2 * security/tomoyo/file.c
4 * Pathname restriction functions.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
10 #include <linux/slab.h>
12 /* Keyword array for operations with one pathname. */
13 const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
14 [TOMOYO_TYPE_READ_WRITE] = "read/write",
15 [TOMOYO_TYPE_EXECUTE] = "execute",
16 [TOMOYO_TYPE_READ] = "read",
17 [TOMOYO_TYPE_WRITE] = "write",
18 [TOMOYO_TYPE_UNLINK] = "unlink",
19 [TOMOYO_TYPE_RMDIR] = "rmdir",
20 [TOMOYO_TYPE_TRUNCATE] = "truncate",
21 [TOMOYO_TYPE_SYMLINK] = "symlink",
22 [TOMOYO_TYPE_REWRITE] = "rewrite",
23 [TOMOYO_TYPE_CHROOT] = "chroot",
24 [TOMOYO_TYPE_UMOUNT] = "unmount",
27 /* Keyword array for operations with one pathname and three numbers. */
28 const char *tomoyo_mkdev_keyword[TOMOYO_MAX_MKDEV_OPERATION] = {
29 [TOMOYO_TYPE_MKBLOCK] = "mkblock",
30 [TOMOYO_TYPE_MKCHAR] = "mkchar",
33 /* Keyword array for operations with two pathnames. */
34 const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION] = {
35 [TOMOYO_TYPE_LINK] = "link",
36 [TOMOYO_TYPE_RENAME] = "rename",
37 [TOMOYO_TYPE_PIVOT_ROOT] = "pivot_root",
40 /* Keyword array for operations with one pathname and one number. */
41 const char *tomoyo_path_number_keyword[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
42 [TOMOYO_TYPE_CREATE] = "create",
43 [TOMOYO_TYPE_MKDIR] = "mkdir",
44 [TOMOYO_TYPE_MKFIFO] = "mkfifo",
45 [TOMOYO_TYPE_MKSOCK] = "mksock",
46 [TOMOYO_TYPE_IOCTL] = "ioctl",
47 [TOMOYO_TYPE_CHMOD] = "chmod",
48 [TOMOYO_TYPE_CHOWN] = "chown",
49 [TOMOYO_TYPE_CHGRP] = "chgrp",
52 static const u8 tomoyo_p2mac[TOMOYO_MAX_PATH_OPERATION] = {
53 [TOMOYO_TYPE_READ_WRITE] = TOMOYO_MAC_FILE_OPEN,
54 [TOMOYO_TYPE_EXECUTE] = TOMOYO_MAC_FILE_EXECUTE,
55 [TOMOYO_TYPE_READ] = TOMOYO_MAC_FILE_OPEN,
56 [TOMOYO_TYPE_WRITE] = TOMOYO_MAC_FILE_OPEN,
57 [TOMOYO_TYPE_UNLINK] = TOMOYO_MAC_FILE_UNLINK,
58 [TOMOYO_TYPE_RMDIR] = TOMOYO_MAC_FILE_RMDIR,
59 [TOMOYO_TYPE_TRUNCATE] = TOMOYO_MAC_FILE_TRUNCATE,
60 [TOMOYO_TYPE_SYMLINK] = TOMOYO_MAC_FILE_SYMLINK,
61 [TOMOYO_TYPE_REWRITE] = TOMOYO_MAC_FILE_REWRITE,
62 [TOMOYO_TYPE_CHROOT] = TOMOYO_MAC_FILE_CHROOT,
63 [TOMOYO_TYPE_UMOUNT] = TOMOYO_MAC_FILE_UMOUNT,
66 static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION] = {
67 [TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK,
68 [TOMOYO_TYPE_MKCHAR] = TOMOYO_MAC_FILE_MKCHAR,
71 static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {
72 [TOMOYO_TYPE_LINK] = TOMOYO_MAC_FILE_LINK,
73 [TOMOYO_TYPE_RENAME] = TOMOYO_MAC_FILE_RENAME,
74 [TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT,
77 static const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
78 [TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE,
79 [TOMOYO_TYPE_MKDIR] = TOMOYO_MAC_FILE_MKDIR,
80 [TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO,
81 [TOMOYO_TYPE_MKSOCK] = TOMOYO_MAC_FILE_MKSOCK,
82 [TOMOYO_TYPE_IOCTL] = TOMOYO_MAC_FILE_IOCTL,
83 [TOMOYO_TYPE_CHMOD] = TOMOYO_MAC_FILE_CHMOD,
84 [TOMOYO_TYPE_CHOWN] = TOMOYO_MAC_FILE_CHOWN,
85 [TOMOYO_TYPE_CHGRP] = TOMOYO_MAC_FILE_CHGRP,
88 void tomoyo_put_name_union(struct tomoyo_name_union *ptr)
93 tomoyo_put_group(ptr->group);
95 tomoyo_put_name(ptr->filename);
98 bool tomoyo_compare_name_union(const struct tomoyo_path_info *name,
99 const struct tomoyo_name_union *ptr)
102 return tomoyo_path_matches_group(name, ptr->group);
103 return tomoyo_path_matches_pattern(name, ptr->filename);
106 void tomoyo_put_number_union(struct tomoyo_number_union *ptr)
108 if (ptr && ptr->is_group)
109 tomoyo_put_group(ptr->group);
112 bool tomoyo_compare_number_union(const unsigned long value,
113 const struct tomoyo_number_union *ptr)
116 return tomoyo_number_matches_group(value, value, ptr->group);
117 return value >= ptr->values[0] && value <= ptr->values[1];
120 static void tomoyo_add_slash(struct tomoyo_path_info *buf)
125 * This is OK because tomoyo_encode() reserves space for appending "/".
127 strcat((char *) buf->name, "/");
128 tomoyo_fill_path_info(buf);
132 * tomoyo_strendswith - Check whether the token ends with the given token.
134 * @name: The token to check.
135 * @tail: The token to find.
137 * Returns true if @name ends with @tail, false otherwise.
139 static bool tomoyo_strendswith(const char *name, const char *tail)
145 len = strlen(name) - strlen(tail);
146 return len >= 0 && !strcmp(name + len, tail);
150 * tomoyo_get_realpath - Get realpath.
152 * @buf: Pointer to "struct tomoyo_path_info".
153 * @path: Pointer to "struct path".
155 * Returns true on success, false otherwise.
157 static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, struct path *path)
159 buf->name = tomoyo_realpath_from_path(path);
161 tomoyo_fill_path_info(buf);
168 * tomoyo_audit_path_log - Audit path request log.
170 * @r: Pointer to "struct tomoyo_request_info".
172 * Returns 0 on success, negative value otherwise.
174 static int tomoyo_audit_path_log(struct tomoyo_request_info *r)
176 const char *operation = tomoyo_path_keyword[r->param.path.operation];
177 const struct tomoyo_path_info *filename = r->param.path.filename;
180 tomoyo_warn_log(r, "%s %s", operation, filename->name);
181 return tomoyo_supervisor(r, "allow_%s %s\n", operation,
182 tomoyo_pattern(filename));
186 * tomoyo_audit_path2_log - Audit path/path request log.
188 * @r: Pointer to "struct tomoyo_request_info".
190 * Returns 0 on success, negative value otherwise.
192 static int tomoyo_audit_path2_log(struct tomoyo_request_info *r)
194 const char *operation = tomoyo_path2_keyword[r->param.path2.operation];
195 const struct tomoyo_path_info *filename1 = r->param.path2.filename1;
196 const struct tomoyo_path_info *filename2 = r->param.path2.filename2;
199 tomoyo_warn_log(r, "%s %s %s", operation, filename1->name,
201 return tomoyo_supervisor(r, "allow_%s %s %s\n", operation,
202 tomoyo_pattern(filename1),
203 tomoyo_pattern(filename2));
207 * tomoyo_audit_mkdev_log - Audit path/number/number/number request log.
209 * @r: Pointer to "struct tomoyo_request_info".
211 * Returns 0 on success, negative value otherwise.
213 static int tomoyo_audit_mkdev_log(struct tomoyo_request_info *r)
215 const char *operation = tomoyo_mkdev_keyword[r->param.mkdev.operation];
216 const struct tomoyo_path_info *filename = r->param.mkdev.filename;
217 const unsigned int major = r->param.mkdev.major;
218 const unsigned int minor = r->param.mkdev.minor;
219 const unsigned int mode = r->param.mkdev.mode;
222 tomoyo_warn_log(r, "%s %s 0%o %u %u", operation, filename->name, mode,
224 return tomoyo_supervisor(r, "allow_%s %s 0%o %u %u\n", operation,
225 tomoyo_pattern(filename), mode, major, minor);
229 * tomoyo_audit_path_number_log - Audit path/number request log.
231 * @r: Pointer to "struct tomoyo_request_info".
232 * @error: Error code.
234 * Returns 0 on success, negative value otherwise.
236 static int tomoyo_audit_path_number_log(struct tomoyo_request_info *r)
238 const u8 type = r->param.path_number.operation;
240 const struct tomoyo_path_info *filename = r->param.path_number.filename;
241 const char *operation = tomoyo_path_number_keyword[type];
246 case TOMOYO_TYPE_CREATE:
247 case TOMOYO_TYPE_MKDIR:
248 case TOMOYO_TYPE_MKFIFO:
249 case TOMOYO_TYPE_MKSOCK:
250 case TOMOYO_TYPE_CHMOD:
251 radix = TOMOYO_VALUE_TYPE_OCTAL;
253 case TOMOYO_TYPE_IOCTL:
254 radix = TOMOYO_VALUE_TYPE_HEXADECIMAL;
257 radix = TOMOYO_VALUE_TYPE_DECIMAL;
260 tomoyo_print_ulong(buffer, sizeof(buffer), r->param.path_number.number,
262 tomoyo_warn_log(r, "%s %s %s", operation, filename->name, buffer);
263 return tomoyo_supervisor(r, "allow_%s %s %s\n", operation,
264 tomoyo_pattern(filename), buffer);
267 static bool tomoyo_same_globally_readable(const struct tomoyo_acl_head *a,
268 const struct tomoyo_acl_head *b)
270 return container_of(a, struct tomoyo_readable_file,
272 container_of(b, struct tomoyo_readable_file,
277 * tomoyo_update_globally_readable_entry - Update "struct tomoyo_readable_file" list.
279 * @filename: Filename unconditionally permitted to open() for reading.
280 * @is_delete: True if it is a delete request.
282 * Returns 0 on success, negative value otherwise.
284 * Caller holds tomoyo_read_lock().
286 static int tomoyo_update_globally_readable_entry(const char *filename,
287 const bool is_delete)
289 struct tomoyo_readable_file e = { };
292 if (!tomoyo_correct_word(filename))
294 e.filename = tomoyo_get_name(filename);
297 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
299 [TOMOYO_ID_GLOBALLY_READABLE],
300 tomoyo_same_globally_readable);
301 tomoyo_put_name(e.filename);
306 * tomoyo_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
308 * @filename: The filename to check.
310 * Returns true if any domain can open @filename for reading, false otherwise.
312 * Caller holds tomoyo_read_lock().
314 static bool tomoyo_globally_readable_file(const struct tomoyo_path_info *
317 struct tomoyo_readable_file *ptr;
320 list_for_each_entry_rcu(ptr, &tomoyo_policy_list
321 [TOMOYO_ID_GLOBALLY_READABLE], head.list) {
322 if (!ptr->head.is_deleted &&
323 tomoyo_path_matches_pattern(filename, ptr->filename)) {
332 * tomoyo_write_globally_readable - Write "struct tomoyo_readable_file" list.
334 * @data: String to parse.
335 * @is_delete: True if it is a delete request.
337 * Returns 0 on success, negative value otherwise.
339 * Caller holds tomoyo_read_lock().
341 int tomoyo_write_globally_readable(char *data, const bool is_delete)
343 return tomoyo_update_globally_readable_entry(data, is_delete);
346 static bool tomoyo_same_pattern(const struct tomoyo_acl_head *a,
347 const struct tomoyo_acl_head *b)
349 return container_of(a, struct tomoyo_no_pattern, head)->pattern ==
350 container_of(b, struct tomoyo_no_pattern, head)->pattern;
354 * tomoyo_update_file_pattern_entry - Update "struct tomoyo_no_pattern" list.
356 * @pattern: Pathname pattern.
357 * @is_delete: True if it is a delete request.
359 * Returns 0 on success, negative value otherwise.
361 * Caller holds tomoyo_read_lock().
363 static int tomoyo_update_file_pattern_entry(const char *pattern,
364 const bool is_delete)
366 struct tomoyo_no_pattern e = { };
369 if (!tomoyo_correct_word(pattern))
371 e.pattern = tomoyo_get_name(pattern);
374 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
375 &tomoyo_policy_list[TOMOYO_ID_PATTERN],
376 tomoyo_same_pattern);
377 tomoyo_put_name(e.pattern);
382 * tomoyo_pattern - Get patterned pathname.
384 * @filename: The filename to find patterned pathname.
386 * Returns pointer to pathname pattern if matched, @filename otherwise.
388 * Caller holds tomoyo_read_lock().
390 const char *tomoyo_pattern(const struct tomoyo_path_info *filename)
392 struct tomoyo_no_pattern *ptr;
393 const struct tomoyo_path_info *pattern = NULL;
395 list_for_each_entry_rcu(ptr, &tomoyo_policy_list[TOMOYO_ID_PATTERN],
397 if (ptr->head.is_deleted)
399 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
401 pattern = ptr->pattern;
402 if (tomoyo_strendswith(pattern->name, "/\\*")) {
403 /* Do nothing. Try to find the better match. */
405 /* This would be the better match. Use this. */
411 return filename->name;
415 * tomoyo_write_pattern - Write "struct tomoyo_no_pattern" list.
417 * @data: String to parse.
418 * @is_delete: True if it is a delete request.
420 * Returns 0 on success, negative value otherwise.
422 * Caller holds tomoyo_read_lock().
424 int tomoyo_write_pattern(char *data, const bool is_delete)
426 return tomoyo_update_file_pattern_entry(data, is_delete);
429 static bool tomoyo_same_no_rewrite(const struct tomoyo_acl_head *a,
430 const struct tomoyo_acl_head *b)
432 return container_of(a, struct tomoyo_no_rewrite, head)->pattern
433 == container_of(b, struct tomoyo_no_rewrite, head)
438 * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite" list.
440 * @pattern: Pathname pattern that are not rewritable by default.
441 * @is_delete: True if it is a delete request.
443 * Returns 0 on success, negative value otherwise.
445 * Caller holds tomoyo_read_lock().
447 static int tomoyo_update_no_rewrite_entry(const char *pattern,
448 const bool is_delete)
450 struct tomoyo_no_rewrite e = { };
453 if (!tomoyo_correct_word(pattern))
455 e.pattern = tomoyo_get_name(pattern);
458 error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
459 &tomoyo_policy_list[TOMOYO_ID_NO_REWRITE],
460 tomoyo_same_no_rewrite);
461 tomoyo_put_name(e.pattern);
466 * tomoyo_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
468 * @filename: Filename to check.
470 * Returns true if @filename is specified by "deny_rewrite" directive,
473 * Caller holds tomoyo_read_lock().
475 static bool tomoyo_no_rewrite_file(const struct tomoyo_path_info *filename)
477 struct tomoyo_no_rewrite *ptr;
480 list_for_each_entry_rcu(ptr, &tomoyo_policy_list[TOMOYO_ID_NO_REWRITE],
482 if (ptr->head.is_deleted)
484 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
493 * tomoyo_write_no_rewrite - Write "struct tomoyo_no_rewrite" list.
495 * @data: String to parse.
496 * @is_delete: True if it is a delete request.
498 * Returns 0 on success, negative value otherwise.
500 * Caller holds tomoyo_read_lock().
502 int tomoyo_write_no_rewrite(char *data, const bool is_delete)
504 return tomoyo_update_no_rewrite_entry(data, is_delete);
507 static bool tomoyo_check_path_acl(const struct tomoyo_request_info *r,
508 const struct tomoyo_acl_info *ptr)
510 const struct tomoyo_path_acl *acl = container_of(ptr, typeof(*acl),
512 return (acl->perm & (1 << r->param.path.operation)) &&
513 tomoyo_compare_name_union(r->param.path.filename, &acl->name);
516 static bool tomoyo_check_path_number_acl(const struct tomoyo_request_info *r,
517 const struct tomoyo_acl_info *ptr)
519 const struct tomoyo_path_number_acl *acl =
520 container_of(ptr, typeof(*acl), head);
521 return (acl->perm & (1 << r->param.path_number.operation)) &&
522 tomoyo_compare_number_union(r->param.path_number.number,
524 tomoyo_compare_name_union(r->param.path_number.filename,
528 static bool tomoyo_check_path2_acl(const struct tomoyo_request_info *r,
529 const struct tomoyo_acl_info *ptr)
531 const struct tomoyo_path2_acl *acl =
532 container_of(ptr, typeof(*acl), head);
533 return (acl->perm & (1 << r->param.path2.operation)) &&
534 tomoyo_compare_name_union(r->param.path2.filename1, &acl->name1)
535 && tomoyo_compare_name_union(r->param.path2.filename2,
539 static bool tomoyo_check_mkdev_acl(const struct tomoyo_request_info *r,
540 const struct tomoyo_acl_info *ptr)
542 const struct tomoyo_mkdev_acl *acl =
543 container_of(ptr, typeof(*acl), head);
544 return (acl->perm & (1 << r->param.mkdev.operation)) &&
545 tomoyo_compare_number_union(r->param.mkdev.mode,
547 tomoyo_compare_number_union(r->param.mkdev.major,
549 tomoyo_compare_number_union(r->param.mkdev.minor,
551 tomoyo_compare_name_union(r->param.mkdev.filename,
555 static bool tomoyo_same_path_acl(const struct tomoyo_acl_info *a,
556 const struct tomoyo_acl_info *b)
558 const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head);
559 const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head);
560 return tomoyo_same_acl_head(&p1->head, &p2->head) &&
561 tomoyo_same_name_union(&p1->name, &p2->name);
564 static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a,
565 struct tomoyo_acl_info *b,
566 const bool is_delete)
568 u16 * const a_perm = &container_of(a, struct tomoyo_path_acl, head)
571 const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm;
574 if ((perm & TOMOYO_RW_MASK) != TOMOYO_RW_MASK)
575 perm &= ~(1 << TOMOYO_TYPE_READ_WRITE);
576 else if (!(perm & (1 << TOMOYO_TYPE_READ_WRITE)))
577 perm &= ~TOMOYO_RW_MASK;
580 if ((perm & TOMOYO_RW_MASK) == TOMOYO_RW_MASK)
581 perm |= (1 << TOMOYO_TYPE_READ_WRITE);
582 else if (perm & (1 << TOMOYO_TYPE_READ_WRITE))
583 perm |= TOMOYO_RW_MASK;
590 * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list.
592 * @type: Type of operation.
593 * @filename: Filename.
594 * @domain: Pointer to "struct tomoyo_domain_info".
595 * @is_delete: True if it is a delete request.
597 * Returns 0 on success, negative value otherwise.
599 * Caller holds tomoyo_read_lock().
601 static int tomoyo_update_path_acl(const u8 type, const char *filename,
602 struct tomoyo_domain_info * const domain,
603 const bool is_delete)
605 struct tomoyo_path_acl e = {
606 .head.type = TOMOYO_TYPE_PATH_ACL,
610 if (e.perm == (1 << TOMOYO_TYPE_READ_WRITE))
611 e.perm |= TOMOYO_RW_MASK;
612 if (!tomoyo_parse_name_union(filename, &e.name))
614 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
615 tomoyo_same_path_acl,
616 tomoyo_merge_path_acl);
617 tomoyo_put_name_union(&e.name);
621 static bool tomoyo_same_mkdev_acl(const struct tomoyo_acl_info *a,
622 const struct tomoyo_acl_info *b)
624 const struct tomoyo_mkdev_acl *p1 = container_of(a, typeof(*p1),
626 const struct tomoyo_mkdev_acl *p2 = container_of(b, typeof(*p2),
628 return tomoyo_same_acl_head(&p1->head, &p2->head)
629 && tomoyo_same_name_union(&p1->name, &p2->name)
630 && tomoyo_same_number_union(&p1->mode, &p2->mode)
631 && tomoyo_same_number_union(&p1->major, &p2->major)
632 && tomoyo_same_number_union(&p1->minor, &p2->minor);
635 static bool tomoyo_merge_mkdev_acl(struct tomoyo_acl_info *a,
636 struct tomoyo_acl_info *b,
637 const bool is_delete)
639 u8 *const a_perm = &container_of(a, struct tomoyo_mkdev_acl,
642 const u8 b_perm = container_of(b, struct tomoyo_mkdev_acl, head)
653 * tomoyo_update_mkdev_acl - Update "struct tomoyo_mkdev_acl" list.
655 * @type: Type of operation.
656 * @filename: Filename.
657 * @mode: Create mode.
658 * @major: Device major number.
659 * @minor: Device minor number.
660 * @domain: Pointer to "struct tomoyo_domain_info".
661 * @is_delete: True if it is a delete request.
663 * Returns 0 on success, negative value otherwise.
665 * Caller holds tomoyo_read_lock().
667 static int tomoyo_update_mkdev_acl(const u8 type, const char *filename,
668 char *mode, char *major, char *minor,
669 struct tomoyo_domain_info * const
670 domain, const bool is_delete)
672 struct tomoyo_mkdev_acl e = {
673 .head.type = TOMOYO_TYPE_MKDEV_ACL,
676 int error = is_delete ? -ENOENT : -ENOMEM;
677 if (!tomoyo_parse_name_union(filename, &e.name) ||
678 !tomoyo_parse_number_union(mode, &e.mode) ||
679 !tomoyo_parse_number_union(major, &e.major) ||
680 !tomoyo_parse_number_union(minor, &e.minor))
682 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
683 tomoyo_same_mkdev_acl,
684 tomoyo_merge_mkdev_acl);
686 tomoyo_put_name_union(&e.name);
687 tomoyo_put_number_union(&e.mode);
688 tomoyo_put_number_union(&e.major);
689 tomoyo_put_number_union(&e.minor);
693 static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info *a,
694 const struct tomoyo_acl_info *b)
696 const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head);
697 const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head);
698 return tomoyo_same_acl_head(&p1->head, &p2->head)
699 && tomoyo_same_name_union(&p1->name1, &p2->name1)
700 && tomoyo_same_name_union(&p1->name2, &p2->name2);
703 static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a,
704 struct tomoyo_acl_info *b,
705 const bool is_delete)
707 u8 * const a_perm = &container_of(a, struct tomoyo_path2_acl, head)
710 const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm;
720 * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list.
722 * @type: Type of operation.
723 * @filename1: First filename.
724 * @filename2: Second filename.
725 * @domain: Pointer to "struct tomoyo_domain_info".
726 * @is_delete: True if it is a delete request.
728 * Returns 0 on success, negative value otherwise.
730 * Caller holds tomoyo_read_lock().
732 static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
733 const char *filename2,
734 struct tomoyo_domain_info * const domain,
735 const bool is_delete)
737 struct tomoyo_path2_acl e = {
738 .head.type = TOMOYO_TYPE_PATH2_ACL,
741 int error = is_delete ? -ENOENT : -ENOMEM;
742 if (!tomoyo_parse_name_union(filename1, &e.name1) ||
743 !tomoyo_parse_name_union(filename2, &e.name2))
745 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
746 tomoyo_same_path2_acl,
747 tomoyo_merge_path2_acl);
749 tomoyo_put_name_union(&e.name1);
750 tomoyo_put_name_union(&e.name2);
755 * tomoyo_path_permission - Check permission for single path operation.
757 * @r: Pointer to "struct tomoyo_request_info".
758 * @operation: Type of operation.
759 * @filename: Filename to check.
761 * Returns 0 on success, negative value otherwise.
763 * Caller holds tomoyo_read_lock().
765 int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
766 const struct tomoyo_path_info *filename)
771 r->type = tomoyo_p2mac[operation];
772 r->mode = tomoyo_get_mode(r->profile, r->type);
773 if (r->mode == TOMOYO_CONFIG_DISABLED)
775 r->param_type = TOMOYO_TYPE_PATH_ACL;
776 r->param.path.filename = filename;
777 r->param.path.operation = operation;
779 tomoyo_check_acl(r, tomoyo_check_path_acl);
780 if (!r->granted && operation == TOMOYO_TYPE_READ &&
781 !r->domain->ignore_global_allow_read &&
782 tomoyo_globally_readable_file(filename))
784 error = tomoyo_audit_path_log(r);
786 * Do not retry for execute request, for alias may have
789 } while (error == TOMOYO_RETRY_REQUEST &&
790 operation != TOMOYO_TYPE_EXECUTE);
792 * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
793 * we need to check "allow_rewrite" permission if the filename is
794 * specified by "deny_rewrite" keyword.
796 if (!error && operation == TOMOYO_TYPE_TRUNCATE &&
797 tomoyo_no_rewrite_file(filename)) {
798 operation = TOMOYO_TYPE_REWRITE;
804 static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info *a,
805 const struct tomoyo_acl_info *b)
807 const struct tomoyo_path_number_acl *p1 = container_of(a, typeof(*p1),
809 const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2),
811 return tomoyo_same_acl_head(&p1->head, &p2->head)
812 && tomoyo_same_name_union(&p1->name, &p2->name)
813 && tomoyo_same_number_union(&p1->number, &p2->number);
816 static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a,
817 struct tomoyo_acl_info *b,
818 const bool is_delete)
820 u8 * const a_perm = &container_of(a, struct tomoyo_path_number_acl,
823 const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head)
834 * tomoyo_update_path_number_acl - Update ioctl/chmod/chown/chgrp ACL.
836 * @type: Type of operation.
837 * @filename: Filename.
839 * @domain: Pointer to "struct tomoyo_domain_info".
840 * @is_delete: True if it is a delete request.
842 * Returns 0 on success, negative value otherwise.
844 static int tomoyo_update_path_number_acl(const u8 type, const char *filename,
846 struct tomoyo_domain_info * const
848 const bool is_delete)
850 struct tomoyo_path_number_acl e = {
851 .head.type = TOMOYO_TYPE_PATH_NUMBER_ACL,
854 int error = is_delete ? -ENOENT : -ENOMEM;
855 if (!tomoyo_parse_name_union(filename, &e.name))
857 if (!tomoyo_parse_number_union(number, &e.number))
859 error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
860 tomoyo_same_path_number_acl,
861 tomoyo_merge_path_number_acl);
863 tomoyo_put_name_union(&e.name);
864 tomoyo_put_number_union(&e.number);
869 * tomoyo_path_number_perm - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
871 * @type: Type of operation.
872 * @path: Pointer to "struct path".
875 * Returns 0 on success, negative value otherwise.
877 int tomoyo_path_number_perm(const u8 type, struct path *path,
878 unsigned long number)
880 struct tomoyo_request_info r;
882 struct tomoyo_path_info buf;
885 if (tomoyo_init_request_info(&r, NULL, tomoyo_pn2mac[type])
886 == TOMOYO_CONFIG_DISABLED || !path->mnt || !path->dentry)
888 idx = tomoyo_read_lock();
889 if (!tomoyo_get_realpath(&buf, path))
891 if (type == TOMOYO_TYPE_MKDIR)
892 tomoyo_add_slash(&buf);
893 r.param_type = TOMOYO_TYPE_PATH_NUMBER_ACL;
894 r.param.path_number.operation = type;
895 r.param.path_number.filename = &buf;
896 r.param.path_number.number = number;
898 tomoyo_check_acl(&r, tomoyo_check_path_number_acl);
899 error = tomoyo_audit_path_number_log(&r);
900 } while (error == TOMOYO_RETRY_REQUEST);
903 tomoyo_read_unlock(idx);
904 if (r.mode != TOMOYO_CONFIG_ENFORCING)
910 * tomoyo_check_open_permission - Check permission for "read" and "write".
912 * @domain: Pointer to "struct tomoyo_domain_info".
913 * @path: Pointer to "struct path".
914 * @flag: Flags for open().
916 * Returns 0 on success, negative value otherwise.
918 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
919 struct path *path, const int flag)
921 const u8 acc_mode = ACC_MODE(flag);
923 struct tomoyo_path_info buf;
924 struct tomoyo_request_info r;
928 (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode)))
931 r.mode = TOMOYO_CONFIG_DISABLED;
932 idx = tomoyo_read_lock();
933 if (!tomoyo_get_realpath(&buf, path))
937 * If the filename is specified by "deny_rewrite" keyword,
938 * we need to check "allow_rewrite" permission when the filename is not
939 * opened for append mode or the filename is truncated at open time.
941 if ((acc_mode & MAY_WRITE) && !(flag & O_APPEND)
942 && tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_REWRITE)
943 != TOMOYO_CONFIG_DISABLED) {
944 if (!tomoyo_get_realpath(&buf, path)) {
948 if (tomoyo_no_rewrite_file(&buf))
949 error = tomoyo_path_permission(&r, TOMOYO_TYPE_REWRITE,
952 if (!error && acc_mode &&
953 tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_OPEN)
954 != TOMOYO_CONFIG_DISABLED) {
956 if (!buf.name && !tomoyo_get_realpath(&buf, path)) {
960 if (acc_mode == (MAY_READ | MAY_WRITE))
961 operation = TOMOYO_TYPE_READ_WRITE;
962 else if (acc_mode == MAY_READ)
963 operation = TOMOYO_TYPE_READ;
965 operation = TOMOYO_TYPE_WRITE;
966 error = tomoyo_path_permission(&r, operation, &buf);
970 tomoyo_read_unlock(idx);
971 if (r.mode != TOMOYO_CONFIG_ENFORCING)
977 * tomoyo_path_perm - Check permission for "unlink", "rmdir", "truncate", "symlink", "rewrite", "chroot" and "unmount".
979 * @operation: Type of operation.
980 * @path: Pointer to "struct path".
982 * Returns 0 on success, negative value otherwise.
984 int tomoyo_path_perm(const u8 operation, struct path *path)
987 struct tomoyo_path_info buf;
988 struct tomoyo_request_info r;
993 if (tomoyo_init_request_info(&r, NULL, tomoyo_p2mac[operation])
994 == TOMOYO_CONFIG_DISABLED)
997 idx = tomoyo_read_lock();
998 if (!tomoyo_get_realpath(&buf, path))
1000 switch (operation) {
1001 case TOMOYO_TYPE_REWRITE:
1002 if (!tomoyo_no_rewrite_file(&buf)) {
1007 case TOMOYO_TYPE_RMDIR:
1008 case TOMOYO_TYPE_CHROOT:
1009 case TOMOYO_TYPE_UMOUNT:
1010 tomoyo_add_slash(&buf);
1013 error = tomoyo_path_permission(&r, operation, &buf);
1016 tomoyo_read_unlock(idx);
1017 if (r.mode != TOMOYO_CONFIG_ENFORCING)
1023 * tomoyo_mkdev_perm - Check permission for "mkblock" and "mkchar".
1025 * @operation: Type of operation. (TOMOYO_TYPE_MKCHAR or TOMOYO_TYPE_MKBLOCK)
1026 * @path: Pointer to "struct path".
1027 * @mode: Create mode.
1028 * @dev: Device number.
1030 * Returns 0 on success, negative value otherwise.
1032 int tomoyo_mkdev_perm(const u8 operation, struct path *path,
1033 const unsigned int mode, unsigned int dev)
1035 struct tomoyo_request_info r;
1036 int error = -ENOMEM;
1037 struct tomoyo_path_info buf;
1041 tomoyo_init_request_info(&r, NULL, tomoyo_pnnn2mac[operation])
1042 == TOMOYO_CONFIG_DISABLED)
1044 idx = tomoyo_read_lock();
1046 if (tomoyo_get_realpath(&buf, path)) {
1047 dev = new_decode_dev(dev);
1048 r.param_type = TOMOYO_TYPE_MKDEV_ACL;
1049 r.param.mkdev.filename = &buf;
1050 r.param.mkdev.operation = operation;
1051 r.param.mkdev.mode = mode;
1052 r.param.mkdev.major = MAJOR(dev);
1053 r.param.mkdev.minor = MINOR(dev);
1054 tomoyo_check_acl(&r, tomoyo_check_mkdev_acl);
1055 error = tomoyo_audit_mkdev_log(&r);
1058 tomoyo_read_unlock(idx);
1059 if (r.mode != TOMOYO_CONFIG_ENFORCING)
1065 * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root".
1067 * @operation: Type of operation.
1068 * @path1: Pointer to "struct path".
1069 * @path2: Pointer to "struct path".
1071 * Returns 0 on success, negative value otherwise.
1073 int tomoyo_path2_perm(const u8 operation, struct path *path1,
1076 int error = -ENOMEM;
1077 struct tomoyo_path_info buf1;
1078 struct tomoyo_path_info buf2;
1079 struct tomoyo_request_info r;
1082 if (!path1->mnt || !path2->mnt ||
1083 tomoyo_init_request_info(&r, NULL, tomoyo_pp2mac[operation])
1084 == TOMOYO_CONFIG_DISABLED)
1088 idx = tomoyo_read_lock();
1089 if (!tomoyo_get_realpath(&buf1, path1) ||
1090 !tomoyo_get_realpath(&buf2, path2))
1092 switch (operation) {
1093 struct dentry *dentry;
1094 case TOMOYO_TYPE_RENAME:
1095 case TOMOYO_TYPE_LINK:
1096 dentry = path1->dentry;
1097 if (!dentry->d_inode || !S_ISDIR(dentry->d_inode->i_mode))
1100 case TOMOYO_TYPE_PIVOT_ROOT:
1101 tomoyo_add_slash(&buf1);
1102 tomoyo_add_slash(&buf2);
1105 r.param_type = TOMOYO_TYPE_PATH2_ACL;
1106 r.param.path2.operation = operation;
1107 r.param.path2.filename1 = &buf1;
1108 r.param.path2.filename2 = &buf2;
1110 tomoyo_check_acl(&r, tomoyo_check_path2_acl);
1111 error = tomoyo_audit_path2_log(&r);
1112 } while (error == TOMOYO_RETRY_REQUEST);
1116 tomoyo_read_unlock(idx);
1117 if (r.mode != TOMOYO_CONFIG_ENFORCING)
1123 * tomoyo_write_file - Update file related list.
1125 * @data: String to parse.
1126 * @domain: Pointer to "struct tomoyo_domain_info".
1127 * @is_delete: True if it is a delete request.
1129 * Returns 0 on success, negative value otherwise.
1131 * Caller holds tomoyo_read_lock().
1133 int tomoyo_write_file(char *data, struct tomoyo_domain_info *domain,
1134 const bool is_delete)
1138 if (!tomoyo_tokenize(data, w, sizeof(w)) || !w[1][0])
1140 if (strncmp(w[0], "allow_", 6))
1143 for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) {
1144 if (strcmp(w[0], tomoyo_path_keyword[type]))
1146 return tomoyo_update_path_acl(type, w[1], domain, is_delete);
1150 for (type = 0; type < TOMOYO_MAX_PATH2_OPERATION; type++) {
1151 if (strcmp(w[0], tomoyo_path2_keyword[type]))
1153 return tomoyo_update_path2_acl(type, w[1], w[2], domain,
1156 for (type = 0; type < TOMOYO_MAX_PATH_NUMBER_OPERATION; type++) {
1157 if (strcmp(w[0], tomoyo_path_number_keyword[type]))
1159 return tomoyo_update_path_number_acl(type, w[1], w[2], domain,
1162 if (!w[3][0] || !w[4][0])
1164 for (type = 0; type < TOMOYO_MAX_MKDEV_OPERATION; type++) {
1165 if (strcmp(w[0], tomoyo_mkdev_keyword[type]))
1167 return tomoyo_update_mkdev_acl(type, w[1], w[2], w[3],
1168 w[4], domain, is_delete);