Commit 059d84db authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files

TOMOYO: Add socket operation restriction support.



This patch adds support for permission checks for PF_INET/PF_INET6/PF_UNIX
socket's bind()/listen()/connect()/send() operations.
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent d58e0da8
config SECURITY_TOMOYO config SECURITY_TOMOYO
bool "TOMOYO Linux Support" bool "TOMOYO Linux Support"
depends on SECURITY depends on SECURITY
depends on NET
select SECURITYFS select SECURITYFS
select SECURITY_PATH select SECURITY_PATH
select SECURITY_NETWORK
default n default n
help help
This selects TOMOYO Linux, pathname-based access control. This selects TOMOYO Linux, pathname-based access control.
......
obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o obj-y = audit.o common.o condition.o domain.o environ.o file.o gc.o group.o load_policy.o memory.o mount.o network.o realpath.o securityfs_if.o tomoyo.o util.o
$(obj)/policy/profile.conf: $(obj)/policy/profile.conf:
@mkdir -p $(obj)/policy/ @mkdir -p $(obj)/policy/
......
...@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX ...@@ -44,10 +44,27 @@ const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
[TOMOYO_MAC_FILE_MOUNT] = "mount", [TOMOYO_MAC_FILE_MOUNT] = "mount",
[TOMOYO_MAC_FILE_UMOUNT] = "unmount", [TOMOYO_MAC_FILE_UMOUNT] = "unmount",
[TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root", [TOMOYO_MAC_FILE_PIVOT_ROOT] = "pivot_root",
/* CONFIG::network group */
[TOMOYO_MAC_NETWORK_INET_STREAM_BIND] = "inet_stream_bind",
[TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN] = "inet_stream_listen",
[TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT] = "inet_stream_connect",
[TOMOYO_MAC_NETWORK_INET_DGRAM_BIND] = "inet_dgram_bind",
[TOMOYO_MAC_NETWORK_INET_DGRAM_SEND] = "inet_dgram_send",
[TOMOYO_MAC_NETWORK_INET_RAW_BIND] = "inet_raw_bind",
[TOMOYO_MAC_NETWORK_INET_RAW_SEND] = "inet_raw_send",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND] = "unix_stream_bind",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN] = "unix_stream_listen",
[TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT] = "unix_stream_connect",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND] = "unix_dgram_bind",
[TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND] = "unix_dgram_send",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND] = "unix_seqpacket_bind",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN] = "unix_seqpacket_listen",
[TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
/* CONFIG::misc group */ /* CONFIG::misc group */
[TOMOYO_MAC_ENVIRON] = "env", [TOMOYO_MAC_ENVIRON] = "env",
/* CONFIG group */ /* CONFIG group */
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file", [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc", [TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_MISC] = "misc",
}; };
...@@ -135,11 +152,20 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = { ...@@ -135,11 +152,20 @@ const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
[TOMOYO_TYPE_UMOUNT] = "unmount", [TOMOYO_TYPE_UMOUNT] = "unmount",
}; };
/* String table for socket's operation. */
const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION] = {
[TOMOYO_NETWORK_BIND] = "bind",
[TOMOYO_NETWORK_LISTEN] = "listen",
[TOMOYO_NETWORK_CONNECT] = "connect",
[TOMOYO_NETWORK_SEND] = "send",
};
/* String table for categories. */ /* String table for categories. */
static const char * const tomoyo_category_keywords static const char * const tomoyo_category_keywords
[TOMOYO_MAX_MAC_CATEGORY_INDEX] = { [TOMOYO_MAX_MAC_CATEGORY_INDEX] = {
[TOMOYO_MAC_CATEGORY_FILE] = "file", [TOMOYO_MAC_CATEGORY_FILE] = "file",
[TOMOYO_MAC_CATEGORY_MISC] = "misc", [TOMOYO_MAC_CATEGORY_NETWORK] = "network",
[TOMOYO_MAC_CATEGORY_MISC] = "misc",
}; };
/* Permit policy management by non-root user? */ /* Permit policy management by non-root user? */
...@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns, ...@@ -1042,8 +1068,10 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
static const struct { static const struct {
const char *keyword; const char *keyword;
int (*write) (struct tomoyo_acl_param *); int (*write) (struct tomoyo_acl_param *);
} tomoyo_callback[2] = { } tomoyo_callback[4] = {
{ "file ", tomoyo_write_file }, { "file ", tomoyo_write_file },
{ "network inet ", tomoyo_write_inet_network },
{ "network unix ", tomoyo_write_unix_network },
{ "misc ", tomoyo_write_misc }, { "misc ", tomoyo_write_misc },
}; };
u8 i; u8 i;
...@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head, ...@@ -1375,6 +1403,60 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
tomoyo_print_number_union(head, &ptr->mode); tomoyo_print_number_union(head, &ptr->mode);
tomoyo_print_number_union(head, &ptr->major); tomoyo_print_number_union(head, &ptr->major);
tomoyo_print_number_union(head, &ptr->minor); tomoyo_print_number_union(head, &ptr->minor);
} else if (acl_type == TOMOYO_TYPE_INET_ACL) {
struct tomoyo_inet_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network inet ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_set_space(head);
if (ptr->address.group) {
tomoyo_set_string(head, "@");
tomoyo_set_string(head, ptr->address.group->group_name
->name);
} else {
char buf[128];
tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
tomoyo_io_printf(head, "%s", buf);
}
tomoyo_print_number_union(head, &ptr->port);
} else if (acl_type == TOMOYO_TYPE_UNIX_ACL) {
struct tomoyo_unix_acl *ptr =
container_of(acl, typeof(*ptr), head);
const u8 perm = ptr->perm;
for (bit = 0; bit < TOMOYO_MAX_NETWORK_OPERATION; bit++) {
if (!(perm & (1 << bit)))
continue;
if (first) {
tomoyo_set_group(head, "network unix ");
tomoyo_set_string(head, tomoyo_proto_keyword
[ptr->protocol]);
tomoyo_set_space(head);
first = false;
} else {
tomoyo_set_slash(head);
}
tomoyo_set_string(head, tomoyo_socket_keyword[bit]);
}
if (first)
return true;
tomoyo_print_name_union(head, &ptr->name);
} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) { } else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
struct tomoyo_mount_acl *ptr = struct tomoyo_mount_acl *ptr =
container_of(acl, typeof(*ptr), head); container_of(acl, typeof(*ptr), head);
...@@ -1548,8 +1630,9 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = { ...@@ -1548,8 +1630,9 @@ static const char *tomoyo_transition_type[TOMOYO_MAX_TRANSITION_TYPE] = {
/* String table for grouping keywords. */ /* String table for grouping keywords. */
static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = { static const char *tomoyo_group_name[TOMOYO_MAX_GROUP] = {
[TOMOYO_PATH_GROUP] = "path_group ", [TOMOYO_PATH_GROUP] = "path_group ",
[TOMOYO_NUMBER_GROUP] = "number_group ", [TOMOYO_NUMBER_GROUP] = "number_group ",
[TOMOYO_ADDRESS_GROUP] = "address_group ",
}; };
/** /**
...@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head) ...@@ -1591,7 +1674,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
} }
/** /**
* tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group" list. * tomoyo_read_group - Read "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
* *
* @head: Pointer to "struct tomoyo_io_buffer". * @head: Pointer to "struct tomoyo_io_buffer".
* @idx: Index number. * @idx: Index number.
...@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx) ...@@ -1628,6 +1711,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
(ptr, (ptr,
struct tomoyo_number_group, struct tomoyo_number_group,
head)->number); head)->number);
} else if (idx == TOMOYO_ADDRESS_GROUP) {
char buffer[128];
struct tomoyo_address_group *member =
container_of(ptr, typeof(*member),
head);
tomoyo_print_ip(buffer, sizeof(buffer),
&member->address);
tomoyo_io_printf(head, " %s", buffer);
} }
tomoyo_set_lf(head); tomoyo_set_lf(head);
} }
......
...@@ -23,6 +23,16 @@ ...@@ -23,6 +23,16 @@
#include <linux/poll.h> #include <linux/poll.h>
#include <linux/binfmts.h> #include <linux/binfmts.h>
#include <linux/highmem.h> #include <linux/highmem.h>
#include <linux/net.h>
#include <linux/inet.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/un.h>
#include <net/sock.h>
#include <net/af_unix.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <net/udp.h>
/********** Constants definitions. **********/ /********** Constants definitions. **********/
...@@ -34,6 +44,12 @@ ...@@ -34,6 +44,12 @@
#define TOMOYO_HASH_BITS 8 #define TOMOYO_HASH_BITS 8
#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
/*
* TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET.
* Therefore, we don't need SOCK_MAX.
*/
#define TOMOYO_SOCK_MAX 6
#define TOMOYO_EXEC_TMPSIZE 4096 #define TOMOYO_EXEC_TMPSIZE 4096
/* Profile number is an integer between 0 and 255. */ /* Profile number is an integer between 0 and 255. */
...@@ -136,6 +152,7 @@ enum tomoyo_mode_index { ...@@ -136,6 +152,7 @@ enum tomoyo_mode_index {
/* Index numbers for entry type. */ /* Index numbers for entry type. */
enum tomoyo_policy_id { enum tomoyo_policy_id {
TOMOYO_ID_GROUP, TOMOYO_ID_GROUP,
TOMOYO_ID_ADDRESS_GROUP,
TOMOYO_ID_PATH_GROUP, TOMOYO_ID_PATH_GROUP,
TOMOYO_ID_NUMBER_GROUP, TOMOYO_ID_NUMBER_GROUP,
TOMOYO_ID_TRANSITION_CONTROL, TOMOYO_ID_TRANSITION_CONTROL,
...@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index { ...@@ -166,6 +183,7 @@ enum tomoyo_domain_info_flags_index {
enum tomoyo_group_id { enum tomoyo_group_id {
TOMOYO_PATH_GROUP, TOMOYO_PATH_GROUP,
TOMOYO_NUMBER_GROUP, TOMOYO_NUMBER_GROUP,
TOMOYO_ADDRESS_GROUP,
TOMOYO_MAX_GROUP TOMOYO_MAX_GROUP
}; };
...@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index { ...@@ -196,6 +214,8 @@ enum tomoyo_acl_entry_type_index {
TOMOYO_TYPE_PATH_NUMBER_ACL, TOMOYO_TYPE_PATH_NUMBER_ACL,
TOMOYO_TYPE_MKDEV_ACL, TOMOYO_TYPE_MKDEV_ACL,
TOMOYO_TYPE_MOUNT_ACL, TOMOYO_TYPE_MOUNT_ACL,
TOMOYO_TYPE_INET_ACL,
TOMOYO_TYPE_UNIX_ACL,
TOMOYO_TYPE_ENV_ACL, TOMOYO_TYPE_ENV_ACL,
}; };
...@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index { ...@@ -229,6 +249,15 @@ enum tomoyo_mkdev_acl_index {
TOMOYO_MAX_MKDEV_OPERATION TOMOYO_MAX_MKDEV_OPERATION
}; };
/* Index numbers for socket operations. */
enum tomoyo_network_acl_index {
TOMOYO_NETWORK_BIND, /* bind() operation. */
TOMOYO_NETWORK_LISTEN, /* listen() operation. */
TOMOYO_NETWORK_CONNECT, /* connect() operation. */
TOMOYO_NETWORK_SEND, /* send() operation. */
TOMOYO_MAX_NETWORK_OPERATION
};
/* Index numbers for access controls with two pathnames. */ /* Index numbers for access controls with two pathnames. */
enum tomoyo_path2_acl_index { enum tomoyo_path2_acl_index {
TOMOYO_TYPE_LINK, TOMOYO_TYPE_LINK,
...@@ -301,6 +330,21 @@ enum tomoyo_mac_index { ...@@ -301,6 +330,21 @@ enum tomoyo_mac_index {
TOMOYO_MAC_FILE_MOUNT, TOMOYO_MAC_FILE_MOUNT,
TOMOYO_MAC_FILE_UMOUNT, TOMOYO_MAC_FILE_UMOUNT,
TOMOYO_MAC_FILE_PIVOT_ROOT, TOMOYO_MAC_FILE_PIVOT_ROOT,
TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
TOMOYO_MAC_NETWORK_INET_RAW_BIND,
TOMOYO_MAC_NETWORK_INET_RAW_SEND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
TOMOYO_MAC_ENVIRON, TOMOYO_MAC_ENVIRON,
TOMOYO_MAX_MAC_INDEX TOMOYO_MAX_MAC_INDEX
}; };
...@@ -308,6 +352,7 @@ enum tomoyo_mac_index { ...@@ -308,6 +352,7 @@ enum tomoyo_mac_index {
/* Index numbers for category of functionality. */ /* Index numbers for category of functionality. */
enum tomoyo_mac_category_index { enum tomoyo_mac_category_index {
TOMOYO_MAC_CATEGORY_FILE, TOMOYO_MAC_CATEGORY_FILE,
TOMOYO_MAC_CATEGORY_NETWORK,
TOMOYO_MAC_CATEGORY_MISC, TOMOYO_MAC_CATEGORY_MISC,
TOMOYO_MAX_MAC_CATEGORY_INDEX TOMOYO_MAX_MAC_CATEGORY_INDEX
}; };
...@@ -402,6 +447,22 @@ struct tomoyo_request_info { ...@@ -402,6 +447,22 @@ struct tomoyo_request_info {
struct { struct {
const struct tomoyo_path_info *name; const struct tomoyo_path_info *name;
} environ; } environ;
struct {
const __be32 *address;
u16 port;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
bool is_ipv6;
} inet_network;
struct {
const struct tomoyo_path_info *address;
/* One of values smaller than TOMOYO_SOCK_MAX. */
u8 protocol;
/* One of values in "enum tomoyo_network_acl_index". */
u8 operation;
} unix_network;
struct { struct {
const struct tomoyo_path_info *type; const struct tomoyo_path_info *type;
const struct tomoyo_path_info *dir; const struct tomoyo_path_info *dir;
...@@ -448,7 +509,14 @@ struct tomoyo_number_union { ...@@ -448,7 +509,14 @@ struct tomoyo_number_union {
u8 value_type[2]; u8 value_type[2];
}; };
/* Structure for "path_group"/"number_group" directive. */ /* Structure for holding an IP address. */
struct tomoyo_ipaddr_union {
struct in6_addr ip[2]; /* Big endian. */
struct tomoyo_group *group; /* Pointer to address group. */
bool is_ipv6; /* Valid only if @group == NULL. */
};
/* Structure for "path_group"/"number_group"/"address_group" directive. */
struct tomoyo_group { struct tomoyo_group {
struct tomoyo_shared_acl_head head; struct tomoyo_shared_acl_head head;
const struct tomoyo_path_info *group_name; const struct tomoyo_path_info *group_name;
...@@ -467,6 +535,13 @@ struct tomoyo_number_group { ...@@ -467,6 +535,13 @@ struct tomoyo_number_group {
struct tomoyo_number_union number; struct tomoyo_number_union number;
}; };
/* Structure for "address_group" directive. */
struct tomoyo_address_group {
struct tomoyo_acl_head head;
/* Structure for holding an IP address. */
struct tomoyo_ipaddr_union address;
};
/* Subset of "struct stat". Used by conditional ACL and audit logs. */ /* Subset of "struct stat". Used by conditional ACL and audit logs. */
struct tomoyo_mini_stat { struct tomoyo_mini_stat {
uid_t uid; uid_t uid;
...@@ -650,6 +725,23 @@ struct tomoyo_env_acl { ...@@ -650,6 +725,23 @@ struct tomoyo_env_acl {
const struct tomoyo_path_info *env; /* environment variable */ const struct tomoyo_path_info *env; /* environment variable */
}; };
/* Structure for "network inet" directive. */
struct tomoyo_inet_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_ipaddr_union address;
struct tomoyo_number_union port;
};
/* Structure for "network unix" directive. */
struct tomoyo_unix_acl {
struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */
u8 protocol;
u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */
struct tomoyo_name_union name;
};
/* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */
struct tomoyo_acl_param { struct tomoyo_acl_param {
char *data; char *data;
...@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace { ...@@ -793,6 +885,8 @@ struct tomoyo_policy_namespace {
/********** Function prototypes. **********/ /********** Function prototypes. **********/
bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
const struct tomoyo_group *group);
bool tomoyo_compare_number_union(const unsigned long value, bool tomoyo_compare_number_union(const unsigned long value,
const struct tomoyo_number_union *ptr); const struct tomoyo_number_union *ptr);
bool tomoyo_condition(struct tomoyo_request_info *r, bool tomoyo_condition(struct tomoyo_request_info *r,
...@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr); ...@@ -808,6 +902,8 @@ bool tomoyo_memory_ok(void *ptr);
bool tomoyo_number_matches_group(const unsigned long min, bool tomoyo_number_matches_group(const unsigned long min,
const unsigned long max, const unsigned long max,
const struct tomoyo_group *group); const struct tomoyo_group *group);
bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
struct tomoyo_ipaddr_union *ptr);
bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
struct tomoyo_name_union *ptr); struct tomoyo_name_union *ptr);
bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
...@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, ...@@ -817,6 +913,7 @@ bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
bool tomoyo_permstr(const char *string, const char *keyword); bool tomoyo_permstr(const char *string, const char *keyword);
bool tomoyo_str_starts(char **src, const char *find); bool tomoyo_str_starts(char **src, const char *find);
char *tomoyo_encode(const char *str); char *tomoyo_encode(const char *str);
char *tomoyo_encode2(const char *str, int str_len);
char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
va_list args); va_list args);
char *tomoyo_read_token(struct tomoyo_acl_param *param); char *tomoyo_read_token(struct tomoyo_acl_param *param);
...@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, ...@@ -855,6 +952,13 @@ int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
const struct tomoyo_path_info *filename); const struct tomoyo_path_info *filename);
int tomoyo_poll_control(struct file *file, poll_table *wait); int tomoyo_poll_control(struct file *file, poll_table *wait);
int tomoyo_poll_log(struct file *file, poll_table *wait); int tomoyo_poll_log(struct file *file, poll_table *wait);
int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
int addr_len);
int tomoyo_socket_connect_permission(struct socket *sock,
struct sockaddr *addr, int addr_len);
int tomoyo_socket_listen_permission(struct socket *sock);
int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
int size);
int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
__printf(2, 3); __printf(2, 3);
int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
...@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param); ...@@ -874,8 +978,10 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
int tomoyo_write_file(struct tomoyo_acl_param *param); int tomoyo_write_file(struct tomoyo_acl_param *param);
int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
int tomoyo_write_misc(struct tomoyo_acl_param *param); int tomoyo_write_misc(struct tomoyo_acl_param *param);
int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
int tomoyo_write_transition_control(struct tomoyo_acl_param *param, int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
const u8 type); const u8 type);
int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
const int buffer_len); const int buffer_len);
ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
...@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename); ...@@ -911,6 +1017,8 @@ void tomoyo_load_policy(const char *filename);
void tomoyo_memory_free(void *ptr); void tomoyo_memory_free(void *ptr);
void tomoyo_normalize_line(unsigned char *buffer); void tomoyo_normalize_line(unsigned char *buffer);
void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
void tomoyo_print_ip(char *buf, const unsigned int size,
const struct tomoyo_ipaddr_union *ptr);
void tomoyo_print_ulong(char *buffer, const int buffer_len, void tomoyo_print_ulong(char *buffer, const int buffer_len,
const unsigned long value, const u8 type); const unsigned long value, const u8 type);
void tomoyo_put_name_union(struct tomoyo_name_union *ptr); void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
...@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX ...@@ -933,6 +1041,8 @@ extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
+ TOMOYO_MAX_MAC_CATEGORY_INDEX]; + TOMOYO_MAX_MAC_CATEGORY_INDEX];
extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
...@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union ...@@ -1111,6 +1221,21 @@ static inline bool tomoyo_same_number_union
a->value_type[1] == b->value_type[1]; a->value_type[1] == b->value_type[1];
} }
/**
* tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry.
*
* @a: Pointer to "struct tomoyo_ipaddr_union".
* @b: Pointer to "struct tomoyo_ipaddr_union".
*
* Returns true if @a == @b, false otherwise.
*/
static inline bool tomoyo_same_ipaddr_union
(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
{
return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
a->is_ipv6 == b->is_ipv6;
}
/** /**
* tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread.
* *
......
...@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock); ...@@ -16,6 +16,7 @@ static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
/* Size of an element. */ /* Size of an element. */
static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = { static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
[TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group), [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
[TOMOYO_ID_ADDRESS_GROUP] = sizeof(struct tomoyo_address_group),
[TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group), [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
[TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group), [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
[TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator), [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
...@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = { ...@@ -36,6 +37,8 @@ static const u8 tomoyo_acl_size[] = {
[TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl), [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
[TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl), [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
[TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl), [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
[TOMOYO_TYPE_INET_ACL] = sizeof(struct tomoyo_inet_acl),
[TOMOYO_TYPE_UNIX_ACL] = sizeof(struct tomoyo_unix_acl),
[TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl), [TOMOYO_TYPE_ENV_ACL] = sizeof(struct tomoyo_env_acl),
}; };
...@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element) ...@@ -302,6 +305,23 @@ static void tomoyo_del_acl(struct list_head *element)
tomoyo_put_name(entry->env); tomoyo_put_name(entry->env);
} }
break; break;
case TOMOYO_TYPE_INET_ACL:
{
struct tomoyo_inet_acl *entry =
container_of(acl, typeof(*entry), head);
tomoyo_put_group(entry->address.group);
tomoyo_put_number_union(&entry->port);
}
break;
case TOMOYO_TYPE_UNIX_ACL:
{
struct tomoyo_unix_acl *entry =
container_of(acl, typeof(*entry), head);