]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
f7433243 KT |
2 | /* |
3 | * security/tomoyo/tomoyo.c | |
4 | * | |
0f2a55d5 | 5 | * Copyright (C) 2005-2011 NTT DATA CORPORATION |
f7433243 KT |
6 | */ |
7 | ||
3c4ed7bd | 8 | #include <linux/lsm_hooks.h> |
f7433243 | 9 | #include "common.h" |
f7433243 | 10 | |
0f2a55d5 TH |
11 | /** |
12 | * tomoyo_cred_alloc_blank - Target for security_cred_alloc_blank(). | |
13 | * | |
14 | * @new: Pointer to "struct cred". | |
15 | * @gfp: Memory allocation flags. | |
16 | * | |
17 | * Returns 0. | |
18 | */ | |
ee18d64c DH |
19 | static int tomoyo_cred_alloc_blank(struct cred *new, gfp_t gfp) |
20 | { | |
f1efc8c4 CS |
21 | struct tomoyo_domain_info **blob = tomoyo_cred(new); |
22 | ||
23 | *blob = NULL; | |
ee18d64c DH |
24 | return 0; |
25 | } | |
26 | ||
0f2a55d5 TH |
27 | /** |
28 | * tomoyo_cred_prepare - Target for security_prepare_creds(). | |
29 | * | |
30 | * @new: Pointer to "struct cred". | |
31 | * @old: Pointer to "struct cred". | |
32 | * @gfp: Memory allocation flags. | |
33 | * | |
34 | * Returns 0. | |
35 | */ | |
f7433243 KT |
36 | static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, |
37 | gfp_t gfp) | |
38 | { | |
f1efc8c4 CS |
39 | struct tomoyo_domain_info **old_blob = tomoyo_cred(old); |
40 | struct tomoyo_domain_info **new_blob = tomoyo_cred(new); | |
41 | struct tomoyo_domain_info *domain; | |
42 | ||
43 | domain = *old_blob; | |
44 | *new_blob = domain; | |
45 | ||
ec8e6a4e TH |
46 | if (domain) |
47 | atomic_inc(&domain->users); | |
f7433243 KT |
48 | return 0; |
49 | } | |
50 | ||
0f2a55d5 TH |
51 | /** |
52 | * tomoyo_cred_transfer - Target for security_transfer_creds(). | |
53 | * | |
54 | * @new: Pointer to "struct cred". | |
55 | * @old: Pointer to "struct cred". | |
56 | */ | |
ee18d64c DH |
57 | static void tomoyo_cred_transfer(struct cred *new, const struct cred *old) |
58 | { | |
ec8e6a4e TH |
59 | tomoyo_cred_prepare(new, old, 0); |
60 | } | |
61 | ||
0f2a55d5 TH |
62 | /** |
63 | * tomoyo_cred_free - Target for security_cred_free(). | |
64 | * | |
65 | * @cred: Pointer to "struct cred". | |
66 | */ | |
ec8e6a4e TH |
67 | static void tomoyo_cred_free(struct cred *cred) |
68 | { | |
f1efc8c4 CS |
69 | struct tomoyo_domain_info **blob = tomoyo_cred(cred); |
70 | struct tomoyo_domain_info *domain = *blob; | |
71 | ||
ec8e6a4e TH |
72 | if (domain) |
73 | atomic_dec(&domain->users); | |
ee18d64c DH |
74 | } |
75 | ||
0f2a55d5 TH |
76 | /** |
77 | * tomoyo_bprm_set_creds - Target for security_bprm_set_creds(). | |
78 | * | |
79 | * @bprm: Pointer to "struct linux_binprm". | |
80 | * | |
81 | * Returns 0 on success, negative value otherwise. | |
82 | */ | |
f7433243 KT |
83 | static int tomoyo_bprm_set_creds(struct linux_binprm *bprm) |
84 | { | |
f1efc8c4 CS |
85 | struct tomoyo_domain_info **blob; |
86 | struct tomoyo_domain_info *domain; | |
87 | ||
f7433243 KT |
88 | /* |
89 | * Do only if this function is called for the first time of an execve | |
90 | * operation. | |
91 | */ | |
ddb4a144 | 92 | if (bprm->called_set_creds) |
f7433243 | 93 | return 0; |
7986cf28 | 94 | #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER |
f7433243 KT |
95 | /* |
96 | * Load policy if /sbin/tomoyo-init exists and /sbin/init is requested | |
97 | * for the first time. | |
98 | */ | |
99 | if (!tomoyo_policy_loaded) | |
100 | tomoyo_load_policy(bprm->filename); | |
7986cf28 | 101 | #endif |
ec8e6a4e TH |
102 | /* |
103 | * Release reference to "struct tomoyo_domain_info" stored inside | |
104 | * "bprm->cred->security". New reference to "struct tomoyo_domain_info" | |
105 | * stored inside "bprm->cred->security" will be acquired later inside | |
106 | * tomoyo_find_next_domain(). | |
107 | */ | |
f1efc8c4 CS |
108 | blob = tomoyo_cred(bprm->cred); |
109 | domain = *blob; | |
110 | atomic_dec(&domain->users); | |
f7433243 KT |
111 | /* |
112 | * Tell tomoyo_bprm_check_security() is called for the first time of an | |
113 | * execve operation. | |
114 | */ | |
f1efc8c4 | 115 | *blob = NULL; |
f7433243 KT |
116 | return 0; |
117 | } | |
118 | ||
0f2a55d5 TH |
119 | /** |
120 | * tomoyo_bprm_check_security - Target for security_bprm_check(). | |
121 | * | |
122 | * @bprm: Pointer to "struct linux_binprm". | |
123 | * | |
124 | * Returns 0 on success, negative value otherwise. | |
125 | */ | |
f7433243 KT |
126 | static int tomoyo_bprm_check_security(struct linux_binprm *bprm) |
127 | { | |
f1efc8c4 CS |
128 | struct tomoyo_domain_info **blob; |
129 | struct tomoyo_domain_info *domain; | |
f7433243 | 130 | |
f1efc8c4 CS |
131 | blob = tomoyo_cred(bprm->cred); |
132 | domain = *blob; | |
f7433243 KT |
133 | /* |
134 | * Execute permission is checked against pathname passed to do_execve() | |
135 | * using current domain. | |
136 | */ | |
fdb8ebb7 | 137 | if (!domain) { |
fdb8ebb7 TH |
138 | const int idx = tomoyo_read_lock(); |
139 | const int err = tomoyo_find_next_domain(bprm); | |
140 | tomoyo_read_unlock(idx); | |
141 | return err; | |
142 | } | |
f7433243 KT |
143 | /* |
144 | * Read permission is checked against interpreters using next domain. | |
f7433243 | 145 | */ |
0f2a55d5 TH |
146 | return tomoyo_check_open_permission(domain, &bprm->file->f_path, |
147 | O_RDONLY); | |
f7433243 KT |
148 | } |
149 | ||
0f2a55d5 TH |
150 | /** |
151 | * tomoyo_inode_getattr - Target for security_inode_getattr(). | |
152 | * | |
153 | * @mnt: Pointer to "struct vfsmount". | |
154 | * @dentry: Pointer to "struct dentry". | |
155 | * | |
156 | * Returns 0 on success, negative value otherwise. | |
157 | */ | |
3f7036a0 | 158 | static int tomoyo_inode_getattr(const struct path *path) |
7c75964f | 159 | { |
3f7036a0 | 160 | return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL); |
7c75964f TH |
161 | } |
162 | ||
0f2a55d5 TH |
163 | /** |
164 | * tomoyo_path_truncate - Target for security_path_truncate(). | |
165 | * | |
166 | * @path: Pointer to "struct path". | |
167 | * | |
168 | * Returns 0 on success, negative value otherwise. | |
169 | */ | |
81f4c506 | 170 | static int tomoyo_path_truncate(const struct path *path) |
f7433243 | 171 | { |
97fb35e4 | 172 | return tomoyo_path_perm(TOMOYO_TYPE_TRUNCATE, path, NULL); |
f7433243 KT |
173 | } |
174 | ||
0f2a55d5 TH |
175 | /** |
176 | * tomoyo_path_unlink - Target for security_path_unlink(). | |
177 | * | |
178 | * @parent: Pointer to "struct path". | |
179 | * @dentry: Pointer to "struct dentry". | |
180 | * | |
181 | * Returns 0 on success, negative value otherwise. | |
182 | */ | |
989f74e0 | 183 | static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) |
f7433243 | 184 | { |
8291798d | 185 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 186 | return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); |
f7433243 KT |
187 | } |
188 | ||
0f2a55d5 TH |
189 | /** |
190 | * tomoyo_path_mkdir - Target for security_path_mkdir(). | |
191 | * | |
192 | * @parent: Pointer to "struct path". | |
193 | * @dentry: Pointer to "struct dentry". | |
194 | * @mode: DAC permission mode. | |
195 | * | |
196 | * Returns 0 on success, negative value otherwise. | |
197 | */ | |
d3607752 | 198 | static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry, |
4572befe | 199 | umode_t mode) |
f7433243 | 200 | { |
8291798d | 201 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
a1f9bb6a TH |
202 | return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, |
203 | mode & S_IALLUGO); | |
f7433243 KT |
204 | } |
205 | ||
0f2a55d5 TH |
206 | /** |
207 | * tomoyo_path_rmdir - Target for security_path_rmdir(). | |
208 | * | |
209 | * @parent: Pointer to "struct path". | |
210 | * @dentry: Pointer to "struct dentry". | |
211 | * | |
212 | * Returns 0 on success, negative value otherwise. | |
213 | */ | |
989f74e0 | 214 | static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) |
f7433243 | 215 | { |
8291798d | 216 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 217 | return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); |
f7433243 KT |
218 | } |
219 | ||
0f2a55d5 TH |
220 | /** |
221 | * tomoyo_path_symlink - Target for security_path_symlink(). | |
222 | * | |
223 | * @parent: Pointer to "struct path". | |
224 | * @dentry: Pointer to "struct dentry". | |
225 | * @old_name: Symlink's content. | |
226 | * | |
227 | * Returns 0 on success, negative value otherwise. | |
228 | */ | |
d3607752 | 229 | static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry, |
f7433243 KT |
230 | const char *old_name) |
231 | { | |
8291798d | 232 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
97fb35e4 | 233 | return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); |
f7433243 KT |
234 | } |
235 | ||
0f2a55d5 TH |
236 | /** |
237 | * tomoyo_path_mknod - Target for security_path_mknod(). | |
238 | * | |
239 | * @parent: Pointer to "struct path". | |
240 | * @dentry: Pointer to "struct dentry". | |
241 | * @mode: DAC permission mode. | |
242 | * @dev: Device attributes. | |
243 | * | |
244 | * Returns 0 on success, negative value otherwise. | |
245 | */ | |
d3607752 | 246 | static int tomoyo_path_mknod(const struct path *parent, struct dentry *dentry, |
04fc66e7 | 247 | umode_t mode, unsigned int dev) |
f7433243 | 248 | { |
8291798d | 249 | struct path path = { .mnt = parent->mnt, .dentry = dentry }; |
7ef61233 | 250 | int type = TOMOYO_TYPE_CREATE; |
a1f9bb6a | 251 | const unsigned int perm = mode & S_IALLUGO; |
f7433243 KT |
252 | |
253 | switch (mode & S_IFMT) { | |
254 | case S_IFCHR: | |
7ef61233 | 255 | type = TOMOYO_TYPE_MKCHAR; |
f7433243 KT |
256 | break; |
257 | case S_IFBLK: | |
7ef61233 | 258 | type = TOMOYO_TYPE_MKBLOCK; |
f7433243 | 259 | break; |
a1f9bb6a TH |
260 | default: |
261 | goto no_dev; | |
262 | } | |
75093152 | 263 | return tomoyo_mkdev_perm(type, &path, perm, dev); |
a1f9bb6a TH |
264 | no_dev: |
265 | switch (mode & S_IFMT) { | |
f7433243 | 266 | case S_IFIFO: |
7ef61233 | 267 | type = TOMOYO_TYPE_MKFIFO; |
f7433243 KT |
268 | break; |
269 | case S_IFSOCK: | |
7ef61233 | 270 | type = TOMOYO_TYPE_MKSOCK; |
f7433243 KT |
271 | break; |
272 | } | |
a1f9bb6a | 273 | return tomoyo_path_number_perm(type, &path, perm); |
f7433243 KT |
274 | } |
275 | ||
0f2a55d5 TH |
276 | /** |
277 | * tomoyo_path_link - Target for security_path_link(). | |
278 | * | |
279 | * @old_dentry: Pointer to "struct dentry". | |
280 | * @new_dir: Pointer to "struct path". | |
281 | * @new_dentry: Pointer to "struct dentry". | |
282 | * | |
283 | * Returns 0 on success, negative value otherwise. | |
284 | */ | |
3ccee46a | 285 | static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_dir, |
f7433243 KT |
286 | struct dentry *new_dentry) |
287 | { | |
8291798d KC |
288 | struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; |
289 | struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; | |
97d6931e | 290 | return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); |
f7433243 KT |
291 | } |
292 | ||
0f2a55d5 TH |
293 | /** |
294 | * tomoyo_path_rename - Target for security_path_rename(). | |
295 | * | |
296 | * @old_parent: Pointer to "struct path". | |
297 | * @old_dentry: Pointer to "struct dentry". | |
298 | * @new_parent: Pointer to "struct path". | |
299 | * @new_dentry: Pointer to "struct dentry". | |
300 | * | |
301 | * Returns 0 on success, negative value otherwise. | |
302 | */ | |
3ccee46a | 303 | static int tomoyo_path_rename(const struct path *old_parent, |
f7433243 | 304 | struct dentry *old_dentry, |
3ccee46a | 305 | const struct path *new_parent, |
f7433243 KT |
306 | struct dentry *new_dentry) |
307 | { | |
8291798d KC |
308 | struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; |
309 | struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; | |
97d6931e | 310 | return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); |
f7433243 KT |
311 | } |
312 | ||
0f2a55d5 TH |
313 | /** |
314 | * tomoyo_file_fcntl - Target for security_file_fcntl(). | |
315 | * | |
316 | * @file: Pointer to "struct file". | |
317 | * @cmd: Command for fcntl(). | |
318 | * @arg: Argument for @cmd. | |
319 | * | |
320 | * Returns 0 on success, negative value otherwise. | |
321 | */ | |
f7433243 KT |
322 | static int tomoyo_file_fcntl(struct file *file, unsigned int cmd, |
323 | unsigned long arg) | |
324 | { | |
7c75964f TH |
325 | if (!(cmd == F_SETFL && ((arg ^ file->f_flags) & O_APPEND))) |
326 | return 0; | |
327 | return tomoyo_check_open_permission(tomoyo_domain(), &file->f_path, | |
328 | O_WRONLY | (arg & O_APPEND)); | |
f7433243 KT |
329 | } |
330 | ||
0f2a55d5 | 331 | /** |
83d49856 | 332 | * tomoyo_file_open - Target for security_file_open(). |
0f2a55d5 TH |
333 | * |
334 | * @f: Pointer to "struct file". | |
335 | * @cred: Pointer to "struct cred". | |
336 | * | |
337 | * Returns 0 on success, negative value otherwise. | |
338 | */ | |
83d49856 | 339 | static int tomoyo_file_open(struct file *f, const struct cred *cred) |
f7433243 KT |
340 | { |
341 | int flags = f->f_flags; | |
f7433243 KT |
342 | /* Don't check read permission here if called from do_execve(). */ |
343 | if (current->in_execve) | |
344 | return 0; | |
345 | return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags); | |
346 | } | |
347 | ||
0f2a55d5 TH |
348 | /** |
349 | * tomoyo_file_ioctl - Target for security_file_ioctl(). | |
350 | * | |
351 | * @file: Pointer to "struct file". | |
352 | * @cmd: Command for ioctl(). | |
353 | * @arg: Argument for @cmd. | |
354 | * | |
355 | * Returns 0 on success, negative value otherwise. | |
356 | */ | |
937bf613 TH |
357 | static int tomoyo_file_ioctl(struct file *file, unsigned int cmd, |
358 | unsigned long arg) | |
359 | { | |
a1f9bb6a | 360 | return tomoyo_path_number_perm(TOMOYO_TYPE_IOCTL, &file->f_path, cmd); |
937bf613 TH |
361 | } |
362 | ||
0f2a55d5 TH |
363 | /** |
364 | * tomoyo_path_chmod - Target for security_path_chmod(). | |
365 | * | |
cdcf116d AV |
366 | * @path: Pointer to "struct path". |
367 | * @mode: DAC permission mode. | |
0f2a55d5 TH |
368 | * |
369 | * Returns 0 on success, negative value otherwise. | |
370 | */ | |
be01f9f2 | 371 | static int tomoyo_path_chmod(const struct path *path, umode_t mode) |
937bf613 | 372 | { |
cdcf116d | 373 | return tomoyo_path_number_perm(TOMOYO_TYPE_CHMOD, path, |
a1f9bb6a | 374 | mode & S_IALLUGO); |
937bf613 TH |
375 | } |
376 | ||
0f2a55d5 TH |
377 | /** |
378 | * tomoyo_path_chown - Target for security_path_chown(). | |
379 | * | |
380 | * @path: Pointer to "struct path". | |
381 | * @uid: Owner ID. | |
382 | * @gid: Group ID. | |
383 | * | |
384 | * Returns 0 on success, negative value otherwise. | |
385 | */ | |
7fd25dac | 386 | static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) |
937bf613 TH |
387 | { |
388 | int error = 0; | |
d2b31ca6 EB |
389 | if (uid_valid(uid)) |
390 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, | |
391 | from_kuid(&init_user_ns, uid)); | |
392 | if (!error && gid_valid(gid)) | |
393 | error = tomoyo_path_number_perm(TOMOYO_TYPE_CHGRP, path, | |
394 | from_kgid(&init_user_ns, gid)); | |
937bf613 TH |
395 | return error; |
396 | } | |
397 | ||
0f2a55d5 TH |
398 | /** |
399 | * tomoyo_path_chroot - Target for security_path_chroot(). | |
400 | * | |
401 | * @path: Pointer to "struct path". | |
402 | * | |
403 | * Returns 0 on success, negative value otherwise. | |
404 | */ | |
77b286c0 | 405 | static int tomoyo_path_chroot(const struct path *path) |
937bf613 | 406 | { |
97fb35e4 | 407 | return tomoyo_path_perm(TOMOYO_TYPE_CHROOT, path, NULL); |
937bf613 TH |
408 | } |
409 | ||
0f2a55d5 TH |
410 | /** |
411 | * tomoyo_sb_mount - Target for security_sb_mount(). | |
412 | * | |
413 | * @dev_name: Name of device file. Maybe NULL. | |
414 | * @path: Pointer to "struct path". | |
415 | * @type: Name of filesystem type. Maybe NULL. | |
416 | * @flags: Mount options. | |
417 | * @data: Optional data. Maybe NULL. | |
418 | * | |
419 | * Returns 0 on success, negative value otherwise. | |
420 | */ | |
8a04c43b | 421 | static int tomoyo_sb_mount(const char *dev_name, const struct path *path, |
808d4e3c | 422 | const char *type, unsigned long flags, void *data) |
937bf613 | 423 | { |
2106ccd9 | 424 | return tomoyo_mount_permission(dev_name, path, type, flags, data); |
937bf613 TH |
425 | } |
426 | ||
0f2a55d5 TH |
427 | /** |
428 | * tomoyo_sb_umount - Target for security_sb_umount(). | |
429 | * | |
430 | * @mnt: Pointer to "struct vfsmount". | |
431 | * @flags: Unmount options. | |
432 | * | |
433 | * Returns 0 on success, negative value otherwise. | |
434 | */ | |
937bf613 TH |
435 | static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) |
436 | { | |
8291798d | 437 | struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; |
97fb35e4 | 438 | return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); |
937bf613 TH |
439 | } |
440 | ||
0f2a55d5 TH |
441 | /** |
442 | * tomoyo_sb_pivotroot - Target for security_sb_pivotroot(). | |
443 | * | |
444 | * @old_path: Pointer to "struct path". | |
445 | * @new_path: Pointer to "struct path". | |
446 | * | |
447 | * Returns 0 on success, negative value otherwise. | |
448 | */ | |
3b73b68c | 449 | static int tomoyo_sb_pivotroot(const struct path *old_path, const struct path *new_path) |
937bf613 | 450 | { |
97d6931e | 451 | return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path); |
937bf613 TH |
452 | } |
453 | ||
059d84db TH |
454 | /** |
455 | * tomoyo_socket_listen - Check permission for listen(). | |
456 | * | |
457 | * @sock: Pointer to "struct socket". | |
458 | * @backlog: Backlog parameter. | |
459 | * | |
460 | * Returns 0 on success, negative value otherwise. | |
461 | */ | |
462 | static int tomoyo_socket_listen(struct socket *sock, int backlog) | |
463 | { | |
464 | return tomoyo_socket_listen_permission(sock); | |
465 | } | |
466 | ||
467 | /** | |
468 | * tomoyo_socket_connect - Check permission for connect(). | |
469 | * | |
470 | * @sock: Pointer to "struct socket". | |
471 | * @addr: Pointer to "struct sockaddr". | |
472 | * @addr_len: Size of @addr. | |
473 | * | |
474 | * Returns 0 on success, negative value otherwise. | |
475 | */ | |
476 | static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr, | |
477 | int addr_len) | |
478 | { | |
479 | return tomoyo_socket_connect_permission(sock, addr, addr_len); | |
480 | } | |
481 | ||
482 | /** | |
483 | * tomoyo_socket_bind - Check permission for bind(). | |
484 | * | |
485 | * @sock: Pointer to "struct socket". | |
486 | * @addr: Pointer to "struct sockaddr". | |
487 | * @addr_len: Size of @addr. | |
488 | * | |
489 | * Returns 0 on success, negative value otherwise. | |
490 | */ | |
491 | static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr, | |
492 | int addr_len) | |
493 | { | |
494 | return tomoyo_socket_bind_permission(sock, addr, addr_len); | |
495 | } | |
496 | ||
497 | /** | |
498 | * tomoyo_socket_sendmsg - Check permission for sendmsg(). | |
499 | * | |
500 | * @sock: Pointer to "struct socket". | |
501 | * @msg: Pointer to "struct msghdr". | |
502 | * @size: Size of message. | |
503 | * | |
504 | * Returns 0 on success, negative value otherwise. | |
505 | */ | |
506 | static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg, | |
507 | int size) | |
508 | { | |
509 | return tomoyo_socket_sendmsg_permission(sock, msg, size); | |
510 | } | |
511 | ||
f1efc8c4 CS |
512 | struct lsm_blob_sizes tomoyo_blob_sizes = { |
513 | .lbs_cred = sizeof(struct tomoyo_domain_info *), | |
514 | }; | |
515 | ||
c3fa109a TH |
516 | /* |
517 | * tomoyo_security_ops is a "struct security_operations" which is used for | |
518 | * registering TOMOYO. | |
519 | */ | |
ca97d939 | 520 | static struct security_hook_list tomoyo_hooks[] __lsm_ro_after_init = { |
e20b043a CS |
521 | LSM_HOOK_INIT(cred_alloc_blank, tomoyo_cred_alloc_blank), |
522 | LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), | |
523 | LSM_HOOK_INIT(cred_transfer, tomoyo_cred_transfer), | |
524 | LSM_HOOK_INIT(cred_free, tomoyo_cred_free), | |
525 | LSM_HOOK_INIT(bprm_set_creds, tomoyo_bprm_set_creds), | |
526 | LSM_HOOK_INIT(bprm_check_security, tomoyo_bprm_check_security), | |
527 | LSM_HOOK_INIT(file_fcntl, tomoyo_file_fcntl), | |
528 | LSM_HOOK_INIT(file_open, tomoyo_file_open), | |
529 | LSM_HOOK_INIT(path_truncate, tomoyo_path_truncate), | |
530 | LSM_HOOK_INIT(path_unlink, tomoyo_path_unlink), | |
531 | LSM_HOOK_INIT(path_mkdir, tomoyo_path_mkdir), | |
532 | LSM_HOOK_INIT(path_rmdir, tomoyo_path_rmdir), | |
533 | LSM_HOOK_INIT(path_symlink, tomoyo_path_symlink), | |
534 | LSM_HOOK_INIT(path_mknod, tomoyo_path_mknod), | |
535 | LSM_HOOK_INIT(path_link, tomoyo_path_link), | |
536 | LSM_HOOK_INIT(path_rename, tomoyo_path_rename), | |
537 | LSM_HOOK_INIT(inode_getattr, tomoyo_inode_getattr), | |
538 | LSM_HOOK_INIT(file_ioctl, tomoyo_file_ioctl), | |
539 | LSM_HOOK_INIT(path_chmod, tomoyo_path_chmod), | |
540 | LSM_HOOK_INIT(path_chown, tomoyo_path_chown), | |
541 | LSM_HOOK_INIT(path_chroot, tomoyo_path_chroot), | |
542 | LSM_HOOK_INIT(sb_mount, tomoyo_sb_mount), | |
543 | LSM_HOOK_INIT(sb_umount, tomoyo_sb_umount), | |
544 | LSM_HOOK_INIT(sb_pivotroot, tomoyo_sb_pivotroot), | |
545 | LSM_HOOK_INIT(socket_bind, tomoyo_socket_bind), | |
546 | LSM_HOOK_INIT(socket_connect, tomoyo_socket_connect), | |
547 | LSM_HOOK_INIT(socket_listen, tomoyo_socket_listen), | |
548 | LSM_HOOK_INIT(socket_sendmsg, tomoyo_socket_sendmsg), | |
f7433243 KT |
549 | }; |
550 | ||
fdb8ebb7 | 551 | /* Lock for GC. */ |
505f14f7 | 552 | DEFINE_SRCU(tomoyo_ss); |
fdb8ebb7 | 553 | |
f1efc8c4 CS |
554 | bool tomoyo_enabled; |
555 | ||
0f2a55d5 TH |
556 | /** |
557 | * tomoyo_init - Register TOMOYO Linux as a LSM module. | |
558 | * | |
559 | * Returns 0. | |
560 | */ | |
f7433243 KT |
561 | static int __init tomoyo_init(void) |
562 | { | |
f1efc8c4 | 563 | static int finish; |
f7433243 | 564 | struct cred *cred = (struct cred *) current_cred(); |
f1efc8c4 CS |
565 | struct tomoyo_domain_info **blob; |
566 | ||
567 | if (!security_module_enable("tomoyo")) { | |
568 | tomoyo_enabled = false; | |
569 | return 0; | |
570 | } | |
571 | tomoyo_enabled = true; | |
f7433243 | 572 | |
f1efc8c4 CS |
573 | if (!finish) { |
574 | security_add_blobs(&tomoyo_blob_sizes); | |
575 | finish = 1; | |
f7433243 | 576 | return 0; |
f1efc8c4 CS |
577 | } |
578 | ||
f7433243 | 579 | /* register ourselves with the security framework */ |
d69dece5 | 580 | security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); |
f7433243 | 581 | printk(KERN_INFO "TOMOYO Linux initialized\n"); |
f1efc8c4 CS |
582 | lsm_early_cred(cred); |
583 | blob = tomoyo_cred(cred); | |
584 | *blob = &tomoyo_kernel_domain; | |
c3ef1500 | 585 | tomoyo_mm_init(); |
f7433243 KT |
586 | return 0; |
587 | } | |
588 | ||
589 | security_initcall(tomoyo_init); |