Skip to content

L
linux
Commit 059d84db authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files
Options

TOMOYO: Add socket operation restriction support. 

This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
socket's bind()/listen()/connect()/send() operations.
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent d58e0da8
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 1215 additions and 17 deletions
security/tomoyo/Kconfig
View file @ 059d84db
config SECURITY_TOMOYO
bool "TOMOYO Linux Support"
depends on SECURITY
depends on NET
select SECURITYFS
select SECURITY_PATH
select SECURITY_NETWORK
default n
help
This selects TOMOYO Linux, pathname-based access control.
......
security/tomoyo/Makefile
View file @ 059d84db
obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o
obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
$(obj)/policy/profile.conf:
@mkdir -p $(obj)/policy/
......
security/tomoyo/common.c
View file @ 059d84db
......@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
[TOMOYO_MAC_FILE_MOUNT] = "mount",
[TOMOYO_MAC_FILE_UMOUNT] = "unmount",
[TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root",
/* CONFIG::network group */
[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] = "inet_stream_bind",
[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] = "inet_stream_listen",
[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] = "inet_stream_connect",
[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] = "inet_dgram_bind",
[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] = "inet_dgram_send",
[TOMOYO_MAC_NETWORK_INET_RAW_BIND] = "inet_raw_bind",
[TOMOYO_MAC_NETWORK_INET_RAW_SEND] = "inet_raw_send",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] = "unix_stream_bind",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] = "unix_stream_listen",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] = "unix_stream_connect",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] = "unix_dgram_bind",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] = "unix_dgram_send",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] = "unix_seqpacket_bind",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] = "unix_seqpacket_listen",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
/* CONFIG::misc group */
[TOMOYO_MAC_ENVIRON] = "env",
/* CONFIG group */
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc",
};
......@@ -135,11 +152,20 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
[TOMOYO_TYPE_UMOUNT] = "unmount",
};
/* String table for socket's operation. */
const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION] = {
[TOMOYO_NETWORK_BIND] = "bind",
[TOMOYO_NETWORK_LISTEN] = "listen",
[TOMOYO_NETWORK_CONNECT] = "connect",
[TOMOYO_NETWORK_SEND] = "send",
};
/* String table for categories. */
static const char * const tomoyo_category_keywords
[TOMOYO_MAX_MAC_CATEGORY_INDEX] = {
[TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAC_CATEGORY_MISC] = "misc",
[TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAC_CATEGORY_MISC] = "misc",
};
/* Permit policy management by non-root user? */
......@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
static const struct {
const char *keyword;
int (*write) (struct tomoyo_acl_param *);
} tomoyo_callback[2] = {
} tomoyo_callback[4] = {
{ "file ", tomoyo_write_file },
{ "network inet ", tomoyo_write_inet_network },
{ "network unix ", tomoyo_write_unix_network },
{ "misc ", tomoyo_write_misc },
};
u8 i;
......@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
tomoyo_print_number_union(head, &ptr->mode);
tomoyo_print_number_union(head, &ptr->major);
tomoyo_print_number_union(head, &ptr->minor);
} else if (acl_type == TOMOYO_TYPE_INET_ACL) {
struct tomoyo_inet_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network inet ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_set_space(head);
if (ptr->address.group) {
tomoyo_set_string(head, "@");
tomoyo_set_string(head, ptr->address.group->group_name
->name);
} else {
char buf[128];
tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
tomoyo_io_printf(head, "%s", buf);
}
tomoyo_print_number_union(head, &ptr->port);
} else if (acl_type == TOMOYO_TYPE_UNIX_ACL) {
struct tomoyo_unix_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network unix ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_print_name_union(head, &ptr->name);
} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
struct tomoyo_mount_acl *ptr =
container_of(acl, typeof(*ptr), head);
......@@ -1548,8 +1630,9 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = {
/* String table for grouping keywords. */
static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = {
[TOMOYO_PATH_GROUP] = "path_group ",
[TOMOYO_NUMBER_GROUP] = "number_group ",
[TOMOYO_PATH_GROUP] = "path_group ",
[TOMOYO_NUMBER_GROUP] = "number_group ",
[TOMOYO_ADDRESS_GROUP] = "address_group ",
};
/**
......@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
}
/**
* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group" list.
* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
*
* @head: Pointer to "struct tomoyo_io_buffer".
* @idx: Index number.
......@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
(ptr,
struct tomoyo_number_group,
head)->number);
} else if (idx == TOMOYO_ADDRESS_GROUP) {
char buffer[128];
struct tomoyo_address_group *member =
container_of(ptr, typeof(*member),
head);
tomoyo_print_ip(buffer, sizeof(buffer),
&member->address);
tomoyo_io_printf(head, " %s", buffer);
}
tomoyo_set_lf(head);
}
......
security/tomoyo/common.h
View file @ 059d84db
......@@ -23,6 +23,16 @@
#include <linux/poll.h>
#include <linux/binfmts.h>
#include <linux/highmem.h>
#include <linux/net.h>
#include <linux/inet.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/un.h>
#include <net/sock.h>
#include <net/af_unix.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/udp.h>
/********** Constants definitions. **********/
......@@ -34,6 +44,12 @@
#define TOMOYO_HASH_BITS 8
#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
/*
* TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
* Therefore, we don't need SOCK_MAX.
*/
#define TOMOYO_SOCK_MAX 6
#define TOMOYO_EXEC_TMPSIZE 4096
/* Profile number is an integer between 0 and 255. */
......@@ -136,6 +152,7 @@ enum tomoyo_mode_index {
/* Index numbers for entry type. */
enum tomoyo_policy_id {
TOMOYO_ID_GROUP,
TOMOYO_ID_ADDRESS_GROUP,
TOMOYO_ID_PATH_GROUP,
TOMOYO_ID_NUMBER_GROUP,
TOMOYO_ID_TRANSITION_CONTROL,
......@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index {
enum tomoyo_group_id {
TOMOYO_PATH_GROUP,
TOMOYO_NUMBER_GROUP,
TOMOYO_ADDRESS_GROUP,
TOMOYO_MAX_GROUP
};
......@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index {
TOMOYO_TYPE_PATH_NUMBER_ACL,
TOMOYO_TYPE_MKDEV_ACL,
TOMOYO_TYPE_MOUNT_ACL,
TOMOYO_TYPE_INET_ACL,
TOMOYO_TYPE_UNIX_ACL,
TOMOYO_TYPE_ENV_ACL,
};
......@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index {
TOMOYO_MAX_MKDEV_OPERATION
};
/* Index numbers for socket operations. */
enum tomoyo_network_acl_index {
TOMOYO_NETWORK_BIND, /* bind() operation. */
TOMOYO_NETWORK_LISTEN, /* listen() operation. */
TOMOYO_NETWORK_CONNECT, /* connect() operation. */
TOMOYO_NETWORK_SEND, /* send() operation. */
TOMOYO_MAX_NETWORK_OPERATION
};
/* Index numbers for access controls with two pathnames. */
enum tomoyo_path2_acl_index {
TOMOYO_TYPE_LINK,
......@@ -301,6 +330,21 @@ enum tomoyo_mac_index {
TOMOYO_MAC_FILE_MOUNT,
TOMOYO_MAC_FILE_UMOUNT,
TOMOYO_MAC_FILE_PIVOT_ROOT,
TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
TOMOYO_MAC_NETWORK_INET_RAW_BIND,
TOMOYO_MAC_NETWORK_INET_RAW_SEND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
TOMOYO_MAC_ENVIRON,
TOMOYO_MAX_MAC_INDEX
};
......@@ -308,6 +352,7 @@ enum tomoyo_mac_index {
/* Index numbers for category of functionality. */
enum tomoyo_mac_category_index {
TOMOYO_MAC_CATEGORY_FILE,
TOMOYO_MAC_CATEGORY_NETWORK,
TOMOYO_MAC_CATEGORY_MISC,
TOMOYO_MAX_MAC_CATEGORY_INDEX
};
......@@ -402,6 +447,22 @@ struct tomoyo_request_info {
struct {
const struct tomoyo_path_info *name;
} environ;
struct {
const __be32 *address;
u16 port;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
bool is_ipv6;
} inet_network;
struct {
const struct tomoyo_path_info *address;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
} unix_network;
struct {
const struct tomoyo_path_info *type;
const struct tomoyo_path_info *dir;
......@@ -448,7 +509,14 @@ struct tomoyo_number_union {
u8 value_type[2];
};
/* Structure for "path_group"/"number_group" directive. */
/* Structure for holding an IP address. */
struct tomoyo_ipaddr_union {
struct in6_addr ip[2]; /* Big endian. */
struct tomoyo_group *group; /* Pointer to address group. */
bool is_ipv6; /* Valid only if @group == NULL. */
};
/* Structure for "path_group"/"number_group"/"address_group" directive. */
struct tomoyo_group {
struct tomoyo_shared_acl_head head;
const struct tomoyo_path_info *group_name;
......@@ -467,6 +535,13 @@ struct tomoyo_number_group {
struct tomoyo_number_union number;
};
/* Structure for "address_group" directive. */
struct tomoyo_address_group {
struct tomoyo_acl_head head;
/* Structure for holding an IP address. */
struct tomoyo_ipaddr_union address;
};
/* Subset of "struct stat". Used by conditional ACL and audit logs. */
struct tomoyo_mini_stat {
uid_t uid;
......@@ -650,6 +725,23 @@ struct tomoyo_env_acl {
const struct tomoyo_path_info *env; /* environment variable */
};
/* Structure for "network inet" directive. */
struct tomoyo_inet_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_ipaddr_union address;
struct tomoyo_number_union port;
};
/* Structure for "network unix" directive. */
struct tomoyo_unix_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_name_union name;
};
/* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */
struct tomoyo_acl_param {
char *data;
......@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace {
/********** Function prototypes. **********/
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group);
bool tomoyo_compare_number_union(const unsigned long value,
const struct tomoyo_number_union *ptr);
bool tomoyo_condition(struct tomoyo_request_info *r,
......@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr);
bool tomoyo_number_matches_group(const unsigned long min,
const unsigned long max,
const struct tomoyo_group *group);
bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
struct tomoyo_ipaddr_union *ptr);
bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
struct tomoyo_name_union *ptr);
bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
......@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
bool tomoyo_permstr(const char *string, const char *keyword);
bool tomoyo_str_starts(char **src, const char *find);
char *tomoyo_encode(const char *str);
char *tomoyo_encode2(const char *str, int str_len);
char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
va_list args);
char *tomoyo_read_token(struct tomoyo_acl_param *param);
......@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
const struct tomoyo_path_info *filename);
int tomoyo_poll_control(struct file *file, poll_table *wait);
int tomoyo_poll_log(struct file *file, poll_table *wait);
int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
int addr_len);
int tomoyo_socket_connect_permission(struct socket *sock,
struct sockaddr *addr, int addr_len);
int tomoyo_socket_listen_permission(struct socket *sock);
int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
int size);
int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
__printf(2, 3);
int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
......@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
int tomoyo_write_file(struct tomoyo_acl_param *param);
int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
int tomoyo_write_misc(struct tomoyo_acl_param *param);
int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
const u8 type);
int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
const int buffer_len);
ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
......@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename);
void tomoyo_memory_free(void *ptr);
void tomoyo_normalize_line(unsigned char *buffer);
void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
void tomoyo_print_ip(char *buf, const unsigned int size,
const struct tomoyo_ipaddr_union *ptr);
void tomoyo_print_ulong(char *buffer, const int buffer_len,
const unsigned long value, const u8 type);
void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
......@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
+ TOMOYO_MAX_MAC_CATEGORY_INDEX];
extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
......@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union
a->value_type[1] == b->value_type[1];
}
/**
* tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry.
*
* @a: Pointer to "struct tomoyo_ipaddr_union".
* @b: Pointer to "struct tomoyo_ipaddr_union".
*
* Returns true if @a == @b, false otherwise.
*/
static inline bool tomoyo_same_ipaddr_union
(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
{
return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
a->is_ipv6 == b->is_ipv6;
}
/**
* tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread.
*
......
security/tomoyo/gc.c
View file @ 059d84db
......@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
/* Size of an element. */
static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
[TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
[TOMOYO_ID_ADDRESS_GROUP] = sizeof(struct tomoyo_address_group),
[TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
[TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
[TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
......@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = {
[TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
[TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
[TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
[TOMOYO_TYPE_INET_ACL] = sizeof(struct tomoyo_inet_acl),
[TOMOYO_TYPE_UNIX_ACL] = sizeof(struct tomoyo_unix_acl),
[TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
};
......@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element)
tomoyo_put_name(entry->env);
}
break;
case TOMOYO_TYPE_INET_ACL:
{
struct tomoyo_inet_acl *entry =
container_of(acl, typeof(*entry), head);
tomoyo_put_group(entry->address.group);
tomoyo_put_number_union(&entry->port);
}
break;
case TOMOYO_TYPE_UNIX_ACL:
{
struct tomoyo_unix_acl *entry =
container_of(acl, typeof(*entry), head);
tomoyo_put_name_union(&entry->name);
}
break;
}
}
......@@ -430,6 +450,18 @@ static void tomoyo_del_group(struct list_head *element)
tomoyo_put_name(group->group_name);
}
/**
* tomoyo_del_address_group - Delete members in "struct tomoyo_address_group".
*
* @element: Pointer to "struct list_head".
*
* Returns nothing.
*/
static inline void tomoyo_del_address_group(struct list_head *element)
{
/* Nothing to do. */
}
/**
* tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
*
......@@ -527,9 +559,12 @@ static void tomoyo_collect_entry(void)
case 0:
id = TOMOYO_ID_PATH_GROUP;
break;
default:
case 1:
id = TOMOYO_ID_NUMBER_GROUP;
break;
default:
id = TOMOYO_ID_ADDRESS_GROUP;
break;
}
list_for_each_entry(group, list, head.list) {
if (!tomoyo_collect_member
......@@ -634,6 +669,9 @@ static bool tomoyo_kfree_entry(void)
case TOMOYO_ID_PATH_GROUP:
tomoyo_del_path_group(element);
break;
case TOMOYO_ID_ADDRESS_GROUP:
tomoyo_del_address_group(element);
break;
case TOMOYO_ID_GROUP:
tomoyo_del_group(element);
break;
......
security/tomoyo/group.c
View file @ 059d84db
......@@ -42,7 +42,26 @@ static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
}
/**
* tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group" list.
* tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
*
* @a: Pointer to "struct tomoyo_acl_head".
* @b: Pointer to "struct tomoyo_acl_head".
*
* Returns true if @a == @b, false otherwise.
*/
static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
const struct tomoyo_acl_head *b)
{
const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
head);
const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
head);
return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
}
/**
* tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
*
* @param: Pointer to "struct tomoyo_acl_param".
* @type: Type of this group.
......@@ -77,6 +96,14 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
* tomoyo_put_number_union() is not needed because
* param->data[0] != '@'.
*/
} else {
struct tomoyo_address_group e = { };
if (param->data[0] == '@' ||
!tomoyo_parse_ipaddr_union(param, &e.address))
goto out;
error = tomoyo_update_policy(&e.head, sizeof(e), param,
tomoyo_same_address_group);
}
out:
tomoyo_put_group(group);
......@@ -137,3 +164,35 @@ bool tomoyo_number_matches_group(const unsigned long min,
}
return matched;
}
/**
* tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
*
* @is_ipv6: True if @address is an IPv6 address.
* @address: An IPv4 or IPv6 address.
* @group: Pointer to "struct tomoyo_address_group".
*
* Returns true if @address matches addresses in @group group, false otherwise.
*
* Caller holds tomoyo_read_lock().
*/
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group)
{
struct tomoyo_address_group *member;
bool matched = false;
const u8 size = is_ipv6 ? 16 : 4;
list_for_each_entry_rcu(member, &group->member_list, head.list) {
if (member->head.is_deleted)
continue;
if (member->address.is_ipv6 != is_ipv6)
continue;
if (memcmp(&member->address.ip[0], address, size) > 0 ||
memcmp(address, &member->address.ip[1], size) > 0)
continue;
matched = true;
break;
}
return matched;
}
security/tomoyo/network.c 0 → 100644
View file @ 059d84db
This diff is collapsed.
security/tomoyo/realpath.c
View file @ 059d84db
......@@ -15,17 +15,19 @@
#include "../../fs/internal.h"
/**
* tomoyo_encode: Convert binary string to ascii string.
* tomoyo_encode2 - Encode binary string to ascii string.
*
* @str: String in binary format.
* @str: String in binary format.
* @str_len: Size of @str in byte.
*
* Returns pointer to @str in ascii format on success, NULL otherwise.
*
* This function uses kzalloc(), so caller must kfree() if this function
* didn't return NULL.
*/
char *tomoyo_encode(const char *str)
char *tomoyo_encode2(const char *str, int str_len)
{
int i;
int len = 0;
const char *p = str;
char *cp;
......@@ -33,8 +35,9 @@ char *tomoyo_encode(const char *str)
if (!p)
return NULL;
while (*p) {
const unsigned char c = *p++;
for (i = 0; i < str_len; i++) {
const unsigned char c = p[i];
if (c == '\\')
len += 2;
else if (c > ' ' && c < 127)
......@@ -49,8 +52,8 @@ char *tomoyo_encode(const char *str)
return NULL;
cp0 = cp;
p = str;
while (*p) {
const unsigned char c = *p++;
for (i = 0; i < str_len; i++) {
const unsigned char c = p[i];
if (c == '\\') {
*cp++ = '\\';
......@@ -67,6 +70,21 @@ char *tomoyo_encode(const char *str)
return cp0;
}
/**
* tomoyo_encode - Encode binary string to ascii string.
*
* @str: String in binary format.
*
* Returns pointer to @str in ascii format on success, NULL otherwise.
*
* This function uses kzalloc(), so caller must kfree() if this function
* didn't return NULL.
*/
char *tomoyo_encode(const char *str)
{
return str ? tomoyo_encode2(str, strlen(str)) : NULL;
}
/**
* tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
*
......
security/tomoyo/tomoyo.c
View file @ 059d84db
......@@ -442,6 +442,64 @@ static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path)
return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
}
/**
* tomoyo_socket_listen - Check permission for listen().
*
* @sock: Pointer to "struct socket".
* @backlog: Backlog parameter.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_listen(struct socket *sock, int backlog)
{
return tomoyo_socket_listen_permission(sock);
}
/**
* tomoyo_socket_connect - Check permission for connect().
*
* @sock: Pointer to "struct socket".
* @addr: Pointer to "struct sockaddr".
* @addr_len: Size of @addr.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
return tomoyo_socket_connect_permission(sock, addr, addr_len);
}
/**
* tomoyo_socket_bind - Check permission for bind().
*
* @sock: Pointer to "struct socket".
* @addr: Pointer to "struct sockaddr".
* @addr_len: Size of @addr.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
return tomoyo_socket_bind_permission(sock, addr, addr_len);
}
/**
* tomoyo_socket_sendmsg - Check permission for sendmsg().
*
* @sock: Pointer to "struct socket".
* @msg: Pointer to "struct msghdr".
* @size: Size of message.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size)
{
return tomoyo_socket_sendmsg_permission(sock, msg, size);
}
/*
* tomoyo_security_ops is a "struct security_operations" which is used for
* registering TOMOYO.
......@@ -472,6 +530,10 @@ static struct security_operations tomoyo_security_ops = {
.sb_mount = tomoyo_sb_mount,
.sb_umount = tomoyo_sb_umount,
.sb_pivotroot = tomoyo_sb_pivotroot,
.socket_bind = tomoyo_socket_bind,
.socket_connect = tomoyo_socket_connect,
.socket_listen = tomoyo_socket_listen,
.socket_sendmsg = tomoyo_socket_sendmsg,
};
/* Lock for GC. */
......
security/tomoyo/util.c
View file @ 059d84db
......@@ -42,6 +42,37 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
[TOMOYO_MAC_FILE_MOUNT] = TOMOYO_MAC_CATEGORY_FILE,
[TOMOYO_MAC_FILE_UMOUNT] = TOMOYO_MAC_CATEGORY_FILE,
[TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
/* CONFIG::network group */
[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_RAW_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_RAW_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
/* CONFIG::misc group */
[TOMOYO_MAC_ENVIRON] = TOMOYO_MAC_CATEGORY_MISC,
};
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7