1 // SPDX-License-Identifier: GPL-2.0
3 * security/tomoyo/securityfs_if.c
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
8 #include <linux/security.h>
12 * tomoyo_check_task_acl - Check permission for task operation.
14 * @r: Pointer to "struct tomoyo_request_info".
15 * @ptr: Pointer to "struct tomoyo_acl_info".
17 * Returns true if granted, false otherwise.
19 static bool tomoyo_check_task_acl(struct tomoyo_request_info
*r
,
20 const struct tomoyo_acl_info
*ptr
)
22 const struct tomoyo_task_acl
*acl
= container_of(ptr
, typeof(*acl
),
24 return !tomoyo_pathcmp(r
->param
.task
.domainname
, acl
->domainname
);
28 * tomoyo_write_self - write() for /sys/kernel/security/tomoyo/self_domain interface.
30 * @file: Pointer to "struct file".
31 * @buf: Domainname to transit to.
32 * @count: Size of @buf.
35 * Returns @count on success, negative value otherwise.
37 * If domain transition was permitted but the domain transition failed, this
38 * function returns error rather than terminating current thread with SIGKILL.
40 static ssize_t
tomoyo_write_self(struct file
*file
, const char __user
*buf
,
41 size_t count
, loff_t
*ppos
)
45 if (!count
|| count
>= TOMOYO_EXEC_TMPSIZE
- 10)
47 data
= memdup_user_nul(buf
, count
);
50 tomoyo_normalize_line(data
);
51 if (tomoyo_correct_domain(data
)) {
52 const int idx
= tomoyo_read_lock();
53 struct tomoyo_path_info name
;
54 struct tomoyo_request_info r
;
56 tomoyo_fill_path_info(&name
);
57 /* Check "task manual_domain_transition" permission. */
58 tomoyo_init_request_info(&r
, NULL
, TOMOYO_MAC_FILE_EXECUTE
);
59 r
.param_type
= TOMOYO_TYPE_MANUAL_TASK_ACL
;
60 r
.param
.task
.domainname
= &name
;
61 tomoyo_check_acl(&r
, tomoyo_check_task_acl
);
65 struct tomoyo_domain_info
*new_domain
=
66 tomoyo_assign_domain(data
, true);
70 struct cred
*cred
= prepare_creds();
74 struct tomoyo_domain_info
**blob
;
75 struct tomoyo_domain_info
*old_domain
;
77 blob
= tomoyo_cred(cred
);
80 atomic_inc(&new_domain
->users
);
81 atomic_dec(&old_domain
->users
);
87 tomoyo_read_unlock(idx
);
91 return error
? error
: count
;
95 * tomoyo_read_self - read() for /sys/kernel/security/tomoyo/self_domain interface.
97 * @file: Pointer to "struct file".
98 * @buf: Domainname which current thread belongs to.
99 * @count: Size of @buf.
100 * @ppos: Bytes read by now.
102 * Returns read size on success, negative value otherwise.
104 static ssize_t
tomoyo_read_self(struct file
*file
, char __user
*buf
,
105 size_t count
, loff_t
*ppos
)
107 const char *domain
= tomoyo_domain()->domainname
->name
;
108 loff_t len
= strlen(domain
);
110 if (pos
>= len
|| !count
)
115 if (copy_to_user(buf
, domain
+ pos
, len
))
121 /* Operations for /sys/kernel/security/tomoyo/self_domain interface. */
122 static const struct file_operations tomoyo_self_operations
= {
123 .write
= tomoyo_write_self
,
124 .read
= tomoyo_read_self
,
128 * tomoyo_open - open() for /sys/kernel/security/tomoyo/ interface.
130 * @inode: Pointer to "struct inode".
131 * @file: Pointer to "struct file".
133 * Returns 0 on success, negative value otherwise.
135 static int tomoyo_open(struct inode
*inode
, struct file
*file
)
137 const int key
= ((u8
*) file_inode(file
)->i_private
)
139 return tomoyo_open_control(key
, file
);
143 * tomoyo_release - close() for /sys/kernel/security/tomoyo/ interface.
145 * @file: Pointer to "struct file".
148 static int tomoyo_release(struct inode
*inode
, struct file
*file
)
150 tomoyo_close_control(file
->private_data
);
155 * tomoyo_poll - poll() for /sys/kernel/security/tomoyo/ interface.
157 * @file: Pointer to "struct file".
158 * @wait: Pointer to "poll_table". Maybe NULL.
160 * Returns POLLIN | POLLRDNORM | POLLOUT | POLLWRNORM if ready to read/write,
161 * POLLOUT | POLLWRNORM otherwise.
163 static unsigned int tomoyo_poll(struct file
*file
, poll_table
*wait
)
165 return tomoyo_poll_control(file
, wait
);
169 * tomoyo_read - read() for /sys/kernel/security/tomoyo/ interface.
171 * @file: Pointer to "struct file".
172 * @buf: Pointer to buffer.
173 * @count: Size of @buf.
176 * Returns bytes read on success, negative value otherwise.
178 static ssize_t
tomoyo_read(struct file
*file
, char __user
*buf
, size_t count
,
181 return tomoyo_read_control(file
->private_data
, buf
, count
);
185 * tomoyo_write - write() for /sys/kernel/security/tomoyo/ interface.
187 * @file: Pointer to "struct file".
188 * @buf: Pointer to buffer.
189 * @count: Size of @buf.
192 * Returns @count on success, negative value otherwise.
194 static ssize_t
tomoyo_write(struct file
*file
, const char __user
*buf
,
195 size_t count
, loff_t
*ppos
)
197 return tomoyo_write_control(file
->private_data
, buf
, count
);
201 * tomoyo_operations is a "struct file_operations" which is used for handling
202 * /sys/kernel/security/tomoyo/ interface.
204 * Some files under /sys/kernel/security/tomoyo/ directory accept open(O_RDWR).
205 * See tomoyo_io_buffer for internals.
207 static const struct file_operations tomoyo_operations
= {
209 .release
= tomoyo_release
,
212 .write
= tomoyo_write
,
213 .llseek
= noop_llseek
,
217 * tomoyo_create_entry - Create interface files under /sys/kernel/security/tomoyo/ directory.
219 * @name: The name of the interface file.
220 * @mode: The permission of the interface file.
221 * @parent: The parent directory.
222 * @key: Type of interface.
226 static void __init
tomoyo_create_entry(const char *name
, const umode_t mode
,
227 struct dentry
*parent
, const u8 key
)
229 securityfs_create_file(name
, mode
, parent
, ((u8
*) NULL
) + key
,
234 * tomoyo_initerface_init - Initialize /sys/kernel/security/tomoyo/ interface.
238 static int __init
tomoyo_initerface_init(void)
240 struct tomoyo_domain_info
*domain
;
241 struct dentry
*tomoyo_dir
;
245 domain
= tomoyo_domain();
246 /* Don't create securityfs entries unless registered. */
247 if (domain
!= &tomoyo_kernel_domain
)
250 tomoyo_dir
= securityfs_create_dir("tomoyo", NULL
);
251 tomoyo_create_entry("query", 0600, tomoyo_dir
,
253 tomoyo_create_entry("domain_policy", 0600, tomoyo_dir
,
254 TOMOYO_DOMAINPOLICY
);
255 tomoyo_create_entry("exception_policy", 0600, tomoyo_dir
,
256 TOMOYO_EXCEPTIONPOLICY
);
257 tomoyo_create_entry("audit", 0400, tomoyo_dir
,
259 tomoyo_create_entry(".process_status", 0600, tomoyo_dir
,
260 TOMOYO_PROCESS_STATUS
);
261 tomoyo_create_entry("stat", 0644, tomoyo_dir
,
263 tomoyo_create_entry("profile", 0600, tomoyo_dir
,
265 tomoyo_create_entry("manager", 0600, tomoyo_dir
,
267 tomoyo_create_entry("version", 0400, tomoyo_dir
,
269 securityfs_create_file("self_domain", 0666, tomoyo_dir
, NULL
,
270 &tomoyo_self_operations
);
271 tomoyo_load_builtin_policy();
275 fs_initcall(tomoyo_initerface_init
);