Skip to content

L
linux
Commit 059d84db authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files
Options

TOMOYO: Add socket operation restriction support. 

This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
socket's bind()/listen()/connect()/send() operations.
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent d58e0da8
Expand all Show whitespace changes
Inline Side-by-side
Showing with 1215 additions and 17 deletions
security/tomoyo/Kconfig
View file @ 059d84db
config SECURITY_TOMOYO config SECURITY_TOMOYO
bool "TOMOYO Linux Support" bool "TOMOYO Linux Support"
depends on SECURITY depends on SECURITY
depends on NET
select SECURITYFS select SECURITYFS
select SECURITY_PATH select SECURITY_PATH
select SECURITY_NETWORK
default n default n
help help
This selects TOMOYO Linux, pathname-based access control. This selects TOMOYO Linux, pathname-based access control.
......
security/tomoyo/Makefile
View file @ 059d84db
obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
$(obj)/policy/profile.conf: $(obj)/policy/profile.conf:
@mkdir -p $(obj)/policy/ @mkdir -p $(obj)/policy/
......
security/tomoyo/common.c
View file @ 059d84db
...@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX ...@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
[TOMOYO_MAC_FILE_MOUNT] = "mount", [TOMOYO_MAC_FILE_MOUNT] = "mount",
[TOMOYO_MAC_FILE_UMOUNT] = "unmount", [TOMOYO_MAC_FILE_UMOUNT] = "unmount",
[TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root", [TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root",
/* CONFIG::network group */
[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] = "inet_stream_bind",
[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] = "inet_stream_listen",
[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] = "inet_stream_connect",
[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] = "inet_dgram_bind",
[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] = "inet_dgram_send",
[TOMOYO_MAC_NETWORK_INET_RAW_BIND] = "inet_raw_bind",
[TOMOYO_MAC_NETWORK_INET_RAW_SEND] = "inet_raw_send",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] = "unix_stream_bind",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] = "unix_stream_listen",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] = "unix_stream_connect",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] = "unix_dgram_bind",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] = "unix_dgram_send",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] = "unix_seqpacket_bind",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] = "unix_seqpacket_listen",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
/* CONFIG::misc group */ /* CONFIG::misc group */
[TOMOYO_MAC_ENVIRON] = "env", [TOMOYO_MAC_ENVIRON] = "env",
/* CONFIG group */ /* CONFIG group */
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file", [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc", [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc",
}; };
...@@ -135,10 +152,19 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = { ...@@ -135,10 +152,19 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
[TOMOYO_TYPE_UMOUNT] = "unmount", [TOMOYO_TYPE_UMOUNT] = "unmount",
}; };
/* String table for socket's operation. */
const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION] = {
[TOMOYO_NETWORK_BIND] = "bind",
[TOMOYO_NETWORK_LISTEN] = "listen",
[TOMOYO_NETWORK_CONNECT] = "connect",
[TOMOYO_NETWORK_SEND] = "send",
};
/* String table for categories. */ /* String table for categories. */
static const char * const tomoyo_category_keywords static const char * const tomoyo_category_keywords
[TOMOYO_MAX_MAC_CATEGORY_INDEX] = { [TOMOYO_MAX_MAC_CATEGORY_INDEX] = {
[TOMOYO_MAC_CATEGORY_FILE] = "file", [TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAC_CATEGORY_MISC] = "misc", [TOMOYO_MAC_CATEGORY_MISC] = "misc",
}; };
...@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns, ...@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
static const struct { static const struct {
const char *keyword; const char *keyword;
int (*write) (struct tomoyo_acl_param *); int (*write) (struct tomoyo_acl_param *);
} tomoyo_callback[2] = { } tomoyo_callback[4] = {
{ "file ", tomoyo_write_file }, { "file ", tomoyo_write_file },
{ "network inet ", tomoyo_write_inet_network },
{ "network unix ", tomoyo_write_unix_network },
{ "misc ", tomoyo_write_misc }, { "misc ", tomoyo_write_misc },
}; };
u8 i; u8 i;
...@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head, ...@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
tomoyo_print_number_union(head, &ptr->mode); tomoyo_print_number_union(head, &ptr->mode);
tomoyo_print_number_union(head, &ptr->major); tomoyo_print_number_union(head, &ptr->major);
tomoyo_print_number_union(head, &ptr->minor); tomoyo_print_number_union(head, &ptr->minor);
} else if (acl_type == TOMOYO_TYPE_INET_ACL) {
struct tomoyo_inet_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network inet ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_set_space(head);
if (ptr->address.group) {
tomoyo_set_string(head, "@");
tomoyo_set_string(head, ptr->address.group->group_name
->name);
} else {
char buf[128];
tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
tomoyo_io_printf(head, "%s", buf);
}
tomoyo_print_number_union(head, &ptr->port);
} else if (acl_type == TOMOYO_TYPE_UNIX_ACL) {
struct tomoyo_unix_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network unix ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_print_name_union(head, &ptr->name);
} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) { } else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
struct tomoyo_mount_acl *ptr = struct tomoyo_mount_acl *ptr =
container_of(acl, typeof(*ptr), head); container_of(acl, typeof(*ptr), head);
...@@ -1550,6 +1632,7 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = { ...@@ -1550,6 +1632,7 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = {
static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = { static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = {
[TOMOYO_PATH_GROUP] = "path_group ", [TOMOYO_PATH_GROUP] = "path_group ",
[TOMOYO_NUMBER_GROUP] = "number_group ", [TOMOYO_NUMBER_GROUP] = "number_group ",
[TOMOYO_ADDRESS_GROUP] = "address_group ",
}; };
/** /**
...@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head) ...@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
} }
/** /**
* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group" list. * tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
* *
* @head: Pointer to "struct tomoyo_io_buffer". * @head: Pointer to "struct tomoyo_io_buffer".
* @idx: Index number. * @idx: Index number.
...@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx) ...@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
(ptr, (ptr,
struct tomoyo_number_group, struct tomoyo_number_group,
head)->number); head)->number);
} else if (idx == TOMOYO_ADDRESS_GROUP) {
char buffer[128];
struct tomoyo_address_group *member =
container_of(ptr, typeof(*member),
head);
tomoyo_print_ip(buffer, sizeof(buffer),
&member->address);
tomoyo_io_printf(head, " %s", buffer);
} }
tomoyo_set_lf(head); tomoyo_set_lf(head);
} }
......
security/tomoyo/common.h
View file @ 059d84db
...@@ -23,6 +23,16 @@ ...@@ -23,6 +23,16 @@
#include <linux/poll.h> #include <linux/poll.h>
#include <linux/binfmts.h> #include <linux/binfmts.h>
#include <linux/highmem.h> #include <linux/highmem.h>
#include <linux/net.h>
#include <linux/inet.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/un.h>
#include <net/sock.h>
#include <net/af_unix.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/udp.h>
/********** Constants definitions. **********/ /********** Constants definitions. **********/
...@@ -34,6 +44,12 @@ ...@@ -34,6 +44,12 @@
#define TOMOYO_HASH_BITS 8 #define TOMOYO_HASH_BITS 8
#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
/*
* TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
* Therefore, we don't need SOCK_MAX.
*/
#define TOMOYO_SOCK_MAX 6
#define TOMOYO_EXEC_TMPSIZE 4096 #define TOMOYO_EXEC_TMPSIZE 4096
/* Profile number is an integer between 0 and 255. */ /* Profile number is an integer between 0 and 255. */
...@@ -136,6 +152,7 @@ enum tomoyo_mode_index { ...@@ -136,6 +152,7 @@ enum tomoyo_mode_index {
/* Index numbers for entry type. */ /* Index numbers for entry type. */
enum tomoyo_policy_id { enum tomoyo_policy_id {
TOMOYO_ID_GROUP, TOMOYO_ID_GROUP,
TOMOYO_ID_ADDRESS_GROUP,
TOMOYO_ID_PATH_GROUP, TOMOYO_ID_PATH_GROUP,
TOMOYO_ID_NUMBER_GROUP, TOMOYO_ID_NUMBER_GROUP,
TOMOYO_ID_TRANSITION_CONTROL, TOMOYO_ID_TRANSITION_CONTROL,
...@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index { ...@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index {
enum tomoyo_group_id { enum tomoyo_group_id {
TOMOYO_PATH_GROUP, TOMOYO_PATH_GROUP,
TOMOYO_NUMBER_GROUP, TOMOYO_NUMBER_GROUP,
TOMOYO_ADDRESS_GROUP,
TOMOYO_MAX_GROUP TOMOYO_MAX_GROUP
}; };
...@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index { ...@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index {
TOMOYO_TYPE_PATH_NUMBER_ACL, TOMOYO_TYPE_PATH_NUMBER_ACL,
TOMOYO_TYPE_MKDEV_ACL, TOMOYO_TYPE_MKDEV_ACL,
TOMOYO_TYPE_MOUNT_ACL, TOMOYO_TYPE_MOUNT_ACL,
TOMOYO_TYPE_INET_ACL,
TOMOYO_TYPE_UNIX_ACL,
TOMOYO_TYPE_ENV_ACL, TOMOYO_TYPE_ENV_ACL,
}; };
...@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index { ...@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index {
TOMOYO_MAX_MKDEV_OPERATION TOMOYO_MAX_MKDEV_OPERATION
}; };
/* Index numbers for socket operations. */
enum tomoyo_network_acl_index {
TOMOYO_NETWORK_BIND, /* bind() operation. */
TOMOYO_NETWORK_LISTEN, /* listen() operation. */
TOMOYO_NETWORK_CONNECT, /* connect() operation. */
TOMOYO_NETWORK_SEND, /* send() operation. */
TOMOYO_MAX_NETWORK_OPERATION
};
/* Index numbers for access controls with two pathnames. */ /* Index numbers for access controls with two pathnames. */
enum tomoyo_path2_acl_index { enum tomoyo_path2_acl_index {
TOMOYO_TYPE_LINK, TOMOYO_TYPE_LINK,
...@@ -301,6 +330,21 @@ enum tomoyo_mac_index { ...@@ -301,6 +330,21 @@ enum tomoyo_mac_index {
TOMOYO_MAC_FILE_MOUNT, TOMOYO_MAC_FILE_MOUNT,
TOMOYO_MAC_FILE_UMOUNT, TOMOYO_MAC_FILE_UMOUNT,
TOMOYO_MAC_FILE_PIVOT_ROOT, TOMOYO_MAC_FILE_PIVOT_ROOT,
TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
TOMOYO_MAC_NETWORK_INET_RAW_BIND,
TOMOYO_MAC_NETWORK_INET_RAW_SEND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
TOMOYO_MAC_ENVIRON, TOMOYO_MAC_ENVIRON,
TOMOYO_MAX_MAC_INDEX TOMOYO_MAX_MAC_INDEX
}; };
...@@ -308,6 +352,7 @@ enum tomoyo_mac_index { ...@@ -308,6 +352,7 @@ enum tomoyo_mac_index {
/* Index numbers for category of functionality. */ /* Index numbers for category of functionality. */
enum tomoyo_mac_category_index { enum tomoyo_mac_category_index {
TOMOYO_MAC_CATEGORY_FILE, TOMOYO_MAC_CATEGORY_FILE,
TOMOYO_MAC_CATEGORY_NETWORK,
TOMOYO_MAC_CATEGORY_MISC, TOMOYO_MAC_CATEGORY_MISC,
TOMOYO_MAX_MAC_CATEGORY_INDEX TOMOYO_MAX_MAC_CATEGORY_INDEX
}; };
...@@ -402,6 +447,22 @@ struct tomoyo_request_info { ...@@ -402,6 +447,22 @@ struct tomoyo_request_info {
struct { struct {
const struct tomoyo_path_info *name; const struct tomoyo_path_info *name;
} environ; } environ;
struct {
const __be32 *address;
u16 port;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
bool is_ipv6;
} inet_network;
struct {
const struct tomoyo_path_info *address;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
} unix_network;
struct { struct {
const struct tomoyo_path_info *type; const struct tomoyo_path_info *type;
const struct tomoyo_path_info *dir; const struct tomoyo_path_info *dir;
...@@ -448,7 +509,14 @@ struct tomoyo_number_union { ...@@ -448,7 +509,14 @@ struct tomoyo_number_union {
u8 value_type[2]; u8 value_type[2];
}; };
/* Structure for "path_group"/"number_group" directive. */ /* Structure for holding an IP address. */
struct tomoyo_ipaddr_union {
struct in6_addr ip[2]; /* Big endian. */
struct tomoyo_group *group; /* Pointer to address group. */
bool is_ipv6; /* Valid only if @group == NULL. */
};
/* Structure for "path_group"/"number_group"/"address_group" directive. */
struct tomoyo_group { struct tomoyo_group {
struct tomoyo_shared_acl_head head; struct tomoyo_shared_acl_head head;
const struct tomoyo_path_info *group_name; const struct tomoyo_path_info *group_name;
...@@ -467,6 +535,13 @@ struct tomoyo_number_group { ...@@ -467,6 +535,13 @@ struct tomoyo_number_group {
struct tomoyo_number_union number; struct tomoyo_number_union number;
}; };
/* Structure for "address_group" directive. */
struct tomoyo_address_group {
struct tomoyo_acl_head head;
/* Structure for holding an IP address. */
struct tomoyo_ipaddr_union address;
};
/* Subset of "struct stat". Used by conditional ACL and audit logs. */ /* Subset of "struct stat". Used by conditional ACL and audit logs. */
struct tomoyo_mini_stat { struct tomoyo_mini_stat {
uid_t uid; uid_t uid;
...@@ -650,6 +725,23 @@ struct tomoyo_env_acl { ...@@ -650,6 +725,23 @@ struct tomoyo_env_acl {
const struct tomoyo_path_info *env; /* environment variable */ const struct tomoyo_path_info *env; /* environment variable */
}; };
/* Structure for "network inet" directive. */
struct tomoyo_inet_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_ipaddr_union address;
struct tomoyo_number_union port;
};
/* Structure for "network unix" directive. */
struct tomoyo_unix_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_name_union name;
};
/* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */
struct tomoyo_acl_param { struct tomoyo_acl_param {
char *data; char *data;
...@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace { ...@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace {
/********** Function prototypes. **********/ /********** Function prototypes. **********/
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group);
bool tomoyo_compare_number_union(const unsigned long value, bool tomoyo_compare_number_union(const unsigned long value,
const struct tomoyo_number_union *ptr); const struct tomoyo_number_union *ptr);
bool tomoyo_condition(struct tomoyo_request_info *r, bool tomoyo_condition(struct tomoyo_request_info *r,
...@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr); ...@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr);
bool tomoyo_number_matches_group(const unsigned long min, bool tomoyo_number_matches_group(const unsigned long min,
const unsigned long max, const unsigned long max,
const struct tomoyo_group *group); const struct tomoyo_group *group);
bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
struct tomoyo_ipaddr_union *ptr);
bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
struct tomoyo_name_union *ptr); struct tomoyo_name_union *ptr);
bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
...@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, ...@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
bool tomoyo_permstr(const char *string, const char *keyword); bool tomoyo_permstr(const char *string, const char *keyword);
bool tomoyo_str_starts(char **src, const char *find); bool tomoyo_str_starts(char **src, const char *find);
char *tomoyo_encode(const char *str); char *tomoyo_encode(const char *str);
char *tomoyo_encode2(const char *str, int str_len);
char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
va_list args); va_list args);
char *tomoyo_read_token(struct tomoyo_acl_param *param); char *tomoyo_read_token(struct tomoyo_acl_param *param);
...@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, ...@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
const struct tomoyo_path_info *filename); const struct tomoyo_path_info *filename);
int tomoyo_poll_control(struct file *file, poll_table *wait); int tomoyo_poll_control(struct file *file, poll_table *wait);
int tomoyo_poll_log(struct file *file, poll_table *wait); int tomoyo_poll_log(struct file *file, poll_table *wait);
int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
int addr_len);
int tomoyo_socket_connect_permission(struct socket *sock,
struct sockaddr *addr, int addr_len);
int tomoyo_socket_listen_permission(struct socket *sock);
int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
int size);
int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
__printf(2, 3); __printf(2, 3);
int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
...@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param); ...@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
int tomoyo_write_file(struct tomoyo_acl_param *param); int tomoyo_write_file(struct tomoyo_acl_param *param);
int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
int tomoyo_write_misc(struct tomoyo_acl_param *param); int tomoyo_write_misc(struct tomoyo_acl_param *param);
int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
int tomoyo_write_transition_control(struct tomoyo_acl_param *param, int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
const u8 type); const u8 type);
int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
const int buffer_len); const int buffer_len);
ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
...@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename); ...@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename);
void tomoyo_memory_free(void *ptr); void tomoyo_memory_free(void *ptr);
void tomoyo_normalize_line(unsigned char *buffer); void tomoyo_normalize_line(unsigned char *buffer);
void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
void tomoyo_print_ip(char *buf, const unsigned int size,
const struct tomoyo_ipaddr_union *ptr);
void tomoyo_print_ulong(char *buffer, const int buffer_len, void tomoyo_print_ulong(char *buffer, const int buffer_len,
const unsigned long value, const u8 type); const unsigned long value, const u8 type);
void tomoyo_put_name_union(struct tomoyo_name_union *ptr); void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
...@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX ...@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
+ TOMOYO_MAX_MAC_CATEGORY_INDEX]; + TOMOYO_MAX_MAC_CATEGORY_INDEX];
extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
...@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union ...@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union
a->value_type[1] == b->value_type[1]; a->value_type[1] == b->value_type[1];
} }
/**
* tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry.
*
* @a: Pointer to "struct tomoyo_ipaddr_union".
* @b: Pointer to "struct tomoyo_ipaddr_union".
*
* Returns true if @a == @b, false otherwise.
*/
static inline bool tomoyo_same_ipaddr_union
(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
{
return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
a->is_ipv6 == b->is_ipv6;
}
/** /**
* tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread.
* *
......
security/tomoyo/gc.c
View file @ 059d84db
...@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock); ...@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
/* Size of an element. */ /* Size of an element. */
static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = { static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
[TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group), [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
[TOMOYO_ID_ADDRESS_GROUP] = sizeof(struct tomoyo_address_group),
[TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group), [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
[TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group), [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
[TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator), [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
...@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = { ...@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = {
[TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl), [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
[TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl), [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
[TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl), [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
[TOMOYO_TYPE_INET_ACL] = sizeof(struct tomoyo_inet_acl),
[TOMOYO_TYPE_UNIX_ACL] = sizeof(struct tomoyo_unix_acl),
[TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl), [TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
}; };
...@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element) ...@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element)
tomoyo_put_name(entry->env); tomoyo_put_name(entry->env);
} }
break; break;
case TOMOYO_TYPE_INET_ACL:
{
struct tomoyo_inet_acl *entry =
container_of(acl, typeof(*entry), head);
tomoyo_put_group(entry->address.group);
tomoyo_put_number_union(&entry->port);
}
break;
case TOMOYO_TYPE_UNIX_ACL:
{
struct tomoyo_unix_acl *entry =
container_of(acl, typeof(*entry), head);
tomoyo_put_name_union(&entry->name);
}
break;
} }
} }
...@@ -430,6 +450,18 @@ static void tomoyo_del_group(struct list_head *element) ...@@ -430,6 +450,18 @@ static void tomoyo_del_group(struct list_head *element)
tomoyo_put_name(group->group_name); tomoyo_put_name(group->group_name);
} }
/**
* tomoyo_del_address_group - Delete members in "struct tomoyo_address_group".
*
* @element: Pointer to "struct list_head".
*
* Returns nothing.
*/
static inline void tomoyo_del_address_group(struct list_head *element)
{
/* Nothing to do. */
}
/** /**
* tomoyo_del_number_group - Delete members in "struct tomoyo_number_group". * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
* *
...@@ -527,9 +559,12 @@ static void tomoyo_collect_entry(void) ...@@ -527,9 +559,12 @@ static void tomoyo_collect_entry(void)
case 0: case 0:
id = TOMOYO_ID_PATH_GROUP; id = TOMOYO_ID_PATH_GROUP;
break; break;
default: case 1:
id = TOMOYO_ID_NUMBER_GROUP; id = TOMOYO_ID_NUMBER_GROUP;
break; break;
default:
id = TOMOYO_ID_ADDRESS_GROUP;
break;
} }
list_for_each_entry(group, list, head.list) { list_for_each_entry(group, list, head.list) {
if (!tomoyo_collect_member if (!tomoyo_collect_member
...@@ -634,6 +669,9 @@ static bool tomoyo_kfree_entry(void) ...@@ -634,6 +669,9 @@ static bool tomoyo_kfree_entry(void)
case TOMOYO_ID_PATH_GROUP: case TOMOYO_ID_PATH_GROUP:
tomoyo_del_path_group(element); tomoyo_del_path_group(element);
break; break;
case TOMOYO_ID_ADDRESS_GROUP:
tomoyo_del_address_group(element);
break;
case TOMOYO_ID_GROUP: case TOMOYO_ID_GROUP:
tomoyo_del_group(element); tomoyo_del_group(element);
break; break;
......
security/tomoyo/group.c
View file @ 059d84db
...@@ -42,7 +42,26 @@ static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a, ...@@ -42,7 +42,26 @@ static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
} }
/** /**
* tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group" list. * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
*
* @a: Pointer to "struct tomoyo_acl_head".
* @b: Pointer to "struct tomoyo_acl_head".
*
* Returns true if @a == @b, false otherwise.
*/
static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
const struct tomoyo_acl_head *b)
{
const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
head);
const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
head);
return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
}
/**
* tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
* *
* @param: Pointer to "struct tomoyo_acl_param". * @param: Pointer to "struct tomoyo_acl_param".
* @type: Type of this group. * @type: Type of this group.
...@@ -77,6 +96,14 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type) ...@@ -77,6 +96,14 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
* tomoyo_put_number_union() is not needed because * tomoyo_put_number_union() is not needed because
* param->data[0] != '@'. * param->data[0] != '@'.
*/ */
} else {
struct tomoyo_address_group e = { };
if (param->data[0] == '@' ||
!tomoyo_parse_ipaddr_union(param, &e.address))
goto out;
error = tomoyo_update_policy(&e.head, sizeof(e), param,
tomoyo_same_address_group);
} }
out: out:
tomoyo_put_group(group); tomoyo_put_group(group);
...@@ -137,3 +164,35 @@ bool tomoyo_number_matches_group(const unsigned long min, ...@@ -137,3 +164,35 @@ bool tomoyo_number_matches_group(const unsigned long min,
} }
return matched; return matched;
} }
/**
* tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
*
* @is_ipv6: True if @address is an IPv6 address.
* @address: An IPv4 or IPv6 address.
* @group: Pointer to "struct tomoyo_address_group".
*
* Returns true if @address matches addresses in @group group, false otherwise.
*
* Caller holds tomoyo_read_lock().
*/
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group)
{
struct tomoyo_address_group *member;
bool matched = false;
const u8 size = is_ipv6 ? 16 : 4;
list_for_each_entry_rcu(member, &group->member_list, head.list) {
if (member->head.is_deleted)
continue;
if (member->address.is_ipv6 != is_ipv6)
continue;
if (memcmp(&member->address.ip[0], address, size) > 0 ||
memcmp(address, &member->address.ip[1], size) > 0)
continue;
matched = true;
break;
}
return matched;
}
security/tomoyo/network.c 0 → 100644
View file @ 059d84db
This diff is collapsed.
security/tomoyo/realpath.c
View file @ 059d84db
...@@ -15,17 +15,19 @@ ...@@ -15,17 +15,19 @@
#include "../../fs/internal.h" #include "../../fs/internal.h"
/** /**
* tomoyo_encode: Convert binary string to ascii string. * tomoyo_encode2 - Encode binary string to ascii string.
* *
* @str: String in binary format. * @str: String in binary format.
* @str_len: Size of @str in byte.
* *
* Returns pointer to @str in ascii format on success, NULL otherwise. * Returns pointer to @str in ascii format on success, NULL otherwise.
* *
* This function uses kzalloc(), so caller must kfree() if this function * This function uses kzalloc(), so caller must kfree() if this function
* didn't return NULL. * didn't return NULL.
*/ */
char *tomoyo_encode(const char *str) char *tomoyo_encode2(const char *str, int str_len)
{ {
int i;
int len = 0; int len = 0;
const char *p = str; const char *p = str;
char *cp; char *cp;
...@@ -33,8 +35,9 @@ char *tomoyo_encode(const char *str) ...@@ -33,8 +35,9 @@ char *tomoyo_encode(const char *str)
if (!p) if (!p)
return NULL; return NULL;
while (*p) { for (i = 0; i < str_len; i++) {
const unsigned char c = *p++; const unsigned char c = p[i];
if (c == '\\') if (c == '\\')
len += 2; len += 2;
else if (c > ' ' && c < 127) else if (c > ' ' && c < 127)
...@@ -49,8 +52,8 @@ char *tomoyo_encode(const char *str) ...@@ -49,8 +52,8 @@ char *tomoyo_encode(const char *str)
return NULL; return NULL;
cp0 = cp; cp0 = cp;
p = str; p = str;
while (*p) { for (i = 0; i < str_len; i++) {
const unsigned char c = *p++; const unsigned char c = p[i];
if (c == '\\') { if (c == '\\') {
*cp++ = '\\'; *cp++ = '\\';
...@@ -67,6 +70,21 @@ char *tomoyo_encode(const char *str) ...@@ -67,6 +70,21 @@ char *tomoyo_encode(const char *str)
return cp0; return cp0;
} }
/**
* tomoyo_encode - Encode binary string to ascii string.
*
* @str: String in binary format.
*
* Returns pointer to @str in ascii format on success, NULL otherwise.
*
* This function uses kzalloc(), so caller must kfree() if this function
* didn't return NULL.
*/
char *tomoyo_encode(const char *str)
{
return str ? tomoyo_encode2(str, strlen(str)) : NULL;
}
/** /**
* tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root. * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
* *
......
security/tomoyo/tomoyo.c
View file @ 059d84db
...@@ -442,6 +442,64 @@ static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path) ...@@ -442,6 +442,64 @@ static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path)
return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
} }
/**
* tomoyo_socket_listen - Check permission for listen().
*
* @sock: Pointer to "struct socket".
* @backlog: Backlog parameter.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_listen(struct socket *sock, int backlog)
{
return tomoyo_socket_listen_permission(sock);
}
/**
* tomoyo_socket_connect - Check permission for connect().
*
* @sock: Pointer to "struct socket".
* @addr: Pointer to "struct sockaddr".
* @addr_len: Size of @addr.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
return tomoyo_socket_connect_permission(sock, addr, addr_len);
}
/**
* tomoyo_socket_bind - Check permission for bind().
*
* @sock: Pointer to "struct socket".
* @addr: Pointer to "struct sockaddr".
* @addr_len: Size of @addr.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
int addr_len)
{
return tomoyo_socket_bind_permission(sock, addr, addr_len);
}
/**
* tomoyo_socket_sendmsg - Check permission for sendmsg().
*
* @sock: Pointer to "struct socket".
* @msg: Pointer to "struct msghdr".
* @size: Size of message.
*
* Returns 0 on success, negative value otherwise.
*/
static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
int size)
{
return tomoyo_socket_sendmsg_permission(sock, msg, size);
}
/* /*
* tomoyo_security_ops is a "struct security_operations" which is used for * tomoyo_security_ops is a "struct security_operations" which is used for
* registering TOMOYO. * registering TOMOYO.
...@@ -472,6 +530,10 @@ static struct security_operations tomoyo_security_ops = { ...@@ -472,6 +530,10 @@ static struct security_operations tomoyo_security_ops = {
.sb_mount = tomoyo_sb_mount, .sb_mount = tomoyo_sb_mount,
.sb_umount = tomoyo_sb_umount, .sb_umount = tomoyo_sb_umount,
.sb_pivotroot = tomoyo_sb_pivotroot, .sb_pivotroot = tomoyo_sb_pivotroot,
.socket_bind = tomoyo_socket_bind,
.socket_connect = tomoyo_socket_connect,
.socket_listen = tomoyo_socket_listen,
.socket_sendmsg = tomoyo_socket_sendmsg,
}; };
/* Lock for GC. */ /* Lock for GC. */
......
security/tomoyo/util.c
View file @ 059d84db
...@@ -42,6 +42,37 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = { ...@@ -42,6 +42,37 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
[TOMOYO_MAC_FILE_MOUNT] = TOMOYO_MAC_CATEGORY_FILE, [TOMOYO_MAC_FILE_MOUNT] = TOMOYO_MAC_CATEGORY_FILE,
[TOMOYO_MAC_FILE_UMOUNT] = TOMOYO_MAC_CATEGORY_FILE, [TOMOYO_MAC_FILE_UMOUNT] = TOMOYO_MAC_CATEGORY_FILE,
[TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE, [TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
/* CONFIG::network group */
[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_RAW_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_INET_RAW_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] =
TOMOYO_MAC_CATEGORY_NETWORK,
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] =
TOMOYO_MAC_CATEGORY_NETWORK,
/* CONFIG::misc group */ /* CONFIG::misc group */
[TOMOYO_MAC_ENVIRON] = TOMOYO_MAC_CATEGORY_MISC, [TOMOYO_MAC_ENVIRON] = TOMOYO_MAC_CATEGORY_MISC,
}; };
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7