TOMOYO: Add built-in policy support.

To be able to start using enforcing mode from the early stage of boot sequence,
this patch adds support for built-in policy configuration (and next patch adds
support for activating access control without calling external policy loader
program).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>

diff --git a/security/tomoyo/Makefile b/security/tomoyo/Makefile
index b13f7f9fbb52affff7f2b26066cd7425967db114..04f676a940aedb9a0ae90f95f8a07baff6b10885 100644 (file)
--- a/security/tomoyo/Makefile
+++ b/security/tomoyo/Makefile
@@ -1 +1,48 @@
 obj-y = audit.o common.o domain.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o
+
+$(obj)/policy/profile.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/profile.conf
+       @touch $@
+
+$(obj)/policy/exception_policy.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating a default policy/exception_policy.conf
+       @echo initialize_domain /sbin/modprobe from any >> $@
+       @echo initialize_domain /sbin/hotplug from any >> $@
+
+$(obj)/policy/domain_policy.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/domain_policy.conf
+       @touch $@
+
+$(obj)/policy/manager.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/manager.conf
+       @touch $@
+
+$(obj)/policy/stat.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/stat.conf
+       @touch $@
+
+$(obj)/builtin-policy.h: $(obj)/policy/profile.conf $(obj)/policy/exception_policy.conf $(obj)/policy/domain_policy.conf $(obj)/policy/manager.conf $(obj)/policy/stat.conf
+       @echo Generating built-in policy for TOMOYO 2.4.x.
+       @echo "static char tomoyo_builtin_profile[] __initdata =" > $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/profile.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_exception_policy[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/exception_policy.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_domain_policy[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/domain_policy.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_manager[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/manager.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_stat[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/stat.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @mv $@.tmp $@
+
+$(obj)/common.o: $(obj)/builtin-policy.h

diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 7bc0d1d958675282bb1a38a9a9861a666dd62926..01e60ad68b3ade5f0778e0feb6a9eee7015ec82f 100644 (file)
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -2361,3 +2361,63 @@ void tomoyo_check_profile(void)
        tomoyo_read_unlock(idx);
        printk(KERN_INFO "Mandatory Access Control activated.\n");
 }
+
+/**
+ * tomoyo_load_builtin_policy - Load built-in policy.
+ *
+ * Returns nothing.
+ */
+void __init tomoyo_load_builtin_policy(void)
+{
+       /*
+        * This include file is manually created and contains built-in policy
+        * named "tomoyo_builtin_profile", "tomoyo_builtin_exception_policy",
+        * "tomoyo_builtin_domain_policy", "tomoyo_builtin_manager",
+        * "tomoyo_builtin_stat" in the form of "static char [] __initdata".
+        */
+#include "builtin-policy.h"
+       u8 i;
+       const int idx = tomoyo_read_lock();
+       for (i = 0; i < 5; i++) {
+               struct tomoyo_io_buffer head = { };
+               char *start = "";
+               switch (i) {
+               case 0:
+                       start = tomoyo_builtin_profile;
+                       head.type = TOMOYO_PROFILE;
+                       head.write = tomoyo_write_profile;
+                       break;
+               case 1:
+                       start = tomoyo_builtin_exception_policy;
+                       head.type = TOMOYO_EXCEPTIONPOLICY;
+                       head.write = tomoyo_write_exception;
+                       break;
+               case 2:
+                       start = tomoyo_builtin_domain_policy;
+                       head.type = TOMOYO_DOMAINPOLICY;
+                       head.write = tomoyo_write_domain;
+                       break;
+               case 3:
+                       start = tomoyo_builtin_manager;
+                       head.type = TOMOYO_MANAGER;
+                       head.write = tomoyo_write_manager;
+                       break;
+               case 4:
+                       start = tomoyo_builtin_stat;
+                       head.type = TOMOYO_STAT;
+                       head.write = tomoyo_write_stat;
+                       break;
+               }
+               while (1) {
+                       char *end = strchr(start, '\n');
+                       if (!end)
+                               break;
+                       *end = '\0';
+                       tomoyo_normalize_line(start);
+                       head.write_buf = start;
+                       tomoyo_parse_policy(&head, start);
+                       start = end + 1;
+               }
+       }
+       tomoyo_read_unlock(idx);
+}

diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index 7984a0ed548b483177d8a08d19411f669c9d7705..a15fe29740a4246b48f262cb20030a2b8b0cd133 100644 (file)
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -662,6 +662,7 @@ const struct tomoyo_path_info *tomoyo_get_name(const char *name);
 void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp);
 void tomoyo_update_stat(const u8 index);
 void __init tomoyo_mm_init(void);
+void __init tomoyo_load_builtin_policy(void);
 int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
                           const struct tomoyo_path_info *filename);
 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,

diff --git a/security/tomoyo/memory.c b/security/tomoyo/memory.c
index 78b6143068de2cb1031b3020bd4c2488deebe9b3..46538ce47d72c4bd58d367e670dab398112e03ad 100644 (file)
--- a/security/tomoyo/memory.c
+++ b/security/tomoyo/memory.c
@@ -215,14 +215,4 @@ void __init tomoyo_mm_init(void)
        INIT_LIST_HEAD(&tomoyo_kernel_domain.acl_info_list);
        tomoyo_kernel_domain.domainname = tomoyo_get_name("<kernel>");
        list_add_tail_rcu(&tomoyo_kernel_domain.list, &tomoyo_domain_list);
-#if 0
-       /* Will be replaced with tomoyo_load_builtin_policy(). */
-       {
-               /* Load built-in policy. */
-               tomoyo_write_transition_control("/sbin/hotplug", false,
-                                       TOMOYO_TRANSITION_CONTROL_INITIALIZE);
-               tomoyo_write_transition_control("/sbin/modprobe", false,
-                                       TOMOYO_TRANSITION_CONTROL_INITIALIZE);
-       }
-#endif
 }