]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
f7433243 KT |
2 | /* |
3 | * security/tomoyo/tomoyo.c | |
4 | * | |
0f2a55d5 | 5 | * Copyright (C) 2005-2011 NTT DATA CORPORATION |
f7433243 KT |
6 | */ |
7 | ||
3c4ed7bd | 8 | #include <linux/lsm_hooks.h> |
f7433243 | 9 | #include "common.h" |
f7433243 | 10 | |
0f2a55d5 | 11 | /** |
8c6cb983 | 12 | * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. |
0f2a55d5 | 13 | * |
8c6cb983 | 14 | * Returns pointer to "struct tomoyo_domain_info" for current thread. |
0f2a55d5 | 15 | */ |
8c6cb983 | 16 | struct tomoyo_domain_info *tomoyo_domain(void) |
ee18d64c | 17 | { |
8c6cb983 | 18 | struct tomoyo_task *s = tomoyo_task(current); |
43fc4609 | 19 | |
8c6cb983 TH |
20 | if (s->old_domain_info && !current->in_execve) { |
21 | atomic_dec(&s->old_domain_info->users); | |
22 | s->old_domain_info = NULL; | |
23 | } | |
24 | return s->domain_info; | |
ee18d64c DH |
25 | } |
26 | ||
0f2a55d5 TH |
27 | /** |
28 | * tomoyo_cred_prepare - Target for security_prepare_creds(). | |
29 | * | |
30 | * @new: Pointer to "struct cred". | |
31 | * @old: Pointer to "struct cred". | |
32 | * @gfp: Memory allocation flags. | |
33 | * | |
34 | * Returns 0. | |
35 | */ | |
f7433243 KT |
36 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
37 | gfp_t gfp) | |
38 | { | |
8c6cb983 TH |
39 | /* Restore old_domain_info saved by previous execve() request. */ |
40 | struct tomoyo_task *s = tomoyo_task(current); | |
43fc4609 | 41 | |
8c6cb983 TH |
42 | if (s->old_domain_info && !current->in_execve) { |
43 | atomic_dec(&s->domain_info->users); | |
44 | s->domain_info = s->old_domain_info; | |
45 | s->old_domain_info = NULL; | |
46 | } | |
f7433243 KT |
47 | return 0; |
48 | } | |
49 | ||
0f2a55d5 | 50 | /** |
8c6cb983 | 51 | * tomoyo_bprm_committed_creds - Target for security_bprm_committed_creds(). |
0f2a55d5 | 52 | * |
8c6cb983 | 53 | * @bprm: Pointer to "struct linux_binprm". |
0f2a55d5 | 54 | */ |
8c6cb983 | 55 | static void tomoyo_bprm_committed_creds(struct linux_binprm *bprm) |
ec8e6a4e | 56 | { |
8c6cb983 TH |
57 | /* Clear old_domain_info saved by execve() request. */ |
58 | struct tomoyo_task *s = tomoyo_task(current); | |
43fc4609 | 59 | |
8c6cb983 TH |
60 | atomic_dec(&s->old_domain_info->users); |
61 | s->old_domain_info = NULL; | |
ee18d64c DH |
62 | } |
63 | ||
8c6cb983 | 64 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
0f2a55d5 | 65 | /** |
98eaa63e | 66 | * tomoyo_bprm_creds_for_exec - Target for security_bprm_creds_for_exec(). |
0f2a55d5 TH |
67 | * |
68 | * @bprm: Pointer to "struct linux_binprm". | |
69 | * | |
8c6cb983 | 70 | * Returns 0. |
0f2a55d5 | 71 | */ |
b8bff599 | 72 | static int tomoyo_bprm_creds_for_exec(struct linux_binprm *bprm) |
f7433243 | 73 | { |
f7433243 KT |
74 | /* |
75 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested | |
76 | * for the first time. | |
77 | */ | |
78 | if (!tomoyo_policy_loaded) | |
79 | tomoyo_load_policy(bprm->filename); | |
f7433243 KT |
80 | return 0; |
81 | } | |
8c6cb983 | 82 | #endif |
f7433243 | 83 | |
0f2a55d5 TH |
84 | /** |
85 | * tomoyo_bprm_check_security - Target for security_bprm_check(). | |
86 | * | |
87 | * @bprm: Pointer to "struct linux_binprm". | |
88 | * | |
89 | * Returns 0 on success, negative value otherwise. | |
90 | */ | |
f7433243 KT |
91 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
92 | { | |
8c6cb983 | 93 | struct tomoyo_task *s = tomoyo_task(current); |
f7433243 KT |
94 | |
95 | /* | |
be619f7f | 96 | * Execute permission is checked against pathname passed to execve() |
f7433243 KT |
97 | * using current domain. |
98 | */ | |
8c6cb983 | 99 | if (!s->old_domain_info) { |
fdb8ebb7 TH |
100 | const int idx = tomoyo_read_lock(); |
101 | const int err = tomoyo_find_next_domain(bprm); | |
cdcf6723 | 102 | |
fdb8ebb7 TH |
103 | tomoyo_read_unlock(idx); |
104 | return err; | |
105 | } | |
f7433243 KT |
106 | /* |
107 | * Read permission is checked against interpreters using next domain. | |
f7433243 | 108 | */ |
8c6cb983 TH |
109 | return tomoyo_check_open_permission(s->domain_info, |
110 | &bprm->file->f_path, O_RDONLY); | |
f7433243 KT |
111 | } |
112 | ||
0f2a55d5 TH |
113 | /** |
114 | * tomoyo_inode_getattr - Target for security_inode_getattr(). | |
115 | * | |
98eaa63e | 116 | * @path: Pointer to "struct path". |
0f2a55d5 TH |
117 | * |
118 | * Returns 0 on success, negative value otherwise. | |
119 | */ | |
3f7036a0 | 120 | static int tomoyo_inode_getattr(const struct path *path) |
7c75964f | 121 | { |
3f7036a0 | 122 | return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); |
7c75964f TH |
123 | } |
124 | ||
0f2a55d5 TH |
125 | /** |
126 | * tomoyo_path_truncate - Target for security_path_truncate(). | |
127 | * | |
128 | * @path: Pointer to "struct path". | |
129 | * | |
130 | * Returns 0 on success, negative value otherwise. | |
131 | */ | |
81f4c506 | 132 | static int tomoyo_path_truncate(const struct path *path) |
f7433243 | 133 | { |
97fb35e4 | 134 | return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); |
f7433243 KT |
135 | } |
136 | ||
0f2a55d5 TH |
137 | /** |
138 | * tomoyo_path_unlink - Target for security_path_unlink(). | |
139 | * | |
140 | * @parent: Pointer to "struct path". | |
141 | * @dentry: Pointer to "struct dentry". | |
142 | * | |
143 | * Returns 0 on success, negative value otherwise. | |
144 | */ | |
989f74e0 | 145 | static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) |
f7433243 | 146 | { |
8291798d | 147 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
cdcf6723 | 148 | |
97fb35e4 | 149 | return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); |
f7433243 KT |
150 | } |
151 | ||
0f2a55d5 TH |
152 | /** |
153 | * tomoyo_path_mkdir - Target for security_path_mkdir(). | |
154 | * | |
155 | * @parent: Pointer to "struct path". | |
156 | * @dentry: Pointer to "struct dentry". | |
157 | * @mode: DAC permission mode. | |
158 | * | |
159 | * Returns 0 on success, negative value otherwise. | |
160 | */ | |
d3607752 | 161 | static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, |
4572befe | 162 | umode_t mode) |
f7433243 | 163 | { |
8291798d | 164 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
cdcf6723 | 165 | |
a1f9bb6a TH |
166 | return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, |
167 | mode & S_IALLUGO); | |
f7433243 KT |
168 | } |
169 | ||
0f2a55d5 TH |
170 | /** |
171 | * tomoyo_path_rmdir - Target for security_path_rmdir(). | |
172 | * | |
173 | * @parent: Pointer to "struct path". | |
174 | * @dentry: Pointer to "struct dentry". | |
175 | * | |
176 | * Returns 0 on success, negative value otherwise. | |
177 | */ | |
989f74e0 | 178 | static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) |
f7433243 | 179 | { |
8291798d | 180 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
cdcf6723 | 181 | |
97fb35e4 | 182 | return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); |
f7433243 KT |
183 | } |
184 | ||
0f2a55d5 TH |
185 | /** |
186 | * tomoyo_path_symlink - Target for security_path_symlink(). | |
187 | * | |
188 | * @parent: Pointer to "struct path". | |
189 | * @dentry: Pointer to "struct dentry". | |
190 | * @old_name: Symlink's content. | |
191 | * | |
192 | * Returns 0 on success, negative value otherwise. | |
193 | */ | |
d3607752 | 194 | static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, |
f7433243 KT |
195 | const char *old_name) |
196 | { | |
8291798d | 197 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
cdcf6723 | 198 | |
97fb35e4 | 199 | return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); |
f7433243 KT |
200 | } |
201 | ||
0f2a55d5 TH |
202 | /** |
203 | * tomoyo_path_mknod - Target for security_path_mknod(). | |
204 | * | |
205 | * @parent: Pointer to "struct path". | |
206 | * @dentry: Pointer to "struct dentry". | |
207 | * @mode: DAC permission mode. | |
208 | * @dev: Device attributes. | |
209 | * | |
210 | * Returns 0 on success, negative value otherwise. | |
211 | */ | |
d3607752 | 212 | static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, |
04fc66e7 | 213 | umode_t mode, unsigned int dev) |
f7433243 | 214 | { |
8291798d | 215 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
7ef61233 | 216 | int type = TOMOYO_TYPE_CREATE; |
a1f9bb6a | 217 | const unsigned int perm = mode & S_IALLUGO; |
f7433243 KT |
218 | |
219 | switch (mode & S_IFMT) { | |
220 | case S_IFCHR: | |
7ef61233 | 221 | type = TOMOYO_TYPE_MKCHAR; |
f7433243 KT |
222 | break; |
223 | case S_IFBLK: | |
7ef61233 | 224 | type = TOMOYO_TYPE_MKBLOCK; |
f7433243 | 225 | break; |
a1f9bb6a TH |
226 | default: |
227 | goto no_dev; | |
228 | } | |
75093152 | 229 | return tomoyo_mkdev_perm(type, &path, perm, dev); |
a1f9bb6a TH |
230 | no_dev: |
231 | switch (mode & S_IFMT) { | |
f7433243 | 232 | case S_IFIFO: |
7ef61233 | 233 | type = TOMOYO_TYPE_MKFIFO; |
f7433243 KT |
234 | break; |
235 | case S_IFSOCK: | |
7ef61233 | 236 | type = TOMOYO_TYPE_MKSOCK; |
f7433243 KT |
237 | break; |
238 | } | |
a1f9bb6a | 239 | return tomoyo_path_number_perm(type, &path, perm); |
f7433243 KT |
240 | } |
241 | ||
0f2a55d5 TH |
242 | /** |
243 | * tomoyo_path_link - Target for security_path_link(). | |
244 | * | |
245 | * @old_dentry: Pointer to "struct dentry". | |
246 | * @new_dir: Pointer to "struct path". | |
247 | * @new_dentry: Pointer to "struct dentry". | |
248 | * | |
249 | * Returns 0 on success, negative value otherwise. | |
250 | */ | |
3ccee46a | 251 | static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, |
f7433243 KT |
252 | struct dentry *new_dentry) |
253 | { | |
8291798d KC |
254 | struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; |
255 | struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; | |
cdcf6723 | 256 | |
97d6931e | 257 | return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); |
f7433243 KT |
258 | } |
259 | ||
0f2a55d5 TH |
260 | /** |
261 | * tomoyo_path_rename - Target for security_path_rename(). | |
262 | * | |
263 | * @old_parent: Pointer to "struct path". | |
264 | * @old_dentry: Pointer to "struct dentry". | |
265 | * @new_parent: Pointer to "struct path". | |
266 | * @new_dentry: Pointer to "struct dentry". | |
267 | * | |
268 | * Returns 0 on success, negative value otherwise. | |
269 | */ | |
3ccee46a | 270 | static int tomoyo_path_rename(const struct path *old_parent, |
f7433243 | 271 | struct dentry *old_dentry, |
3ccee46a | 272 | const struct path *new_parent, |
f7433243 KT |
273 | struct dentry *new_dentry) |
274 | { | |
8291798d KC |
275 | struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; |
276 | struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; | |
cdcf6723 | 277 | |
97d6931e | 278 | return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); |
f7433243 KT |
279 | } |
280 | ||
0f2a55d5 TH |
281 | /** |
282 | * tomoyo_file_fcntl - Target for security_file_fcntl(). | |
283 | * | |
284 | * @file: Pointer to "struct file". | |
285 | * @cmd: Command for fcntl(). | |
286 | * @arg: Argument for @cmd. | |
287 | * | |
288 | * Returns 0 on success, negative value otherwise. | |
289 | */ | |
f7433243 KT |
290 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
291 | unsigned long arg) | |
292 | { | |
7c75964f TH |
293 | if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) |
294 | return 0; | |
295 | return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, | |
296 | O_WRONLY | (arg & O_APPEND)); | |
f7433243 KT |
297 | } |
298 | ||
0f2a55d5 | 299 | /** |
83d49856 | 300 | * tomoyo_file_open - Target for security_file_open(). |
0f2a55d5 | 301 | * |
98eaa63e | 302 | * @f: Pointer to "struct file". |
0f2a55d5 TH |
303 | * |
304 | * Returns 0 on success, negative value otherwise. | |
305 | */ | |
94817692 | 306 | static int tomoyo_file_open(struct file *f) |
f7433243 | 307 | { |
be619f7f | 308 | /* Don't check read permission here if called from execve(). */ |
f7433243 KT |
309 | if (current->in_execve) |
310 | return 0; | |
cdcf6723 TH |
311 | return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, |
312 | f->f_flags); | |
f7433243 KT |
313 | } |
314 | ||
0f2a55d5 TH |
315 | /** |
316 | * tomoyo_file_ioctl - Target for security_file_ioctl(). | |
317 | * | |
318 | * @file: Pointer to "struct file". | |
319 | * @cmd: Command for ioctl(). | |
320 | * @arg: Argument for @cmd. | |
321 | * | |
322 | * Returns 0 on success, negative value otherwise. | |
323 | */ | |
937bf613 TH |
324 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
325 | unsigned long arg) | |
326 | { | |
a1f9bb6a | 327 | return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); |
937bf613 TH |
328 | } |
329 | ||
0f2a55d5 TH |
330 | /** |
331 | * tomoyo_path_chmod - Target for security_path_chmod(). | |
332 | * | |
cdcf116d AV |
333 | * @path: Pointer to "struct path". |
334 | * @mode: DAC permission mode. | |
0f2a55d5 TH |
335 | * |
336 | * Returns 0 on success, negative value otherwise. | |
337 | */ | |
be01f9f2 | 338 | static int tomoyo_path_chmod(const struct path *path, umode_t mode) |
937bf613 | 339 | { |
cdcf116d | 340 | return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, |
a1f9bb6a | 341 | mode & S_IALLUGO); |
937bf613 TH |
342 | } |
343 | ||
0f2a55d5 TH |
344 | /** |
345 | * tomoyo_path_chown - Target for security_path_chown(). | |
346 | * | |
347 | * @path: Pointer to "struct path". | |
348 | * @uid: Owner ID. | |
349 | * @gid: Group ID. | |
350 | * | |
351 | * Returns 0 on success, negative value otherwise. | |
352 | */ | |
7fd25dac | 353 | static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) |
937bf613 TH |
354 | { |
355 | int error = 0; | |
cdcf6723 | 356 | |
d2b31ca6 EB |
357 | if (uid_valid(uid)) |
358 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, | |
359 | from_kuid(&init_user_ns, uid)); | |
360 | if (!error && gid_valid(gid)) | |
361 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, | |
362 | from_kgid(&init_user_ns, gid)); | |
937bf613 TH |
363 | return error; |
364 | } | |
365 | ||
0f2a55d5 TH |
366 | /** |
367 | * tomoyo_path_chroot - Target for security_path_chroot(). | |
368 | * | |
369 | * @path: Pointer to "struct path". | |
370 | * | |
371 | * Returns 0 on success, negative value otherwise. | |
372 | */ | |
77b286c0 | 373 | static int tomoyo_path_chroot(const struct path *path) |
937bf613 | 374 | { |
97fb35e4 | 375 | return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); |
937bf613 TH |
376 | } |
377 | ||
0f2a55d5 TH |
378 | /** |
379 | * tomoyo_sb_mount - Target for security_sb_mount(). | |
380 | * | |
381 | * @dev_name: Name of device file. Maybe NULL. | |
382 | * @path: Pointer to "struct path". | |
383 | * @type: Name of filesystem type. Maybe NULL. | |
384 | * @flags: Mount options. | |
385 | * @data: Optional data. Maybe NULL. | |
386 | * | |
387 | * Returns 0 on success, negative value otherwise. | |
388 | */ | |
8a04c43b | 389 | static int tomoyo_sb_mount(const char *dev_name, const struct path *path, |
808d4e3c | 390 | const char *type, unsigned long flags, void *data) |
937bf613 | 391 | { |
2106ccd9 | 392 | return tomoyo_mount_permission(dev_name, path, type, flags, data); |
937bf613 TH |
393 | } |
394 | ||
0f2a55d5 TH |
395 | /** |
396 | * tomoyo_sb_umount - Target for security_sb_umount(). | |
397 | * | |
398 | * @mnt: Pointer to "struct vfsmount". | |
399 | * @flags: Unmount options. | |
400 | * | |
401 | * Returns 0 on success, negative value otherwise. | |
402 | */ | |
937bf613 TH |
403 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
404 | { | |
8291798d | 405 | struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; |
cdcf6723 | 406 | |
97fb35e4 | 407 | return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); |
937bf613 TH |
408 | } |
409 | ||
0f2a55d5 TH |
410 | /** |
411 | * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). | |
412 | * | |
413 | * @old_path: Pointer to "struct path". | |
414 | * @new_path: Pointer to "struct path". | |
415 | * | |
416 | * Returns 0 on success, negative value otherwise. | |
417 | */ | |
3b73b68c | 418 | static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) |
937bf613 | 419 | { |
97d6931e | 420 | return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); |
937bf613 TH |
421 | } |
422 | ||
059d84db TH |
423 | /** |
424 | * tomoyo_socket_listen - Check permission for listen(). | |
425 | * | |
426 | * @sock: Pointer to "struct socket". | |
427 | * @backlog: Backlog parameter. | |
428 | * | |
429 | * Returns 0 on success, negative value otherwise. | |
430 | */ | |
431 | static int tomoyo_socket_listen(struct socket *sock, int backlog) | |
432 | { | |
433 | return tomoyo_socket_listen_permission(sock); | |
434 | } | |
435 | ||
436 | /** | |
437 | * tomoyo_socket_connect - Check permission for connect(). | |
438 | * | |
439 | * @sock: Pointer to "struct socket". | |
440 | * @addr: Pointer to "struct sockaddr". | |
441 | * @addr_len: Size of @addr. | |
442 | * | |
443 | * Returns 0 on success, negative value otherwise. | |
444 | */ | |
445 | static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, | |
446 | int addr_len) | |
447 | { | |
448 | return tomoyo_socket_connect_permission(sock, addr, addr_len); | |
449 | } | |
450 | ||
451 | /** | |
452 | * tomoyo_socket_bind - Check permission for bind(). | |
453 | * | |
454 | * @sock: Pointer to "struct socket". | |
455 | * @addr: Pointer to "struct sockaddr". | |
456 | * @addr_len: Size of @addr. | |
457 | * | |
458 | * Returns 0 on success, negative value otherwise. | |
459 | */ | |
460 | static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, | |
461 | int addr_len) | |
462 | { | |
463 | return tomoyo_socket_bind_permission(sock, addr, addr_len); | |
464 | } | |
465 | ||
466 | /** | |
467 | * tomoyo_socket_sendmsg - Check permission for sendmsg(). | |
468 | * | |
469 | * @sock: Pointer to "struct socket". | |
470 | * @msg: Pointer to "struct msghdr". | |
471 | * @size: Size of message. | |
472 | * | |
473 | * Returns 0 on success, negative value otherwise. | |
474 | */ | |
475 | static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, | |
476 | int size) | |
477 | { | |
478 | return tomoyo_socket_sendmsg_permission(sock, msg, size); | |
479 | } | |
480 | ||
bbd3662a | 481 | struct lsm_blob_sizes tomoyo_blob_sizes __lsm_ro_after_init = { |
8c6cb983 | 482 | .lbs_task = sizeof(struct tomoyo_task), |
bbd3662a CS |
483 | }; |
484 | ||
8c6cb983 TH |
485 | /** |
486 | * tomoyo_task_alloc - Target for security_task_alloc(). | |
487 | * | |
98eaa63e C |
488 | * @task: Pointer to "struct task_struct". |
489 | * @clone_flags: clone() flags. | |
8c6cb983 TH |
490 | * |
491 | * Returns 0. | |
492 | */ | |
493 | static int tomoyo_task_alloc(struct task_struct *task, | |
494 | unsigned long clone_flags) | |
495 | { | |
496 | struct tomoyo_task *old = tomoyo_task(current); | |
497 | struct tomoyo_task *new = tomoyo_task(task); | |
498 | ||
499 | new->domain_info = old->domain_info; | |
500 | atomic_inc(&new->domain_info->users); | |
501 | new->old_domain_info = NULL; | |
502 | return 0; | |
503 | } | |
504 | ||
505 | /** | |
506 | * tomoyo_task_free - Target for security_task_free(). | |
507 | * | |
508 | * @task: Pointer to "struct task_struct". | |
509 | */ | |
510 | static void tomoyo_task_free(struct task_struct *task) | |
511 | { | |
512 | struct tomoyo_task *s = tomoyo_task(task); | |
513 | ||
514 | if (s->domain_info) { | |
515 | atomic_dec(&s->domain_info->users); | |
516 | s->domain_info = NULL; | |
517 | } | |
518 | if (s->old_domain_info) { | |
519 | atomic_dec(&s->old_domain_info->users); | |
520 | s->old_domain_info = NULL; | |
521 | } | |
522 | } | |
523 | ||
f17b27a2 CS |
524 | static struct lsm_id tomoyo_lsmid __lsm_ro_after_init = { |
525 | .lsm = "tomoyo", | |
526 | .slot = LSMBLOB_NOT_NEEDED | |
527 | }; | |
528 | ||
c3fa109a TH |
529 | /* |
530 | * tomoyo_security_ops is a "struct security_operations" which is used for | |
531 | * registering TOMOYO. | |
532 | */ | |
ca97d939 | 533 | static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = { |
e20b043a | 534 | LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), |
8c6cb983 TH |
535 | LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), |
536 | LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), | |
537 | LSM_HOOK_INIT(task_free, tomoyo_task_free), | |
538 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER | |
b8bff599 | 539 | LSM_HOOK_INIT(bprm_creds_for_exec, tomoyo_bprm_creds_for_exec), |
8c6cb983 | 540 | #endif |
e20b043a CS |
541 | LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), |
542 | LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), | |
543 | LSM_HOOK_INIT(file_open, tomoyo_file_open), | |
544 | LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), | |
545 | LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), | |
546 | LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), | |
547 | LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), | |
548 | LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), | |
549 | LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), | |
550 | LSM_HOOK_INIT(path_link, tomoyo_path_link), | |
551 | LSM_HOOK_INIT(path_rename, tomoyo_path_rename), | |
552 | LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), | |
553 | LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), | |
554 | LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), | |
555 | LSM_HOOK_INIT(path_chown, tomoyo_path_chown), | |
556 | LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), | |
557 | LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), | |
558 | LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), | |
559 | LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), | |
560 | LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), | |
561 | LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), | |
562 | LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), | |
563 | LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), | |
f7433243 KT |
564 | }; |
565 | ||
fdb8ebb7 | 566 | /* Lock for GC. */ |
505f14f7 | 567 | DEFINE_SRCU(tomoyo_ss); |
fdb8ebb7 | 568 | |
43fc4609 CS |
569 | int tomoyo_enabled __lsm_ro_after_init = 1; |
570 | ||
0f2a55d5 TH |
571 | /** |
572 | * tomoyo_init - Register TOMOYO Linux as a LSM module. | |
573 | * | |
574 | * Returns 0. | |
575 | */ | |
f7433243 KT |
576 | static int __init tomoyo_init(void) |
577 | { | |
8c6cb983 | 578 | struct tomoyo_task *s = tomoyo_task(current); |
f7433243 | 579 | |
f7433243 | 580 | /* register ourselves with the security framework */ |
f17b27a2 CS |
581 | security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), |
582 | &tomoyo_lsmid); | |
cdcf6723 | 583 | pr_info("TOMOYO Linux initialized\n"); |
8c6cb983 TH |
584 | s->domain_info = &tomoyo_kernel_domain; |
585 | atomic_inc(&tomoyo_kernel_domain.users); | |
586 | s->old_domain_info = NULL; | |
c3ef1500 | 587 | tomoyo_mm_init(); |
43fc4609 | 588 | |
f7433243 KT |
589 | return 0; |
590 | } | |
591 | ||
3d6e5f6d | 592 | DEFINE_LSM(tomoyo) = { |
07aed2f2 | 593 | .name = "tomoyo", |
43fc4609 | 594 | .enabled = &tomoyo_enabled, |
a5e2fe7e | 595 | .flags = LSM_FLAG_LEGACY_MAJOR, |
bbd3662a | 596 | .blobs = &tomoyo_blob_sizes, |
3d6e5f6d KC |
597 | .init = tomoyo_init, |
598 | }; |