security/tomoyo/domain.c

   1 /*
   2  * security/tomoyo/domain.c
   3  *
   4  * Domain transition functions for TOMOYO.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  */
   8
   9 #include "common.h"
  10 #include <linux/binfmts.h>
  11 #include <linux/slab.h>
  12
  13 /* Variables definitions.*/
  14
  15 /* The initial domain. */
  16 struct tomoyo_domain_info tomoyo_kernel_domain;
  17
  18 /**
  19  * tomoyo_update_policy - Update an entry for exception policy.
  20  *
  21  * @new_entry:       Pointer to "struct tomoyo_acl_info".
  22  * @size:            Size of @new_entry in bytes.
  23  * @is_delete:       True if it is a delete request.
  24  * @list:            Pointer to "struct list_head".
  25  * @check_duplicate: Callback function to find duplicated entry.
  26  *
  27  * Returns 0 on success, negative value otherwise.
  28  *
  29  * Caller holds tomoyo_read_lock().
  30  */
  31 int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
  32                          bool is_delete, struct list_head *list,
  33                          bool (*check_duplicate) (const struct tomoyo_acl_head
  34                                                   *,
  35                                                   const struct tomoyo_acl_head
  36                                                   *))
  37 {
  38         int error = is_delete ? -ENOENT : -ENOMEM;
  39         struct tomoyo_acl_head *entry;
  40
  41         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  42                 return -ENOMEM;
  43         list_for_each_entry_rcu(entry, list, list) {
  44                 if (!check_duplicate(entry, new_entry))
  45                         continue;
  46                 entry->is_deleted = is_delete;
  47                 error = 0;
  48                 break;
  49         }
  50         if (error && !is_delete) {
  51                 entry = tomoyo_commit_ok(new_entry, size);
  52                 if (entry) {
  53                         list_add_tail_rcu(&entry->list, list);
  54                         error = 0;
  55                 }
  56         }
  57         mutex_unlock(&tomoyo_policy_lock);
  58         return error;
  59 }
  60
  61 /**
  62  * tomoyo_update_domain - Update an entry for domain policy.
  63  *
  64  * @new_entry:       Pointer to "struct tomoyo_acl_info".
  65  * @size:            Size of @new_entry in bytes.
  66  * @is_delete:       True if it is a delete request.
  67  * @domain:          Pointer to "struct tomoyo_domain_info".
  68  * @check_duplicate: Callback function to find duplicated entry.
  69  * @merge_duplicate: Callback function to merge duplicated entry.
  70  *
  71  * Returns 0 on success, negative value otherwise.
  72  *
  73  * Caller holds tomoyo_read_lock().
  74  */
  75 int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
  76                          bool is_delete, struct tomoyo_domain_info *domain,
  77                          bool (*check_duplicate) (const struct tomoyo_acl_info
  78                                                   *,
  79                                                   const struct tomoyo_acl_info
  80                                                   *),
  81                          bool (*merge_duplicate) (struct tomoyo_acl_info *,
  82                                                   struct tomoyo_acl_info *,
  83                                                   const bool))
  84 {
  85         int error = is_delete ? -ENOENT : -ENOMEM;
  86         struct tomoyo_acl_info *entry;
  87
  88         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  89                 return error;
  90         list_for_each_entry_rcu(entry, &domain->acl_info_list, list) {
  91                 if (!check_duplicate(entry, new_entry))
  92                         continue;
  93                 if (merge_duplicate)
  94                         entry->is_deleted = merge_duplicate(entry, new_entry,
  95                                                             is_delete);
  96                 else
  97                         entry->is_deleted = is_delete;
  98                 error = 0;
  99                 break;
 100         }
 101         if (error && !is_delete) {
 102                 entry = tomoyo_commit_ok(new_entry, size);
 103                 if (entry) {
 104                         list_add_tail_rcu(&entry->list, &domain->acl_info_list);
 105                         error = 0;
 106                 }
 107         }
 108         mutex_unlock(&tomoyo_policy_lock);
 109         return error;
 110 }
 111
 112 /*
 113  * tomoyo_domain_list is used for holding list of domains.
 114  * The ->acl_info_list of "struct tomoyo_domain_info" is used for holding
 115  * permissions (e.g. "allow_read /lib/libc-2.5.so") given to each domain.
 116  *
 117  * An entry is added by
 118  *
 119  * # ( echo "<kernel>"; echo "allow_execute /sbin/init" ) > \
 120  *                                  /sys/kernel/security/tomoyo/domain_policy
 121  *
 122  * and is deleted by
 123  *
 124  * # ( echo "<kernel>"; echo "delete allow_execute /sbin/init" ) > \
 125  *                                  /sys/kernel/security/tomoyo/domain_policy
 126  *
 127  * and all entries are retrieved by
 128  *
 129  * # cat /sys/kernel/security/tomoyo/domain_policy
 130  *
 131  * A domain is added by
 132  *
 133  * # echo "<kernel>" > /sys/kernel/security/tomoyo/domain_policy
 134  *
 135  * and is deleted by
 136  *
 137  * # echo "delete <kernel>" > /sys/kernel/security/tomoyo/domain_policy
 138  *
 139  * and all domains are retrieved by
 140  *
 141  * # grep '^<kernel>' /sys/kernel/security/tomoyo/domain_policy
 142  *
 143  * Normally, a domainname is monotonically getting longer because a domainname
 144  * which the process will belong to if an execve() operation succeeds is
 145  * defined as a concatenation of "current domainname" + "pathname passed to
 146  * execve()".
 147  * See tomoyo_domain_initializer_list and tomoyo_domain_keeper_list for
 148  * exceptions.
 149  */
 150 LIST_HEAD(tomoyo_domain_list);
 151
 152 /**
 153  * tomoyo_get_last_name - Get last component of a domainname.
 154  *
 155  * @domain: Pointer to "struct tomoyo_domain_info".
 156  *
 157  * Returns the last component of the domainname.
 158  */
 159 const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain)
 160 {
 161         const char *cp0 = domain->domainname->name;
 162         const char *cp1 = strrchr(cp0, ' ');
 163
 164         if (cp1)
 165                 return cp1 + 1;
 166         return cp0;
 167 }
 168
 169 /*
 170  * tomoyo_domain_initializer_list is used for holding list of programs which
 171  * triggers reinitialization of domainname. Normally, a domainname is
 172  * monotonically getting longer. But sometimes, we restart daemon programs.
 173  * It would be convenient for us that "a daemon started upon system boot" and
 174  * "the daemon restarted from console" belong to the same domain. Thus, TOMOYO
 175  * provides a way to shorten domainnames.
 176  *
 177  * An entry is added by
 178  *
 179  * # echo 'initialize_domain /usr/sbin/httpd' > \
 180  *                               /sys/kernel/security/tomoyo/exception_policy
 181  *
 182  * and is deleted by
 183  *
 184  * # echo 'delete initialize_domain /usr/sbin/httpd' > \
 185  *                               /sys/kernel/security/tomoyo/exception_policy
 186  *
 187  * and all entries are retrieved by
 188  *
 189  * # grep ^initialize_domain /sys/kernel/security/tomoyo/exception_policy
 190  *
 191  * In the example above, /usr/sbin/httpd will belong to
 192  * "<kernel> /usr/sbin/httpd" domain.
 193  *
 194  * You may specify a domainname using "from" keyword.
 195  * "initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
 196  * will cause "/usr/sbin/httpd" executed from "<kernel> /etc/rc.d/init.d/httpd"
 197  * domain to belong to "<kernel> /usr/sbin/httpd" domain.
 198  *
 199  * You may add "no_" prefix to "initialize_domain".
 200  * "initialize_domain /usr/sbin/httpd" and
 201  * "no_initialize_domain /usr/sbin/httpd from <kernel> /etc/rc.d/init.d/httpd"
 202  * will cause "/usr/sbin/httpd" to belong to "<kernel> /usr/sbin/httpd" domain
 203  * unless executed from "<kernel> /etc/rc.d/init.d/httpd" domain.
 204  */
 205 LIST_HEAD(tomoyo_domain_initializer_list);
 206
 207 static bool tomoyo_same_domain_initializer_entry(const struct tomoyo_acl_head *
 208                                                  a,
 209                                                  const struct tomoyo_acl_head *
 210                                                  b)
 211 {
 212         const struct tomoyo_domain_initializer_entry *p1 =
 213                 container_of(a, typeof(*p1), head);
 214         const struct tomoyo_domain_initializer_entry *p2 =
 215                 container_of(b, typeof(*p2), head);
 216         return p1->is_not == p2->is_not && p1->is_last_name == p2->is_last_name
 217                 && p1->domainname == p2->domainname
 218                 && p1->program == p2->program;
 219 }
 220
 221 /**
 222  * tomoyo_update_domain_initializer_entry - Update "struct tomoyo_domain_initializer_entry" list.
 223  *
 224  * @domainname: The name of domain. May be NULL.
 225  * @program:    The name of program.
 226  * @is_not:     True if it is "no_initialize_domain" entry.
 227  * @is_delete:  True if it is a delete request.
 228  *
 229  * Returns 0 on success, negative value otherwise.
 230  *
 231  * Caller holds tomoyo_read_lock().
 232  */
 233 static int tomoyo_update_domain_initializer_entry(const char *domainname,
 234                                                   const char *program,
 235                                                   const bool is_not,
 236                                                   const bool is_delete)
 237 {
 238         struct tomoyo_domain_initializer_entry e = { .is_not = is_not };
 239         int error = is_delete ? -ENOENT : -ENOMEM;
 240
 241         if (!tomoyo_is_correct_path(program))
 242                 return -EINVAL;
 243         if (domainname) {
 244                 if (!tomoyo_is_domain_def(domainname) &&
 245                     tomoyo_is_correct_path(domainname))
 246                         e.is_last_name = true;
 247                 else if (!tomoyo_is_correct_domain(domainname))
 248                         return -EINVAL;
 249                 e.domainname = tomoyo_get_name(domainname);
 250                 if (!e.domainname)
 251                         goto out;
 252         }
 253         e.program = tomoyo_get_name(program);
 254         if (!e.program)
 255                 goto out;
 256         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 257                                      &tomoyo_domain_initializer_list,
 258                                      tomoyo_same_domain_initializer_entry);
 259  out:
 260         tomoyo_put_name(e.domainname);
 261         tomoyo_put_name(e.program);
 262         return error;
 263 }
 264
 265 /**
 266  * tomoyo_read_domain_initializer_policy - Read "struct tomoyo_domain_initializer_entry" list.
 267  *
 268  * @head: Pointer to "struct tomoyo_io_buffer".
 269  *
 270  * Returns true on success, false otherwise.
 271  *
 272  * Caller holds tomoyo_read_lock().
 273  */
 274 bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer *head)
 275 {
 276         struct list_head *pos;
 277         bool done = true;
 278
 279         list_for_each_cookie(pos, head->read_var2,
 280                              &tomoyo_domain_initializer_list) {
 281                 const char *no;
 282                 const char *from = "";
 283                 const char *domain = "";
 284                 struct tomoyo_domain_initializer_entry *ptr;
 285                 ptr = list_entry(pos, struct tomoyo_domain_initializer_entry,
 286                                  head.list);
 287                 if (ptr->head.is_deleted)
 288                         continue;
 289                 no = ptr->is_not ? "no_" : "";
 290                 if (ptr->domainname) {
 291                         from = " from ";
 292                         domain = ptr->domainname->name;
 293                 }
 294                 done = tomoyo_io_printf(head,
 295                                         "%s" TOMOYO_KEYWORD_INITIALIZE_DOMAIN
 296                                         "%s%s%s\n", no, ptr->program->name,
 297                                         from, domain);
 298                 if (!done)
 299                         break;
 300         }
 301         return done;
 302 }
 303
 304 /**
 305  * tomoyo_write_domain_initializer_policy - Write "struct tomoyo_domain_initializer_entry" list.
 306  *
 307  * @data:      String to parse.
 308  * @is_not:    True if it is "no_initialize_domain" entry.
 309  * @is_delete: True if it is a delete request.
 310  *
 311  * Returns 0 on success, negative value otherwise.
 312  *
 313  * Caller holds tomoyo_read_lock().
 314  */
 315 int tomoyo_write_domain_initializer_policy(char *data, const bool is_not,
 316                                            const bool is_delete)
 317 {
 318         char *cp = strstr(data, " from ");
 319
 320         if (cp) {
 321                 *cp = '\0';
 322                 return tomoyo_update_domain_initializer_entry(cp + 6, data,
 323                                                               is_not,
 324                                                               is_delete);
 325         }
 326         return tomoyo_update_domain_initializer_entry(NULL, data, is_not,
 327                                                       is_delete);
 328 }
 329
 330 /**
 331  * tomoyo_is_domain_initializer - Check whether the given program causes domainname reinitialization.
 332  *
 333  * @domainname: The name of domain.
 334  * @program:    The name of program.
 335  * @last_name:  The last component of @domainname.
 336  *
 337  * Returns true if executing @program reinitializes domain transition,
 338  * false otherwise.
 339  *
 340  * Caller holds tomoyo_read_lock().
 341  */
 342 static bool tomoyo_is_domain_initializer(const struct tomoyo_path_info *
 343                                          domainname,
 344                                          const struct tomoyo_path_info *program,
 345                                          const struct tomoyo_path_info *
 346                                          last_name)
 347 {
 348         struct tomoyo_domain_initializer_entry *ptr;
 349         bool flag = false;
 350
 351         list_for_each_entry_rcu(ptr, &tomoyo_domain_initializer_list,
 352                                 head.list) {
 353                 if (ptr->head.is_deleted)
 354                         continue;
 355                 if (ptr->domainname) {
 356                         if (!ptr->is_last_name) {
 357                                 if (ptr->domainname != domainname)
 358                                         continue;
 359                         } else {
 360                                 if (tomoyo_pathcmp(ptr->domainname, last_name))
 361                                         continue;
 362                         }
 363                 }
 364                 if (tomoyo_pathcmp(ptr->program, program))
 365                         continue;
 366                 if (ptr->is_not) {
 367                         flag = false;
 368                         break;
 369                 }
 370                 flag = true;
 371         }
 372         return flag;
 373 }
 374
 375 /*
 376  * tomoyo_domain_keeper_list is used for holding list of domainnames which
 377  * suppresses domain transition. Normally, a domainname is monotonically
 378  * getting longer. But sometimes, we want to suppress domain transition.
 379  * It would be convenient for us that programs executed from a login session
 380  * belong to the same domain. Thus, TOMOYO provides a way to suppress domain
 381  * transition.
 382  *
 383  * An entry is added by
 384  *
 385  * # echo 'keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
 386  *                              /sys/kernel/security/tomoyo/exception_policy
 387  *
 388  * and is deleted by
 389  *
 390  * # echo 'delete keep_domain <kernel> /usr/sbin/sshd /bin/bash' > \
 391  *                              /sys/kernel/security/tomoyo/exception_policy
 392  *
 393  * and all entries are retrieved by
 394  *
 395  * # grep ^keep_domain /sys/kernel/security/tomoyo/exception_policy
 396  *
 397  * In the example above, any process which belongs to
 398  * "<kernel> /usr/sbin/sshd /bin/bash" domain will remain in that domain,
 399  * unless explicitly specified by "initialize_domain" or "no_keep_domain".
 400  *
 401  * You may specify a program using "from" keyword.
 402  * "keep_domain /bin/pwd from <kernel> /usr/sbin/sshd /bin/bash"
 403  * will cause "/bin/pwd" executed from "<kernel> /usr/sbin/sshd /bin/bash"
 404  * domain to remain in "<kernel> /usr/sbin/sshd /bin/bash" domain.
 405  *
 406  * You may add "no_" prefix to "keep_domain".
 407  * "keep_domain <kernel> /usr/sbin/sshd /bin/bash" and
 408  * "no_keep_domain /usr/bin/passwd from <kernel> /usr/sbin/sshd /bin/bash" will
 409  * cause "/usr/bin/passwd" to belong to
 410  * "<kernel> /usr/sbin/sshd /bin/bash /usr/bin/passwd" domain, unless
 411  * explicitly specified by "initialize_domain".
 412  */
 413 LIST_HEAD(tomoyo_domain_keeper_list);
 414
 415 static bool tomoyo_same_domain_keeper_entry(const struct tomoyo_acl_head *a,
 416                                             const struct tomoyo_acl_head *b)
 417 {
 418         const struct tomoyo_domain_keeper_entry *p1 =
 419                 container_of(a, typeof(*p1), head);
 420         const struct tomoyo_domain_keeper_entry *p2 =
 421                 container_of(b, typeof(*p2), head);
 422         return p1->is_not == p2->is_not && p1->is_last_name == p2->is_last_name
 423                 && p1->domainname == p2->domainname
 424                 && p1->program == p2->program;
 425 }
 426
 427 /**
 428  * tomoyo_update_domain_keeper_entry - Update "struct tomoyo_domain_keeper_entry" list.
 429  *
 430  * @domainname: The name of domain.
 431  * @program:    The name of program. May be NULL.
 432  * @is_not:     True if it is "no_keep_domain" entry.
 433  * @is_delete:  True if it is a delete request.
 434  *
 435  * Returns 0 on success, negative value otherwise.
 436  *
 437  * Caller holds tomoyo_read_lock().
 438  */
 439 static int tomoyo_update_domain_keeper_entry(const char *domainname,
 440                                              const char *program,
 441                                              const bool is_not,
 442                                              const bool is_delete)
 443 {
 444         struct tomoyo_domain_keeper_entry e = { .is_not = is_not };
 445         int error = is_delete ? -ENOENT : -ENOMEM;
 446
 447         if (!tomoyo_is_domain_def(domainname) &&
 448             tomoyo_is_correct_path(domainname))
 449                 e.is_last_name = true;
 450         else if (!tomoyo_is_correct_domain(domainname))
 451                 return -EINVAL;
 452         if (program) {
 453                 if (!tomoyo_is_correct_path(program))
 454                         return -EINVAL;
 455                 e.program = tomoyo_get_name(program);
 456                 if (!e.program)
 457                         goto out;
 458         }
 459         e.domainname = tomoyo_get_name(domainname);
 460         if (!e.domainname)
 461                 goto out;
 462         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 463                                      &tomoyo_domain_keeper_list,
 464                                      tomoyo_same_domain_keeper_entry);
 465  out:
 466         tomoyo_put_name(e.domainname);
 467         tomoyo_put_name(e.program);
 468         return error;
 469 }
 470
 471 /**
 472  * tomoyo_write_domain_keeper_policy - Write "struct tomoyo_domain_keeper_entry" list.
 473  *
 474  * @data:      String to parse.
 475  * @is_not:    True if it is "no_keep_domain" entry.
 476  * @is_delete: True if it is a delete request.
 477  *
 478  * Caller holds tomoyo_read_lock().
 479  */
 480 int tomoyo_write_domain_keeper_policy(char *data, const bool is_not,
 481                                       const bool is_delete)
 482 {
 483         char *cp = strstr(data, " from ");
 484
 485         if (cp) {
 486                 *cp = '\0';
 487                 return tomoyo_update_domain_keeper_entry(cp + 6, data, is_not,
 488                                                          is_delete);
 489         }
 490         return tomoyo_update_domain_keeper_entry(data, NULL, is_not, is_delete);
 491 }
 492
 493 /**
 494  * tomoyo_read_domain_keeper_policy - Read "struct tomoyo_domain_keeper_entry" list.
 495  *
 496  * @head: Pointer to "struct tomoyo_io_buffer".
 497  *
 498  * Returns true on success, false otherwise.
 499  *
 500  * Caller holds tomoyo_read_lock().
 501  */
 502 bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer *head)
 503 {
 504         struct list_head *pos;
 505         bool done = true;
 506
 507         list_for_each_cookie(pos, head->read_var2,
 508                              &tomoyo_domain_keeper_list) {
 509                 struct tomoyo_domain_keeper_entry *ptr;
 510                 const char *no;
 511                 const char *from = "";
 512                 const char *program = "";
 513
 514                 ptr = list_entry(pos, struct tomoyo_domain_keeper_entry,
 515                                  head.list);
 516                 if (ptr->head.is_deleted)
 517                         continue;
 518                 no = ptr->is_not ? "no_" : "";
 519                 if (ptr->program) {
 520                         from = " from ";
 521                         program = ptr->program->name;
 522                 }
 523                 done = tomoyo_io_printf(head,
 524                                         "%s" TOMOYO_KEYWORD_KEEP_DOMAIN
 525                                         "%s%s%s\n", no, program, from,
 526                                         ptr->domainname->name);
 527                 if (!done)
 528                         break;
 529         }
 530         return done;
 531 }
 532
 533 /**
 534  * tomoyo_is_domain_keeper - Check whether the given program causes domain transition suppression.
 535  *
 536  * @domainname: The name of domain.
 537  * @program:    The name of program.
 538  * @last_name:  The last component of @domainname.
 539  *
 540  * Returns true if executing @program supresses domain transition,
 541  * false otherwise.
 542  *
 543  * Caller holds tomoyo_read_lock().
 544  */
 545 static bool tomoyo_is_domain_keeper(const struct tomoyo_path_info *domainname,
 546                                     const struct tomoyo_path_info *program,
 547                                     const struct tomoyo_path_info *last_name)
 548 {
 549         struct tomoyo_domain_keeper_entry *ptr;
 550         bool flag = false;
 551
 552         list_for_each_entry_rcu(ptr, &tomoyo_domain_keeper_list, head.list) {
 553                 if (ptr->head.is_deleted)
 554                         continue;
 555                 if (!ptr->is_last_name) {
 556                         if (ptr->domainname != domainname)
 557                                 continue;
 558                 } else {
 559                         if (tomoyo_pathcmp(ptr->domainname, last_name))
 560                                 continue;
 561                 }
 562                 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
 563                         continue;
 564                 if (ptr->is_not) {
 565                         flag = false;
 566                         break;
 567                 }
 568                 flag = true;
 569         }
 570         return flag;
 571 }
 572
 573 /*
 574  * tomoyo_aggregator_list is used for holding list of rewrite table for
 575  * execve() request. Some programs provides similar functionality. This keyword
 576  * allows users to aggregate such programs.
 577  *
 578  * Entries are added by
 579  *
 580  * # echo 'aggregator /usr/bin/vi /./editor' > \
 581  *                            /sys/kernel/security/tomoyo/exception_policy
 582  * # echo 'aggregator /usr/bin/emacs /./editor' > \
 583  *                            /sys/kernel/security/tomoyo/exception_policy
 584  *
 585  * and are deleted by
 586  *
 587  * # echo 'delete aggregator /usr/bin/vi /./editor' > \
 588  *                            /sys/kernel/security/tomoyo/exception_policy
 589  * # echo 'delete aggregator /usr/bin/emacs /./editor' > \
 590  *                            /sys/kernel/security/tomoyo/exception_policy
 591  *
 592  * and all entries are retrieved by
 593  *
 594  * # grep ^aggregator /sys/kernel/security/tomoyo/exception_policy
 595  *
 596  * In the example above, if /usr/bin/vi or /usr/bin/emacs are executed,
 597  * permission is checked for /./editor and domainname which the current process
 598  * will belong to after execve() succeeds is calculated using /./editor .
 599  */
 600 LIST_HEAD(tomoyo_aggregator_list);
 601
 602 static bool tomoyo_same_aggregator_entry(const struct tomoyo_acl_head *a,
 603                                          const struct tomoyo_acl_head *b)
 604 {
 605         const struct tomoyo_aggregator_entry *p1 = container_of(a, typeof(*p1),
 606                                                                 head);
 607         const struct tomoyo_aggregator_entry *p2 = container_of(b, typeof(*p2),
 608                                                                 head);
 609         return p1->original_name == p2->original_name &&
 610                 p1->aggregated_name == p2->aggregated_name;
 611 }
 612
 613 /**
 614  * tomoyo_update_aggregator_entry - Update "struct tomoyo_aggregator_entry" list.
 615  *
 616  * @original_name:   The original program's name.
 617  * @aggregated_name: The program name to use.
 618  * @is_delete:       True if it is a delete request.
 619  *
 620  * Returns 0 on success, negative value otherwise.
 621  *
 622  * Caller holds tomoyo_read_lock().
 623  */
 624 static int tomoyo_update_aggregator_entry(const char *original_name,
 625                                           const char *aggregated_name,
 626                                           const bool is_delete)
 627 {
 628         struct tomoyo_aggregator_entry e = { };
 629         int error = is_delete ? -ENOENT : -ENOMEM;
 630
 631         if (!tomoyo_is_correct_path(original_name) ||
 632             !tomoyo_is_correct_path(aggregated_name))
 633                 return -EINVAL;
 634         e.original_name = tomoyo_get_name(original_name);
 635         e.aggregated_name = tomoyo_get_name(aggregated_name);
 636         if (!e.original_name || !e.aggregated_name ||
 637             e.aggregated_name->is_patterned) /* No patterns allowed. */
 638                 goto out;
 639         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 640                                      &tomoyo_aggregator_list,
 641                                      tomoyo_same_aggregator_entry);
 642  out:
 643         tomoyo_put_name(e.original_name);
 644         tomoyo_put_name(e.aggregated_name);
 645         return error;
 646 }
 647
 648 /**
 649  * tomoyo_read_aggregator_policy - Read "struct tomoyo_aggregator_entry" list.
 650  *
 651  * @head: Pointer to "struct tomoyo_io_buffer".
 652  *
 653  * Returns true on success, false otherwise.
 654  *
 655  * Caller holds tomoyo_read_lock().
 656  */
 657 bool tomoyo_read_aggregator_policy(struct tomoyo_io_buffer *head)
 658 {
 659         struct list_head *pos;
 660         bool done = true;
 661
 662         list_for_each_cookie(pos, head->read_var2, &tomoyo_aggregator_list) {
 663                 struct tomoyo_aggregator_entry *ptr;
 664
 665                 ptr = list_entry(pos, struct tomoyo_aggregator_entry,
 666                                  head.list);
 667                 if (ptr->head.is_deleted)
 668                         continue;
 669                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_AGGREGATOR
 670                                         "%s %s\n", ptr->original_name->name,
 671                                         ptr->aggregated_name->name);
 672                 if (!done)
 673                         break;
 674         }
 675         return done;
 676 }
 677
 678 /**
 679  * tomoyo_write_aggregator_policy - Write "struct tomoyo_aggregator_entry" list.
 680  *
 681  * @data:      String to parse.
 682  * @is_delete: True if it is a delete request.
 683  *
 684  * Returns 0 on success, negative value otherwise.
 685  *
 686  * Caller holds tomoyo_read_lock().
 687  */
 688 int tomoyo_write_aggregator_policy(char *data, const bool is_delete)
 689 {
 690         char *cp = strchr(data, ' ');
 691
 692         if (!cp)
 693                 return -EINVAL;
 694         *cp++ = '\0';
 695         return tomoyo_update_aggregator_entry(data, cp, is_delete);
 696 }
 697
 698 /*
 699  * tomoyo_alias_list is used for holding list of symlink's pathnames which are
 700  * allowed to be passed to an execve() request. Normally, the domainname which
 701  * the current process will belong to after execve() succeeds is calculated
 702  * using dereferenced pathnames. But some programs behave differently depending
 703  * on the name passed to argv[0]. For busybox, calculating domainname using
 704  * dereferenced pathnames will cause all programs in the busybox to belong to
 705  * the same domain. Thus, TOMOYO provides a way to allow use of symlink's
 706  * pathname for checking execve()'s permission and calculating domainname which
 707  * the current process will belong to after execve() succeeds.
 708  *
 709  * An entry is added by
 710  *
 711  * # echo 'alias /bin/busybox /bin/cat' > \
 712  *                            /sys/kernel/security/tomoyo/exception_policy
 713  *
 714  * and is deleted by
 715  *
 716  * # echo 'delete alias /bin/busybox /bin/cat' > \
 717  *                            /sys/kernel/security/tomoyo/exception_policy
 718  *
 719  * and all entries are retrieved by
 720  *
 721  * # grep ^alias /sys/kernel/security/tomoyo/exception_policy
 722  *
 723  * In the example above, if /bin/cat is a symlink to /bin/busybox and execution
 724  * of /bin/cat is requested, permission is checked for /bin/cat rather than
 725  * /bin/busybox and domainname which the current process will belong to after
 726  * execve() succeeds is calculated using /bin/cat rather than /bin/busybox .
 727  */
 728 LIST_HEAD(tomoyo_alias_list);
 729
 730 static bool tomoyo_same_alias_entry(const struct tomoyo_acl_head *a,
 731                                     const struct tomoyo_acl_head *b)
 732 {
 733         const struct tomoyo_alias_entry *p1 = container_of(a, typeof(*p1),
 734                                                            head);
 735         const struct tomoyo_alias_entry *p2 = container_of(b, typeof(*p2),
 736                                                            head);
 737         return p1->original_name == p2->original_name &&
 738                 p1->aliased_name == p2->aliased_name;
 739 }
 740
 741 /**
 742  * tomoyo_update_alias_entry - Update "struct tomoyo_alias_entry" list.
 743  *
 744  * @original_name: The original program's real name.
 745  * @aliased_name:  The symbolic program's symbolic link's name.
 746  * @is_delete:     True if it is a delete request.
 747  *
 748  * Returns 0 on success, negative value otherwise.
 749  *
 750  * Caller holds tomoyo_read_lock().
 751  */
 752 static int tomoyo_update_alias_entry(const char *original_name,
 753                                      const char *aliased_name,
 754                                      const bool is_delete)
 755 {
 756         struct tomoyo_alias_entry e = { };
 757         int error = is_delete ? -ENOENT : -ENOMEM;
 758
 759         if (!tomoyo_is_correct_path(original_name) ||
 760             !tomoyo_is_correct_path(aliased_name))
 761                 return -EINVAL;
 762         e.original_name = tomoyo_get_name(original_name);
 763         e.aliased_name = tomoyo_get_name(aliased_name);
 764         if (!e.original_name || !e.aliased_name ||
 765             e.original_name->is_patterned || e.aliased_name->is_patterned)
 766                 goto out; /* No patterns allowed. */
 767         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
 768                                      &tomoyo_alias_list,
 769                                      tomoyo_same_alias_entry);
 770  out:
 771         tomoyo_put_name(e.original_name);
 772         tomoyo_put_name(e.aliased_name);
 773         return error;
 774 }
 775
 776 /**
 777  * tomoyo_read_alias_policy - Read "struct tomoyo_alias_entry" list.
 778  *
 779  * @head: Pointer to "struct tomoyo_io_buffer".
 780  *
 781  * Returns true on success, false otherwise.
 782  *
 783  * Caller holds tomoyo_read_lock().
 784  */
 785 bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head)
 786 {
 787         struct list_head *pos;
 788         bool done = true;
 789
 790         list_for_each_cookie(pos, head->read_var2, &tomoyo_alias_list) {
 791                 struct tomoyo_alias_entry *ptr;
 792
 793                 ptr = list_entry(pos, struct tomoyo_alias_entry, head.list);
 794                 if (ptr->head.is_deleted)
 795                         continue;
 796                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALIAS "%s %s\n",
 797                                         ptr->original_name->name,
 798                                         ptr->aliased_name->name);
 799                 if (!done)
 800                         break;
 801         }
 802         return done;
 803 }
 804
 805 /**
 806  * tomoyo_write_alias_policy - Write "struct tomoyo_alias_entry" list.
 807  *
 808  * @data:      String to parse.
 809  * @is_delete: True if it is a delete request.
 810  *
 811  * Returns 0 on success, negative value otherwise.
 812  *
 813  * Caller holds tomoyo_read_lock().
 814  */
 815 int tomoyo_write_alias_policy(char *data, const bool is_delete)
 816 {
 817         char *cp = strchr(data, ' ');
 818
 819         if (!cp)
 820                 return -EINVAL;
 821         *cp++ = '\0';
 822         return tomoyo_update_alias_entry(data, cp, is_delete);
 823 }
 824
 825 /**
 826  * tomoyo_find_or_assign_new_domain - Create a domain.
 827  *
 828  * @domainname: The name of domain.
 829  * @profile:    Profile number to assign if the domain was newly created.
 830  *
 831  * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
 832  *
 833  * Caller holds tomoyo_read_lock().
 834  */
 835 struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char *
 836                                                             domainname,
 837                                                             const u8 profile)
 838 {
 839         struct tomoyo_domain_info *entry;
 840         struct tomoyo_domain_info *domain = NULL;
 841         const struct tomoyo_path_info *saved_domainname;
 842         bool found = false;
 843
 844         if (!tomoyo_is_correct_domain(domainname))
 845                 return NULL;
 846         saved_domainname = tomoyo_get_name(domainname);
 847         if (!saved_domainname)
 848                 return NULL;
 849         entry = kzalloc(sizeof(*entry), GFP_NOFS);
 850         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 851                 goto out;
 852         list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 853                 if (domain->is_deleted ||
 854                     tomoyo_pathcmp(saved_domainname, domain->domainname))
 855                         continue;
 856                 found = true;
 857                 break;
 858         }
 859         if (!found && tomoyo_memory_ok(entry)) {
 860                 INIT_LIST_HEAD(&entry->acl_info_list);
 861                 entry->domainname = saved_domainname;
 862                 saved_domainname = NULL;
 863                 entry->profile = profile;
 864                 list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
 865                 domain = entry;
 866                 entry = NULL;
 867                 found = true;
 868         }
 869         mutex_unlock(&tomoyo_policy_lock);
 870  out:
 871         tomoyo_put_name(saved_domainname);
 872         kfree(entry);
 873         return found ? domain : NULL;
 874 }
 875
 876 /**
 877  * tomoyo_find_next_domain - Find a domain.
 878  *
 879  * @bprm: Pointer to "struct linux_binprm".
 880  *
 881  * Returns 0 on success, negative value otherwise.
 882  *
 883  * Caller holds tomoyo_read_lock().
 884  */
 885 int tomoyo_find_next_domain(struct linux_binprm *bprm)
 886 {
 887         struct tomoyo_request_info r;
 888         char *tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
 889         struct tomoyo_domain_info *old_domain = tomoyo_domain();
 890         struct tomoyo_domain_info *domain = NULL;
 891         const char *old_domain_name = old_domain->domainname->name;
 892         const char *original_name = bprm->filename;
 893         u8 mode;
 894         bool is_enforce;
 895         int retval = -ENOMEM;
 896         bool need_kfree = false;
 897         struct tomoyo_path_info rn = { }; /* real name */
 898         struct tomoyo_path_info sn = { }; /* symlink name */
 899         struct tomoyo_path_info ln; /* last name */
 900
 901         ln.name = tomoyo_get_last_name(old_domain);
 902         tomoyo_fill_path_info(&ln);
 903         mode = tomoyo_init_request_info(&r, NULL, TOMOYO_MAC_FILE_EXECUTE);
 904         is_enforce = (mode == TOMOYO_CONFIG_ENFORCING);
 905         if (!tmp)
 906                 goto out;
 907
 908  retry:
 909         if (need_kfree) {
 910                 kfree(rn.name);
 911                 need_kfree = false;
 912         }
 913         /* Get tomoyo_realpath of program. */
 914         retval = -ENOENT;
 915         rn.name = tomoyo_realpath(original_name);
 916         if (!rn.name)
 917                 goto out;
 918         tomoyo_fill_path_info(&rn);
 919         need_kfree = true;
 920
 921         /* Get tomoyo_realpath of symbolic link. */
 922         sn.name = tomoyo_realpath_nofollow(original_name);
 923         if (!sn.name)
 924                 goto out;
 925         tomoyo_fill_path_info(&sn);
 926
 927         /* Check 'alias' directive. */
 928         if (tomoyo_pathcmp(&rn, &sn)) {
 929                 struct tomoyo_alias_entry *ptr;
 930                 /* Is this program allowed to be called via symbolic links? */
 931                 list_for_each_entry_rcu(ptr, &tomoyo_alias_list, head.list) {
 932                         if (ptr->head.is_deleted ||
 933                             tomoyo_pathcmp(&rn, ptr->original_name) ||
 934                             tomoyo_pathcmp(&sn, ptr->aliased_name))
 935                                 continue;
 936                         kfree(rn.name);
 937                         need_kfree = false;
 938                         /* This is OK because it is read only. */
 939                         rn = *ptr->aliased_name;
 940                         break;
 941                 }
 942         }
 943
 944         /* Check 'aggregator' directive. */
 945         {
 946                 struct tomoyo_aggregator_entry *ptr;
 947                 list_for_each_entry_rcu(ptr, &tomoyo_aggregator_list,
 948                                         head.list) {
 949                         if (ptr->head.is_deleted ||
 950                             !tomoyo_path_matches_pattern(&rn,
 951                                                          ptr->original_name))
 952                                 continue;
 953                         if (need_kfree)
 954                                 kfree(rn.name);
 955                         need_kfree = false;
 956                         /* This is OK because it is read only. */
 957                         rn = *ptr->aggregated_name;
 958                         break;
 959                 }
 960         }
 961
 962         /* Check execute permission. */
 963         retval = tomoyo_path_permission(&r, TOMOYO_TYPE_EXECUTE, &rn);
 964         if (retval == TOMOYO_RETRY_REQUEST)
 965                 goto retry;
 966         if (retval < 0)
 967                 goto out;
 968
 969         if (tomoyo_is_domain_initializer(old_domain->domainname, &rn, &ln)) {
 970                 /* Transit to the child of tomoyo_kernel_domain domain. */
 971                 snprintf(tmp, TOMOYO_EXEC_TMPSIZE - 1,
 972                          TOMOYO_ROOT_NAME " " "%s", rn.name);
 973         } else if (old_domain == &tomoyo_kernel_domain &&
 974                    !tomoyo_policy_loaded) {
 975                 /*
 976                  * Needn't to transit from kernel domain before starting
 977                  * /sbin/init. But transit from kernel domain if executing
 978                  * initializers because they might start before /sbin/init.
 979                  */
 980                 domain = old_domain;
 981         } else if (tomoyo_is_domain_keeper(old_domain->domainname, &rn, &ln)) {
 982                 /* Keep current domain. */
 983                 domain = old_domain;
 984         } else {
 985                 /* Normal domain transition. */
 986                 snprintf(tmp, TOMOYO_EXEC_TMPSIZE - 1,
 987                          "%s %s", old_domain_name, rn.name);
 988         }
 989         if (domain || strlen(tmp) >= TOMOYO_EXEC_TMPSIZE - 10)
 990                 goto done;
 991         domain = tomoyo_find_domain(tmp);
 992         if (domain)
 993                 goto done;
 994         if (is_enforce) {
 995                 int error = tomoyo_supervisor(&r, "# wants to create domain\n"
 996                                               "%s\n", tmp);
 997                 if (error == TOMOYO_RETRY_REQUEST)
 998                         goto retry;
 999                 if (error < 0)
1000                         goto done;
1001         }
1002         domain = tomoyo_find_or_assign_new_domain(tmp, old_domain->profile);
1003  done:
1004         if (domain)
1005                 goto out;
1006         printk(KERN_WARNING "TOMOYO-ERROR: Domain '%s' not defined.\n", tmp);
1007         if (is_enforce)
1008                 retval = -EPERM;
1009         else
1010                 old_domain->transition_failed = true;
1011  out:
1012         if (!domain)
1013                 domain = old_domain;
1014         /* Update reference count on "struct tomoyo_domain_info". */
1015         atomic_inc(&domain->users);
1016         bprm->cred->security = domain;
1017         if (need_kfree)
1018                 kfree(rn.name);
1019         kfree(sn.name);
1020         kfree(tmp);
1021         return retval;
1022 }