lkml.org 
[lkml]   [2007]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[TOMOYO #5 07/18] Domain transition functions.
    Every process belongs to a domain in TOMOYO Linux.
    Domain transition occurs when execve(2) is called
    and the domain is expressed as 'process invocation history',
    such as '<kernel> /sbin/init /etc/init.d/rc'.
    Domain information is stored in task_struct->security.

    Signed-off-by: Kentaro Takeda <takedakn@nttdata.co.jp>
    Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
    security/tomoyo/domain.c | 1168 +++++++++++++++++++++++++++++++++++++++++++++++
    1 file changed, 1168 insertions(+)

    --- /dev/null 1970-01-01 00:00:00.000000000 +0000
    +++ linux-2.6-mm/security/tomoyo/domain.c 2007-11-14 15:15:44.000000000 +0900
    @@ -0,0 +1,1168 @@
    +/*
    + * security/tomoyo/domain.c
    + *
    + * Domain transition functions for TOMOYO Linux.
    + */
    +
    +#include "tomoyo.h"
    +#include "realpath.h"
    +
    +/************************* VARIABLES *************************/
    +
    +/* The initial domain. */
    +struct domain_info KERNEL_DOMAIN;
    +
    +/* Lock for appending domain's ACL. */
    +DEFINE_MUTEX(domain_acl_lock);
    +
    +/* Domain creation lock. */
    +static DEFINE_MUTEX(new_domain_assign_lock);
    +
    +/***** The structure for program files to force domain reconstruction. *****/
    +
    +struct domain_initializer_entry {
    + struct list_head list;
    + const struct path_info *domainname; /* This may be NULL */
    + const struct path_info *program;
    + bool is_deleted;
    + bool is_not;
    + bool is_last_name;
    +};
    +
    +/***** The structure for domains to not to transit domains. *****/
    +
    +struct domain_keeper_entry {
    + struct list_head list;
    + const struct path_info *domainname;
    + const struct path_info *program; /* This may be NULL */
    + bool is_deleted;
    + bool is_not;
    + bool is_last_name;
    +};
    +
    +/***** The structure for program files that should be aggregated. *****/
    +
    +struct aggregator_entry {
    + struct list_head list;
    + const struct path_info *original_name;
    + const struct path_info *aggregated_name;
    + bool is_deleted;
    +};
    +
    +/***** The structure for program files that should be aliased. *****/
    +
    +struct alias_entry {
    + struct list_head list;
    + const struct path_info *original_name;
    + const struct path_info *aliased_name;
    + bool is_deleted;
    +};
    +
    +/************************* UTILITY FUNCTIONS *************************/
    +
    +/**
    + * tmy_is_domain_def - check if the line is likely a domain definition.
    + * @buffer: the line to check.
    + *
    + * Returns true if @buffer is likely a domain definition.
    + * Returns false otherwise.
    + *
    + * For complete validation check, use tmy_is_correct_domain().
    + */
    +bool tmy_is_domain_def(const unsigned char *buffer)
    +{
    + return strncmp(buffer, TMY_ROOT_NAME, TMY_ROOT_NAME_LEN) == 0;
    +}
    +
    +/**
    + * tmy_add_acl - add an entry to a domain.
    + * @domain: pointer to "struct domain_info".
    + * @acl: pointer to "struct acl_info" to add.
    + *
    + * Returns zero.
    + */
    +int tmy_add_acl(struct domain_info *domain,
    + struct acl_info *acl)
    +{
    + list_add_tail_mb(&acl->list, &domain->acl_info_list);
    + tmy_update_counter(TMY_UPDATE_DOMAINPOLICY);
    + return 0;
    +}
    +
    +/**
    + * tmy_del_acl - remove an entry from a domain
    + * @ptr: pointer to "struct acl_info" to remove.
    + *
    + * Returns zero.
    + *
    + * TOMOYO Linux doesn't free memory used by policy because policies are not
    + * so frequently changed after entring into enforcing mode.
    + * This makes the code free of read-lock.
    + * The caller uses "down(&domain_acl_lock);" as write-lock.
    + */
    +int tmy_del_acl(struct acl_info *ptr)
    +{
    + ptr->is_deleted = 1;
    + tmy_update_counter(TMY_UPDATE_DOMAINPOLICY);
    + return 0;
    +}
    +
    +/************************ DOMAIN INITIALIZER HANDLER ************************/
    +
    +static LIST_HEAD(domain_initializer_list);
    +
    +/* Update domain initializer list. */
    +static int tmy_add_domain_initializer_entry(const char *domainname,
    + const char *program,
    + const bool is_not,
    + const bool is_delete)
    +{
    + struct domain_initializer_entry *new_entry;
    + struct domain_initializer_entry *ptr;
    + static DEFINE_MUTEX(mutex);
    + const struct path_info *saved_program;
    + const struct path_info *saved_domainname = NULL;
    + int error = -ENOMEM;
    + bool is_last_name = 0;
    +
    + if (!tmy_correct_path(program, 1, -1, -1, __FUNCTION__))
    + return -EINVAL; /* No patterns allowed. */
    +
    + if (domainname) {
    + if (!tmy_is_domain_def(domainname) &&
    + tmy_correct_path(domainname, 1, -1, -1, __FUNCTION__))
    + is_last_name = 1;
    +
    + else if (!tmy_is_correct_domain(domainname, __FUNCTION__))
    + return -EINVAL;
    +
    + saved_domainname = tmy_save_name(domainname);
    + if (!saved_domainname)
    + return -ENOMEM;
    + }
    +
    + saved_program = tmy_save_name(program);
    + if (!saved_program)
    + return -ENOMEM;
    +
    + mutex_lock(&mutex);
    +
    + list_for_each_entry(ptr, &domain_initializer_list, list) {
    + if (ptr->is_not == is_not &&
    + ptr->domainname == saved_domainname &&
    + ptr->program == saved_program) {
    + ptr->is_deleted = is_delete;
    + error = 0;
    + goto out;
    + }
    + }
    +
    + if (is_delete) {
    + error = -ENOENT;
    + goto out;
    + }
    +
    + new_entry = tmy_alloc_element(sizeof(*new_entry));
    + if (!new_entry)
    + goto out;
    +
    + new_entry->domainname = saved_domainname;
    + new_entry->program = saved_program;
    + new_entry->is_not = is_not;
    + new_entry->is_last_name = is_last_name;
    + list_add_tail_mb(&new_entry->list, &domain_initializer_list);
    + error = 0;
    +out: ;
    +
    + mutex_unlock(&mutex);
    + return error;
    +}
    +
    +/**
    + * tmy_read_domain_initializer_policy - read domain initializer policy.
    + * @head: pointer to "struct io_buffer".
    + *
    + * Returns nonzero if reading incomplete.
    + * Returns zero otherwise.
    + */
    +int tmy_read_domain_initializer_policy(struct io_buffer *head)
    +{
    + struct list_head *pos;
    + list_for_each_cookie(pos, head->read_var2, &domain_initializer_list) {
    + struct domain_initializer_entry *ptr;
    + ptr = list_entry(pos, struct domain_initializer_entry, list);
    + if (ptr->is_deleted)
    + continue;
    + if (ptr->domainname) {
    + if (tmy_io_printf(head, "%s" TMY_INITIALIZE_DOMAIN
    + "%s from %s\n",
    + ptr->is_not ? "no_" : "",
    + ptr->program->name,
    + ptr->domainname->name))
    + return -ENOMEM;
    + } else {
    + if (tmy_io_printf(head, "%s" TMY_INITIALIZE_DOMAIN
    + "%s\n",
    + ptr->is_not ? "no_" : "",
    + ptr->program->name))
    + return -ENOMEM;
    + }
    + }
    + return 0;
    +}
    +
    +/**
    + * tmy_add_domain_initializer_policy - add domain initializer policy
    + * @data: a line to parse.
    + * @is_not: is this overriding?
    + * @is_delete: is this remove request?
    + *
    + * Returns zero on success.
    + * Returns nonzero on failure.
    + *
    + * This function adds or removes a domain initializer entry.
    + */
    +int tmy_add_domain_initializer_policy(char *data,
    + const bool is_not,
    + const bool is_delete)
    +{
    + char *cp = strstr(data, " from ");
    +
    + if (cp) {
    + *cp = '\0';
    + return tmy_add_domain_initializer_entry(cp + 6, data, is_not,
    + is_delete);
    + }
    +
    + return tmy_add_domain_initializer_entry(NULL, data, is_not, is_delete);
    +}
    +
    +/* Should I transit to a domain under "<kernel>" domain? */
    +static int tmy_is_domain_initializer(const struct path_info *domainname,
    + const struct path_info *program,
    + const struct path_info *last_name)
    +{
    + struct domain_initializer_entry *ptr;
    + int flag = 0;
    + list_for_each_entry(ptr, &domain_initializer_list, list) {
    + if (ptr->is_deleted)
    + continue;
    + if (ptr->domainname) {
    + if (!ptr->is_last_name) {
    + if (ptr->domainname != domainname)
    + continue;
    + } else {
    + if (tmy_pathcmp(ptr->domainname, last_name))
    + continue;
    + }
    + }
    + if (tmy_pathcmp(ptr->program, program))
    + continue;
    + if (ptr->is_not)
    + return 0;
    + flag = 1;
    + }
    + return flag;
    +}
    +
    +/************************* DOMAIN KEEPER HANDLER *************************/
    +
    +static LIST_HEAD(domain_keeper_list);
    +
    +/* Update domain keeper list. */
    +static int tmy_add_domain_keeper_entry(const char *domainname,
    + const char *program,
    + const bool is_not,
    + const bool is_delete)
    +{
    + struct domain_keeper_entry *new_entry;
    + struct domain_keeper_entry *ptr;
    + const struct path_info *saved_domainname;
    + const struct path_info *saved_program = NULL;
    + static DEFINE_MUTEX(mutex);
    + int error = -ENOMEM;
    + bool is_last_name = 0;
    +
    + if (!tmy_is_domain_def(domainname) &&
    + tmy_correct_path(domainname, 1, -1, -1, __FUNCTION__))
    + is_last_name = 1;
    +
    + else if (!tmy_is_correct_domain(domainname, __FUNCTION__))
    + return -EINVAL;
    +
    + if (program) {
    + if (!tmy_correct_path(program, 1, -1, -1, __FUNCTION__))
    + return -EINVAL;
    +
    + saved_program = tmy_save_name(program);
    + if (!saved_program)
    + return -ENOMEM;
    + }
    +
    + saved_domainname = tmy_save_name(domainname);
    + if (!saved_domainname)
    + return -ENOMEM;
    +
    + mutex_lock(&mutex);
    + list_for_each_entry(ptr, &domain_keeper_list, list) {
    + if (ptr->is_not == is_not &&
    + ptr->domainname == saved_domainname &&
    + ptr->program == saved_program) {
    + ptr->is_deleted = is_delete;
    + error = 0;
    + goto out;
    + }
    + }
    +
    + if (is_delete) {
    + error = -ENOENT;
    + goto out;
    + }
    +
    + new_entry = tmy_alloc_element(sizeof(*new_entry));
    + if (!new_entry)
    + goto out;
    +
    + new_entry->domainname = saved_domainname;
    + new_entry->program = saved_program;
    + new_entry->is_not = is_not;
    + new_entry->is_last_name = is_last_name;
    + list_add_tail_mb(&new_entry->list, &domain_keeper_list);
    + error = 0;
    +
    +out: ;
    +
    + mutex_unlock(&mutex);
    + return error;
    +}
    +
    +/**
    + * tmy_add_domain_keeper_policy - add domain keeper policy.
    + * @data: a line to parse.
    + * @is_not: is this overriding?
    + * @is_delete: is this remove request?
    + *
    + * Returns zero on success.
    + * Returns nonzero on failure.
    + *
    + * This function adds or removes a domain keeper entry.
    + *
    + */
    +int tmy_add_domain_keeper_policy(char *data,
    + const bool is_not,
    + const bool is_delete)
    +{
    + char *cp = strstr(data, " from ");
    +
    + if (cp) {
    + *cp = '\0';
    + return tmy_add_domain_keeper_entry(cp + 6, data,
    + is_not, is_delete);
    + }
    +
    + return tmy_add_domain_keeper_entry(data, NULL, is_not, is_delete);
    +}
    +
    +/**
    + * tmy_read_domain_keeper_policy - read domain keeper policy.
    + * @head: pointer to "struct io_buffer".
    + *
    + * Returns nonzero if reading incomplete.
    + * Returns zero otherwise.
    + */
    +int tmy_read_domain_keeper_policy(struct io_buffer *head)
    +{
    + struct list_head *pos;
    + list_for_each_cookie(pos, head->read_var2, &domain_keeper_list) {
    + struct domain_keeper_entry *ptr;
    + ptr = list_entry(pos, struct domain_keeper_entry, list);
    + if (ptr->is_deleted)
    + continue;
    + if (ptr->program) {
    + if (tmy_io_printf(head,
    + "%s" TMY_KEEP_DOMAIN
    + "%s from %s\n",
    + ptr->is_not ? "no_" : "",
    + ptr->program->name,
    + ptr->domainname->name))
    + return -ENOMEM;
    + } else {
    + if (tmy_io_printf(head,
    + "%s" TMY_KEEP_DOMAIN
    + "%s\n",
    + ptr->is_not ? "no_" : "",
    + ptr->domainname->name))
    + return -ENOMEM;
    + }
    + }
    + return 0;
    +}
    +
    +/* Should I remain in current domain? */
    +static int tmy_is_domain_keeper(const struct path_info *domainname,
    + const struct path_info *program,
    + const struct path_info *last_name)
    +{
    + struct domain_keeper_entry *ptr;
    + int flag = 0;
    + list_for_each_entry(ptr, &domain_keeper_list, list) {
    + if (ptr->is_deleted)
    + continue;
    + if (!ptr->is_last_name) {
    + if (ptr->domainname != domainname)
    + continue;
    + } else {
    + if (tmy_pathcmp(ptr->domainname, last_name))
    + continue;
    + }
    + if (ptr->program && tmy_pathcmp(ptr->program, program))
    + continue;
    + if (ptr->is_not)
    + return 0;
    + flag = 1;
    + }
    + return flag;
    +}
    +
    +/********************* SYMBOLIC LINKED PROGRAM HANDLER *********************/
    +
    +static LIST_HEAD(alias_list);
    +
    +/* Update alias list. */
    +static int tmy_add_alias_entry(const char *original_name,
    + const char *aliased_name,
    + const bool is_delete)
    +{
    + struct alias_entry *new_entry;
    + struct alias_entry *ptr;
    + static DEFINE_MUTEX(mutex);
    + const struct path_info *saved_original_name;
    + const struct path_info *saved_aliased_name;
    + int error = -ENOMEM;
    +
    + if (!tmy_correct_path(original_name, 1, -1, -1, __FUNCTION__) ||
    + !tmy_correct_path(aliased_name, 1, -1, -1, __FUNCTION__))
    + return -EINVAL; /* No patterns allowed. */
    +
    + saved_original_name = tmy_save_name(original_name);
    + saved_aliased_name = tmy_save_name(aliased_name);
    + if (!saved_original_name || !saved_aliased_name)
    + return -ENOMEM;
    +
    + mutex_lock(&mutex);
    +
    + list_for_each_entry(ptr, &alias_list, list) {
    + if (ptr->original_name == saved_original_name &&
    + ptr->aliased_name == saved_aliased_name) {
    + ptr->is_deleted = is_delete;
    + error = 0;
    + goto out;
    + }
    + }
    +
    + if (is_delete) {
    + error = -ENOENT;
    + goto out;
    + }
    +
    + new_entry = tmy_alloc_element(sizeof(*new_entry));
    + if (!new_entry)
    + goto out;
    +
    + new_entry->original_name = saved_original_name;
    + new_entry->aliased_name = saved_aliased_name;
    + list_add_tail_mb(&new_entry->list, &alias_list);
    + error = 0;
    +out: ;
    + mutex_unlock(&mutex);
    + return error;
    +}
    +
    +/**
    + * tmy_read_alias_policy - read alias policy.
    + * @head: pointer to "struct io_buffer".
    + *
    + * Returns nonzero if reading incomplete.
    + * Returns zero otherwise.
    + */
    +int tmy_read_alias_policy(struct io_buffer *head)
    +{
    + struct list_head *pos;
    + list_for_each_cookie(pos, head->read_var2, &alias_list) {
    + struct alias_entry *ptr;
    + ptr = list_entry(pos, struct alias_entry, list);
    + if (ptr->is_deleted)
    + continue;
    + if (tmy_io_printf(head,
    + TMY_ALIAS "%s %s\n",
    + ptr->original_name->name,
    + ptr->aliased_name->name))
    + return -ENOMEM;
    + }
    + return 0;
    +}
    +
    +/**
    + * tmy_add_alias_policy - add alias policy.
    + * @data: a line to parse.
    + * @is_delete: is this remove request?
    + *
    + * Returns zero on success.
    + * Returns nonzero on failure.
    + *
    + * This function adds or removes an alias entry.
    + */
    +int tmy_add_alias_policy(char *data, const bool is_delete)
    +{
    + char *cp = strchr(data, ' ');
    +
    + if (!cp)
    + return -EINVAL;
    + *cp++ = '\0';
    +
    + return tmy_add_alias_entry(data, cp, is_delete);
    +}
    +
    +/************************ DOMAIN AGGREGATOR HANDLER ************************/
    +
    +static LIST_HEAD(aggregator_list);
    +
    +/* Update aggregator list. */
    +static int tmy_add_aggregator_entry(const char *original_name,
    + const char *aggregated_name,
    + const bool is_delete)
    +{
    + struct aggregator_entry *new_entry;
    + struct aggregator_entry *ptr;
    + static DEFINE_MUTEX(mutex);
    + const struct path_info *saved_original_name;
    + const struct path_info *saved_aggregated_name;
    + int error = -ENOMEM;
    +
    + if (!tmy_correct_path(original_name, 1, 0, -1, __FUNCTION__) ||
    + !tmy_correct_path(aggregated_name, 1, -1, -1, __FUNCTION__))
    + return -EINVAL;
    +
    + saved_original_name = tmy_save_name(original_name);
    + saved_aggregated_name = tmy_save_name(aggregated_name);
    + if (!saved_original_name || !saved_aggregated_name)
    + return -ENOMEM;
    +
    + mutex_lock(&mutex);
    +
    + list_for_each_entry(ptr, &aggregator_list, list) {
    + if (ptr->original_name == saved_original_name &&
    + ptr->aggregated_name == saved_aggregated_name) {
    + ptr->is_deleted = is_delete;
    + error = 0;
    + goto out;
    + }
    + }
    +
    + if (is_delete) {
    + error = -ENOENT;
    + goto out;
    + }
    +
    + new_entry = tmy_alloc_element(sizeof(*new_entry));
    + if (!new_entry)
    + goto out;
    +
    + new_entry->original_name = saved_original_name;
    + new_entry->aggregated_name = saved_aggregated_name;
    + list_add_tail_mb(&new_entry->list, &aggregator_list);
    + error = 0;
    +out: ;
    +
    + mutex_unlock(&mutex);
    +
    + return error;
    +}
    +
    +/**
    + * tmy_read_aggregator_policy - read aggregator policy.
    + * @head: pointer to "struct io_buffer".
    + *
    + * Returns nonzero if reading incomplete.
    + * Returns zero otherwise.
    + */
    +int tmy_read_aggregator_policy(struct io_buffer *head)
    +{
    + struct list_head *pos;
    + list_for_each_cookie(pos, head->read_var2, &aggregator_list) {
    + struct aggregator_entry *ptr;
    + ptr = list_entry(pos, struct aggregator_entry, list);
    + if (ptr->is_deleted)
    + continue;
    + if (tmy_io_printf(head,
    + TMY_AGGREGATOR "%s %s\n",
    + ptr->original_name->name,
    + ptr->aggregated_name->name))
    + return -ENOMEM;
    + }
    + return 0;
    +}
    +
    +/**
    + * tmy_add_aggregator_policy - add aggregator policy.
    + * @data: a line to parse.
    + * @is_delete: is this remove request?
    + *
    + * Returns zero on success.
    + * Returns nonzero on failure.
    + *
    + * This function adds or removes an aggregator entry.
    + */
    +int tmy_add_aggregator_policy(char *data, const bool is_delete)
    +{
    + char *cp = strchr(data, ' ');
    +
    + if (!cp)
    + return -EINVAL;
    + *cp++ = '\0';
    +
    + return tmy_add_aggregator_entry(data, cp, is_delete);
    +}
    +
    +/************************* DOMAIN DELETION HANDLER *************************/
    +
    +/**
    + * tmy_delete_domain - delete a domain.
    + * @domainname0: domainname to delete.
    + *
    + * Returns zero.
    + *
    + * This function deletes domains.
    + * The behavior of deleting domain is like deleting files on Linux's
    + * filesystem. A process transits to different domain upon do_execve(),
    + * and the process can refer the deleted domains after the domain is deleted,
    + * like a process opens a file and the process can read()/write() the deleted
    + * file after the file is deleted.
    + * This avoids processes from crashing due to referring non-existent domains.
    + * Administrator manually terminates processes thet are referring deleted
    + * domains after deleting domains.
    + * Also, undeleting domains is supported. See tmy_undelete_domain().
    + */
    +int tmy_delete_domain(char *domainname0)
    +{
    + struct domain_info *domain;
    + struct path_info domainname;
    +
    + domainname.name = domainname0;
    + tmy_fill_path_info(&domainname);
    +
    + mutex_lock(&new_domain_assign_lock);
    + /* Is there an active domain? */ /* Never delete KERNEL_DOMAIN */
    + list_for_each_entry(domain, &domain_list, list) {
    + struct domain_info *domain2;
    + if (domain == &KERNEL_DOMAIN ||
    + domain->is_deleted ||
    + tmy_pathcmp(domain->domainname, &domainname))
    + continue;
    + /* Mark already deleted domains as non undeletable. */
    + list_for_each_entry(domain2, &domain_list, list) {
    + if (!domain2->is_deleted ||
    + tmy_pathcmp(domain2->domainname, &domainname))
    + continue;
    + domain2->is_deleted = 255;
    + }
    + /* Delete and mark active domain as undeletable. */
    + domain->is_deleted = 1;
    + break;
    + }
    + mutex_unlock(&new_domain_assign_lock);
    + return 0;
    +}
    +
    +/**
    + * tmy_undelete_domain - undelete a domain.
    + * @domainname0: domainname to undelete.
    + *
    + * Returns pointer to undeleted "struct domain_info" on success.
    + * Returns NULL on failure.
    + *
    + * This function undeletes domains.
    + * Not only the domain previously deleted by tmy_delete_domain()
    + * but also all domains deleted by tmy_delete_domain() are undeletable.
    + * If there is no deleted domain named @domainname0 or
    + * a not-yet-deleted domain named @domainname0 exists, undelete fails.
    + * Otherwise, previously deleted domain named @domainname0 is undeleted.
    + */
    +struct domain_info *tmy_undelete_domain(const char *domainname0)
    +{
    + struct domain_info *domain;
    + struct domain_info *candidate_domain = NULL;
    + struct path_info domainname;
    +
    + domainname.name = domainname0;
    + tmy_fill_path_info(&domainname);
    +
    + mutex_lock(&new_domain_assign_lock);
    +
    + list_for_each_entry(domain, &domain_list, list) {
    + if (tmy_pathcmp(&domainname, domain->domainname))
    + continue;
    +
    + if (!domain->is_deleted) {
    + /* This domain is active. I can't undelete. */
    + candidate_domain = NULL;
    + break;
    + }
    +
    + /* Is this domain undeletable? */
    + if (domain->is_deleted == 1)
    + candidate_domain = domain;
    + }
    + if (candidate_domain)
    + candidate_domain->is_deleted = 0;
    +
    + mutex_unlock(&new_domain_assign_lock);
    +
    + return candidate_domain;
    +}
    +
    +/************************ DOMAIN TRANSITION HANDLER ************************/
    +
    +/**
    + * tmy_find_domain - find a domain with given domainname.
    + * @domainname0: the domainname to find.
    + *
    + * Returns pointer to "struct domain_info" on success.
    + * Returns NULL on failure.
    + *
    + * This function does not create a new domain
    + * if a domain named @domainname0 does not exist.
    + */
    +struct domain_info *tmy_find_domain(const char *domainname0)
    +{
    + struct domain_info *domain;
    + static int first = 1;
    + struct path_info domainname;
    +
    + domainname.name = domainname0;
    + tmy_fill_path_info(&domainname);
    +
    + if (first) {
    + KERNEL_DOMAIN.domainname = tmy_save_name(TMY_ROOT_NAME);
    + first = 0;
    + }
    +
    + list_for_each_entry(domain, &domain_list, list) {
    + if (!domain->is_deleted &&
    + !tmy_pathcmp(&domainname, domain->domainname))
    + return domain;
    + }
    +
    + return NULL;
    +}
    +
    +/**
    + * tmy_new_domain - find or assign a domain with given domainname.
    + * @domainname: the domainname to find.
    + * @profile: profile number to assign if newly created.
    + *
    + * Returns pointer to "struct domain_info" on success.
    + * Returns NULL on failure.
    + *
    + * This function creates a new domain if a domain named @domainname0
    + * does not exist.
    + */
    +struct domain_info *tmy_new_domain(const char *domainname,
    + const u8 profile)
    +{
    + struct domain_info *domain = NULL;
    + const struct path_info *saved_domainname;
    +
    + mutex_lock(&new_domain_assign_lock);
    +
    + domain = tmy_find_domain(domainname);
    + if (domain)
    + goto out;
    +
    + if (!tmy_is_correct_domain(domainname, __FUNCTION__))
    + goto out;
    +
    + saved_domainname = tmy_save_name(domainname);
    + if (!saved_domainname)
    + goto out;
    +
    + /* Can I reuse memory of deleted domain? */
    + list_for_each_entry(domain, &domain_list, list) {
    + struct task_struct *p;
    + struct acl_info *ptr;
    + int flag;
    +
    + if (!domain->is_deleted ||
    + domain->domainname != saved_domainname)
    + continue;
    + flag = 0;
    +
    + /***** CRITICAL SECTION START *****/
    + read_lock(&tasklist_lock);
    + for_each_process(p) {
    + /* "struct task_struct"->security is not NULL. */
    + if (((struct tmy_security *) p->security)->domain
    + == domain) {
    + flag = 1;
    + break;
    + }
    + }
    + read_unlock(&tasklist_lock);
    + /***** CRITICAL SECTION END *****/
    +
    + /* Somebody is still referring this deleted domain. */
    + if (flag)
    + continue;
    +
    + /* OK. Let's reuse memory for this deleted domain. */
    +
    + /* Delete all entries in this deleted domain. */
    + list_for_each_entry(ptr, &domain->acl_info_list, list)
    + ptr->is_deleted = 1;
    +
    + domain->profile = profile;
    + domain->quota_warned = 0;
    +
    + mb(); /* Avoid out-of-order execution. */
    + /* Undelete this deleted domain. */
    + domain->is_deleted = 0;
    + goto out;
    + }
    +
    + /* No memory reusable. Create using new memory. */
    + domain = tmy_alloc_element(sizeof(*domain));
    + if (domain) {
    + INIT_LIST_HEAD(&domain->acl_info_list);
    + domain->domainname = saved_domainname;
    + domain->profile = profile;
    + list_add_tail_mb(&domain->list, &domain_list);
    + }
    +out: ;
    + mutex_unlock(&new_domain_assign_lock);
    +
    + return domain;
    +}
    +
    +/* Convert non ASCII printable characters to ASCII printable characters. */
    +static int tmy_escape(char *dest, const char *src, int dest_len)
    +{
    + while (*src) {
    + const unsigned char c = *(const unsigned char *) src;
    +
    + if (c == '\\') {
    + dest_len -= 2;
    + if (dest_len <= 0)
    + goto out;
    + *dest++ = '\\';
    + *dest++ = '\\';
    + } else if (c > ' ' && c < 127) {
    + if (--dest_len <= 0)
    + goto out;
    + *dest++ = c;
    + } else {
    + dest_len -= 4;
    + if (dest_len <= 0)
    + goto out;
    + *dest++ = '\\';
    + *dest++ = (c >> 6) + '0';
    + *dest++ = ((c >> 3) & 7) + '0';
    + *dest++ = (c & 7) + '0';
    + }
    + src++;
    + }
    +
    + if (--dest_len <= 0)
    + goto out;
    + *dest = '\0';
    +
    + return 0;
    +out: ;
    + return -ENOMEM;
    +}
    +
    +/* Get argv[0] of "struct linux_binprm". */
    +static char *tmy_get_argv0(struct linux_binprm *bprm)
    +{
    + char *arg_ptr;
    + int arg_len = 0;
    + unsigned long pos = bprm->p;
    + int i = pos / PAGE_SIZE;
    + int offset = pos % PAGE_SIZE;
    +
    + if (bprm->argc <= 0)
    + return NULL;
    +
    + arg_ptr = tmy_alloc(PAGE_SIZE);
    +
    + if (!arg_ptr)
    + goto out;
    +
    + while (1) {
    + struct page *page;
    + const char *kaddr;
    + char *tmp_arg;
    +
    +#ifdef CONFIG_MMU
    + if (get_user_pages(current, bprm->mm, pos,
    + 1, 0, 1, &page, NULL) <= 0)
    + goto out;
    +#else
    + page = bprm->page[i];
    +#endif
    + kaddr = kmap(page);
    + if (!kaddr) { /* Mapping failed. */
    +#ifdef CONFIG_MMU
    + put_page(page);
    +#endif
    + goto out;
    + }
    +
    + memmove(arg_ptr + arg_len, kaddr + offset, PAGE_SIZE - offset);
    + kunmap(page);
    +
    +#ifdef CONFIG_MMU
    + put_page(page);
    + pos += PAGE_SIZE - offset;
    +#endif
    +
    + arg_len += PAGE_SIZE - offset;
    +
    + if (memchr(arg_ptr, '\0', arg_len))
    + break;
    +
    + tmp_arg = tmy_alloc(arg_len + PAGE_SIZE);
    + if (!tmp_arg)
    + goto out;
    +
    + memmove(tmp_arg, arg_ptr, arg_len);
    + tmy_free(arg_ptr);
    + arg_ptr = tmp_arg;
    + i++;
    + offset = 0;
    + }
    + return arg_ptr;
    +out: ;
    + tmy_free(arg_ptr);
    +
    + return NULL;
    +}
    +
    +/**
    + * tmy_find_next_domain - find a domain to transit to if do_execve() succeeds.
    + * @bprm: pointer to "struct linux_binprm".
    + * @next_domain: pointer to pointer to "struct domain_info".
    + *
    + * Returns zero if success. @next_domain receives new domain to transit to.
    + * Returns nonzero on failure.
    + *
    + * This function handles TOMOYO Linux's domain transition.
    + * New domains are automatically created unless the domain the caller process
    + * belongs to is assigned a profile for enforcing mode.
    + */
    +int tmy_find_next_domain(struct linux_binprm *bprm,
    + struct domain_info **next_domain)
    +{
    + /* This function assumes that the size of buffer returned */
    + /* by tmy_realpath() = TMY_MAX_PATHNAME_LEN. */
    + struct domain_info *old_domain = TMY_SECURITY->domain;
    + struct domain_info *domain = NULL;
    + const char *old_domain_name = old_domain->domainname->name;
    + const char *original_name = bprm->filename;
    + struct file *filp = bprm->file;
    + char *new_domain_name = NULL;
    + char *real_program_name = NULL;
    + char *symlink_program_name = NULL;
    + const bool is_enforce = (tmy_flags(TMY_MAC_FOR_FILE) == 3);
    + int retval;
    + struct path_info r;
    + struct path_info s;
    + struct path_info l;
    +
    + /*
    + * Built-in initializers.
    + * This is needed because policies are not loaded
    + * until starting /sbin/init .
    + */
    + static int first = 1;
    + if (first) {
    + tmy_add_domain_initializer_entry(NULL, "/sbin/hotplug", 0, 0);
    + tmy_add_domain_initializer_entry(NULL, "/sbin/modprobe", 0, 0);
    + tmy_add_domain_initializer_entry(NULL, "/sbin/udevd", 0, 0);
    + first = 0;
    + }
    +
    + /* Get realpath of program. */
    + /* I hope tmy_realpath() won't fail with -ENOMEM. */
    + retval = -ENOENT;
    + real_program_name = tmy_realpath(original_name);
    +
    + if (!real_program_name)
    + goto out;
    +
    + /* Get realpath of symbolic link. */
    + symlink_program_name = tmy_realpath_nofollow(original_name);
    + if (!symlink_program_name)
    + goto out;
    +
    + r.name = real_program_name;
    + tmy_fill_path_info(&r);
    + s.name = symlink_program_name;
    + tmy_fill_path_info(&s);
    + l.name = strrchr(old_domain_name, ' ');
    +
    + if (l.name)
    + l.name++;
    + else
    + l.name = old_domain_name;
    + tmy_fill_path_info(&l);
    +
    + /* Check 'alias' directive. */
    + if (tmy_pathcmp(&r, &s)) {
    + struct alias_entry *ptr;
    +
    + /* Is this program allowed to be called via symbolic links? */
    + list_for_each_entry(ptr, &alias_list, list) {
    + if (ptr->is_deleted ||
    + tmy_pathcmp(&r, ptr->original_name) ||
    + tmy_pathcmp(&s, ptr->aliased_name))
    + continue;
    + memset(real_program_name, 0, TMY_MAX_PATHNAME_LEN);
    + strncpy(real_program_name,
    + ptr->aliased_name->name,
    + TMY_MAX_PATHNAME_LEN - 1);
    + tmy_fill_path_info(&r);
    + break;
    + }
    + }
    +
    + /* Compare basename of real_program_name and argv[0] */
    + if (bprm->argc > 0 && tmy_flags(TMY_MAC_FOR_ARGV0)) {
    +
    + char *org_argv0 = tmy_get_argv0(bprm);
    +
    + retval = -ENOMEM;
    + if (org_argv0) {
    +
    + const int len = strlen(org_argv0);
    + char *printable_argv0 = tmy_alloc(len * 4 + 8);
    +
    + if (printable_argv0 &&
    + !tmy_escape(printable_argv0, org_argv0,
    + len * 4 + 8)) {
    + const char *base_argv0;
    + const char *base_filename;
    +
    + base_argv0 = strrchr(printable_argv0, '/');
    + if (!base_argv0)
    + base_argv0 = printable_argv0;
    + else
    + base_argv0++;
    +
    + base_filename = strrchr(real_program_name, '/');
    + if (!base_filename)
    + base_filename = real_program_name;
    + else
    + base_filename++;
    +
    + if (strcmp(base_argv0, base_filename))
    + retval = tmy_argv0_perm(&r, base_argv0);
    + else
    + retval = 0;
    + }
    +
    + tmy_free(printable_argv0);
    + tmy_free(org_argv0);
    + }
    +
    + if (retval)
    + goto out;
    +
    + }
    +
    +
    + /* Check 'aggregator' directive. */
    + {
    + struct aggregator_entry *ptr;
    +
    + /* Is this program allowed to be aggregated? */
    + list_for_each_entry(ptr, &aggregator_list, list) {
    + if (ptr->is_deleted ||
    + !tmy_path_match(&r, ptr->original_name))
    + continue;
    + memset(real_program_name, 0, TMY_MAX_PATHNAME_LEN);
    + strncpy(real_program_name,
    + ptr->aggregated_name->name,
    + TMY_MAX_PATHNAME_LEN - 1);
    + tmy_fill_path_info(&r);
    + break;
    + }
    + }
    +
    + /* Check execute permission. */
    + retval = tmy_exec_perm(&r, filp);
    + if (retval < 0)
    + goto out;
    +
    + /* Allocate memory for calcurating domain name. */
    + retval = -ENOMEM;
    + new_domain_name = tmy_alloc(TMY_MAX_PATHNAME_LEN + 16);
    + if (!new_domain_name)
    + goto out;
    +
    + if (tmy_is_domain_initializer(old_domain->domainname, &r, &l))
    + /* Transit to the child of KERNEL_DOMAIN domain. */
    + snprintf(new_domain_name, TMY_MAX_PATHNAME_LEN + 1,
    + TMY_ROOT_NAME " " "%s", real_program_name);
    + else if (old_domain == &KERNEL_DOMAIN && !sbin_init_started)
    + /*
    + * Needn't to transit from kernel domain
    + * before starting /sbin/init .
    + * But transit from kernel domain if executing initializers,
    + * for they might start before /sbin/init .
    + */
    + domain = old_domain;
    + else if (tmy_is_domain_keeper(old_domain->domainname, &r, &l))
    + /* Keep current domain. */
    + domain = old_domain;
    + else
    + /* Normal domain transition. */
    + snprintf(new_domain_name,
    + TMY_MAX_PATHNAME_LEN + 1,
    + "%s %s",
    + old_domain_name,
    + real_program_name);
    +
    + if (domain || strlen(new_domain_name) >= TMY_MAX_PATHNAME_LEN)
    + goto ok;
    +
    + if (is_enforce) {
    + domain = tmy_find_domain(new_domain_name);
    + if (!domain &&
    + tmy_supervisor("#Need to create domain\n%s\n",
    + new_domain_name) == 0) {
    + const u8 profile = TMY_SECURITY->domain->profile;
    + domain = tmy_new_domain(new_domain_name, profile);
    + }
    + } else {
    + const u8 profile = TMY_SECURITY->domain->profile;
    + domain = tmy_new_domain(new_domain_name, profile);
    + }
    +
    +ok: ;
    +
    + if (!domain) {
    + printk(KERN_INFO "TOMOYO-ERROR: Domain '%s' not defined.\n",
    + new_domain_name);
    + if (is_enforce)
    + retval = -EPERM;
    + } else
    + retval = 0;
    +out: ;
    +
    + tmy_free(new_domain_name);
    + tmy_free(real_program_name);
    + tmy_free(symlink_program_name);
    + *next_domain = domain ? domain : old_domain;
    +
    + return retval;
    +}
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-11-16 18:45    [W:0.115 / U:59.560 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site