[mirror_ubuntu-bionic-kernel.git] / security / tomoyo / realpath.c

// SPDX-License-Identifier: GPL-2.0
/*
 * security/tomoyo/realpath.c
 *
 * Copyright (C) 2005-2011  NTT DATA CORPORATION
 */

#include "common.h"
#include <linux/magic.h>

/**
 * tomoyo_encode2 - Encode binary string to ascii string.
 *
 * @str:     String in binary format.
 * @str_len: Size of @str in byte.
 *
 * Returns pointer to @str in ascii format on success, NULL otherwise.
 *
 * This function uses kzalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
char *tomoyo_encode2(const char *str, int str_len)
{
	int i;
	int len = 0;
	const char *p = str;
	char *cp;
	char *cp0;

	if (!p)
		return NULL;
	for (i = 0; i < str_len; i++) {
		const unsigned char c = p[i];

		if (c == '\\')
			len += 2;
		else if (c > ' ' && c < 127)
			len++;
		else
			len += 4;
	}
	len++;
	/* Reserve space for appending "/". */
	cp = kzalloc(len + 10, GFP_NOFS);
	if (!cp)
		return NULL;
	cp0 = cp;
	p = str;
	for (i = 0; i < str_len; i++) {
		const unsigned char c = p[i];

		if (c == '\\') {
			*cp++ = '\\';
			*cp++ = '\\';
		} else if (c > ' ' && c < 127) {
			*cp++ = c;
		} else {
			*cp++ = '\\';
			*cp++ = (c >> 6) + '0';
			*cp++ = ((c >> 3) & 7) + '0';
			*cp++ = (c & 7) + '0';
		}
	}
	return cp0;
}

/**
 * tomoyo_encode - Encode binary string to ascii string.
 *
 * @str: String in binary format.
 *
 * Returns pointer to @str in ascii format on success, NULL otherwise.
 *
 * This function uses kzalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
char *tomoyo_encode(const char *str)
{
	return str ? tomoyo_encode2(str, strlen(str)) : NULL;
}

/**
 * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
 *
 * @path:   Pointer to "struct path".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 */
static char *tomoyo_get_absolute_path(const struct path *path, char * const buffer,
				      const int buflen)
{
	char *pos = ERR_PTR(-ENOMEM);
	if (buflen >= 256) {
		/* go to whatever namespace root we are under */
		pos = d_absolute_path(path, buffer, buflen - 1);
		if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
			struct inode *inode = d_backing_inode(path->dentry);
			if (inode && S_ISDIR(inode->i_mode)) {
				buffer[buflen - 2] = '/';
				buffer[buflen - 1] = '\0';
			}
		}
	}
	return pos;
}

/**
 * tomoyo_get_dentry_path - Get the path of a dentry.
 *
 * @dentry: Pointer to "struct dentry".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 */
static char *tomoyo_get_dentry_path(struct dentry *dentry, char * const buffer,
				    const int buflen)
{
	char *pos = ERR_PTR(-ENOMEM);
	if (buflen >= 256) {
		pos = dentry_path_raw(dentry, buffer, buflen - 1);
		if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
			struct inode *inode = d_backing_inode(dentry);
			if (inode && S_ISDIR(inode->i_mode)) {
				buffer[buflen - 2] = '/';
				buffer[buflen - 1] = '\0';
			}
		}
	}
	return pos;
}

/**
 * tomoyo_get_local_path - Get the path of a dentry.
 *
 * @dentry: Pointer to "struct dentry".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 */
static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
				   const int buflen)
{
	struct super_block *sb = dentry->d_sb;
	char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
	if (IS_ERR(pos))
		return pos;
	/* Convert from $PID to self if $PID is current thread. */
	if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
		char *ep;
		const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
		if (*ep == '/' && pid && pid ==
		    task_tgid_nr_ns(current, sb->s_fs_info)) {
			pos = ep - 5;
			if (pos < buffer)
				goto out;
			memmove(pos, "/self", 5);
		}
		goto prepend_filesystem_name;
	}
	/* Use filesystem name for unnamed devices. */
	if (!MAJOR(sb->s_dev))
		goto prepend_filesystem_name;
	{
		struct inode *inode = d_backing_inode(sb->s_root);
		/*
		 * Use filesystem name if filesystem does not support rename()
		 * operation.
		 */
		if (!inode->i_op->rename)
			goto prepend_filesystem_name;
	}
	/* Prepend device name. */
	{
		char name[64];
		int name_len;
		const dev_t dev = sb->s_dev;
		name[sizeof(name) - 1] = '\0';
		snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
			 MINOR(dev));
		name_len = strlen(name);
		pos -= name_len;
		if (pos < buffer)
			goto out;
		memmove(pos, name, name_len);
		return pos;
	}
	/* Prepend filesystem name. */
prepend_filesystem_name:
	{
		const char *name = sb->s_type->name;
		const int name_len = strlen(name);
		pos -= name_len + 1;
		if (pos < buffer)
			goto out;
		memmove(pos, name, name_len);
		pos[name_len] = ':';
	}
	return pos;
out:
	return ERR_PTR(-ENOMEM);
}

/**
 * tomoyo_get_socket_name - Get the name of a socket.
 *
 * @path:   Pointer to "struct path".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer.
 */
static char *tomoyo_get_socket_name(const struct path *path, char * const buffer,
				    const int buflen)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct socket *sock = inode ? SOCKET_I(inode) : NULL;
	struct sock *sk = sock ? sock->sk : NULL;
	if (sk) {
		snprintf(buffer, buflen, "socket:[family=%u:type=%u:"
			 "protocol=%u]", sk->sk_family, sk->sk_type,
			 sk->sk_protocol);
	} else {
		snprintf(buffer, buflen, "socket:[unknown]");
	}
	return buffer;
}

/**
 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
 *
 * @path: Pointer to "struct path".
 *
 * Returns the realpath of the given @path on success, NULL otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 * Characters out of 0x20 < c < 0x7F range are converted to
 * \ooo style octal string.
 * Character \ is converted to \\ string.
 *
 * These functions use kzalloc(), so the caller must call kfree()
 * if these functions didn't return NULL.
 */
char *tomoyo_realpath_from_path(const struct path *path)
{
	char *buf = NULL;
	char *name = NULL;
	unsigned int buf_len = PAGE_SIZE / 2;
	struct dentry *dentry = path->dentry;
	struct super_block *sb;
	if (!dentry)
		return NULL;
	sb = dentry->d_sb;
	while (1) {
		char *pos;
		struct inode *inode;
		buf_len <<= 1;
		kfree(buf);
		buf = kmalloc(buf_len, GFP_NOFS);
		if (!buf)
			break;
		/* To make sure that pos is '\0' terminated. */
		buf[buf_len - 1] = '\0';
		/* Get better name for socket. */
		if (sb->s_magic == SOCKFS_MAGIC) {
			pos = tomoyo_get_socket_name(path, buf, buf_len - 1);
			goto encode;
		}
		/* For "pipe:[\$]". */
		if (dentry->d_op && dentry->d_op->d_dname) {
			pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
			goto encode;
		}
		inode = d_backing_inode(sb->s_root);
		/*
		 * Get local name for filesystems without rename() operation
		 * or dentry without vfsmount.
		 */
		if (!path->mnt ||
		    (!inode->i_op->rename))
			pos = tomoyo_get_local_path(path->dentry, buf,
						    buf_len - 1);
		/* Get absolute name for the rest. */
		else {
			pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
			/*
			 * Fall back to local name if absolute name is not
			 * available.
			 */
			if (pos == ERR_PTR(-EINVAL))
				pos = tomoyo_get_local_path(path->dentry, buf,
							    buf_len - 1);
		}
encode:
		if (IS_ERR(pos))
			continue;
		name = tomoyo_encode(pos);
		break;
	}
	kfree(buf);
	if (!name)
		tomoyo_warn_oom(__func__);
	return name;
}

/**
 * tomoyo_realpath_nofollow - Get realpath of a pathname.
 *
 * @pathname: The pathname to solve.
 *
 * Returns the realpath of @pathname on success, NULL otherwise.
 */
char *tomoyo_realpath_nofollow(const char *pathname)
{
	struct path path;

	if (pathname && kern_path(pathname, 0, &path) == 0) {
		char *buf = tomoyo_realpath_from_path(&path);
		path_put(&path);
		return buf;
	}
	return NULL;
}
Commit	Line	Data
b2441318	1	// SPDX-License-Identifier: GPL-2.0
c73bd6d4 KT	2	/*
	3	* security/tomoyo/realpath.c
	4	*
0f2a55d5	5	* Copyright (C) 2005-2011 NTT DATA CORPORATION
c73bd6d4 KT	6	*/
c73bd6d4 KT	7
c73bd6d4	8	#include "common.h"
d10577a8	9	#include <linux/magic.h>
c73bd6d4 KT	10
c73bd6d4 KT	11	/**
059d84db	12	* tomoyo_encode2 - Encode binary string to ascii string.
c73bd6d4	13	*
059d84db TH	14	* @str: String in binary format.
059d84db TH	15	* @str_len: Size of @str in byte.
c73bd6d4	16	*
c8c57e84 TH	17	* Returns pointer to @str in ascii format on success, NULL otherwise.
	18	*
	19	* This function uses kzalloc(), so caller must kfree() if this function
	20	* didn't return NULL.
c73bd6d4	21	*/
059d84db	22	char tomoyo_encode2(const char str, int str_len)
c73bd6d4	23	{
059d84db	24	int i;
c8c57e84 TH	25	int len = 0;
	26	const char *p = str;
	27	char *cp;
	28	char *cp0;
c73bd6d4	29
c8c57e84 TH	30	if (!p)
c8c57e84 TH	31	return NULL;
059d84db TH	32	for (i = 0; i < str_len; i++) {
	33	const unsigned char c = p[i];
	34
c8c57e84 TH	35	if (c == '\\')
	36	len += 2;
	37	else if (c > ' ' && c < 127)
	38	len++;
	39	else
	40	len += 4;
	41	}
	42	len++;
	43	/* Reserve space for appending "/". */
	44	cp = kzalloc(len + 10, GFP_NOFS);
	45	if (!cp)
	46	return NULL;
	47	cp0 = cp;
	48	p = str;
059d84db TH	49	for (i = 0; i < str_len; i++) {
059d84db TH	50	const unsigned char c = p[i];
c8c57e84 TH	51
	52	if (c == '\\') {
	53	*cp++ = '\\';
	54	*cp++ = '\\';
	55	} else if (c > ' ' && c < 127) {
	56	*cp++ = c;
	57	} else {
	58	*cp++ = '\\';
	59	*cp++ = (c >> 6) + '0';
	60	*cp++ = ((c >> 3) & 7) + '0';
	61	*cp++ = (c & 7) + '0';
c73bd6d4	62	}
c73bd6d4	63	}
c8c57e84	64	return cp0;
c73bd6d4 KT	65	}
c73bd6d4 KT	66
059d84db TH	67	/**
	68	* tomoyo_encode - Encode binary string to ascii string.
	69	*
	70	* @str: String in binary format.
	71	*
	72	* Returns pointer to @str in ascii format on success, NULL otherwise.
	73	*
	74	* This function uses kzalloc(), so caller must kfree() if this function
	75	* didn't return NULL.
	76	*/
	77	char tomoyo_encode(const char str)
	78	{
	79	return str ? tomoyo_encode2(str, strlen(str)) : NULL;
	80	}
	81
5625f2e3 TH	82	/**
	83	* tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
	84	*
	85	* @path: Pointer to "struct path".
	86	* @buffer: Pointer to buffer to return value in.
	87	* @buflen: Sizeof @buffer.
	88	*
	89	* Returns the buffer on success, an error code otherwise.
	90	*
	91	* If dentry is a directory, trailing '/' is appended.
	92	*/
22473862	93	static char tomoyo_get_absolute_path(const struct path path, char * const buffer,
5625f2e3 TH	94	const int buflen)
	95	{
	96	char *pos = ERR_PTR(-ENOMEM);
	97	if (buflen >= 256) {
5625f2e3	98	/* go to whatever namespace root we are under */
02125a82	99	pos = d_absolute_path(path, buffer, buflen - 1);
5625f2e3	100	if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
c6f493d6	101	struct inode *inode = d_backing_inode(path->dentry);
5625f2e3 TH	102	if (inode && S_ISDIR(inode->i_mode)) {
	103	buffer[buflen - 2] = '/';
	104	buffer[buflen - 1] = '\0';
	105	}
	106	}
	107	}
	108	return pos;
	109	}
	110
	111	/**
	112	* tomoyo_get_dentry_path - Get the path of a dentry.
	113	*
	114	* @dentry: Pointer to "struct dentry".
	115	* @buffer: Pointer to buffer to return value in.
	116	* @buflen: Sizeof @buffer.
	117	*
	118	* Returns the buffer on success, an error code otherwise.
	119	*
	120	* If dentry is a directory, trailing '/' is appended.
	121	*/
	122	static char tomoyo_get_dentry_path(struct dentry dentry, char * const buffer,
	123	const int buflen)
	124	{
	125	char *pos = ERR_PTR(-ENOMEM);
	126	if (buflen >= 256) {
	127	pos = dentry_path_raw(dentry, buffer, buflen - 1);
	128	if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
c6f493d6	129	struct inode *inode = d_backing_inode(dentry);
5625f2e3 TH	130	if (inode && S_ISDIR(inode->i_mode)) {
	131	buffer[buflen - 2] = '/';
	132	buffer[buflen - 1] = '\0';
	133	}
	134	}
	135	}
	136	return pos;
	137	}
	138
	139	/**
	140	* tomoyo_get_local_path - Get the path of a dentry.
	141	*
	142	* @dentry: Pointer to "struct dentry".
	143	* @buffer: Pointer to buffer to return value in.
	144	* @buflen: Sizeof @buffer.
	145	*
	146	* Returns the buffer on success, an error code otherwise.
	147	*/
	148	static char tomoyo_get_local_path(struct dentry dentry, char * const buffer,
	149	const int buflen)
	150	{
	151	struct super_block *sb = dentry->d_sb;
	152	char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
	153	if (IS_ERR(pos))
	154	return pos;
	155	/* Convert from $PID to self if $PID is current thread. */
	156	if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
	157	char *ep;
	158	const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
	159	if (*ep == '/' && pid && pid ==
	160	task_tgid_nr_ns(current, sb->s_fs_info)) {
	161	pos = ep - 5;
	162	if (pos < buffer)
	163	goto out;
	164	memmove(pos, "/self", 5);
	165	}
	166	goto prepend_filesystem_name;
	167	}
	168	/* Use filesystem name for unnamed devices. */
	169	if (!MAJOR(sb->s_dev))
	170	goto prepend_filesystem_name;
	171	{
c6f493d6	172	struct inode *inode = d_backing_inode(sb->s_root);
5625f2e3 TH	173	/*
	174	* Use filesystem name if filesystem does not support rename()
	175	* operation.
	176	*/
2773bf00	177	if (!inode->i_op->rename)
5625f2e3 TH	178	goto prepend_filesystem_name;
	179	}
	180	/* Prepend device name. */
	181	{
	182	char name[64];
	183	int name_len;
	184	const dev_t dev = sb->s_dev;
	185	name[sizeof(name) - 1] = '\0';
	186	snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
	187	MINOR(dev));
	188	name_len = strlen(name);
	189	pos -= name_len;
	190	if (pos < buffer)
	191	goto out;
	192	memmove(pos, name, name_len);
	193	return pos;
	194	}
	195	/* Prepend filesystem name. */
	196	prepend_filesystem_name:
	197	{
	198	const char *name = sb->s_type->name;
	199	const int name_len = strlen(name);
	200	pos -= name_len + 1;
	201	if (pos < buffer)
	202	goto out;
	203	memmove(pos, name, name_len);
	204	pos[name_len] = ':';
	205	}
	206	return pos;
	207	out:
	208	return ERR_PTR(-ENOMEM);
	209	}
	210
	211	/**
	212	* tomoyo_get_socket_name - Get the name of a socket.
	213	*
	214	* @path: Pointer to "struct path".
	215	* @buffer: Pointer to buffer to return value in.
	216	* @buflen: Sizeof @buffer.
	217	*
	218	* Returns the buffer.
	219	*/
22473862	220	static char tomoyo_get_socket_name(const struct path path, char * const buffer,
5625f2e3 TH	221	const int buflen)
5625f2e3 TH	222	{
c6f493d6	223	struct inode *inode = d_backing_inode(path->dentry);
5625f2e3 TH	224	struct socket *sock = inode ? SOCKET_I(inode) : NULL;
	225	struct sock *sk = sock ? sock->sk : NULL;
	226	if (sk) {
	227	snprintf(buffer, buflen, "socket:[family=%u:type=%u:"
	228	"protocol=%u]", sk->sk_family, sk->sk_type,
	229	sk->sk_protocol);
	230	} else {
	231	snprintf(buffer, buflen, "socket:[unknown]");
	232	}
	233	return buffer;
	234	}
	235
c73bd6d4	236	/**
c8c57e84	237	* tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
c73bd6d4	238	*
c8c57e84	239	* @path: Pointer to "struct path".
c73bd6d4	240	*
c8c57e84	241	* Returns the realpath of the given @path on success, NULL otherwise.
c73bd6d4 KT	242	*
	243	* If dentry is a directory, trailing '/' is appended.
	244	* Characters out of 0x20 < c < 0x7F range are converted to
	245	* \ooo style octal string.
	246	* Character \ is converted to \\ string.
c8c57e84 TH	247	*
	248	* These functions use kzalloc(), so the caller must call kfree()
	249	* if these functions didn't return NULL.
c73bd6d4	250	*/
22473862	251	char tomoyo_realpath_from_path(const struct path path)
c73bd6d4	252	{
c8c57e84 TH	253	char *buf = NULL;
	254	char *name = NULL;
	255	unsigned int buf_len = PAGE_SIZE / 2;
c73bd6d4	256	struct dentry *dentry = path->dentry;
5625f2e3	257	struct super_block *sb;
c8c57e84 TH	258	if (!dentry)
c8c57e84 TH	259	return NULL;
5625f2e3	260	sb = dentry->d_sb;
c8c57e84	261	while (1) {
c8c57e84	262	char *pos;
5625f2e3	263	struct inode *inode;
c8c57e84 TH	264	buf_len <<= 1;
	265	kfree(buf);
	266	buf = kmalloc(buf_len, GFP_NOFS);
	267	if (!buf)
	268	break;
5625f2e3 TH	269	/* To make sure that pos is '\0' terminated. */
5625f2e3 TH	270	buf[buf_len - 1] = '\0';
c8c57e84	271	/* Get better name for socket. */
5625f2e3 TH	272	if (sb->s_magic == SOCKFS_MAGIC) {
	273	pos = tomoyo_get_socket_name(path, buf, buf_len - 1);
	274	goto encode;
c8c57e84	275	}
5625f2e3	276	/* For "pipe:[\$]". */
c8c57e84 TH	277	if (dentry->d_op && dentry->d_op->d_dname) {
c8c57e84 TH	278	pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
5625f2e3	279	goto encode;
c73bd6d4	280	}
c6f493d6	281	inode = d_backing_inode(sb->s_root);
5625f2e3 TH	282	/*
	283	* Get local name for filesystems without rename() operation
	284	* or dentry without vfsmount.
	285	*/
8fe7a268	286	if (!path->mnt \|\|
2773bf00	287	(!inode->i_op->rename))
5625f2e3 TH	288	pos = tomoyo_get_local_path(path->dentry, buf,
	289	buf_len - 1);
	290	/* Get absolute name for the rest. */
1418a3e5	291	else {
5625f2e3	292	pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
1418a3e5 TH	293	/*
	294	* Fall back to local name if absolute name is not
	295	* available.
	296	*/
	297	if (pos == ERR_PTR(-EINVAL))
	298	pos = tomoyo_get_local_path(path->dentry, buf,
	299	buf_len - 1);
	300	}
5625f2e3	301	encode:
c8c57e84 TH	302	if (IS_ERR(pos))
	303	continue;
	304	name = tomoyo_encode(pos);
	305	break;
c73bd6d4	306	}
8e2d39a1	307	kfree(buf);
c8c57e84 TH	308	if (!name)
c8c57e84 TH	309	tomoyo_warn_oom(__func__);
c8c57e84	310	return name;
c73bd6d4 KT	311	}
c73bd6d4 KT	312
c73bd6d4 KT	313	/**
	314	* tomoyo_realpath_nofollow - Get realpath of a pathname.
	315	*
	316	* @pathname: The pathname to solve.
	317	*
	318	* Returns the realpath of @pathname on success, NULL otherwise.
	319	*/
	320	char tomoyo_realpath_nofollow(const char pathname)
	321	{
e24977d4	322	struct path path;
c73bd6d4	323
e24977d4 AV	324	if (pathname && kern_path(pathname, 0, &path) == 0) {
	325	char *buf = tomoyo_realpath_from_path(&path);
	326	path_put(&path);
c73bd6d4 KT	327	return buf;
	328	}
	329	return NULL;
	330	}