TOMOYO: Add socket operation restriction support.
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Sat, 10 Sep 2011 06:23:54 +0000 (15:23 +0900)
committerJames Morris <jmorris@namei.org>
Tue, 13 Sep 2011 22:27:05 +0000 (08:27 +1000)
This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
socket's bind()/listen()/connect()/send() operations.

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>
security/tomoyo/Kconfig
security/tomoyo/Makefile
security/tomoyo/common.c
security/tomoyo/common.h
security/tomoyo/gc.c
security/tomoyo/group.c
security/tomoyo/network.c [new file with mode: 0644]
security/tomoyo/realpath.c
security/tomoyo/tomoyo.c
security/tomoyo/util.c

index 7c7f8c16c10fcd2260e4ba7af4e9f5a7e98bb8eb..8eb779b9d77f2ad56c7ccdc5db081bc4b0a05028 100644 (file)
@@ -1,8 +1,10 @@
 config SECURITY_TOMOYO
        bool "TOMOYO Linux Support"
        depends on SECURITY
+       depends on NET
        select SECURITYFS
        select SECURITY_PATH
+       select SECURITY_NETWORK
        default n
        help
          This selects TOMOYO Linux, pathname-based access control.
index f7ade960f6cf8c2afc3493965780515fb2299bc1..fc2a8ce403014cfd5c1c2f9b7575c8cadb612cc8 100644 (file)
@@ -1,4 +1,4 @@
-obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o
+obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
 
 $(obj)/policy/profile.conf:
        @mkdir -p $(obj)/policy/
index d116e1ece3e6b2e88fdad721c1db6c9404fff917..85d915587a71ad8a0d72dc3e6b51e8530df90877 100644 (file)
@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
        [TOMOYO_MAC_FILE_MOUNT]      = "mount",
        [TOMOYO_MAC_FILE_UMOUNT]     = "unmount",
        [TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root",
+       /* CONFIG::network group */
+       [TOMOYO_MAC_NETWORK_INET_STREAM_BIND]       = "inet_stream_bind",
+       [TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN]     = "inet_stream_listen",
+       [TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT]    = "inet_stream_connect",
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_BIND]        = "inet_dgram_bind",
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_SEND]        = "inet_dgram_send",
+       [TOMOYO_MAC_NETWORK_INET_RAW_BIND]          = "inet_raw_bind",
+       [TOMOYO_MAC_NETWORK_INET_RAW_SEND]          = "inet_raw_send",
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND]       = "unix_stream_bind",
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN]     = "unix_stream_listen",
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT]    = "unix_stream_connect",
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND]        = "unix_dgram_bind",
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND]        = "unix_dgram_send",
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND]    = "unix_seqpacket_bind",
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  = "unix_seqpacket_listen",
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
        /* CONFIG::misc group */
        [TOMOYO_MAC_ENVIRON] = "env",
        /* CONFIG group */
        [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
+       [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_NETWORK] = "network",
        [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc",
 };
 
@@ -135,11 +152,20 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
        [TOMOYO_TYPE_UMOUNT]     = "unmount",
 };
 
+/* String table for socket's operation. */
+const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION] = {
+       [TOMOYO_NETWORK_BIND]    = "bind",
+       [TOMOYO_NETWORK_LISTEN]  = "listen",
+       [TOMOYO_NETWORK_CONNECT] = "connect",
+       [TOMOYO_NETWORK_SEND]    = "send",
+};
+
 /* String table for categories. */
 static const char * const tomoyo_category_keywords
 [TOMOYO_MAX_MAC_CATEGORY_INDEX] = {
-       [TOMOYO_MAC_CATEGORY_FILE] = "file",
-       [TOMOYO_MAC_CATEGORY_MISC] = "misc",
+       [TOMOYO_MAC_CATEGORY_FILE]    = "file",
+       [TOMOYO_MAC_CATEGORY_NETWORK] = "network",
+       [TOMOYO_MAC_CATEGORY_MISC]    = "misc",
 };
 
 /* Permit policy management by non-root user? */
@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
        static const struct {
                const char *keyword;
                int (*write) (struct tomoyo_acl_param *);
-       } tomoyo_callback[2] = {
+       } tomoyo_callback[4] = {
                { "file ", tomoyo_write_file },
+               { "network inet ", tomoyo_write_inet_network },
+               { "network unix ", tomoyo_write_unix_network },
                { "misc ", tomoyo_write_misc },
        };
        u8 i;
@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
                tomoyo_print_number_union(head, &ptr->mode);
                tomoyo_print_number_union(head, &ptr->major);
                tomoyo_print_number_union(head, &ptr->minor);
+       } else if (acl_type == TOMOYO_TYPE_INET_ACL) {
+               struct tomoyo_inet_acl *ptr =
+                       container_of(acl, typeof(*ptr), head);
+               const u8 perm = ptr->perm;
+
+               for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
+                       if (!(perm & (1 << bit)))
+                               continue;
+                       if (first) {
+                               tomoyo_set_group(head, "network inet ");
+                               tomoyo_set_string(head, tomoyo_proto_keyword
+                                                 [ptr->protocol]);
+                               tomoyo_set_space(head);
+                               first = false;
+                       } else {
+                               tomoyo_set_slash(head);
+                       }
+                       tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
+               }
+               if (first)
+                       return true;
+               tomoyo_set_space(head);
+               if (ptr->address.group) {
+                       tomoyo_set_string(head, "@");
+                       tomoyo_set_string(head, ptr->address.group->group_name
+                                         ->name);
+               } else {
+                       char buf[128];
+                       tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
+                       tomoyo_io_printf(head, "%s", buf);
+               }
+               tomoyo_print_number_union(head, &ptr->port);
+       } else if (acl_type == TOMOYO_TYPE_UNIX_ACL) {
+               struct tomoyo_unix_acl *ptr =
+                       container_of(acl, typeof(*ptr), head);
+               const u8 perm = ptr->perm;
+
+               for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
+                       if (!(perm & (1 << bit)))
+                               continue;
+                       if (first) {
+                               tomoyo_set_group(head, "network unix ");
+                               tomoyo_set_string(head, tomoyo_proto_keyword
+                                                 [ptr->protocol]);
+                               tomoyo_set_space(head);
+                               first = false;
+                       } else {
+                               tomoyo_set_slash(head);
+                       }
+                       tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
+               }
+               if (first)
+                       return true;
+               tomoyo_print_name_union(head, &ptr->name);
        } else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
                struct tomoyo_mount_acl *ptr =
                        container_of(acl, typeof(*ptr), head);
@@ -1548,8 +1630,9 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = {
 
 /* String table for grouping keywords. */
 static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = {
-       [TOMOYO_PATH_GROUP]   = "path_group ",
-       [TOMOYO_NUMBER_GROUP] = "number_group ",
+       [TOMOYO_PATH_GROUP]    = "path_group ",
+       [TOMOYO_NUMBER_GROUP]  = "number_group ",
+       [TOMOYO_ADDRESS_GROUP] = "address_group ",
 };
 
 /**
@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
 }
 
 /**
- * tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group" list.
+ * tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
  *
  * @head: Pointer to "struct tomoyo_io_buffer".
  * @idx:  Index number.
@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
                                                          (ptr,
                                                   struct tomoyo_number_group,
                                                           head)->number);
+                       } else if (idx == TOMOYO_ADDRESS_GROUP) {
+                               char buffer[128];
+
+                               struct tomoyo_address_group *member =
+                                       container_of(ptr, typeof(*member),
+                                                    head);
+                               tomoyo_print_ip(buffer, sizeof(buffer),
+                                               &member->address);
+                               tomoyo_io_printf(head, " %s", buffer);
                        }
                        tomoyo_set_lf(head);
                }
index 63720a328eddce5bfb4889a958c2d93327597160..d1c758e7f92b08e56340c2f4aa83290c6fb59fbf 100644 (file)
 #include <linux/poll.h>
 #include <linux/binfmts.h>
 #include <linux/highmem.h>
+#include <linux/net.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <linux/un.h>
+#include <net/sock.h>
+#include <net/af_unix.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/udp.h>
 
 /********** Constants definitions. **********/
 
 #define TOMOYO_HASH_BITS  8
 #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
 
+/*
+ * TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
+ * Therefore, we don't need SOCK_MAX.
+ */
+#define TOMOYO_SOCK_MAX 6
+
 #define TOMOYO_EXEC_TMPSIZE     4096
 
 /* Profile number is an integer between 0 and 255. */
@@ -136,6 +152,7 @@ enum tomoyo_mode_index {
 /* Index numbers for entry type. */
 enum tomoyo_policy_id {
        TOMOYO_ID_GROUP,
+       TOMOYO_ID_ADDRESS_GROUP,
        TOMOYO_ID_PATH_GROUP,
        TOMOYO_ID_NUMBER_GROUP,
        TOMOYO_ID_TRANSITION_CONTROL,
@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index {
 enum tomoyo_group_id {
        TOMOYO_PATH_GROUP,
        TOMOYO_NUMBER_GROUP,
+       TOMOYO_ADDRESS_GROUP,
        TOMOYO_MAX_GROUP
 };
 
@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index {
        TOMOYO_TYPE_PATH_NUMBER_ACL,
        TOMOYO_TYPE_MKDEV_ACL,
        TOMOYO_TYPE_MOUNT_ACL,
+       TOMOYO_TYPE_INET_ACL,
+       TOMOYO_TYPE_UNIX_ACL,
        TOMOYO_TYPE_ENV_ACL,
 };
 
@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index {
        TOMOYO_MAX_MKDEV_OPERATION
 };
 
+/* Index numbers for socket operations. */
+enum tomoyo_network_acl_index {
+       TOMOYO_NETWORK_BIND,    /* bind() operation. */
+       TOMOYO_NETWORK_LISTEN,  /* listen() operation. */
+       TOMOYO_NETWORK_CONNECT, /* connect() operation. */
+       TOMOYO_NETWORK_SEND,    /* send() operation. */
+       TOMOYO_MAX_NETWORK_OPERATION
+};
+
 /* Index numbers for access controls with two pathnames. */
 enum tomoyo_path2_acl_index {
        TOMOYO_TYPE_LINK,
@@ -301,6 +330,21 @@ enum tomoyo_mac_index {
        TOMOYO_MAC_FILE_MOUNT,
        TOMOYO_MAC_FILE_UMOUNT,
        TOMOYO_MAC_FILE_PIVOT_ROOT,
+       TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
+       TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
+       TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
+       TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
+       TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
+       TOMOYO_MAC_NETWORK_INET_RAW_BIND,
+       TOMOYO_MAC_NETWORK_INET_RAW_SEND,
+       TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
+       TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
+       TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
+       TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
+       TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
+       TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
+       TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
+       TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
        TOMOYO_MAC_ENVIRON,
        TOMOYO_MAX_MAC_INDEX
 };
@@ -308,6 +352,7 @@ enum tomoyo_mac_index {
 /* Index numbers for category of functionality. */
 enum tomoyo_mac_category_index {
        TOMOYO_MAC_CATEGORY_FILE,
+       TOMOYO_MAC_CATEGORY_NETWORK,
        TOMOYO_MAC_CATEGORY_MISC,
        TOMOYO_MAX_MAC_CATEGORY_INDEX
 };
@@ -402,6 +447,22 @@ struct tomoyo_request_info {
                struct {
                        const struct tomoyo_path_info *name;
                } environ;
+               struct {
+                       const __be32 *address;
+                       u16 port;
+                       /* One of values smaller than TOMOYO_SOCK_MAX. */
+                       u8 protocol;
+                       /* One of values in "enum tomoyo_network_acl_index". */
+                       u8 operation;
+                       bool is_ipv6;
+               } inet_network;
+               struct {
+                       const struct tomoyo_path_info *address;
+                       /* One of values smaller than TOMOYO_SOCK_MAX. */
+                       u8 protocol;
+                       /* One of values in "enum tomoyo_network_acl_index". */
+                       u8 operation;
+               } unix_network;
                struct {
                        const struct tomoyo_path_info *type;
                        const struct tomoyo_path_info *dir;
@@ -448,7 +509,14 @@ struct tomoyo_number_union {
        u8 value_type[2];
 };
 
-/* Structure for "path_group"/"number_group" directive. */
+/* Structure for holding an IP address. */
+struct tomoyo_ipaddr_union {
+       struct in6_addr ip[2]; /* Big endian. */
+       struct tomoyo_group *group; /* Pointer to address group. */
+       bool is_ipv6; /* Valid only if @group == NULL. */
+};
+
+/* Structure for "path_group"/"number_group"/"address_group" directive. */
 struct tomoyo_group {
        struct tomoyo_shared_acl_head head;
        const struct tomoyo_path_info *group_name;
@@ -467,6 +535,13 @@ struct tomoyo_number_group {
        struct tomoyo_number_union number;
 };
 
+/* Structure for "address_group" directive. */
+struct tomoyo_address_group {
+       struct tomoyo_acl_head head;
+       /* Structure for holding an IP address. */
+       struct tomoyo_ipaddr_union address;
+};
+
 /* Subset of "struct stat". Used by conditional ACL and audit logs. */
 struct tomoyo_mini_stat {
        uid_t uid;
@@ -650,6 +725,23 @@ struct tomoyo_env_acl {
        const struct tomoyo_path_info *env; /* environment variable */
 };
 
+/* Structure for "network inet" directive. */
+struct tomoyo_inet_acl {
+       struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */
+       u8 protocol;
+       u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
+       struct tomoyo_ipaddr_union address;
+       struct tomoyo_number_union port;
+};
+
+/* Structure for "network unix" directive. */
+struct tomoyo_unix_acl {
+       struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */
+       u8 protocol;
+       u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
+       struct tomoyo_name_union name;
+};
+
 /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */
 struct tomoyo_acl_param {
        char *data;
@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace {
 
 /********** Function prototypes. **********/
 
+bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
+                                 const struct tomoyo_group *group);
 bool tomoyo_compare_number_union(const unsigned long value,
                                 const struct tomoyo_number_union *ptr);
 bool tomoyo_condition(struct tomoyo_request_info *r,
@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr);
 bool tomoyo_number_matches_group(const unsigned long min,
                                 const unsigned long max,
                                 const struct tomoyo_group *group);
+bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
+                              struct tomoyo_ipaddr_union *ptr);
 bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
                             struct tomoyo_name_union *ptr);
 bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
 bool tomoyo_permstr(const char *string, const char *keyword);
 bool tomoyo_str_starts(char **src, const char *find);
 char *tomoyo_encode(const char *str);
+char *tomoyo_encode2(const char *str, int str_len);
 char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
                      va_list args);
 char *tomoyo_read_token(struct tomoyo_acl_param *param);
@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
                           const struct tomoyo_path_info *filename);
 int tomoyo_poll_control(struct file *file, poll_table *wait);
 int tomoyo_poll_log(struct file *file, poll_table *wait);
+int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
+                                 int addr_len);
+int tomoyo_socket_connect_permission(struct socket *sock,
+                                    struct sockaddr *addr, int addr_len);
+int tomoyo_socket_listen_permission(struct socket *sock);
+int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
+                                    int size);
 int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
        __printf(2, 3);
 int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
 int tomoyo_write_file(struct tomoyo_acl_param *param);
 int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
 int tomoyo_write_misc(struct tomoyo_acl_param *param);
+int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
 int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
                                    const u8 type);
+int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
 ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
                            const int buffer_len);
 ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename);
 void tomoyo_memory_free(void *ptr);
 void tomoyo_normalize_line(unsigned char *buffer);
 void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
+void tomoyo_print_ip(char *buf, const unsigned int size,
+                    const struct tomoyo_ipaddr_union *ptr);
 void tomoyo_print_ulong(char *buffer, const int buffer_len,
                        const unsigned long value, const u8 type);
 void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
                                              + TOMOYO_MAX_MAC_CATEGORY_INDEX];
 extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
 extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
+extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
+extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
 extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
 extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
 extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union
                a->value_type[1] == b->value_type[1];
 }
 
+/**
+ * tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry.
+ *
+ * @a: Pointer to "struct tomoyo_ipaddr_union".
+ * @b: Pointer to "struct tomoyo_ipaddr_union".
+ *
+ * Returns true if @a == @b, false otherwise.
+ */
+static inline bool tomoyo_same_ipaddr_union
+(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
+{
+       return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
+               a->is_ipv6 == b->is_ipv6;
+}
+
 /**
  * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread.
  *
index 818b07998111d748e7e5e6844703b016bb0cf1f6..7747ceb9a2214350c43aebaad5ef5da2c11cccbb 100644 (file)
@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
 /* Size of an element. */
 static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
        [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
+       [TOMOYO_ID_ADDRESS_GROUP] = sizeof(struct tomoyo_address_group),
        [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
        [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
        [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = {
        [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
        [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
        [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
+       [TOMOYO_TYPE_INET_ACL] = sizeof(struct tomoyo_inet_acl),
+       [TOMOYO_TYPE_UNIX_ACL] = sizeof(struct tomoyo_unix_acl),
        [TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
 };
 
@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element)
                        tomoyo_put_name(entry->env);
                }
                break;
+       case TOMOYO_TYPE_INET_ACL:
+               {
+                       struct tomoyo_inet_acl *entry =
+                               container_of(acl, typeof(*entry), head);
+
+                       tomoyo_put_group(entry->address.group);
+                       tomoyo_put_number_union(&entry->port);
+               }
+               break;
+       case TOMOYO_TYPE_UNIX_ACL:
+               {
+                       struct tomoyo_unix_acl *entry =
+                               container_of(acl, typeof(*entry), head);
+
+                       tomoyo_put_name_union(&entry->name);
+               }
+               break;
        }
 }
 
@@ -430,6 +450,18 @@ static void tomoyo_del_group(struct list_head *element)
        tomoyo_put_name(group->group_name);
 }
 
+/**
+ * tomoyo_del_address_group - Delete members in "struct tomoyo_address_group".
+ *
+ * @element: Pointer to "struct list_head".
+ *
+ * Returns nothing.
+ */
+static inline void tomoyo_del_address_group(struct list_head *element)
+{
+       /* Nothing to do. */
+}
+
 /**
  * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
  *
@@ -527,9 +559,12 @@ static void tomoyo_collect_entry(void)
                        case 0:
                                id = TOMOYO_ID_PATH_GROUP;
                                break;
-                       default:
+                       case 1:
                                id = TOMOYO_ID_NUMBER_GROUP;
                                break;
+                       default:
+                               id = TOMOYO_ID_ADDRESS_GROUP;
+                               break;
                        }
                        list_for_each_entry(group, list, head.list) {
                                if (!tomoyo_collect_member
@@ -634,6 +669,9 @@ static bool tomoyo_kfree_entry(void)
                case TOMOYO_ID_PATH_GROUP:
                        tomoyo_del_path_group(element);
                        break;
+               case TOMOYO_ID_ADDRESS_GROUP:
+                       tomoyo_del_address_group(element);
+                       break;
                case TOMOYO_ID_GROUP:
                        tomoyo_del_group(element);
                        break;
index 5fb0e1298400e040bcc724f1196a4c9e02154f4c..50092534ec54083d0af18d852e9e0dc0dc9c154f 100644 (file)
@@ -42,7 +42,26 @@ static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
 }
 
 /**
- * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group" list.
+ * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
+ *
+ * @a: Pointer to "struct tomoyo_acl_head".
+ * @b: Pointer to "struct tomoyo_acl_head".
+ *
+ * Returns true if @a == @b, false otherwise.
+ */
+static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
+                                     const struct tomoyo_acl_head *b)
+{
+       const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
+                                                            head);
+       const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
+                                                            head);
+
+       return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
+}
+
+/**
+ * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
  *
  * @param: Pointer to "struct tomoyo_acl_param".
  * @type:  Type of this group.
@@ -77,6 +96,14 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
                 * tomoyo_put_number_union() is not needed because
                 * param->data[0] != '@'.
                 */
+       } else {
+               struct tomoyo_address_group e = { };
+
+               if (param->data[0] == '@' ||
+                   !tomoyo_parse_ipaddr_union(param, &e.address))
+                       goto out;
+               error = tomoyo_update_policy(&e.head, sizeof(e), param,
+                                            tomoyo_same_address_group);
        }
 out:
        tomoyo_put_group(group);
@@ -137,3 +164,35 @@ bool tomoyo_number_matches_group(const unsigned long min,
        }
        return matched;
 }
+
+/**
+ * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @address: An IPv4 or IPv6 address.
+ * @group:   Pointer to "struct tomoyo_address_group".
+ *
+ * Returns true if @address matches addresses in @group group, false otherwise.
+ *
+ * Caller holds tomoyo_read_lock().
+ */
+bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
+                                 const struct tomoyo_group *group)
+{
+       struct tomoyo_address_group *member;
+       bool matched = false;
+       const u8 size = is_ipv6 ? 16 : 4;
+
+       list_for_each_entry_rcu(member, &group->member_list, head.list) {
+               if (member->head.is_deleted)
+                       continue;
+               if (member->address.is_ipv6 != is_ipv6)
+                       continue;
+               if (memcmp(&member->address.ip[0], address, size) > 0 ||
+                   memcmp(address, &member->address.ip[1], size) > 0)
+                       continue;
+               matched = true;
+               break;
+       }
+       return matched;
+}
diff --git a/security/tomoyo/network.c b/security/tomoyo/network.c
new file mode 100644 (file)
index 0000000..9752771
--- /dev/null
@@ -0,0 +1,771 @@
+/*
+ * security/tomoyo/network.c
+ *
+ * Copyright (C) 2005-2011  NTT DATA CORPORATION
+ */
+
+#include "common.h"
+#include <linux/slab.h>
+
+/* Structure for holding inet domain socket's address. */
+struct tomoyo_inet_addr_info {
+       __be16 port;           /* In network byte order. */
+       const __be32 *address; /* In network byte order. */
+       bool is_ipv6;
+};
+
+/* Structure for holding unix domain socket's address. */
+struct tomoyo_unix_addr_info {
+       u8 *addr; /* This may not be '\0' terminated string. */
+       unsigned int addr_len;
+};
+
+/* Structure for holding socket address. */
+struct tomoyo_addr_info {
+       u8 protocol;
+       u8 operation;
+       struct tomoyo_inet_addr_info inet;
+       struct tomoyo_unix_addr_info unix0;
+};
+
+/* String table for socket's protocols. */
+const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = {
+       [SOCK_STREAM]    = "stream",
+       [SOCK_DGRAM]     = "dgram",
+       [SOCK_RAW]       = "raw",
+       [SOCK_SEQPACKET] = "seqpacket",
+       [0] = " ", /* Dummy for avoiding NULL pointer dereference. */
+       [4] = " ", /* Dummy for avoiding NULL pointer dereference. */
+};
+
+/**
+ * tomoyo_parse_ipaddr_union - Parse an IP address.
+ *
+ * @param: Pointer to "struct tomoyo_acl_param".
+ * @ptr:   Pointer to "struct tomoyo_ipaddr_union".
+ *
+ * Returns true on success, false otherwise.
+ */
+bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
+                              struct tomoyo_ipaddr_union *ptr)
+{
+       u8 * const min = ptr->ip[0].in6_u.u6_addr8;
+       u8 * const max = ptr->ip[1].in6_u.u6_addr8;
+       char *address = tomoyo_read_token(param);
+       const char *end;
+
+       if (!strchr(address, ':') &&
+           in4_pton(address, -1, min, '-', &end) > 0) {
+               ptr->is_ipv6 = false;
+               if (!*end)
+                       ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0];
+               else if (*end++ != '-' ||
+                        in4_pton(end, -1, max, '\0', &end) <= 0 || *end)
+                       return false;
+               return true;
+       }
+       if (in6_pton(address, -1, min, '-', &end) > 0) {
+               ptr->is_ipv6 = true;
+               if (!*end)
+                       memmove(max, min, sizeof(u16) * 8);
+               else if (*end++ != '-' ||
+                        in6_pton(end, -1, max, '\0', &end) <= 0 || *end)
+                       return false;
+               return true;
+       }
+       return false;
+}
+
+/**
+ * tomoyo_print_ipv4 - Print an IPv4 address.
+ *
+ * @buffer:     Buffer to write to.
+ * @buffer_len: Size of @buffer.
+ * @min_ip:     Pointer to __be32.
+ * @max_ip:     Pointer to __be32.
+ *
+ * Returns nothing.
+ */
+static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len,
+                             const __be32 *min_ip, const __be32 *max_ip)
+{
+       snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip,
+                *min_ip == *max_ip ? '\0' : '-', max_ip);
+}
+
+/**
+ * tomoyo_print_ipv6 - Print an IPv6 address.
+ *
+ * @buffer:     Buffer to write to.
+ * @buffer_len: Size of @buffer.
+ * @min_ip:     Pointer to "struct in6_addr".
+ * @max_ip:     Pointer to "struct in6_addr".
+ *
+ * Returns nothing.
+ */
+static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len,
+                             const struct in6_addr *min_ip,
+                             const struct in6_addr *max_ip)
+{
+       snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip,
+                !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip);
+}
+
+/**
+ * tomoyo_print_ip - Print an IP address.
+ *
+ * @buf:  Buffer to write to.
+ * @size: Size of @buf.
+ * @ptr:  Pointer to "struct ipaddr_union".
+ *
+ * Returns nothing.
+ */
+void tomoyo_print_ip(char *buf, const unsigned int size,
+                    const struct tomoyo_ipaddr_union *ptr)
+{
+       if (ptr->is_ipv6)
+               tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]);
+       else
+               tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0],
+                                 &ptr->ip[1].s6_addr32[0]);
+}
+
+/*
+ * Mapping table from "enum tomoyo_network_acl_index" to
+ * "enum tomoyo_mac_index" for inet domain socket.
+ */
+static const u8 tomoyo_inet2mac
+[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
+       [SOCK_STREAM] = {
+               [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
+               [TOMOYO_NETWORK_LISTEN]  =
+               TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
+               [TOMOYO_NETWORK_CONNECT] =
+               TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
+       },
+       [SOCK_DGRAM] = {
+               [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
+               [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
+       },
+       [SOCK_RAW]    = {
+               [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_RAW_BIND,
+               [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_RAW_SEND,
+       },
+};
+
+/*
+ * Mapping table from "enum tomoyo_network_acl_index" to
+ * "enum tomoyo_mac_index" for unix domain socket.
+ */
+static const u8 tomoyo_unix2mac
+[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
+       [SOCK_STREAM] = {
+               [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
+               [TOMOYO_NETWORK_LISTEN]  =
+               TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
+               [TOMOYO_NETWORK_CONNECT] =
+               TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
+       },
+       [SOCK_DGRAM] = {
+               [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
+               [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
+       },
+       [SOCK_SEQPACKET] = {
+               [TOMOYO_NETWORK_BIND]    =
+               TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
+               [TOMOYO_NETWORK_LISTEN]  =
+               TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
+               [TOMOYO_NETWORK_CONNECT] =
+               TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
+       },
+};
+
+/**
+ * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry.
+ *
+ * @a: Pointer to "struct tomoyo_acl_info".
+ * @b: Pointer to "struct tomoyo_acl_info".
+ *
+ * Returns true if @a == @b except permission bits, false otherwise.
+ */
+static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a,
+                                const struct tomoyo_acl_info *b)
+{
+       const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head);
+       const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head);
+
+       return p1->protocol == p2->protocol &&
+               tomoyo_same_ipaddr_union(&p1->address, &p2->address) &&
+               tomoyo_same_number_union(&p1->port, &p2->port);
+}
+
+/**
+ * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry.
+ *
+ * @a: Pointer to "struct tomoyo_acl_info".
+ * @b: Pointer to "struct tomoyo_acl_info".
+ *
+ * Returns true if @a == @b except permission bits, false otherwise.
+ */
+static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a,
+                                const struct tomoyo_acl_info *b)
+{
+       const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head);
+       const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head);
+
+       return p1->protocol == p2->protocol &&
+               tomoyo_same_name_union(&p1->name, &p2->name);
+}
+
+/**
+ * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry.
+ *
+ * @a:         Pointer to "struct tomoyo_acl_info".
+ * @b:         Pointer to "struct tomoyo_acl_info".
+ * @is_delete: True for @a &= ~@b, false for @a |= @b.
+ *
+ * Returns true if @a is empty, false otherwise.
+ */
+static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a,
+                                 struct tomoyo_acl_info *b,
+                                 const bool is_delete)
+{
+       u8 * const a_perm =
+               &container_of(a, struct tomoyo_inet_acl, head)->perm;
+       u8 perm = *a_perm;
+       const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
+
+       if (is_delete)
+               perm &= ~b_perm;
+       else
+               perm |= b_perm;
+       *a_perm = perm;
+       return !perm;
+}
+
+/**
+ * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry.
+ *
+ * @a:         Pointer to "struct tomoyo_acl_info".
+ * @b:         Pointer to "struct tomoyo_acl_info".
+ * @is_delete: True for @a &= ~@b, false for @a |= @b.
+ *
+ * Returns true if @a is empty, false otherwise.
+ */
+static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a,
+                                 struct tomoyo_acl_info *b,
+                                 const bool is_delete)
+{
+       u8 * const a_perm =
+               &container_of(a, struct tomoyo_unix_acl, head)->perm;
+       u8 perm = *a_perm;
+       const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
+
+       if (is_delete)
+               perm &= ~b_perm;
+       else
+               perm |= b_perm;
+       *a_perm = perm;
+       return !perm;
+}
+
+/**
+ * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list.
+ *
+ * @param: Pointer to "struct tomoyo_acl_param".
+ *
+ * Returns 0 on success, negative value otherwise.
+ *
+ * Caller holds tomoyo_read_lock().
+ */
+int tomoyo_write_inet_network(struct tomoyo_acl_param *param)
+{
+       struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL };
+       int error = -EINVAL;
+       u8 type;
+       const char *protocol = tomoyo_read_token(param);
+       const char *operation = tomoyo_read_token(param);
+
+       for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
+               if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
+                       break;
+       for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
+               if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
+                       e.perm |= 1 << type;
+       if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
+               return -EINVAL;
+       if (param->data[0] == '@') {
+               param->data++;
+               e.address.group =
+                       tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP);
+               if (!e.address.group)
+                       return -ENOMEM;
+       } else {
+               if (!tomoyo_parse_ipaddr_union(param, &e.address))
+                       goto out;
+       }
+       if (!tomoyo_parse_number_union(param, &e.port) ||
+           e.port.values[1] > 65535)
+               goto out;
+       error = tomoyo_update_domain(&e.head, sizeof(e), param,
+                                    tomoyo_same_inet_acl,
+                                    tomoyo_merge_inet_acl);
+out:
+       tomoyo_put_group(e.address.group);
+       tomoyo_put_number_union(&e.port);
+       return error;
+}
+
+/**
+ * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list.
+ *
+ * @param: Pointer to "struct tomoyo_acl_param".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_write_unix_network(struct tomoyo_acl_param *param)
+{
+       struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL };
+       int error;
+       u8 type;
+       const char *protocol = tomoyo_read_token(param);
+       const char *operation = tomoyo_read_token(param);
+
+       for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
+               if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
+                       break;
+       for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
+               if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
+                       e.perm |= 1 << type;
+       if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
+               return -EINVAL;
+       if (!tomoyo_parse_name_union(param, &e.name))
+               return -EINVAL;
+       error = tomoyo_update_domain(&e.head, sizeof(e), param,
+                                    tomoyo_same_unix_acl,
+                                    tomoyo_merge_unix_acl);
+       tomoyo_put_name_union(&e.name);
+       return error;
+}
+
+/**
+ * tomoyo_audit_net_log - Audit network log.
+ *
+ * @r:         Pointer to "struct tomoyo_request_info".
+ * @family:    Name of socket family ("inet" or "unix").
+ * @protocol:  Name of protocol in @family.
+ * @operation: Name of socket operation.
+ * @address:   Name of address.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_audit_net_log(struct tomoyo_request_info *r,
+                               const char *family, const u8 protocol,
+                               const u8 operation, const char *address)
+{
+       return tomoyo_supervisor(r, "network %s %s %s %s\n", family,
+                                tomoyo_proto_keyword[protocol],
+                                tomoyo_socket_keyword[operation], address);
+}
+
+/**
+ * tomoyo_audit_inet_log - Audit INET network log.
+ *
+ * @r: Pointer to "struct tomoyo_request_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_audit_inet_log(struct tomoyo_request_info *r)
+{
+       char buf[128];
+       int len;
+       const __be32 *address = r->param.inet_network.address;
+
+       if (r->param.inet_network.is_ipv6)
+               tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *)
+                                 address, (const struct in6_addr *) address);
+       else
+               tomoyo_print_ipv4(buf, sizeof(buf), address, address);
+       len = strlen(buf);
+       snprintf(buf + len, sizeof(buf) - len, " %u",
+                r->param.inet_network.port);
+       return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol,
+                                   r->param.inet_network.operation, buf);
+}
+
+/**
+ * tomoyo_audit_unix_log - Audit UNIX network log.
+ *
+ * @r: Pointer to "struct tomoyo_request_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_audit_unix_log(struct tomoyo_request_info *r)
+{
+       return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol,
+                                   r->param.unix_network.operation,
+                                   r->param.unix_network.address->name);
+}
+
+/**
+ * tomoyo_check_inet_acl - Check permission for inet domain socket operation.
+ *
+ * @r:   Pointer to "struct tomoyo_request_info".
+ * @ptr: Pointer to "struct tomoyo_acl_info".
+ *
+ * Returns true if granted, false otherwise.
+ */
+static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r,
+                                 const struct tomoyo_acl_info *ptr)
+{
+       const struct tomoyo_inet_acl *acl =
+               container_of(ptr, typeof(*acl), head);
+       const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4;
+
+       if (!(acl->perm & (1 << r->param.inet_network.operation)) ||
+           !tomoyo_compare_number_union(r->param.inet_network.port,
+                                        &acl->port))
+               return false;
+       if (acl->address.group)
+               return tomoyo_address_matches_group
+                       (r->param.inet_network.is_ipv6,
+                        r->param.inet_network.address, acl->address.group);
+       return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 &&
+               memcmp(&acl->address.ip[0],
+                      r->param.inet_network.address, size) <= 0 &&
+               memcmp(r->param.inet_network.address,
+                      &acl->address.ip[1], size) <= 0;
+}
+
+/**
+ * tomoyo_check_unix_acl - Check permission for unix domain socket operation.
+ *
+ * @r:   Pointer to "struct tomoyo_request_info".
+ * @ptr: Pointer to "struct tomoyo_acl_info".
+ *
+ * Returns true if granted, false otherwise.
+ */
+static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r,
+                                 const struct tomoyo_acl_info *ptr)
+{
+       const struct tomoyo_unix_acl *acl =
+               container_of(ptr, typeof(*acl), head);
+
+       return (acl->perm & (1 << r->param.unix_network.operation)) &&
+               tomoyo_compare_name_union(r->param.unix_network.address,
+                                         &acl->name);
+}
+
+/**
+ * tomoyo_inet_entry - Check permission for INET network operation.
+ *
+ * @address: Pointer to "struct tomoyo_addr_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_inet_entry(const struct tomoyo_addr_info *address)
+{
+       const int idx = tomoyo_read_lock();
+       struct tomoyo_request_info r;
+       int error = 0;
+       const u8 type = tomoyo_inet2mac[address->protocol][address->operation];
+
+       if (type && tomoyo_init_request_info(&r, NULL, type)
+           != TOMOYO_CONFIG_DISABLED) {
+               r.param_type = TOMOYO_TYPE_INET_ACL;
+               r.param.inet_network.protocol = address->protocol;
+               r.param.inet_network.operation = address->operation;
+               r.param.inet_network.is_ipv6 = address->inet.is_ipv6;
+               r.param.inet_network.address = address->inet.address;
+               r.param.inet_network.port = ntohs(address->inet.port);
+               do {
+                       tomoyo_check_acl(&r, tomoyo_check_inet_acl);
+                       error = tomoyo_audit_inet_log(&r);
+               } while (error == TOMOYO_RETRY_REQUEST);
+       }
+       tomoyo_read_unlock(idx);
+       return error;
+}
+
+/**
+ * tomoyo_check_inet_address - Check permission for inet domain socket's operation.
+ *
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ * @port:     Port number.
+ * @address:  Pointer to "struct tomoyo_addr_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_check_inet_address(const struct sockaddr *addr,
+                                    const unsigned int addr_len,
+                                    const u16 port,
+                                    struct tomoyo_addr_info *address)
+{
+       struct tomoyo_inet_addr_info *i = &address->inet;
+
+       switch (addr->sa_family) {
+       case AF_INET6:
+               if (addr_len < SIN6_LEN_RFC2133)
+                       goto skip;
+               i->is_ipv6 = true;
+               i->address = (__be32 *)
+                       ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;
+               i->port = ((struct sockaddr_in6 *) addr)->sin6_port;
+               break;
+       case AF_INET:
+               if (addr_len < sizeof(struct sockaddr_in))
+                       goto skip;
+               i->is_ipv6 = false;
+               i->address = (__be32 *)
+                       &((struct sockaddr_in *) addr)->sin_addr;
+               i->port = ((struct sockaddr_in *) addr)->sin_port;
+               break;
+       default:
+               goto skip;
+       }
+       if (address->protocol == SOCK_RAW)
+               i->port = htons(port);
+       return tomoyo_inet_entry(address);
+skip:
+       return 0;
+}
+
+/**
+ * tomoyo_unix_entry - Check permission for UNIX network operation.
+ *
+ * @address: Pointer to "struct tomoyo_addr_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_unix_entry(const struct tomoyo_addr_info *address)
+{
+       const int idx = tomoyo_read_lock();
+       struct tomoyo_request_info r;
+       int error = 0;
+       const u8 type = tomoyo_unix2mac[address->protocol][address->operation];
+
+       if (type && tomoyo_init_request_info(&r, NULL, type)
+           != TOMOYO_CONFIG_DISABLED) {
+               char *buf = address->unix0.addr;
+               int len = address->unix0.addr_len - sizeof(sa_family_t);
+
+               if (len <= 0) {
+                       buf = "anonymous";
+                       len = 9;
+               } else if (buf[0]) {
+                       len = strnlen(buf, len);
+               }
+               buf = tomoyo_encode2(buf, len);
+               if (buf) {
+                       struct tomoyo_path_info addr;
+
+                       addr.name = buf;
+                       tomoyo_fill_path_info(&addr);
+                       r.param_type = TOMOYO_TYPE_UNIX_ACL;
+                       r.param.unix_network.protocol = address->protocol;
+                       r.param.unix_network.operation = address->operation;
+                       r.param.unix_network.address = &addr;
+                       do {
+                               tomoyo_check_acl(&r, tomoyo_check_unix_acl);
+                               error = tomoyo_audit_unix_log(&r);
+                       } while (error == TOMOYO_RETRY_REQUEST);
+                       kfree(buf);
+               } else
+                       error = -ENOMEM;
+       }
+       tomoyo_read_unlock(idx);
+       return error;
+}
+
+/**
+ * tomoyo_check_unix_address - Check permission for unix domain socket's operation.
+ *
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ * @address:  Pointer to "struct tomoyo_addr_info".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_check_unix_address(struct sockaddr *addr,
+                                    const unsigned int addr_len,
+                                    struct tomoyo_addr_info *address)
+{
+       struct tomoyo_unix_addr_info *u = &address->unix0;
+
+       if (addr->sa_family != AF_UNIX)
+               return 0;
+       u->addr = ((struct sockaddr_un *) addr)->sun_path;
+       u->addr_len = addr_len;
+       return tomoyo_unix_entry(address);
+}
+
+/**
+ * tomoyo_kernel_service - Check whether I'm kernel service or not.
+ *
+ * Returns true if I'm kernel service, false otherwise.
+ */
+static bool tomoyo_kernel_service(void)
+{
+       /* Nothing to do if I am a kernel service. */
+       return segment_eq(get_fs(), KERNEL_DS);
+}
+
+/**
+ * tomoyo_sock_family - Get socket's family.
+ *
+ * @sk: Pointer to "struct sock".
+ *
+ * Returns one of PF_INET, PF_INET6, PF_UNIX or 0.
+ */
+static u8 tomoyo_sock_family(struct sock *sk)
+{
+       u8 family;
+
+       if (tomoyo_kernel_service())
+               return 0;
+       family = sk->sk_family;
+       switch (family) {
+       case PF_INET:
+       case PF_INET6:
+       case PF_UNIX:
+               return family;
+       default:
+               return 0;
+       }
+}
+
+/**
+ * tomoyo_socket_listen_permission - Check permission for listening a socket.
+ *
+ * @sock: Pointer to "struct socket".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_listen_permission(struct socket *sock)
+{
+       struct tomoyo_addr_info address;
+       const u8 family = tomoyo_sock_family(sock->sk);
+       const unsigned int type = sock->type;
+       struct sockaddr_storage addr;
+       int addr_len;
+
+       if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET))
+               return 0;
+       {
+               const int error = sock->ops->getname(sock, (struct sockaddr *)
+                                                    &addr, &addr_len, 0);
+
+               if (error)
+                       return error;
+       }
+       address.protocol = type;
+       address.operation = TOMOYO_NETWORK_LISTEN;
+       if (family == PF_UNIX)
+               return tomoyo_check_unix_address((struct sockaddr *) &addr,
+                                                addr_len, &address);
+       return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len,
+                                        0, &address);
+}
+
+/**
+ * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket.
+ *
+ * @sock:     Pointer to "struct socket".
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_connect_permission(struct socket *sock,
+                                    struct sockaddr *addr, int addr_len)
+{
+       struct tomoyo_addr_info address;
+       const u8 family = tomoyo_sock_family(sock->sk);
+       const unsigned int type = sock->type;
+
+       if (!family)
+               return 0;
+       address.protocol = type;
+       switch (type) {
+       case SOCK_DGRAM:
+       case SOCK_RAW:
+               address.operation = TOMOYO_NETWORK_SEND;
+               break;
+       case SOCK_STREAM:
+       case SOCK_SEQPACKET:
+               address.operation = TOMOYO_NETWORK_CONNECT;
+               break;
+       default:
+               return 0;
+       }
+       if (family == PF_UNIX)
+               return tomoyo_check_unix_address(addr, addr_len, &address);
+       return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
+                                        &address);
+}
+
+/**
+ * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket.
+ *
+ * @sock:     Pointer to "struct socket".
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
+                                 int addr_len)
+{
+       struct tomoyo_addr_info address;
+       const u8 family = tomoyo_sock_family(sock->sk);
+       const unsigned int type = sock->type;
+
+       if (!family)
+               return 0;
+       switch (type) {
+       case SOCK_STREAM:
+       case SOCK_DGRAM:
+       case SOCK_RAW:
+       case SOCK_SEQPACKET:
+               address.protocol = type;
+               address.operation = TOMOYO_NETWORK_BIND;
+               break;
+       default:
+               return 0;
+       }
+       if (family == PF_UNIX)
+               return tomoyo_check_unix_address(addr, addr_len, &address);
+       return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
+                                        &address);
+}
+
+/**
+ * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram.
+ *
+ * @sock: Pointer to "struct socket".
+ * @msg:  Pointer to "struct msghdr".
+ * @size: Unused.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
+                                    int size)
+{
+       struct tomoyo_addr_info address;
+       const u8 family = tomoyo_sock_family(sock->sk);
+       const unsigned int type = sock->type;
+
+       if (!msg->msg_name || !family ||
+           (type != SOCK_DGRAM && type != SOCK_RAW))
+               return 0;
+       address.protocol = type;
+       address.operation = TOMOYO_NETWORK_SEND;
+       if (family == PF_UNIX)
+               return tomoyo_check_unix_address((struct sockaddr *)
+                                                msg->msg_name,
+                                                msg->msg_namelen, &address);
+       return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name,
+                                        msg->msg_namelen,
+                                        sock->sk->sk_protocol, &address);
+}
index 6c601bd300f386a9faff38e335c4f9c6dbdfa541..738bbdf8d4c77ceba3ba3abfe733a90dc56cd4fb 100644 (file)
 #include "../../fs/internal.h"
 
 /**
- * tomoyo_encode: Convert binary string to ascii string.
+ * tomoyo_encode2 - Encode binary string to ascii string.
  *
- * @str: String in binary format.
+ * @str:     String in binary format.
+ * @str_len: Size of @str in byte.
  *
  * Returns pointer to @str in ascii format on success, NULL otherwise.
  *
  * This function uses kzalloc(), so caller must kfree() if this function
  * didn't return NULL.
  */
-char *tomoyo_encode(const char *str)
+char *tomoyo_encode2(const char *str, int str_len)
 {
+       int i;
        int len = 0;
        const char *p = str;
        char *cp;
@@ -33,8 +35,9 @@ char *tomoyo_encode(const char *str)
 
        if (!p)
                return NULL;
-       while (*p) {
-               const unsigned char c = *p++;
+       for (i = 0; i < str_len; i++) {
+               const unsigned char c = p[i];
+
                if (c == '\\')
                        len += 2;
                else if (c > ' ' && c < 127)
@@ -49,8 +52,8 @@ char *tomoyo_encode(const char *str)
                return NULL;
        cp0 = cp;
        p = str;
-       while (*p) {
-               const unsigned char c = *p++;
+       for (i = 0; i < str_len; i++) {
+               const unsigned char c = p[i];
 
                if (c == '\\') {
                        *cp++ = '\\';
@@ -67,6 +70,21 @@ char *tomoyo_encode(const char *str)
        return cp0;
 }
 
+/**
+ * tomoyo_encode - Encode binary string to ascii string.
+ *
+ * @str: String in binary format.
+ *
+ * Returns pointer to @str in ascii format on success, NULL otherwise.
+ *
+ * This function uses kzalloc(), so caller must kfree() if this function
+ * didn't return NULL.
+ */
+char *tomoyo_encode(const char *str)
+{
+       return str ? tomoyo_encode2(str, strlen(str)) : NULL;
+}
+
 /**
  * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
  *
index f776400a8f3136aefb705aa2893e250ec4122939..4b327b6917451bbe8f4ad2fc2cccad113a9cbf46 100644 (file)
@@ -442,6 +442,64 @@ static int tomoyo_sb_pivotroot(struct path *old_path, struct path *new_path)
        return tomoyo_path2_perm(TOMOYO_TYPE_PIVOT_ROOT, new_path, old_path);
 }
 
+/**
+ * tomoyo_socket_listen - Check permission for listen().
+ *
+ * @sock:    Pointer to "struct socket".
+ * @backlog: Backlog parameter.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_socket_listen(struct socket *sock, int backlog)
+{
+       return tomoyo_socket_listen_permission(sock);
+}
+
+/**
+ * tomoyo_socket_connect - Check permission for connect().
+ *
+ * @sock:     Pointer to "struct socket".
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *addr,
+                                int addr_len)
+{
+       return tomoyo_socket_connect_permission(sock, addr, addr_len);
+}
+
+/**
+ * tomoyo_socket_bind - Check permission for bind().
+ *
+ * @sock:     Pointer to "struct socket".
+ * @addr:     Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *addr,
+                             int addr_len)
+{
+       return tomoyo_socket_bind_permission(sock, addr, addr_len);
+}
+
+/**
+ * tomoyo_socket_sendmsg - Check permission for sendmsg().
+ *
+ * @sock: Pointer to "struct socket".
+ * @msg:  Pointer to "struct msghdr".
+ * @size: Size of message.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
+                                int size)
+{
+       return tomoyo_socket_sendmsg_permission(sock, msg, size);
+}
+
 /*
  * tomoyo_security_ops is a "struct security_operations" which is used for
  * registering TOMOYO.
@@ -472,6 +530,10 @@ static struct security_operations tomoyo_security_ops = {
        .sb_mount            = tomoyo_sb_mount,
        .sb_umount           = tomoyo_sb_umount,
        .sb_pivotroot        = tomoyo_sb_pivotroot,
+       .socket_bind         = tomoyo_socket_bind,
+       .socket_connect      = tomoyo_socket_connect,
+       .socket_listen       = tomoyo_socket_listen,
+       .socket_sendmsg      = tomoyo_socket_sendmsg,
 };
 
 /* Lock for GC. */
index cb7d507b6312a55b822beb99594b253d54a1443a..a1c3d9ccebfa4572a05f3a1a3952f8d1a8af7113 100644 (file)
@@ -42,6 +42,37 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
        [TOMOYO_MAC_FILE_MOUNT]      = TOMOYO_MAC_CATEGORY_FILE,
        [TOMOYO_MAC_FILE_UMOUNT]     = TOMOYO_MAC_CATEGORY_FILE,
        [TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
+       /* CONFIG::network group */
+       [TOMOYO_MAC_NETWORK_INET_STREAM_BIND]       =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN]     =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_BIND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_SEND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_RAW_BIND]          =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_RAW_SEND]          =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND]       =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN]     =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] =
+       TOMOYO_MAC_CATEGORY_NETWORK,
        /* CONFIG::misc group */
        [TOMOYO_MAC_ENVIRON]         = TOMOYO_MAC_CATEGORY_MISC,
 };