]>
Commit | Line | Data |
---|---|---|
f7433243 KT |
1 | /* |
2 | * security/tomoyo/tomoyo.c | |
3 | * | |
0f2a55d5 | 4 | * Copyright (C) 2005-2011 NTT DATA CORPORATION |
f7433243 KT |
5 | */ |
6 | ||
3c4ed7bd | 7 | #include <linux/lsm_hooks.h> |
f7433243 | 8 | #include "common.h" |
f7433243 | 9 | |
0f2a55d5 TH |
10 | /** |
11 | * tomoyo_cred_alloc_blank - Target for security_cred_alloc_blank(). | |
12 | * | |
13 | * @new: Pointer to "struct cred". | |
14 | * @gfp: Memory allocation flags. | |
15 | * | |
16 | * Returns 0. | |
17 | */ | |
ee18d64c DH |
18 | static int tomoyo_cred_alloc_blank(struct cred *new, gfp_t gfp) |
19 | { | |
98738d70 CS |
20 | struct tomoyo_domain_info **blob = tomoyo_cred(new); |
21 | ||
22 | *blob = NULL; | |
ee18d64c DH |
23 | return 0; |
24 | } | |
25 | ||
0f2a55d5 TH |
26 | /** |
27 | * tomoyo_cred_prepare - Target for security_prepare_creds(). | |
28 | * | |
29 | * @new: Pointer to "struct cred". | |
30 | * @old: Pointer to "struct cred". | |
31 | * @gfp: Memory allocation flags. | |
32 | * | |
33 | * Returns 0. | |
34 | */ | |
f7433243 KT |
35 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
36 | gfp_t gfp) | |
37 | { | |
98738d70 CS |
38 | struct tomoyo_domain_info **old_blob = tomoyo_cred(old); |
39 | struct tomoyo_domain_info **new_blob = tomoyo_cred(new); | |
40 | struct tomoyo_domain_info *domain; | |
41 | ||
42 | domain = *old_blob; | |
43 | *new_blob = domain; | |
44 | ||
ec8e6a4e TH |
45 | if (domain) |
46 | atomic_inc(&domain->users); | |
f7433243 KT |
47 | return 0; |
48 | } | |
49 | ||
0f2a55d5 TH |
50 | /** |
51 | * tomoyo_cred_transfer - Target for security_transfer_creds(). | |
52 | * | |
53 | * @new: Pointer to "struct cred". | |
54 | * @old: Pointer to "struct cred". | |
55 | */ | |
ee18d64c DH |
56 | static void tomoyo_cred_transfer(struct cred *new, const struct cred *old) |
57 | { | |
ec8e6a4e TH |
58 | tomoyo_cred_prepare(new, old, 0); |
59 | } | |
60 | ||
0f2a55d5 TH |
61 | /** |
62 | * tomoyo_cred_free - Target for security_cred_free(). | |
63 | * | |
64 | * @cred: Pointer to "struct cred". | |
65 | */ | |
ec8e6a4e TH |
66 | static void tomoyo_cred_free(struct cred *cred) |
67 | { | |
98738d70 CS |
68 | struct tomoyo_domain_info **blob = tomoyo_cred(cred); |
69 | struct tomoyo_domain_info *domain = *blob; | |
70 | ||
ec8e6a4e TH |
71 | if (domain) |
72 | atomic_dec(&domain->users); | |
ee18d64c DH |
73 | } |
74 | ||
0f2a55d5 TH |
75 | /** |
76 | * tomoyo_bprm_set_creds - Target for security_bprm_set_creds(). | |
77 | * | |
78 | * @bprm: Pointer to "struct linux_binprm". | |
79 | * | |
80 | * Returns 0 on success, negative value otherwise. | |
81 | */ | |
f7433243 KT |
82 | static int tomoyo_bprm_set_creds(struct linux_binprm *bprm) |
83 | { | |
98738d70 CS |
84 | struct tomoyo_domain_info **blob; |
85 | struct tomoyo_domain_info *domain; | |
86 | ||
f7433243 KT |
87 | /* |
88 | * Do only if this function is called for the first time of an execve | |
89 | * operation. | |
90 | */ | |
91 | if (bprm->cred_prepared) | |
92 | return 0; | |
7986cf28 | 93 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
f7433243 KT |
94 | /* |
95 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested | |
96 | * for the first time. | |
97 | */ | |
98 | if (!tomoyo_policy_loaded) | |
99 | tomoyo_load_policy(bprm->filename); | |
7986cf28 | 100 | #endif |
ec8e6a4e TH |
101 | /* |
102 | * Release reference to "struct tomoyo_domain_info" stored inside | |
103 | * "bprm->cred->security". New reference to "struct tomoyo_domain_info" | |
104 | * stored inside "bprm->cred->security" will be acquired later inside | |
105 | * tomoyo_find_next_domain(). | |
106 | */ | |
98738d70 CS |
107 | blob = tomoyo_cred(bprm->cred); |
108 | domain = *blob; | |
109 | atomic_dec(&domain->users); | |
f7433243 KT |
110 | /* |
111 | * Tell tomoyo_bprm_check_security() is called for the first time of an | |
112 | * execve operation. | |
113 | */ | |
98738d70 | 114 | *blob = NULL; |
f7433243 KT |
115 | return 0; |
116 | } | |
117 | ||
0f2a55d5 TH |
118 | /** |
119 | * tomoyo_bprm_check_security - Target for security_bprm_check(). | |
120 | * | |
121 | * @bprm: Pointer to "struct linux_binprm". | |
122 | * | |
123 | * Returns 0 on success, negative value otherwise. | |
124 | */ | |
f7433243 KT |
125 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
126 | { | |
98738d70 CS |
127 | struct tomoyo_domain_info **blob; |
128 | struct tomoyo_domain_info *domain; | |
f7433243 | 129 | |
98738d70 CS |
130 | blob = tomoyo_cred(bprm->cred); |
131 | domain = *blob; | |
f7433243 KT |
132 | /* |
133 | * Execute permission is checked against pathname passed to do_execve() | |
134 | * using current domain. | |
135 | */ | |
fdb8ebb7 | 136 | if (!domain) { |
fdb8ebb7 TH |
137 | const int idx = tomoyo_read_lock(); |
138 | const int err = tomoyo_find_next_domain(bprm); | |
139 | tomoyo_read_unlock(idx); | |
140 | return err; | |
141 | } | |
f7433243 KT |
142 | /* |
143 | * Read permission is checked against interpreters using next domain. | |
f7433243 | 144 | */ |
0f2a55d5 TH |
145 | return tomoyo_check_open_permission(domain, &bprm->file->f_path, |
146 | O_RDONLY); | |
f7433243 KT |
147 | } |
148 | ||
0f2a55d5 TH |
149 | /** |
150 | * tomoyo_inode_getattr - Target for security_inode_getattr(). | |
151 | * | |
152 | * @mnt: Pointer to "struct vfsmount". | |
153 | * @dentry: Pointer to "struct dentry". | |
154 | * | |
155 | * Returns 0 on success, negative value otherwise. | |
156 | */ | |
3f7036a0 | 157 | static int tomoyo_inode_getattr(const struct path *path) |
7c75964f | 158 | { |
3f7036a0 | 159 | return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); |
7c75964f TH |
160 | } |
161 | ||
0f2a55d5 TH |
162 | /** |
163 | * tomoyo_path_truncate - Target for security_path_truncate(). | |
164 | * | |
165 | * @path: Pointer to "struct path". | |
166 | * | |
167 | * Returns 0 on success, negative value otherwise. | |
168 | */ | |
81f4c506 | 169 | static int tomoyo_path_truncate(const struct path *path) |
f7433243 | 170 | { |
97fb35e4 | 171 | return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); |
f7433243 KT |
172 | } |
173 | ||
0f2a55d5 TH |
174 | /** |
175 | * tomoyo_path_unlink - Target for security_path_unlink(). | |
176 | * | |
177 | * @parent: Pointer to "struct path". | |
178 | * @dentry: Pointer to "struct dentry". | |
179 | * | |
180 | * Returns 0 on success, negative value otherwise. | |
181 | */ | |
989f74e0 | 182 | static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) |
f7433243 | 183 | { |
8291798d | 184 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 185 | return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); |
f7433243 KT |
186 | } |
187 | ||
0f2a55d5 TH |
188 | /** |
189 | * tomoyo_path_mkdir - Target for security_path_mkdir(). | |
190 | * | |
191 | * @parent: Pointer to "struct path". | |
192 | * @dentry: Pointer to "struct dentry". | |
193 | * @mode: DAC permission mode. | |
194 | * | |
195 | * Returns 0 on success, negative value otherwise. | |
196 | */ | |
d3607752 | 197 | static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, |
4572befe | 198 | umode_t mode) |
f7433243 | 199 | { |
8291798d | 200 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
a1f9bb6a TH |
201 | return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, |
202 | mode & S_IALLUGO); | |
f7433243 KT |
203 | } |
204 | ||
0f2a55d5 TH |
205 | /** |
206 | * tomoyo_path_rmdir - Target for security_path_rmdir(). | |
207 | * | |
208 | * @parent: Pointer to "struct path". | |
209 | * @dentry: Pointer to "struct dentry". | |
210 | * | |
211 | * Returns 0 on success, negative value otherwise. | |
212 | */ | |
989f74e0 | 213 | static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) |
f7433243 | 214 | { |
8291798d | 215 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 216 | return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); |
f7433243 KT |
217 | } |
218 | ||
0f2a55d5 TH |
219 | /** |
220 | * tomoyo_path_symlink - Target for security_path_symlink(). | |
221 | * | |
222 | * @parent: Pointer to "struct path". | |
223 | * @dentry: Pointer to "struct dentry". | |
224 | * @old_name: Symlink's content. | |
225 | * | |
226 | * Returns 0 on success, negative value otherwise. | |
227 | */ | |
d3607752 | 228 | static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, |
f7433243 KT |
229 | const char *old_name) |
230 | { | |
8291798d | 231 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 232 | return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); |
f7433243 KT |
233 | } |
234 | ||
0f2a55d5 TH |
235 | /** |
236 | * tomoyo_path_mknod - Target for security_path_mknod(). | |
237 | * | |
238 | * @parent: Pointer to "struct path". | |
239 | * @dentry: Pointer to "struct dentry". | |
240 | * @mode: DAC permission mode. | |
241 | * @dev: Device attributes. | |
242 | * | |
243 | * Returns 0 on success, negative value otherwise. | |
244 | */ | |
d3607752 | 245 | static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, |
04fc66e7 | 246 | umode_t mode, unsigned int dev) |
f7433243 | 247 | { |
8291798d | 248 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
7ef61233 | 249 | int type = TOMOYO_TYPE_CREATE; |
a1f9bb6a | 250 | const unsigned int perm = mode & S_IALLUGO; |
f7433243 KT |
251 | |
252 | switch (mode & S_IFMT) { | |
253 | case S_IFCHR: | |
7ef61233 | 254 | type = TOMOYO_TYPE_MKCHAR; |
f7433243 KT |
255 | break; |
256 | case S_IFBLK: | |
7ef61233 | 257 | type = TOMOYO_TYPE_MKBLOCK; |
f7433243 | 258 | break; |
a1f9bb6a TH |
259 | default: |
260 | goto no_dev; | |
261 | } | |
75093152 | 262 | return tomoyo_mkdev_perm(type, &path, perm, dev); |
a1f9bb6a TH |
263 | no_dev: |
264 | switch (mode & S_IFMT) { | |
f7433243 | 265 | case S_IFIFO: |
7ef61233 | 266 | type = TOMOYO_TYPE_MKFIFO; |
f7433243 KT |
267 | break; |
268 | case S_IFSOCK: | |
7ef61233 | 269 | type = TOMOYO_TYPE_MKSOCK; |
f7433243 KT |
270 | break; |
271 | } | |
a1f9bb6a | 272 | return tomoyo_path_number_perm(type, &path, perm); |
f7433243 KT |
273 | } |
274 | ||
0f2a55d5 TH |
275 | /** |
276 | * tomoyo_path_link - Target for security_path_link(). | |
277 | * | |
278 | * @old_dentry: Pointer to "struct dentry". | |
279 | * @new_dir: Pointer to "struct path". | |
280 | * @new_dentry: Pointer to "struct dentry". | |
281 | * | |
282 | * Returns 0 on success, negative value otherwise. | |
283 | */ | |
3ccee46a | 284 | static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, |
f7433243 KT |
285 | struct dentry *new_dentry) |
286 | { | |
8291798d KC |
287 | struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; |
288 | struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; | |
97d6931e | 289 | return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); |
f7433243 KT |
290 | } |
291 | ||
0f2a55d5 TH |
292 | /** |
293 | * tomoyo_path_rename - Target for security_path_rename(). | |
294 | * | |
295 | * @old_parent: Pointer to "struct path". | |
296 | * @old_dentry: Pointer to "struct dentry". | |
297 | * @new_parent: Pointer to "struct path". | |
298 | * @new_dentry: Pointer to "struct dentry". | |
299 | * | |
300 | * Returns 0 on success, negative value otherwise. | |
301 | */ | |
3ccee46a | 302 | static int tomoyo_path_rename(const struct path *old_parent, |
f7433243 | 303 | struct dentry *old_dentry, |
3ccee46a | 304 | const struct path *new_parent, |
f7433243 KT |
305 | struct dentry *new_dentry) |
306 | { | |
8291798d KC |
307 | struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; |
308 | struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; | |
97d6931e | 309 | return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); |
f7433243 KT |
310 | } |
311 | ||
0f2a55d5 TH |
312 | /** |
313 | * tomoyo_file_fcntl - Target for security_file_fcntl(). | |
314 | * | |
315 | * @file: Pointer to "struct file". | |
316 | * @cmd: Command for fcntl(). | |
317 | * @arg: Argument for @cmd. | |
318 | * | |
319 | * Returns 0 on success, negative value otherwise. | |
320 | */ | |
f7433243 KT |
321 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
322 | unsigned long arg) | |
323 | { | |
7c75964f TH |
324 | if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) |
325 | return 0; | |
326 | return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, | |
327 | O_WRONLY | (arg & O_APPEND)); | |
f7433243 KT |
328 | } |
329 | ||
0f2a55d5 | 330 | /** |
83d49856 | 331 | * tomoyo_file_open - Target for security_file_open(). |
0f2a55d5 TH |
332 | * |
333 | * @f: Pointer to "struct file". | |
334 | * @cred: Pointer to "struct cred". | |
335 | * | |
336 | * Returns 0 on success, negative value otherwise. | |
337 | */ | |
83d49856 | 338 | static int tomoyo_file_open(struct file *f, const struct cred *cred) |
f7433243 KT |
339 | { |
340 | int flags = f->f_flags; | |
f7433243 KT |
341 | /* Don't check read permission here if called from do_execve(). */ |
342 | if (current->in_execve) | |
343 | return 0; | |
344 | return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags); | |
345 | } | |
346 | ||
0f2a55d5 TH |
347 | /** |
348 | * tomoyo_file_ioctl - Target for security_file_ioctl(). | |
349 | * | |
350 | * @file: Pointer to "struct file". | |
351 | * @cmd: Command for ioctl(). | |
352 | * @arg: Argument for @cmd. | |
353 | * | |
354 | * Returns 0 on success, negative value otherwise. | |
355 | */ | |
937bf613 TH |
356 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
357 | unsigned long arg) | |
358 | { | |
a1f9bb6a | 359 | return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); |
937bf613 TH |
360 | } |
361 | ||
0f2a55d5 TH |
362 | /** |
363 | * tomoyo_path_chmod - Target for security_path_chmod(). | |
364 | * | |
cdcf116d AV |
365 | * @path: Pointer to "struct path". |
366 | * @mode: DAC permission mode. | |
0f2a55d5 TH |
367 | * |
368 | * Returns 0 on success, negative value otherwise. | |
369 | */ | |
be01f9f2 | 370 | static int tomoyo_path_chmod(const struct path *path, umode_t mode) |
937bf613 | 371 | { |
cdcf116d | 372 | return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, |
a1f9bb6a | 373 | mode & S_IALLUGO); |
937bf613 TH |
374 | } |
375 | ||
0f2a55d5 TH |
376 | /** |
377 | * tomoyo_path_chown - Target for security_path_chown(). | |
378 | * | |
379 | * @path: Pointer to "struct path". | |
380 | * @uid: Owner ID. | |
381 | * @gid: Group ID. | |
382 | * | |
383 | * Returns 0 on success, negative value otherwise. | |
384 | */ | |
7fd25dac | 385 | static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) |
937bf613 TH |
386 | { |
387 | int error = 0; | |
d2b31ca6 EB |
388 | if (uid_valid(uid)) |
389 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, | |
390 | from_kuid(&init_user_ns, uid)); | |
391 | if (!error && gid_valid(gid)) | |
392 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, | |
393 | from_kgid(&init_user_ns, gid)); | |
937bf613 TH |
394 | return error; |
395 | } | |
396 | ||
0f2a55d5 TH |
397 | /** |
398 | * tomoyo_path_chroot - Target for security_path_chroot(). | |
399 | * | |
400 | * @path: Pointer to "struct path". | |
401 | * | |
402 | * Returns 0 on success, negative value otherwise. | |
403 | */ | |
77b286c0 | 404 | static int tomoyo_path_chroot(const struct path *path) |
937bf613 | 405 | { |
97fb35e4 | 406 | return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); |
937bf613 TH |
407 | } |
408 | ||
0f2a55d5 TH |
409 | /** |
410 | * tomoyo_sb_mount - Target for security_sb_mount(). | |
411 | * | |
412 | * @dev_name: Name of device file. Maybe NULL. | |
413 | * @path: Pointer to "struct path". | |
414 | * @type: Name of filesystem type. Maybe NULL. | |
415 | * @flags: Mount options. | |
416 | * @data: Optional data. Maybe NULL. | |
417 | * | |
418 | * Returns 0 on success, negative value otherwise. | |
419 | */ | |
8a04c43b | 420 | static int tomoyo_sb_mount(const char *dev_name, const struct path *path, |
808d4e3c | 421 | const char *type, unsigned long flags, void *data) |
937bf613 | 422 | { |
2106ccd9 | 423 | return tomoyo_mount_permission(dev_name, path, type, flags, data); |
937bf613 TH |
424 | } |
425 | ||
0f2a55d5 TH |
426 | /** |
427 | * tomoyo_sb_umount - Target for security_sb_umount(). | |
428 | * | |
429 | * @mnt: Pointer to "struct vfsmount". | |
430 | * @flags: Unmount options. | |
431 | * | |
432 | * Returns 0 on success, negative value otherwise. | |
433 | */ | |
937bf613 TH |
434 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
435 | { | |
8291798d | 436 | struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; |
97fb35e4 | 437 | return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); |
937bf613 TH |
438 | } |
439 | ||
0f2a55d5 TH |
440 | /** |
441 | * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). | |
442 | * | |
443 | * @old_path: Pointer to "struct path". | |
444 | * @new_path: Pointer to "struct path". | |
445 | * | |
446 | * Returns 0 on success, negative value otherwise. | |
447 | */ | |
3b73b68c | 448 | static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) |
937bf613 | 449 | { |
97d6931e | 450 | return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); |
937bf613 TH |
451 | } |
452 | ||
059d84db TH |
453 | /** |
454 | * tomoyo_socket_listen - Check permission for listen(). | |
455 | * | |
456 | * @sock: Pointer to "struct socket". | |
457 | * @backlog: Backlog parameter. | |
458 | * | |
459 | * Returns 0 on success, negative value otherwise. | |
460 | */ | |
461 | static int tomoyo_socket_listen(struct socket *sock, int backlog) | |
462 | { | |
463 | return tomoyo_socket_listen_permission(sock); | |
464 | } | |
465 | ||
466 | /** | |
467 | * tomoyo_socket_connect - Check permission for connect(). | |
468 | * | |
469 | * @sock: Pointer to "struct socket". | |
470 | * @addr: Pointer to "struct sockaddr". | |
471 | * @addr_len: Size of @addr. | |
472 | * | |
473 | * Returns 0 on success, negative value otherwise. | |
474 | */ | |
475 | static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, | |
476 | int addr_len) | |
477 | { | |
478 | return tomoyo_socket_connect_permission(sock, addr, addr_len); | |
479 | } | |
480 | ||
481 | /** | |
482 | * tomoyo_socket_bind - Check permission for bind(). | |
483 | * | |
484 | * @sock: Pointer to "struct socket". | |
485 | * @addr: Pointer to "struct sockaddr". | |
486 | * @addr_len: Size of @addr. | |
487 | * | |
488 | * Returns 0 on success, negative value otherwise. | |
489 | */ | |
490 | static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, | |
491 | int addr_len) | |
492 | { | |
493 | return tomoyo_socket_bind_permission(sock, addr, addr_len); | |
494 | } | |
495 | ||
496 | /** | |
497 | * tomoyo_socket_sendmsg - Check permission for sendmsg(). | |
498 | * | |
499 | * @sock: Pointer to "struct socket". | |
500 | * @msg: Pointer to "struct msghdr". | |
501 | * @size: Size of message. | |
502 | * | |
503 | * Returns 0 on success, negative value otherwise. | |
504 | */ | |
505 | static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, | |
506 | int size) | |
507 | { | |
508 | return tomoyo_socket_sendmsg_permission(sock, msg, size); | |
509 | } | |
510 | ||
98738d70 CS |
511 | struct lsm_blob_sizes tomoyo_blob_sizes = { |
512 | .lbs_cred = sizeof(struct tomoyo_domain_info *), | |
513 | }; | |
514 | ||
c3fa109a TH |
515 | /* |
516 | * tomoyo_security_ops is a "struct security_operations" which is used for | |
517 | * registering TOMOYO. | |
518 | */ | |
ca97d939 | 519 | static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = { |
e20b043a CS |
520 | LSM_HOOK_INIT(cred_alloc_blank, tomoyo_cred_alloc_blank), |
521 | LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), | |
522 | LSM_HOOK_INIT(cred_transfer, tomoyo_cred_transfer), | |
523 | LSM_HOOK_INIT(cred_free, tomoyo_cred_free), | |
524 | LSM_HOOK_INIT(bprm_set_creds, tomoyo_bprm_set_creds), | |
525 | LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), | |
526 | LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), | |
527 | LSM_HOOK_INIT(file_open, tomoyo_file_open), | |
528 | LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), | |
529 | LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), | |
530 | LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), | |
531 | LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), | |
532 | LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), | |
533 | LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), | |
534 | LSM_HOOK_INIT(path_link, tomoyo_path_link), | |
535 | LSM_HOOK_INIT(path_rename, tomoyo_path_rename), | |
536 | LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), | |
537 | LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), | |
538 | LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), | |
539 | LSM_HOOK_INIT(path_chown, tomoyo_path_chown), | |
540 | LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), | |
541 | LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), | |
542 | LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), | |
543 | LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), | |
544 | LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), | |
545 | LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), | |
546 | LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), | |
547 | LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), | |
f7433243 KT |
548 | }; |
549 | ||
fdb8ebb7 | 550 | /* Lock for GC. */ |
505f14f7 | 551 | DEFINE_SRCU(tomoyo_ss); |
fdb8ebb7 | 552 | |
0f2a55d5 TH |
553 | /** |
554 | * tomoyo_init - Register TOMOYO Linux as a LSM module. | |
555 | * | |
556 | * Returns 0. | |
557 | */ | |
f7433243 KT |
558 | static int __init tomoyo_init(void) |
559 | { | |
98738d70 | 560 | static int finish; |
f7433243 | 561 | struct cred *cred = (struct cred *) current_cred(); |
98738d70 | 562 | struct tomoyo_domain_info **blob; |
f7433243 | 563 | |
a3c3cde2 CS |
564 | if (!security_module_enable("tomoyo", |
565 | IS_ENABLED(CONFIG_SECURITY_TOMOYO_STACKED))) | |
f7433243 | 566 | return 0; |
98738d70 CS |
567 | |
568 | if (!finish) { | |
569 | security_add_blobs(&tomoyo_blob_sizes); | |
570 | finish = 1; | |
571 | return 0; | |
572 | } | |
573 | ||
f7433243 | 574 | /* register ourselves with the security framework */ |
d69dece5 | 575 | security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); |
f7433243 | 576 | printk(KERN_INFO "TOMOYO Linux initialized\n"); |
98738d70 CS |
577 | lsm_early_cred(cred); |
578 | blob = tomoyo_cred(cred); | |
579 | *blob = &tomoyo_kernel_domain; | |
c3ef1500 | 580 | tomoyo_mm_init(); |
f7433243 KT |
581 | return 0; |
582 | } | |
583 | ||
584 | security_initcall(tomoyo_init); |