~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/tomoyo/condition.c

Version: ~ [ linux-5.5 ] ~ [ linux-5.4.15 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.98 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.167 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.211 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.211 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.81 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 // SPDX-License-Identifier: GPL-2.0
  2 /*
  3  * security/tomoyo/condition.c
  4  *
  5  * Copyright (C) 2005-2011  NTT DATA CORPORATION
  6  */
  7 
  8 #include "common.h"
  9 #include <linux/slab.h>
 10 
 11 /* List of "struct tomoyo_condition". */
 12 LIST_HEAD(tomoyo_condition_list);
 13 
 14 /**
 15  * tomoyo_argv - Check argv[] in "struct linux_binbrm".
 16  *
 17  * @index:   Index number of @arg_ptr.
 18  * @arg_ptr: Contents of argv[@index].
 19  * @argc:    Length of @argv.
 20  * @argv:    Pointer to "struct tomoyo_argv".
 21  * @checked: Set to true if @argv[@index] was found.
 22  *
 23  * Returns true on success, false otherwise.
 24  */
 25 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
 26                         const int argc, const struct tomoyo_argv *argv,
 27                         u8 *checked)
 28 {
 29         int i;
 30         struct tomoyo_path_info arg;
 31         arg.name = arg_ptr;
 32         for (i = 0; i < argc; argv++, checked++, i++) {
 33                 bool result;
 34                 if (index != argv->index)
 35                         continue;
 36                 *checked = 1;
 37                 tomoyo_fill_path_info(&arg);
 38                 result = tomoyo_path_matches_pattern(&arg, argv->value);
 39                 if (argv->is_not)
 40                         result = !result;
 41                 if (!result)
 42                         return false;
 43         }
 44         return true;
 45 }
 46 
 47 /**
 48  * tomoyo_envp - Check envp[] in "struct linux_binbrm".
 49  *
 50  * @env_name:  The name of environment variable.
 51  * @env_value: The value of environment variable.
 52  * @envc:      Length of @envp.
 53  * @envp:      Pointer to "struct tomoyo_envp".
 54  * @checked:   Set to true if @envp[@env_name] was found.
 55  *
 56  * Returns true on success, false otherwise.
 57  */
 58 static bool tomoyo_envp(const char *env_name, const char *env_value,
 59                         const int envc, const struct tomoyo_envp *envp,
 60                         u8 *checked)
 61 {
 62         int i;
 63         struct tomoyo_path_info name;
 64         struct tomoyo_path_info value;
 65         name.name = env_name;
 66         tomoyo_fill_path_info(&name);
 67         value.name = env_value;
 68         tomoyo_fill_path_info(&value);
 69         for (i = 0; i < envc; envp++, checked++, i++) {
 70                 bool result;
 71                 if (!tomoyo_path_matches_pattern(&name, envp->name))
 72                         continue;
 73                 *checked = 1;
 74                 if (envp->value) {
 75                         result = tomoyo_path_matches_pattern(&value,
 76                                                              envp->value);
 77                         if (envp->is_not)
 78                                 result = !result;
 79                 } else {
 80                         result = true;
 81                         if (!envp->is_not)
 82                                 result = !result;
 83                 }
 84                 if (!result)
 85                         return false;
 86         }
 87         return true;
 88 }
 89 
 90 /**
 91  * tomoyo_scan_bprm - Scan "struct linux_binprm".
 92  *
 93  * @ee:   Pointer to "struct tomoyo_execve".
 94  * @argc: Length of @argc.
 95  * @argv: Pointer to "struct tomoyo_argv".
 96  * @envc: Length of @envp.
 97  * @envp: Poiner to "struct tomoyo_envp".
 98  *
 99  * Returns true on success, false otherwise.
100  */
101 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
102                              const u16 argc, const struct tomoyo_argv *argv,
103                              const u16 envc, const struct tomoyo_envp *envp)
104 {
105         struct linux_binprm *bprm = ee->bprm;
106         struct tomoyo_page_dump *dump = &ee->dump;
107         char *arg_ptr = ee->tmp;
108         int arg_len = 0;
109         unsigned long pos = bprm->p;
110         int offset = pos % PAGE_SIZE;
111         int argv_count = bprm->argc;
112         int envp_count = bprm->envc;
113         bool result = true;
114         u8 local_checked[32];
115         u8 *checked;
116         if (argc + envc <= sizeof(local_checked)) {
117                 checked = local_checked;
118                 memset(local_checked, 0, sizeof(local_checked));
119         } else {
120                 checked = kzalloc(argc + envc, GFP_NOFS);
121                 if (!checked)
122                         return false;
123         }
124         while (argv_count || envp_count) {
125                 if (!tomoyo_dump_page(bprm, pos, dump)) {
126                         result = false;
127                         goto out;
128                 }
129                 pos += PAGE_SIZE - offset;
130                 while (offset < PAGE_SIZE) {
131                         /* Read. */
132                         const char *kaddr = dump->data;
133                         const unsigned char c = kaddr[offset++];
134                         if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
135                                 if (c == '\\') {
136                                         arg_ptr[arg_len++] = '\\';
137                                         arg_ptr[arg_len++] = '\\';
138                                 } else if (c > ' ' && c < 127) {
139                                         arg_ptr[arg_len++] = c;
140                                 } else {
141                                         arg_ptr[arg_len++] = '\\';
142                                         arg_ptr[arg_len++] = (c >> 6) + '';
143                                         arg_ptr[arg_len++] =
144                                                 ((c >> 3) & 7) + '';
145                                         arg_ptr[arg_len++] = (c & 7) + '';
146                                 }
147                         } else {
148                                 arg_ptr[arg_len] = '\0';
149                         }
150                         if (c)
151                                 continue;
152                         /* Check. */
153                         if (argv_count) {
154                                 if (!tomoyo_argv(bprm->argc - argv_count,
155                                                  arg_ptr, argc, argv,
156                                                  checked)) {
157                                         result = false;
158                                         break;
159                                 }
160                                 argv_count--;
161                         } else if (envp_count) {
162                                 char *cp = strchr(arg_ptr, '=');
163                                 if (cp) {
164                                         *cp = '\0';
165                                         if (!tomoyo_envp(arg_ptr, cp + 1,
166                                                          envc, envp,
167                                                          checked + argc)) {
168                                                 result = false;
169                                                 break;
170                                         }
171                                 }
172                                 envp_count--;
173                         } else {
174                                 break;
175                         }
176                         arg_len = 0;
177                 }
178                 offset = 0;
179                 if (!result)
180                         break;
181         }
182 out:
183         if (result) {
184                 int i;
185                 /* Check not-yet-checked entries. */
186                 for (i = 0; i < argc; i++) {
187                         if (checked[i])
188                                 continue;
189                         /*
190                          * Return true only if all unchecked indexes in
191                          * bprm->argv[] are not matched.
192                          */
193                         if (argv[i].is_not)
194                                 continue;
195                         result = false;
196                         break;
197                 }
198                 for (i = 0; i < envc; envp++, i++) {
199                         if (checked[argc + i])
200                                 continue;
201                         /*
202                          * Return true only if all unchecked environ variables
203                          * in bprm->envp[] are either undefined or not matched.
204                          */
205                         if ((!envp->value && !envp->is_not) ||
206                             (envp->value && envp->is_not))
207                                 continue;
208                         result = false;
209                         break;
210                 }
211         }
212         if (checked != local_checked)
213                 kfree(checked);
214         return result;
215 }
216 
217 /**
218  * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition".
219  *
220  * @file:  Pointer to "struct file".
221  * @ptr:   Pointer to "struct tomoyo_name_union".
222  * @match: True if "exec.realpath=", false if "exec.realpath!=".
223  *
224  * Returns true on success, false otherwise.
225  */
226 static bool tomoyo_scan_exec_realpath(struct file *file,
227                                       const struct tomoyo_name_union *ptr,
228                                       const bool match)
229 {
230         bool result;
231         struct tomoyo_path_info exe;
232         if (!file)
233                 return false;
234         exe.name = tomoyo_realpath_from_path(&file->f_path);
235         if (!exe.name)
236                 return false;
237         tomoyo_fill_path_info(&exe);
238         result = tomoyo_compare_name_union(&exe, ptr);
239         kfree(exe.name);
240         return result == match;
241 }
242 
243 /**
244  * tomoyo_get_dqword - tomoyo_get_name() for a quoted string.
245  *
246  * @start: String to save.
247  *
248  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
249  */
250 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
251 {
252         char *cp = start + strlen(start) - 1;
253         if (cp == start || *start++ != '"' || *cp != '"')
254                 return NULL;
255         *cp = '\0';
256         if (*start && !tomoyo_correct_word(start))
257                 return NULL;
258         return tomoyo_get_name(start);
259 }
260 
261 /**
262  * tomoyo_parse_name_union_quoted - Parse a quoted word.
263  *
264  * @param: Pointer to "struct tomoyo_acl_param".
265  * @ptr:   Pointer to "struct tomoyo_name_union".
266  *
267  * Returns true on success, false otherwise.
268  */
269 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
270                                            struct tomoyo_name_union *ptr)
271 {
272         char *filename = param->data;
273         if (*filename == '@')
274                 return tomoyo_parse_name_union(param, ptr);
275         ptr->filename = tomoyo_get_dqword(filename);
276         return ptr->filename != NULL;
277 }
278 
279 /**
280  * tomoyo_parse_argv - Parse an argv[] condition part.
281  *
282  * @left:  Lefthand value.
283  * @right: Righthand value.
284  * @argv:  Pointer to "struct tomoyo_argv".
285  *
286  * Returns true on success, false otherwise.
287  */
288 static bool tomoyo_parse_argv(char *left, char *right,
289                               struct tomoyo_argv *argv)
290 {
291         if (tomoyo_parse_ulong(&argv->index, &left) !=
292             TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left)
293                 return false;
294         argv->value = tomoyo_get_dqword(right);
295         return argv->value != NULL;
296 }
297 
298 /**
299  * tomoyo_parse_envp - Parse an envp[] condition part.
300  *
301  * @left:  Lefthand value.
302  * @right: Righthand value.
303  * @envp:  Pointer to "struct tomoyo_envp".
304  *
305  * Returns true on success, false otherwise.
306  */
307 static bool tomoyo_parse_envp(char *left, char *right,
308                               struct tomoyo_envp *envp)
309 {
310         const struct tomoyo_path_info *name;
311         const struct tomoyo_path_info *value;
312         char *cp = left + strlen(left) - 1;
313         if (*cp-- != ']' || *cp != '"')
314                 goto out;
315         *cp = '\0';
316         if (!tomoyo_correct_word(left))
317                 goto out;
318         name = tomoyo_get_name(left);
319         if (!name)
320                 goto out;
321         if (!strcmp(right, "NULL")) {
322                 value = NULL;
323         } else {
324                 value = tomoyo_get_dqword(right);
325                 if (!value) {
326                         tomoyo_put_name(name);
327                         goto out;
328                 }
329         }
330         envp->name = name;
331         envp->value = value;
332         return true;
333 out:
334         return false;
335 }
336 
337 /**
338  * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry.
339  *
340  * @a: Pointer to "struct tomoyo_condition".
341  * @b: Pointer to "struct tomoyo_condition".
342  *
343  * Returns true if @a == @b, false otherwise.
344  */
345 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
346                                          const struct tomoyo_condition *b)
347 {
348         return a->size == b->size && a->condc == b->condc &&
349                 a->numbers_count == b->numbers_count &&
350                 a->names_count == b->names_count &&
351                 a->argc == b->argc && a->envc == b->envc &&
352                 a->grant_log == b->grant_log && a->transit == b->transit &&
353                 !memcmp(a + 1, b + 1, a->size - sizeof(*a));
354 }
355 
356 /**
357  * tomoyo_condition_type - Get condition type.
358  *
359  * @word: Keyword string.
360  *
361  * Returns one of values in "enum tomoyo_conditions_index" on success,
362  * TOMOYO_MAX_CONDITION_KEYWORD otherwise.
363  */
364 static u8 tomoyo_condition_type(const char *word)
365 {
366         u8 i;
367         for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
368                 if (!strcmp(word, tomoyo_condition_keyword[i]))
369                         break;
370         }
371         return i;
372 }
373 
374 /* Define this to enable debug mode. */
375 /* #define DEBUG_CONDITION */
376 
377 #ifdef DEBUG_CONDITION
378 #define dprintk printk
379 #else
380 #define dprintk(...) do { } while (0)
381 #endif
382 
383 /**
384  * tomoyo_commit_condition - Commit "struct tomoyo_condition".
385  *
386  * @entry: Pointer to "struct tomoyo_condition".
387  *
388  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
389  *
390  * This function merges duplicated entries. This function returns NULL if
391  * @entry is not duplicated but memory quota for policy has exceeded.
392  */
393 static struct tomoyo_condition *tomoyo_commit_condition
394 (struct tomoyo_condition *entry)
395 {
396         struct tomoyo_condition *ptr;
397         bool found = false;
398         if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
399                 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
400                 ptr = NULL;
401                 found = true;
402                 goto out;
403         }
404         list_for_each_entry(ptr, &tomoyo_condition_list, head.list) {
405                 if (!tomoyo_same_condition(ptr, entry) ||
406                     atomic_read(&ptr->head.users) == TOMOYO_GC_IN_PROGRESS)
407                         continue;
408                 /* Same entry found. Share this entry. */
409                 atomic_inc(&ptr->head.users);
410                 found = true;
411                 break;
412         }
413         if (!found) {
414                 if (tomoyo_memory_ok(entry)) {
415                         atomic_set(&entry->head.users, 1);
416                         list_add(&entry->head.list, &tomoyo_condition_list);
417                 } else {
418                         found = true;
419                         ptr = NULL;
420                 }
421         }
422         mutex_unlock(&tomoyo_policy_lock);
423 out:
424         if (found) {
425                 tomoyo_del_condition(&entry->head.list);
426                 kfree(entry);
427                 entry = ptr;
428         }
429         return entry;
430 }
431 
432 /**
433  * tomoyo_get_transit_preference - Parse domain transition preference for execve().
434  *
435  * @param: Pointer to "struct tomoyo_acl_param".
436  * @e:     Pointer to "struct tomoyo_condition".
437  *
438  * Returns the condition string part.
439  */
440 static char *tomoyo_get_transit_preference(struct tomoyo_acl_param *param,
441                                            struct tomoyo_condition *e)
442 {
443         char * const pos = param->data;
444         bool flag;
445         if (*pos == '<') {
446                 e->transit = tomoyo_get_domainname(param);
447                 goto done;
448         }
449         {
450                 char *cp = strchr(pos, ' ');
451                 if (cp)
452                         *cp = '\0';
453                 flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") ||
454                         !strcmp(pos, "initialize") || !strcmp(pos, "reset") ||
455                         !strcmp(pos, "child") || !strcmp(pos, "parent");
456                 if (cp)
457                         *cp = ' ';
458         }
459         if (!flag)
460                 return pos;
461         e->transit = tomoyo_get_name(tomoyo_read_token(param));
462 done:
463         if (e->transit)
464                 return param->data;
465         /*
466          * Return a bad read-only condition string that will let
467          * tomoyo_get_condition() return NULL.
468          */
469         return "/";
470 }
471 
472 /**
473  * tomoyo_get_condition - Parse condition part.
474  *
475  * @param: Pointer to "struct tomoyo_acl_param".
476  *
477  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
478  */
479 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
480 {
481         struct tomoyo_condition *entry = NULL;
482         struct tomoyo_condition_element *condp = NULL;
483         struct tomoyo_number_union *numbers_p = NULL;
484         struct tomoyo_name_union *names_p = NULL;
485         struct tomoyo_argv *argv = NULL;
486         struct tomoyo_envp *envp = NULL;
487         struct tomoyo_condition e = { };
488         char * const start_of_string =
489                 tomoyo_get_transit_preference(param, &e);
490         char * const end_of_string = start_of_string + strlen(start_of_string);
491         char *pos;
492 rerun:
493         pos = start_of_string;
494         while (1) {
495                 u8 left = -1;
496                 u8 right = -1;
497                 char *left_word = pos;
498                 char *cp;
499                 char *right_word;
500                 bool is_not;
501                 if (!*left_word)
502                         break;
503                 /*
504                  * Since left-hand condition does not allow use of "path_group"
505                  * or "number_group" and environment variable's names do not
506                  * accept '=', it is guaranteed that the original line consists
507                  * of one or more repetition of $left$operator$right blocks
508                  * where "$left is free from '=' and ' '" and "$operator is
509                  * either '=' or '!='" and "$right is free from ' '".
510                  * Therefore, we can reconstruct the original line at the end
511                  * of dry run even if we overwrite $operator with '\0'.
512                  */
513                 cp = strchr(pos, ' ');
514                 if (cp) {
515                         *cp = '\0'; /* Will restore later. */
516                         pos = cp + 1;
517                 } else {
518                         pos = "";
519                 }
520                 right_word = strchr(left_word, '=');
521                 if (!right_word || right_word == left_word)
522                         goto out;
523                 is_not = *(right_word - 1) == '!';
524                 if (is_not)
525                         *(right_word++ - 1) = '\0'; /* Will restore later. */
526                 else if (*(right_word + 1) != '=')
527                         *right_word++ = '\0'; /* Will restore later. */
528                 else
529                         goto out;
530                 dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word,
531                         is_not ? "!" : "", right_word);
532                 if (!strcmp(left_word, "grant_log")) {
533                         if (entry) {
534                                 if (is_not ||
535                                     entry->grant_log != TOMOYO_GRANTLOG_AUTO)
536                                         goto out;
537                                 else if (!strcmp(right_word, "yes"))
538                                         entry->grant_log = TOMOYO_GRANTLOG_YES;
539                                 else if (!strcmp(right_word, "no"))
540                                         entry->grant_log = TOMOYO_GRANTLOG_NO;
541                                 else
542                                         goto out;
543                         }
544                         continue;
545                 }
546                 if (!strncmp(left_word, "exec.argv[", 10)) {
547                         if (!argv) {
548                                 e.argc++;
549                                 e.condc++;
550                         } else {
551                                 e.argc--;
552                                 e.condc--;
553                                 left = TOMOYO_ARGV_ENTRY;
554                                 argv->is_not = is_not;
555                                 if (!tomoyo_parse_argv(left_word + 10,
556                                                        right_word, argv++))
557                                         goto out;
558                         }
559                         goto store_value;
560                 }
561                 if (!strncmp(left_word, "exec.envp[\"", 11)) {
562                         if (!envp) {
563                                 e.envc++;
564                                 e.condc++;
565                         } else {
566                                 e.envc--;
567                                 e.condc--;
568                                 left = TOMOYO_ENVP_ENTRY;
569                                 envp->is_not = is_not;
570                                 if (!tomoyo_parse_envp(left_word + 11,
571                                                        right_word, envp++))
572                                         goto out;
573                         }
574                         goto store_value;
575                 }
576                 left = tomoyo_condition_type(left_word);
577                 dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word,
578                         left);
579                 if (left == TOMOYO_MAX_CONDITION_KEYWORD) {
580                         if (!numbers_p) {
581                                 e.numbers_count++;
582                         } else {
583                                 e.numbers_count--;
584                                 left = TOMOYO_NUMBER_UNION;
585                                 param->data = left_word;
586                                 if (*left_word == '@' ||
587                                     !tomoyo_parse_number_union(param,
588                                                                numbers_p++))
589                                         goto out;
590                         }
591                 }
592                 if (!condp)
593                         e.condc++;
594                 else
595                         e.condc--;
596                 if (left == TOMOYO_EXEC_REALPATH ||
597                     left == TOMOYO_SYMLINK_TARGET) {
598                         if (!names_p) {
599                                 e.names_count++;
600                         } else {
601                                 e.names_count--;
602                                 right = TOMOYO_NAME_UNION;
603                                 param->data = right_word;
604                                 if (!tomoyo_parse_name_union_quoted(param,
605                                                                     names_p++))
606                                         goto out;
607                         }
608                         goto store_value;
609                 }
610                 right = tomoyo_condition_type(right_word);
611                 if (right == TOMOYO_MAX_CONDITION_KEYWORD) {
612                         if (!numbers_p) {
613                                 e.numbers_count++;
614                         } else {
615                                 e.numbers_count--;
616                                 right = TOMOYO_NUMBER_UNION;
617                                 param->data = right_word;
618                                 if (!tomoyo_parse_number_union(param,
619                                                                numbers_p++))
620                                         goto out;
621                         }
622                 }
623 store_value:
624                 if (!condp) {
625                         dprintk(KERN_WARNING "%u: dry_run left=%u right=%u "
626                                 "match=%u\n", __LINE__, left, right, !is_not);
627                         continue;
628                 }
629                 condp->left = left;
630                 condp->right = right;
631                 condp->equals = !is_not;
632                 dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n",
633                         __LINE__, condp->left, condp->right,
634                         condp->equals);
635                 condp++;
636         }
637         dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n",
638                 __LINE__, e.condc, e.numbers_count, e.names_count, e.argc,
639                 e.envc);
640         if (entry) {
641                 BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc |
642                        e.condc);
643                 return tomoyo_commit_condition(entry);
644         }
645         e.size = sizeof(*entry)
646                 + e.condc * sizeof(struct tomoyo_condition_element)
647                 + e.numbers_count * sizeof(struct tomoyo_number_union)
648                 + e.names_count * sizeof(struct tomoyo_name_union)
649                 + e.argc * sizeof(struct tomoyo_argv)
650                 + e.envc * sizeof(struct tomoyo_envp);
651         entry = kzalloc(e.size, GFP_NOFS);
652         if (!entry)
653                 goto out2;
654         *entry = e;
655         e.transit = NULL;
656         condp = (struct tomoyo_condition_element *) (entry + 1);
657         numbers_p = (struct tomoyo_number_union *) (condp + e.condc);
658         names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count);
659         argv = (struct tomoyo_argv *) (names_p + e.names_count);
660         envp = (struct tomoyo_envp *) (argv + e.argc);
661         {
662                 bool flag = false;
663                 for (pos = start_of_string; pos < end_of_string; pos++) {
664                         if (*pos)
665                                 continue;
666                         if (flag) /* Restore " ". */
667                                 *pos = ' ';
668                         else if (*(pos + 1) == '=') /* Restore "!=". */
669                                 *pos = '!';
670                         else /* Restore "=". */
671                                 *pos = '=';
672                         flag = !flag;
673                 }
674         }
675         goto rerun;
676 out:
677         dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
678         if (entry) {
679                 tomoyo_del_condition(&entry->head.list);
680                 kfree(entry);
681         }
682 out2:
683         tomoyo_put_name(e.transit);
684         return NULL;
685 }
686 
687 /**
688  * tomoyo_get_attributes - Revalidate "struct inode".
689  *
690  * @obj: Pointer to "struct tomoyo_obj_info".
691  *
692  * Returns nothing.
693  */
694 void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
695 {
696         u8 i;
697         struct dentry *dentry = NULL;
698 
699         for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
700                 struct inode *inode;
701                 switch (i) {
702                 case TOMOYO_PATH1:
703                         dentry = obj->path1.dentry;
704                         if (!dentry)
705                                 continue;
706                         break;
707                 case TOMOYO_PATH2:
708                         dentry = obj->path2.dentry;
709                         if (!dentry)
710                                 continue;
711                         break;
712                 default:
713                         if (!dentry)
714                                 continue;
715                         dentry = dget_parent(dentry);
716                         break;
717                 }
718                 inode = d_backing_inode(dentry);
719                 if (inode) {
720                         struct tomoyo_mini_stat *stat = &obj->stat[i];
721                         stat->uid  = inode->i_uid;
722                         stat->gid  = inode->i_gid;
723                         stat->ino  = inode->i_ino;
724                         stat->mode = inode->i_mode;
725                         stat->dev  = inode->i_sb->s_dev;
726                         stat->rdev = inode->i_rdev;
727                         obj->stat_valid[i] = true;
728                 }
729                 if (i & 1) /* i == TOMOYO_PATH1_PARENT ||
730                               i == TOMOYO_PATH2_PARENT */
731                         dput(dentry);
732         }
733 }
734 
735 /**
736  * tomoyo_condition - Check condition part.
737  *
738  * @r:    Pointer to "struct tomoyo_request_info".
739  * @cond: Pointer to "struct tomoyo_condition". Maybe NULL.
740  *
741  * Returns true on success, false otherwise.
742  *
743  * Caller holds tomoyo_read_lock().
744  */
745 bool tomoyo_condition(struct tomoyo_request_info *r,
746                       const struct tomoyo_condition *cond)
747 {
748         u32 i;
749         unsigned long min_v[2] = { 0, 0 };
750         unsigned long max_v[2] = { 0, 0 };
751         const struct tomoyo_condition_element *condp;
752         const struct tomoyo_number_union *numbers_p;
753         const struct tomoyo_name_union *names_p;
754         const struct tomoyo_argv *argv;
755         const struct tomoyo_envp *envp;
756         struct tomoyo_obj_info *obj;
757         u16 condc;
758         u16 argc;
759         u16 envc;
760         struct linux_binprm *bprm = NULL;
761         if (!cond)
762                 return true;
763         condc = cond->condc;
764         argc = cond->argc;
765         envc = cond->envc;
766         obj = r->obj;
767         if (r->ee)
768                 bprm = r->ee->bprm;
769         if (!bprm && (argc || envc))
770                 return false;
771         condp = (struct tomoyo_condition_element *) (cond + 1);
772         numbers_p = (const struct tomoyo_number_union *) (condp + condc);
773         names_p = (const struct tomoyo_name_union *)
774                 (numbers_p + cond->numbers_count);
775         argv = (const struct tomoyo_argv *) (names_p + cond->names_count);
776         envp = (const struct tomoyo_envp *) (argv + argc);
777         for (i = 0; i < condc; i++) {
778                 const bool match = condp->equals;
779                 const u8 left = condp->left;
780                 const u8 right = condp->right;
781                 bool is_bitop[2] = { false, false };
782                 u8 j;
783                 condp++;
784                 /* Check argv[] and envp[] later. */
785                 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
786                         continue;
787                 /* Check string expressions. */
788                 if (right == TOMOYO_NAME_UNION) {
789                         const struct tomoyo_name_union *ptr = names_p++;
790                         switch (left) {
791                                 struct tomoyo_path_info *symlink;
792                                 struct tomoyo_execve *ee;
793                                 struct file *file;
794                         case TOMOYO_SYMLINK_TARGET:
795                                 symlink = obj ? obj->symlink_target : NULL;
796                                 if (!symlink ||
797                                     !tomoyo_compare_name_union(symlink, ptr)
798                                     == match)
799                                         goto out;
800                                 break;
801                         case TOMOYO_EXEC_REALPATH:
802                                 ee = r->ee;
803                                 file = ee ? ee->bprm->file : NULL;
804                                 if (!tomoyo_scan_exec_realpath(file, ptr,
805                                                                match))
806                                         goto out;
807                                 break;
808                         }
809                         continue;
810                 }
811                 /* Check numeric or bit-op expressions. */
812                 for (j = 0; j < 2; j++) {
813                         const u8 index = j ? right : left;
814                         unsigned long value = 0;
815                         switch (index) {
816                         case TOMOYO_TASK_UID:
817                                 value = from_kuid(&init_user_ns, current_uid());
818                                 break;
819                         case TOMOYO_TASK_EUID:
820                                 value = from_kuid(&init_user_ns, current_euid());
821                                 break;
822                         case TOMOYO_TASK_SUID:
823                                 value = from_kuid(&init_user_ns, current_suid());
824                                 break;
825                         case TOMOYO_TASK_FSUID:
826                                 value = from_kuid(&init_user_ns, current_fsuid());
827                                 break;
828                         case TOMOYO_TASK_GID:
829                                 value = from_kgid(&init_user_ns, current_gid());
830                                 break;
831                         case TOMOYO_TASK_EGID:
832                                 value = from_kgid(&init_user_ns, current_egid());
833                                 break;
834                         case TOMOYO_TASK_SGID:
835                                 value = from_kgid(&init_user_ns, current_sgid());
836                                 break;
837                         case TOMOYO_TASK_FSGID:
838                                 value = from_kgid(&init_user_ns, current_fsgid());
839                                 break;
840                         case TOMOYO_TASK_PID:
841                                 value = tomoyo_sys_getpid();
842                                 break;
843                         case TOMOYO_TASK_PPID:
844                                 value = tomoyo_sys_getppid();
845                                 break;
846                         case TOMOYO_TYPE_IS_SOCKET:
847                                 value = S_IFSOCK;
848                                 break;
849                         case TOMOYO_TYPE_IS_SYMLINK:
850                                 value = S_IFLNK;
851                                 break;
852                         case TOMOYO_TYPE_IS_FILE:
853                                 value = S_IFREG;
854                                 break;
855                         case TOMOYO_TYPE_IS_BLOCK_DEV:
856                                 value = S_IFBLK;
857                                 break;
858                         case TOMOYO_TYPE_IS_DIRECTORY:
859                                 value = S_IFDIR;
860                                 break;
861                         case TOMOYO_TYPE_IS_CHAR_DEV:
862                                 value = S_IFCHR;
863                                 break;
864                         case TOMOYO_TYPE_IS_FIFO:
865                                 value = S_IFIFO;
866                                 break;
867                         case TOMOYO_MODE_SETUID:
868                                 value = S_ISUID;
869                                 break;
870                         case TOMOYO_MODE_SETGID:
871                                 value = S_ISGID;
872                                 break;
873                         case TOMOYO_MODE_STICKY:
874                                 value = S_ISVTX;
875                                 break;
876                         case TOMOYO_MODE_OWNER_READ:
877                                 value = S_IRUSR;
878                                 break;
879                         case TOMOYO_MODE_OWNER_WRITE:
880                                 value = S_IWUSR;
881                                 break;
882                         case TOMOYO_MODE_OWNER_EXECUTE:
883                                 value = S_IXUSR;
884                                 break;
885                         case TOMOYO_MODE_GROUP_READ:
886                                 value = S_IRGRP;
887                                 break;
888                         case TOMOYO_MODE_GROUP_WRITE:
889                                 value = S_IWGRP;
890                                 break;
891                         case TOMOYO_MODE_GROUP_EXECUTE:
892                                 value = S_IXGRP;
893                                 break;
894                         case TOMOYO_MODE_OTHERS_READ:
895                                 value = S_IROTH;
896                                 break;
897                         case TOMOYO_MODE_OTHERS_WRITE:
898                                 value = S_IWOTH;
899                                 break;
900                         case TOMOYO_MODE_OTHERS_EXECUTE:
901                                 value = S_IXOTH;
902                                 break;
903                         case TOMOYO_EXEC_ARGC:
904                                 if (!bprm)
905                                         goto out;
906                                 value = bprm->argc;
907                                 break;
908                         case TOMOYO_EXEC_ENVC:
909                                 if (!bprm)
910                                         goto out;
911                                 value = bprm->envc;
912                                 break;
913                         case TOMOYO_NUMBER_UNION:
914                                 /* Fetch values later. */
915                                 break;
916                         default:
917                                 if (!obj)
918                                         goto out;
919                                 if (!obj->validate_done) {
920                                         tomoyo_get_attributes(obj);
921                                         obj->validate_done = true;
922                                 }
923                                 {
924                                         u8 stat_index;
925                                         struct tomoyo_mini_stat *stat;
926                                         switch (index) {
927                                         case TOMOYO_PATH1_UID:
928                                         case TOMOYO_PATH1_GID:
929                                         case TOMOYO_PATH1_INO:
930                                         case TOMOYO_PATH1_MAJOR:
931                                         case TOMOYO_PATH1_MINOR:
932                                         case TOMOYO_PATH1_TYPE:
933                                         case TOMOYO_PATH1_DEV_MAJOR:
934                                         case TOMOYO_PATH1_DEV_MINOR:
935                                         case TOMOYO_PATH1_PERM:
936                                                 stat_index = TOMOYO_PATH1;
937                                                 break;
938                                         case TOMOYO_PATH2_UID:
939                                         case TOMOYO_PATH2_GID:
940                                         case TOMOYO_PATH2_INO:
941                                         case TOMOYO_PATH2_MAJOR:
942                                         case TOMOYO_PATH2_MINOR:
943                                         case TOMOYO_PATH2_TYPE:
944                                         case TOMOYO_PATH2_DEV_MAJOR:
945                                         case TOMOYO_PATH2_DEV_MINOR:
946                                         case TOMOYO_PATH2_PERM:
947                                                 stat_index = TOMOYO_PATH2;
948                                                 break;
949                                         case TOMOYO_PATH1_PARENT_UID:
950                                         case TOMOYO_PATH1_PARENT_GID:
951                                         case TOMOYO_PATH1_PARENT_INO:
952                                         case TOMOYO_PATH1_PARENT_PERM:
953                                                 stat_index =
954                                                         TOMOYO_PATH1_PARENT;
955                                                 break;
956                                         case TOMOYO_PATH2_PARENT_UID:
957                                         case TOMOYO_PATH2_PARENT_GID:
958                                         case TOMOYO_PATH2_PARENT_INO:
959                                         case TOMOYO_PATH2_PARENT_PERM:
960                                                 stat_index =
961                                                         TOMOYO_PATH2_PARENT;
962                                                 break;
963                                         default:
964                                                 goto out;
965                                         }
966                                         if (!obj->stat_valid[stat_index])
967                                                 goto out;
968                                         stat = &obj->stat[stat_index];
969                                         switch (index) {
970                                         case TOMOYO_PATH1_UID:
971                                         case TOMOYO_PATH2_UID:
972                                         case TOMOYO_PATH1_PARENT_UID:
973                                         case TOMOYO_PATH2_PARENT_UID:
974                                                 value = from_kuid(&init_user_ns, stat->uid);
975                                                 break;
976                                         case TOMOYO_PATH1_GID:
977                                         case TOMOYO_PATH2_GID:
978                                         case TOMOYO_PATH1_PARENT_GID:
979                                         case TOMOYO_PATH2_PARENT_GID:
980                                                 value = from_kgid(&init_user_ns, stat->gid);
981                                                 break;
982                                         case TOMOYO_PATH1_INO:
983                                         case TOMOYO_PATH2_INO:
984                                         case TOMOYO_PATH1_PARENT_INO:
985                                         case TOMOYO_PATH2_PARENT_INO:
986                                                 value = stat->ino;
987                                                 break;
988                                         case TOMOYO_PATH1_MAJOR:
989                                         case TOMOYO_PATH2_MAJOR:
990                                                 value = MAJOR(stat->dev);
991                                                 break;
992                                         case TOMOYO_PATH1_MINOR:
993                                         case TOMOYO_PATH2_MINOR:
994                                                 value = MINOR(stat->dev);
995                                                 break;
996                                         case TOMOYO_PATH1_TYPE:
997                                         case TOMOYO_PATH2_TYPE:
998                                                 value = stat->mode & S_IFMT;
999                                                 break;
1000                                         case TOMOYO_PATH1_DEV_MAJOR:
1001                                         case TOMOYO_PATH2_DEV_MAJOR:
1002                                                 value = MAJOR(stat->rdev);
1003                                                 break;
1004                                         case TOMOYO_PATH1_DEV_MINOR:
1005                                         case TOMOYO_PATH2_DEV_MINOR:
1006                                                 value = MINOR(stat->rdev);
1007                                                 break;
1008                                         case TOMOYO_PATH1_PERM:
1009                                         case TOMOYO_PATH2_PERM:
1010                                         case TOMOYO_PATH1_PARENT_PERM:
1011                                         case TOMOYO_PATH2_PARENT_PERM:
1012                                                 value = stat->mode & S_IALLUGO;
1013                                                 break;
1014                                         }
1015                                 }
1016                                 break;
1017                         }
1018                         max_v[j] = value;
1019                         min_v[j] = value;
1020                         switch (index) {
1021                         case TOMOYO_MODE_SETUID:
1022                         case TOMOYO_MODE_SETGID:
1023                         case TOMOYO_MODE_STICKY:
1024                         case TOMOYO_MODE_OWNER_READ:
1025                         case TOMOYO_MODE_OWNER_WRITE:
1026                         case TOMOYO_MODE_OWNER_EXECUTE:
1027                         case TOMOYO_MODE_GROUP_READ:
1028                         case TOMOYO_MODE_GROUP_WRITE:
1029                         case TOMOYO_MODE_GROUP_EXECUTE:
1030                         case TOMOYO_MODE_OTHERS_READ:
1031                         case TOMOYO_MODE_OTHERS_WRITE:
1032                         case TOMOYO_MODE_OTHERS_EXECUTE:
1033                                 is_bitop[j] = true;
1034                         }
1035                 }
1036                 if (left == TOMOYO_NUMBER_UNION) {
1037                         /* Fetch values now. */
1038                         const struct tomoyo_number_union *ptr = numbers_p++;
1039                         min_v[0] = ptr->values[0];
1040                         max_v[0] = ptr->values[1];
1041                 }
1042                 if (right == TOMOYO_NUMBER_UNION) {
1043                         /* Fetch values now. */
1044                         const struct tomoyo_number_union *ptr = numbers_p++;
1045                         if (ptr->group) {
1046                                 if (tomoyo_number_matches_group(min_v[0],
1047                                                                 max_v[0],
1048                                                                 ptr->group)
1049                                     == match)
1050                                         continue;
1051                         } else {
1052                                 if ((min_v[0] <= ptr->values[1] &&
1053                                      max_v[0] >= ptr->values[0]) == match)
1054                                         continue;
1055                         }
1056                         goto out;
1057                 }
1058                 /*
1059                  * Bit operation is valid only when counterpart value
1060                  * represents permission.
1061                  */
1062                 if (is_bitop[0] && is_bitop[1]) {
1063                         goto out;
1064                 } else if (is_bitop[0]) {
1065                         switch (right) {
1066                         case TOMOYO_PATH1_PERM:
1067                         case TOMOYO_PATH1_PARENT_PERM:
1068                         case TOMOYO_PATH2_PERM:
1069                         case TOMOYO_PATH2_PARENT_PERM:
1070                                 if (!(max_v[0] & max_v[1]) == !match)
1071                                         continue;
1072                         }
1073                         goto out;
1074                 } else if (is_bitop[1]) {
1075                         switch (left) {
1076                         case TOMOYO_PATH1_PERM:
1077                         case TOMOYO_PATH1_PARENT_PERM:
1078                         case TOMOYO_PATH2_PERM:
1079                         case TOMOYO_PATH2_PARENT_PERM:
1080                                 if (!(max_v[0] & max_v[1]) == !match)
1081                                         continue;
1082                         }
1083                         goto out;
1084                 }
1085                 /* Normal value range comparison. */
1086                 if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match)
1087                         continue;
1088 out:
1089                 return false;
1090         }
1091         /* Check argv[] and envp[] now. */
1092         if (r->ee && (argc || envc))
1093                 return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp);
1094         return true;
1095 }
1096 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp