Returns true on success, false otherwise.
 618  *
 619  * Caller holds tomoyo_read_lock().
 620  */
 621 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
 622 {
 623         struct list_head *pos;
 624         bool done = true;
 625
 626         list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
 627                 struct tomoyo_no_rewrite_entry *ptr;
 628                 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry,
 629                                  head.list);
 630                 if (ptr->head.is_deleted)
 631                         continue;
 632                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
 633                                         "%s\n", ptr->pattern->name);
 634                 if (!done)
 635                         break;
 636         }
 637         return done;
 638 }
 639
 640 /**
 641  * tomoyo_path_acl - Check permission for single path operation.
 642  *
 643  * @r:               Pointer to "struct tomoyo_request_info".
 644  * @filename:        Filename to check.
 645  * @perm:            Permission.
 646  *
 647  * Returns 0 on success, -EPERM otherwise.
 648  *
 649  * Caller holds tomoyo_read_lock().
 650  */
 651 static int tomoyo_path_acl(const struct tomoyo_request_info *r,
 652                            const struct tomoyo_path_info *filename,
 653                            const u32 perm)
 654 {
 655         struct tomoyo_domain_info *domain = r->domain;
 656         struct tomoyo_acl_info *ptr;
 657         int error = -EPERM;
 658
 659         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 660                 struct tomoyo_path_acl *acl;
 661                 if (ptr->type != TOMOYO_TYPE_PATH_ACL)
 662                         continue;
 663                 acl = container_of(ptr, struct tomoyo_path_acl, head);
 664                 if (!(acl->perm & perm) ||
 665                     !tomoyo_compare_name_union(filename, &acl->name))
 666                         continue;
 667                 error = 0;
 668                 break;
 669         }
 670         return error;
 671 }
 672
 673 /**
 674  * tomoyo_file_perm - Check permission for opening files.
 675  *
 676  * @r:         Pointer to "struct tomoyo_request_info".
 677  * @filename:  Filename to check.
 678  * @mode:      Mode ("read" or "write" or "read/write" or "execute").
 679  *
 680  * Returns 0 on success, negative value otherwise.
 681  *
 682  * Caller holds tomoyo_read_lock().
 683  */
 684 static int tomoyo_file_perm(struct tomoyo_request_info *r,
 685                             const struct tomoyo_path_info *filename,
 686                             const u8 mode)
 687 {
 688         const char *msg = "<unknown>";
 689         int error = 0;
 690         u32 perm = 0;
 691
 692         if (!filename)
 693                 return 0;
 694
 695         if (mode == 6) {
 696                 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ_WRITE);
 697                 perm = 1 << TOMOYO_TYPE_READ_WRITE;
 698         } else if (mode == 4) {
 699                 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ);
 700                 perm = 1 << TOMOYO_TYPE_READ;
 701         } else if (mode == 2) {
 702                 msg = tomoyo_path2keyword(TOMOYO_TYPE_WRITE);
 703                 perm = 1 << TOMOYO_TYPE_WRITE;
 704         } else if (mode == 1) {
 705                 msg = tomoyo_path2keyword(TOMOYO_TYPE_EXECUTE);
 706                 perm = 1 << TOMOYO_TYPE_EXECUTE;
 707         } else
 708                 BUG();
 709         do {
 710                 error = tomoyo_path_acl(r, filename, perm);
 711                 if (error && mode == 4 && !r->domain->ignore_global_allow_read
 712                     && tomoyo_is_globally_readable_file(filename))
 713                         error = 0;
 714                 if (!error)
 715                         break;
 716                 tomoyo_warn_log(r, "%s %s", msg, filename->name);
 717                 error = tomoyo_supervisor(r, "allow_%s %s\n", msg,
 718                                           tomoyo_file_pattern(filename));
 719                 /*
 720                  * Do not retry for execute request, for alias may have
 721                  * changed.
 722                  */
 723         } while (error == TOMOYO_RETRY_REQUEST && mode != 1);
 724         if (r->mode != TOMOYO_CONFIG_ENFORCING)
 725                 error = 0;
 726         return error;
 727 }
 728
 729 static bool tomoyo_same_path_acl(const struct tomoyo_acl_info *a,
 730                                  const struct tomoyo_acl_info *b)
 731 {
 732         const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head);
 733         const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head);
 734         return tomoyo_is_same_acl_head(&p1->head, &p2->head) &&
 735                 tomoyo_is_same_name_union(&p1->name, &p2->name);
 736 }
 737
 738 static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a,
 739                                   struct tomoyo_acl_info *b,
 740                                   const bool is_delete)
 741 {
 742         u16 * const a_perm = &container_of(a, struct tomoyo_path_acl, head)
 743                 ->perm;
 744         u16 perm = *a_perm;
 745         const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm;
 746         if (is_delete) {
 747                 perm &= ~b_perm;
 748                 if ((perm & TOMOYO_RW_MASK) != TOMOYO_RW_MASK)
 749                         perm &= ~(1 << TOMOYO_TYPE_READ_WRITE);
 750                 else if (!(perm & (1 << TOMOYO_TYPE_READ_WRITE)))
 751                         perm &= ~TOMOYO_RW_MASK;
 752         } else {
 753                 perm |= b_perm;
 754                 if ((perm & TOMOYO_RW_MASK) == TOMOYO_RW_MASK)
 755                         perm |= (1 << TOMOYO_TYPE_READ_WRITE);
 756                 else if (perm & (1 << TOMOYO_TYPE_READ_WRITE))
 757                         perm |= TOMOYO_RW_MASK;
 758         }
 759         *a_perm = perm;
 760         return !perm;
 761 }
 762
 763 /**
 764  * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list.
 765  *
 766  * @type:      Type of operation.
 767  * @filename:  Filename.
 768  * @domain:    Pointer to "struct tomoyo_domain_info".
 769  * @is_delete: True if it is a delete request.
 770  *
 771  * Returns 0 on success, negative value otherwise.
 772  *
 773  * Caller holds tomoyo_read_lock().
 774  */
 775 static int tomoyo_update_path_acl(const u8 type, const char *filename,
 776                                   struct tomoyo_domain_info * const domain,
 777                                   const bool is_delete)
 778 {
 779         struct tomoyo_path_acl e = {
 780                 .head.type = TOMOYO_TYPE_PATH_ACL,
 781                 .perm = 1 << type
 782         };
 783         int error;
 784         if (e.perm == (1 << TOMOYO_TYPE_READ_WRITE))
 785                 e.perm |= TOMOYO_RW_MASK;
 786         if (!tomoyo_parse_name_union(filename, &e.name))
 787                 return -EINVAL;
 788         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 789                                      tomoyo_same_path_acl,
 790                                      tomoyo_merge_path_acl);
 791         tomoyo_put_name_union(&e.name);
 792         return error;
 793 }
 794
 795 static bool tomoyo_same_path_number3_acl(const struct tomoyo_acl_info *a,
 796                                          const struct tomoyo_acl_info *b)
 797 {
 798         const struct tomoyo_path_number3_acl *p1 = container_of(a, typeof(*p1),
 799                                                                 head);
 800         const struct tomoyo_path_number3_acl *p2 = container_of(b, typeof(*p2),
 801                                                                 head);
 802         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
 803                 && tomoyo_is_same_name_union(&p1->name, &p2->name)
 804                 && tomoyo_is_same_number_union(&p1->mode, &p2->mode)
 805                 && tomoyo_is_same_number_union(&p1->major, &p2->major)
 806                 && tomoyo_is_same_number_union(&p1->minor, &p2->minor);
 807 }
 808
 809 static bool tomoyo_merge_path_number3_acl(struct tomoyo_acl_info *a,
 810                                           struct tomoyo_acl_info *b,
 811                                           const bool is_delete)
 812 {
 813         u8 *const a_perm = &container_of(a, struct tomoyo_path_number3_acl,
 814                                          head)->perm;
 815         u8 perm = *a_perm;
 816         const u8 b_perm = container_of(b, struct tomoyo_path_number3_acl, head)
 817                 ->perm;
 818         if (is_delete)
 819                 perm &= ~b_perm;
 820         else
 821                 perm |= b_perm;
 822         *a_perm = perm;
 823         return !perm;
 824 }
 825
 826 /**
 827  * tomoyo_update_path_number3_acl - Update "struct tomoyo_path_number3_acl" list.
 828  *
 829  * @type:      Type of operation.
 830  * @filename:  Filename.
 831  * @mode:      Create mode.
 832  * @major:     Device major number.
 833  * @minor:     Device minor number.
 834  * @domain:    Pointer to "struct tomoyo_domain_info".
 835  * @is_delete: True if it is a delete request.
 836  *
 837  * Returns 0 on success, negative value otherwise.
 838  *
 839  * Caller holds tomoyo_read_lock().
 840  */
 841 static int tomoyo_update_path_number3_acl(const u8 type, const char *filename,
 842                                           char *mode, char *major, char *minor,
 843                                           struct tomoyo_domain_info * const
 844                                           domain, const bool is_delete)
 845 {
 846         struct tomoyo_path_number3_acl e = {
 847                 .head.type = TOMOYO_TYPE_PATH_NUMBER3_ACL,
 848                 .perm = 1 << type
 849         };
 850         int error = is_delete ? -ENOENT : -ENOMEM;
 851         if (!tomoyo_parse_name_union(filename, &e.name) ||
 852             !tomoyo_parse_number_union(mode, &e.mode) ||
 853             !tomoyo_parse_number_union(major, &e.major) ||
 854             !tomoyo_parse_number_union(minor, &e.minor))
 855                 goto out;
 856         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 857                                      tomoyo_same_path_number3_acl,
 858                                      tomoyo_merge_path_number3_acl);
 859  out:
 860         tomoyo_put_name_union(&e.name);
 861         tomoyo_put_number_union(&e.mode);
 862         tomoyo_put_number_union(&e.major);
 863         tomoyo_put_number_union(&e.minor);
 864         return error;
 865 }
 866
 867 static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info *a,
 868                                   const struct tomoyo_acl_info *b)
 869 {
 870         const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head);
 871         const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head);
 872         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
 873                 && tomoyo_is_same_name_union(&p1->name1, &p2->name1)
 874                 && tomoyo_is_same_name_union(&p1->name2, &p2->name2);
 875 }
 876
 877 static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a,
 878                                    struct tomoyo_acl_info *b,
 879                                    const bool is_delete)
 880 {
 881         u8 * const a_perm = &container_of(a, struct tomoyo_path2_acl, head)
 882                 ->perm;
 883         u8 perm = *a_perm;
 884         const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm;
 885         if (is_delete)
 886                 perm &= ~b_perm;
 887         else
 888                 perm |= b_perm;
 889         *a_perm = perm;
 890         return !perm;
 891 }
 892
 893 /**
 894  * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list.
 895  *
 896  * @type:      Type of operation.
 897  * @filename1: First filename.
 898  * @filename2: Second filename.
 899  * @domain:    Pointer to "struct tomoyo_domain_info".
 900  * @is_delete: True if it is a delete request.
 901  *
 902  * Returns 0 on success, negative value otherwise.
 903  *
 904  * Caller holds tomoyo_read_lock().
 905  */
 906 static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
 907                                    const char *filename2,
 908                                    struct tomoyo_domain_info * const domain,
 909                                    const bool is_delete)
 910 {
 911         struct tomoyo_path2_acl e = {
 912                 .head.type = TOMOYO_TYPE_PATH2_ACL,
 913                 .perm = 1 << type
 914         };
 915         int error = is_delete ? -ENOENT : -ENOMEM;
 916         if (!tomoyo_parse_name_union(filename1, &e.name1) ||
 917             !tomoyo_parse_name_union(filename2, &e.name2))
 918                 goto out;
 919         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 920                                      tomoyo_same_path2_acl,
 921                                      tomoyo_merge_path2_acl);
 922  out:
 923         tomoyo_put_name_union(&e.name1);
 924         tomoyo_put_name_union(&e.name2);
 925         return error;
 926 }
 927
 928 /**
 929  * tomoyo_path_number3_acl - Check permission for path/number/number/number operation.
 930  *
 931  * @r:        Pointer to "struct tomoyo_request_info".
 932  * @filename: Filename to check.
 933  * @perm:     Permission.
 934  * @mode:     Create mode.
 935  * @major:    Device major number.
 936  * @minor:    Device minor number.
 937  *
 938  * Returns 0 on success, -EPERM otherwise.
 939  *
 940  * Caller holds tomoyo_read_lock().
 941  */
 942 static int tomoyo_path_number3_acl(struct tomoyo_request_info *r,
 943                                    const struct tomoyo_path_info *filename,
 944                                    const u16 perm, const unsigned int mode,
 945                                    const unsigned int major,
 946                                    const unsigned int minor)
 947 {
 948         struct tomoyo_domain_info *domain = r->domain;
 949         struct tomoyo_acl_info *ptr;
 950         int error = -EPERM;
 951         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 952                 struct tomoyo_path_number3_acl *acl;
 953                 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER3_ACL)
 954                         continue;
 955                 acl = container_of(ptr, struct tomoyo_path_number3_acl, head);
 956                 if (!tomoyo_compare_number_union(mode, &acl->mode))
 957                         continue;
 958                 if (!tomoyo_compare_number_union(major, &acl->major))
 959                         continue;
 960                 if (!tomoyo_compare_number_union(minor, &acl->minor))
 961                         continue;
 962                 if (!(acl->perm & perm))
 963                         continue;
 964                 if (!tomoyo_compare_name_union(filename, &acl->name))
 965                         continue;
 966                 error = 0;
 967                 break;
 968         }
 969         return error;
 970 }
 971
 972 /**
 973  * tomoyo_path2_acl - Check permission for double path operation.
 974  *
 975  * @r:         Pointer to "struct tomoyo_request_info".
 976  * @type:      Type of operation.
 977  * @filename1: First filename to check.
 978  * @filename2: Second filename to check.
 979  *
 980  * Returns 0 on success, -EPERM otherwise.
 981  *
 982  * Caller holds tomoyo_read_lock().
 983  */
 984 static int tomoyo_path2_acl(const struct tomoyo_request_info *r, const u8 type,
 985                             const struct tomoyo_path_info *filename1,
 986                             const struct tomoyo_path_info *filename2)
 987 {
 988         const struct tomoyo_domain_info *domain = r->domain;
 989         struct tomoyo_acl_info *ptr;
 990         const u8 perm = 1 << type;
 991         int error = -EPERM;
 992
 993         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 994                 struct tomoyo_path2_acl *acl;
 995                 if (ptr->type != TOMOYO_TYPE_PATH2_ACL)
 996                         continue;
 997                 acl = container_of(ptr, struct tomoyo_path2_acl, head);
 998                 if (!(acl->perm & perm))
 999                         continue;
1000                 if (!tomoyo_compare_name_union(filename1, &acl->name1))
1001                         continue;
1002                 if (!tomoyo_compare_name_union(filename2, &acl->name2))
1003                         continue;
1004                 error = 0;
1005                 break;
1006         }
1007         return error;
1008 }
1009
1010 /**
1011  * tomoyo_path_permission - Check permission for single path operation.
1012  *
1013  * @r:         Pointer to "struct tomoyo_request_info".
1014  * @operation: Type of operation.
1015  * @filename:  Filename to check.
1016  *
1017  * Returns 0 on success, negative value otherwise.
1018  *
1019  * Caller holds tomoyo_read_lock().
1020  */
1021 static int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
1022                                   const struct tomoyo_path_info *filename)
1023 {
1024         const char *msg;
1025         int error;
1026
1027  next:
1028         r->type = tomoyo_p2mac[operation];
1029         r->mode = tomoyo_get_mode(r->profile, r->type);
1030         if (r->mode == TOMOYO_CONFIG_DISABLED)
1031                 return 0;
1032         do {
1033                 error = tomoyo_path_acl(r, filename, 1 << operation);
1034                 if (!error)
1035                         break;
1036                 msg = tomoyo_path2keyword(operation);
1037                 tomoyo_warn_log(r, "%s %s", msg, filename->name);
1038                 error = tomoyo_supervisor(r, "allow_%s %s\n", msg,
1039                                           tomoyo_file_pattern(filename));
1040         } while (error == TOMOYO_RETRY_REQUEST);
1041         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1042                 error = 0;
1043         /*
1044          * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1045          * we need to check "allow_rewrite" permission if the filename is
1046          * specified by "deny_rewrite" keyword.
1047          */
1048         if (!error && operation == TOMOYO_TYPE_TRUNCATE &&
1049             tomoyo_is_no_rewrite_file(filename)) {
1050                 operation = TOMOYO_TYPE_REWRITE;
1051                 goto next;
1052         }
1053         return error;
1054 }
1055
1056 /**
1057  * tomoyo_path_number_acl - Check permission for ioctl/chmod/chown/chgrp operation.
1058  *
1059  * @r:        Pointer to "struct tomoyo_request_info".
1060  * @type:     Operation.
1061  * @filename: Filename to check.
1062  * @number:   Number.
1063  *
1064  * Returns 0 on success, -EPERM otherwise.
1065  *
1066  * Caller holds tomoyo_read_lock().
1067  */
1068 static int tomoyo_path_number_acl(struct tomoyo_request_info *r, const u8 type,
1069                                   const struct tomoyo_path_info *filename,
1070                                   const unsigned long number)
1071 {
1072         struct tomoyo_domain_info *domain = r->domain;
1073         struct tomoyo_acl_info *ptr;
1074         const u8 perm = 1 << type;
1075         int error = -EPERM;
1076         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1077                 struct tomoyo_path_number_acl *acl;
1078                 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER_ACL)
1079                         continue;
1080                 acl = container_of(ptr, struct tomoyo_path_number_acl,
1081                                    head);
1082                 if (!(acl->perm & perm) ||
1083                     !tomoyo_compare_number_union(number, &acl->number) ||
1084                     !tomoyo_compare_name_union(filename, &acl->name))
1085                         continue;
1086                 error = 0;
1087                 break;
1088         }
1089         return error;
1090 }
1091
1092 static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info *a,
1093                                         const struct tomoyo_acl_info *b)
1094 {
1095         const struct tomoyo_path_number_acl *p1 = container_of(a, typeof(*p1),
1096                                                                head);
1097         const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2),
1098                                                                head);
1099         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
1100                 && tomoyo_is_same_name_union(&p1->name, &p2->name)
1101                 && tomoyo_is_same_number_union(&p1->number, &p2->number);
1102 }
1103
1104 static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a,
1105                                          struct tomoyo_acl_info *b,
1106                                          const bool is_delete)
1107 {
1108         u8 * const a_perm = &container_of(a, struct tomoyo_path_number_acl,
1109                                           head)->perm;
1110         u8 perm = *a_perm;
1111         const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head)
1112                 ->perm;
1113         if (is_delete)
1114                 perm &= ~b_perm;
1115         else
1116                 perm |= b_perm;
1117         *a_perm = perm;
1118         return !perm;
1119 }
1120
1121 /**
1122  * tomoyo_update_path_number_acl - Update ioctl/chmod/chown/chgrp ACL.
1123  *
1124  * @type:      Type of operation.
1125  * @filename:  Filename.
1126  * @number:    Number.
1127  * @domain:    Pointer to "struct tomoyo_domain_info".
1128  * @is_delete: True if it is a delete request.
1129  *
1130  * Returns 0 on success, negative value otherwise.
1131  */
1132 static int tomoyo_update_path_number_acl(const u8 type, const char *filename,
1133                                          char *number,
1134                                          struct tomoyo_domain_info * const
1135                                          domain,
1136                                          const bool is_delete)
1137 {
1138         struct tomoyo_path_number_acl e = {
1139                 .head.type = TOMOYO_TYPE_PATH_NUMBER_ACL,
1140                 .perm = 1 << type
1141         };
1142         int error = is_delete ? -ENOENT : -ENOMEM;
1143         if (!tomoyo_parse_name_union(filename, &e.name))
1144                 return -EINVAL;
1145         if (!tomoyo_parse_number_union(number, &e.number))
1146                 goto out;
1147         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
1148                                      tomoyo_same_path_number_acl,
1149                                      tomoyo_merge_path_number_acl);
1150  out:
1151         tomoyo_put_name_union(&e.name);
1152         tomoyo_put_number_union(&e.number);
1153         return error;
1154 }
1155
1156 /**
1157  * tomoyo_path_number_perm2 - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
1158  *
1159  * @r:        Pointer to "strct tomoyo_request_info".
1160  * @filename: Filename to check.
1161  * @number:   Number.
1162  *
1163  * Returns 0 on success, negative value otherwise.
1164  *
1165  * Caller holds tomoyo_read_lock().
1166  */
1167 static int tomoyo_path_number_perm2(struct tomoyo_request_info *r,
1168                                     const u8 type,
1169                                     const struct tomoyo_path_info *filename,
1170                                     const unsigned long number)
1171 {
1172         char buffer[64];
1173         int error;
1174         u8 radix;
1175         const char *msg;
1176
1177         if (!filename)
1178                 return 0;
1179         switch (type) {
1180         case TOMOYO_TYPE_CREATE:
1181         case TOMOYO_TYPE_MKDIR:
1182         case TOMOYO_TYPE_MKFIFO:
1183         case TOMOYO_TYPE_MKSOCK:
1184         case TOMOYO_TYPE_CHMOD:
1185                 radix = TOMOYO_VALUE_TYPE_OCTAL;
1186                 break;
1187         case TOMOYO_TYPE_IOCTL:
1188                 radix = TOMOYO_VALUE_TYPE_HEXADECIMAL;
1189                 break;
1190         default:
1191                 radix = TOMOYO_VALUE_TYPE_DECIMAL;
1192                 break;
1193         }
1194         tomoyo_print_ulong(buffer, sizeof(buffer), number, radix);
1195         do {
1196                 error = tomoyo_path_number_acl(r, type, filename, number);
1197                 if (!error)
1198                         break;
1199                 msg = tomoyo_path_number2keyword(type);
1200                 tomoyo_warn_log(r, "%s %s %s", msg, filename->name, buffer);
1201                 error = tomoyo_supervisor(r, "allow_%s %s %s\n", msg,
1202                                           tomoyo_file_pattern(filename),
1203                                           buffer);
1204         } while (error == TOMOYO_RETRY_REQUEST);
1205         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1206                 error = 0;
1207         return error;
1208 }
1209
1210 /**
1211  * tomoyo_path_number_perm - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
1212  *
1213  * @type:   Type of operation.
1214  * @path:   Pointer to "struct path".
1215  * @number: Number.
1216  *
1217  * Returns 0 on success, negative value otherwise.
1218  */
1219 int tomoyo_path_number_perm(const u8 type, struct path *path,
1220                             unsigned long number)
1221 {
1222         struct tomoyo_request_info r;
1223         int error = -ENOMEM;
1224         struct tomoyo_path_info buf;
1225         int idx;
1226
1227         if (tomoyo_init_request_info(&r, NULL, tomoyo_pn2mac[type])
1228             == TOMOYO_CONFIG_DISABLED || !path->mnt || !path->dentry)
1229                 return 0;
1230         idx = tomoyo_read_lock();
1231         if (!tomoyo_get_realpath(&buf, path))
1232                 goto out;
1233         if (type == TOMOYO_TYPE_MKDIR)
1234                 tomoyo_add_slash(&buf);
1235         error = tomoyo_path_number_perm2(&r, type, &buf, number);
1236  out:
1237         kfree(buf.name);
1238         tomoyo_read_unlock(idx);
1239         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1240                 error = 0;
1241         return error;
1242 }
1243
1244 /**
1245  * tomoyo_check_exec_perm - Check permission for "execute".
1246  *
1247  * @r:        Pointer to "struct tomoyo_request_info".
1248  * @filename: Check permission for "execute".
1249  *
1250  * Returns 0 on success, negativevalue otherwise.
1251  *
1252  * Caller holds tomoyo_read_lock().
1253  */
1254 int tomoyo_check_exec_perm(struct tomoyo_request_info *r,
1255                            const struct tomoyo_path_info *filename)
1256 {
1257         if (r->mode == TOMOYO_CONFIG_DISABLED)
1258                 return 0;
1259         return tomoyo_file_perm(r, filename, 1);
1260 }
1261
1262 /**
1263  * tomoyo_check_open_permission - Check permission for "read" and "write".
1264  *
1265  * @domain: Pointer to "struct tomoyo_domain_info".
1266  * @path:   Pointer to "struct path".
1267  * @flag:   Flags for open().
1268  *
1269  * Returns 0 on success, negative value otherwise.
1270  */
1271 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1272                                  struct path *path, const int flag)
1273 {
1274         const u8 acc_mode = ACC_MODE(flag);
1275         int error = -ENOMEM;
1276         struct tomoyo_path_info buf;
1277         struct tomoyo_request_info r;
1278         int idx;
1279
1280         if (!path->mnt ||
1281             (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode)))
1282                 return 0;
1283         buf.name = NULL;
1284         r.mode = TOMOYO_CONFIG_DISABLED;
1285         idx = tomoyo_read_lock();
1286         if (!tomoyo_get_realpath(&buf, path))
1287                 goto out;
1288         error = 0;
1289         /*
1290          * If the filename is specified by "deny_rewrite" keyword,
1291          * we need to check "allow_rewrite" permission when the filename is not
1292          * opened for append mode or the filename is truncated at open time.
1293          */
1294         if ((acc_mode & MAY_WRITE) && !(flag & O_APPEND)
1295             && tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_REWRITE)
1296             != TOMOYO_CONFIG_DISABLED) {
1297                 if (!tomoyo_get_realpath(&buf, path)) {
1298                         error = -ENOMEM;
1299                         goto out;
1300                 }
1301                 if (tomoyo_is_no_rewrite_file(&buf))
1302                         error = tomoyo_path_permission(&r, TOMOYO_TYPE_REWRITE,
1303                                                        &buf);
1304         }
1305         if (!error && acc_mode &&
1306             tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_OPEN)
1307             != TOMOYO_CONFIG_DISABLED) {
1308                 if (!buf.name && !tomoyo_get_realpath(&buf, path)) {
1309                         error = -ENOMEM;
1310                         goto out;
1311                 }
1312                 error = tomoyo_file_perm(&r, &buf, acc_mode);
1313         }
1314  out:
1315         kfree(buf.name);
1316         tomoyo_read_unlock(idx);
1317         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1318                 error = 0;
1319         return error;
1320 }
1321
1322 /**
1323  * tomoyo_path_perm - Check permission for "unlink", "rmdir", "truncate", "symlink", "rewrite", "chroot" and "unmount".
1324  *
1325  * @operation: Type of operation.
1326  * @path:      Pointer to "struct path".
1327  *
1328  * Returns 0 on success, negative value otherwise.
1329  */
1330 int tomoyo_path_perm(const u8 operation, struct path *path)
1331 {
1332         int error = -ENOMEM;
1333         struct tomoyo_path_info buf;
1334         struct tomoyo_request_info r;
1335         int idx;
1336
1337         if (!path->mnt)
1338                 return 0;
1339         if (tomoyo_init_request_info(&r, NULL, tomoyo_p2mac[operation])
1340             == TOMOYO_CONFIG_DISABLED)
1341                 return 0;
1342         buf.name = NULL;
1343         idx = tomoyo_read_lock();
1344         if (!tomoyo_get_realpath(&buf, path))
1345                 goto out;
1346         switch (operation) {
1347         case TOMOYO_TYPE_REWRITE:
1348                 if (!tomoyo_is_no_rewrite_file(&buf)) {
1349                         error = 0;
1350                         goto out;
1351                 }
1352                 break;
1353         case TOMOYO_TYPE_RMDIR:
1354         case TOMOYO_TYPE_CHROOT:
1355         case TOMOYO_TYPE_UMOUNT:
1356                 tomoyo_add_slash(&buf);
1357                 break;
1358         }
1359         error = tomoyo_path_permission(&r, operation, &buf);
1360  out:
1361         kfree(buf.name);
1362         tomoyo_read_unlock(idx);
1363         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1364                 error = 0;
1365         return error;
1366 }
1367
1368 /**
1369  * tomoyo_path_number3_perm2 - Check permission for path/number/number/number operation.
1370  *
1371  * @r:         Pointer to "struct tomoyo_request_info".
1372  * @operation: Type of operation.
1373  * @filename:  Filename to check.
1374  * @mode:      Create mode.
1375  * @dev:       Device number.
1376  *
1377  * Returns 0 on success, negative value otherwise.
1378  *
1379  * Caller holds tomoyo_read_lock().
1380  */
1381 static int tomoyo_path_number3_perm2(struct tomoyo_request_info *r,
1382                                      const u8 operation,
1383                                      const struct tomoyo_path_info *filename,
1384                                      const unsigned int mode,
1385                                      const unsigned int dev)
1386 {
1387         int error;
1388         const char *msg;
1389         const unsigned int major = MAJOR(dev);
1390         const unsigned int minor = MINOR(dev);
1391
1392         do {
1393                 error = tomoyo_path_number3_acl(r, filename, 1 << operation,
1394                                                 mode, major, minor);
1395                 if (!error)
1396                         break;
1397                 msg = tomoyo_path_number32keyword(operation);
1398                 tomoyo_warn_log(r, "%s %s 0%o %u %u", msg, filename->name,
1399                                 mode, major, minor);
1400                 error = tomoyo_supervisor(r, "allow_%s %s 0%o %u %u\n", msg,
1401                                           tomoyo_file_pattern(filename), mode,
1402                                           major, minor);
1403         } while (error == TOMOYO_RETRY_REQUEST);
1404         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1405                 error = 0;
1406         return error;
1407 }
1408
1409 /**
1410  * tomoyo_path_number3_perm - Check permission for "mkblock" and "mkchar".
1411  *
1412  * @operation: Type of operation. (TOMOYO_TYPE_MKCHAR or TOMOYO_TYPE_MKBLOCK)
1413  * @path:      Pointer to "struct path".
1414  * @mode:      Create mode.
1415  * @dev:       Device number.
1416  *
1417  * Returns 0 on success, negative value otherwise.
1418  */
1419 int tomoyo_path_number3_perm(const u8 operation, struct path *path,
1420                              const unsigned int mode, unsigned int dev)
1421 {
1422         struct tomoyo_request_info r;
1423         int error = -ENOMEM;
1424         struct tomoyo_path_info buf;
1425         int idx;
1426
1427         if (!path->mnt ||
1428             tomoyo_init_request_info(&r, NULL, tomoyo_pnnn2mac[operation])
1429             == TOMOYO_CONFIG_DISABLED)
1430                 return 0;
1431         idx = tomoyo_read_lock();
1432         error = -ENOMEM;
1433         if (tomoyo_get_realpath(&buf, path)) {
1434                 error = tomoyo_path_number3_perm2(&r, operation, &buf, mode,
1435                                                   new_decode_dev(dev));
1436                 kfree(buf.name);
1437         }
1438         tomoyo_read_unlock(idx);
1439         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1440                 error = 0;
1441         return error;
1442 }
1443
1444 /**
1445  * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root".
1446  *
1447  * @operation: Type of operation.
1448  * @path1:      Pointer to "struct path".
1449  * @path2:      Pointer to "struct path".
1450  *
1451  * Returns 0 on success, negative value otherwise.
1452  */
1453 int tomoyo_path2_perm(const u8 operation, struct path *path1,
1454                       struct path *path2)
1455 {
1456         int error = -ENOMEM;
1457         const char *msg;
1458         struct tomoyo_path_info buf1;
1459         struct tomoyo_path_info buf2;
1460         struct tomoyo_request_info r;
1461         int idx;
1462
1463         if (!path1->mnt || !path2->mnt ||
1464             tomoyo_init_request_info(&r, NULL, tomoyo_pp2mac[operation])
1465             == TOMOYO_CONFIG_DISABLED)
1466                 return 0;
1467         buf1.name = NULL;
1468         buf2.name = NULL;
1469         idx = tomoyo_read_lock();
1470         if (!tomoyo_get_realpath(&buf1, path1) ||
1471             !tomoyo_get_realpath(&buf2, path2))
1472                 goto out;
1473         switch (operation) {
1474                 struct dentry *dentry;
1475         case TOMOYO_TYPE_RENAME:
1476         case TOMOYO_TYPE_LINK:
1477                 dentry = path1->dentry;
1478                 if (!dentry->d_inode || !S_ISDIR(dentry->d_inode->i_mode))
1479                         break;
1480                 /* fall through */
1481         case TOMOYO_TYPE_PIVOT_ROOT:
1482                 tomoyo_add_slash(&buf1);
1483                 tomoyo_add_slash(&buf2);
1484                 break;
1485         }
1486         do {
1487                 error = tomoyo_path2_acl(&r, operation, &buf1, &buf2);
1488                 if (!error)
1489                         break;
1490                 msg = tomoyo_path22keyword(operation);
1491                 tomoyo_warn_log(&r, "%s %s %s", msg, buf1.name, buf2.name);
1492                 error = tomoyo_supervisor(&r, "allow_%s %s %s\n", msg,
1493                                           tomoyo_file_pattern(&buf1),
1494                                           tomoyo_file_pattern(&buf2));
1495         } while (error == TOMOYO_RETRY_REQUEST);
1496  out:
1497         kfree(buf1.name);
1498         kfree(buf2.name);
1499         tomoyo_read_unlock(idx);
1500         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1501                 error = 0;
1502         return error;
1503 }
1504
1505 /**
1506  * tomoyo_write_file_policy - Update file related list.
1507  *
1508  * @data:      String to parse.
1509  * @domain:    Pointer to "struct tomoyo_domain_info".
1510  * @is_delete: True if it is a delete request.
1511  *
1512  * Returns 0 on success, negative value otherwise.
1513  *
1514  * Caller holds tomoyo_read_lock().
1515  */
1516 int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
1517                              const bool is_delete)
1518 {
1519         char *w[5];
1520         u8 type;
1521         if (!tomoyo_tokenize(data, w, sizeof(w)) || !w[1][0])
1522                 return -EINVAL;
1523         if (strncmp(w[0], "allow_", 6))
1524                 goto out;
1525         w[0] += 6;
1526         for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) {
1527                 if (strcmp(w[0], tomoyo_path_keyword[type]))
1528                         continue;
1529                 return tomoyo_update_path_acl(type, w[1], domain, is_delete);
1530         }
1531         if (!w[2][0])
1532                 goto out;
1533         for (type = 0; type < TOMOYO_MAX_PATH2_OPERATION; type++) {
1534                 if (strcmp(w[0], tomoyo_path2_keyword[type]))
1535                         continue;
1536                 return tomoyo_update_path2_acl(type, w[1], w[2], domain,
1537                                                is_delete);
1538         }
1539         for (type = 0; type < TOMOYO_MAX_PATH_NUMBER_OPERATION; type++) {
1540                 if (strcmp(w[0], tomoyo_path_number_keyword[type]))
1541                         continue;
1542                 return tomoyo_update_path_number_acl(type, w[1], w[2], domain,
1543                                                      is_delete);
1544         }
1545         if (!w[3][0] || !w[4][0])
1546                 goto out;
1547         for (type = 0; type < TOMOYO_MAX_PATH_NUMBER3_OPERATION; type++) {
1548                 if (strcmp(w[0], tomoyo_path_number3_keyword[type]))
1549                         continue;
1550                 return tomoyo_update_path_number3_acl(type, w[1], w[2], w[3],
1551                                                       w[4], domain, is_delete);
1552         }
1553  out:
1554         return -EINVAL;
1555 }