?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
TOMOYO: Allow controlling generation of access granted logs for per an entry basis.
[linux-2.6.git] / security / tomoyo / condition.c
blob3a05eb3e2a643f4b973c65173e479b89db4a319d
1 /*
2 * security/tomoyo/condition.c
3 *
4 * Copyright (C) 2005-2011 NTT DATA CORPORATION
5 */
6
7 #include "common.h"
8 #include <linux/slab.h>
9
10 /* List of "struct tomoyo_condition". */
11 LIST_HEAD(tomoyo_condition_list);
12
13 /**
14 * tomoyo_argv - Check argv[] in "struct linux_binbrm".
15 *
16 * @index: Index number of @arg_ptr.
17 * @arg_ptr: Contents of argv[@index].
18 * @argc: Length of @argv.
19 * @argv: Pointer to "struct tomoyo_argv".
20 * @checked: Set to true if @argv[@index] was found.
21 *
22 * Returns true on success, false otherwise.
23 */
24 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
25 const int argc, const struct tomoyo_argv *argv,
26 u8 *checked)
27 {
28 int i;
29 struct tomoyo_path_info arg;
30 arg.name = arg_ptr;
31 for (i = 0; i < argc; argv++, checked++, i++) {
32 bool result;
33 if (index != argv->index)
34 continue;
35 *checked = 1;
36 tomoyo_fill_path_info(&arg);
37 result = tomoyo_path_matches_pattern(&arg, argv->value);
38 if (argv->is_not)
39 result = !result;
40 if (!result)
41 return false;
42 }
43 return true;
44 }
45
46 /**
47 * tomoyo_envp - Check envp[] in "struct linux_binbrm".
48 *
49 * @env_name: The name of environment variable.
50 * @env_value: The value of environment variable.
51 * @envc: Length of @envp.
52 * @envp: Pointer to "struct tomoyo_envp".
53 * @checked: Set to true if @envp[@env_name] was found.
54 *
55 * Returns true on success, false otherwise.
56 */
57 static bool tomoyo_envp(const char *env_name, const char *env_value,
58 const int envc, const struct tomoyo_envp *envp,
59 u8 *checked)
60 {
61 int i;
62 struct tomoyo_path_info name;
63 struct tomoyo_path_info value;
64 name.name = env_name;
65 tomoyo_fill_path_info(&name);
66 value.name = env_value;
67 tomoyo_fill_path_info(&value);
68 for (i = 0; i < envc; envp++, checked++, i++) {
69 bool result;
70 if (!tomoyo_path_matches_pattern(&name, envp->name))
71 continue;
72 *checked = 1;
73 if (envp->value) {
74 result = tomoyo_path_matches_pattern(&value,
75 envp->value);
76 if (envp->is_not)
77 result = !result;
78 } else {
79 result = true;
80 if (!envp->is_not)
81 result = !result;
82 }
83 if (!result)
84 return false;
85 }
86 return true;
87 }
88
89 /**
90 * tomoyo_scan_bprm - Scan "struct linux_binprm".
91 *
92 * @ee: Pointer to "struct tomoyo_execve".
93 * @argc: Length of @argc.
94 * @argv: Pointer to "struct tomoyo_argv".
95 * @envc: Length of @envp.
96 * @envp: Poiner to "struct tomoyo_envp".
97 *
98 * Returns true on success, false otherwise.
99 */
100 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
101 const u16 argc, const struct tomoyo_argv *argv,
102 const u16 envc, const struct tomoyo_envp *envp)
103 {
104 struct linux_binprm *bprm = ee->bprm;
105 struct tomoyo_page_dump *dump = &ee->dump;
106 char *arg_ptr = ee->tmp;
107 int arg_len = 0;
108 unsigned long pos = bprm->p;
109 int offset = pos % PAGE_SIZE;
110 int argv_count = bprm->argc;
111 int envp_count = bprm->envc;
112 bool result = true;
113 u8 local_checked[32];
114 u8 *checked;
115 if (argc + envc <= sizeof(local_checked)) {
116 checked = local_checked;
117 memset(local_checked, 0, sizeof(local_checked));
118 } else {
119 checked = kzalloc(argc + envc, GFP_NOFS);
120 if (!checked)
121 return false;
122 }
123 while (argv_count || envp_count) {
124 if (!tomoyo_dump_page(bprm, pos, dump)) {
125 result = false;
126 goto out;
127 }
128 pos += PAGE_SIZE - offset;
129 while (offset < PAGE_SIZE) {
130 /* Read. */
131 const char *kaddr = dump->data;
132 const unsigned char c = kaddr[offset++];
133 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
134 if (c == '\\') {
135 arg_ptr[arg_len++] = '\\';
136 arg_ptr[arg_len++] = '\\';
137 } else if (c > ' ' && c < 127) {
138 arg_ptr[arg_len++] = c;
139 } else {
140 arg_ptr[arg_len++] = '\\';
141 arg_ptr[arg_len++] = (c >> 6) + '0';
142 arg_ptr[arg_len++] =
143 ((c >> 3) & 7) + '0';
144 arg_ptr[arg_len++] = (c & 7) + '0';
145 }
146 } else {
147 arg_ptr[arg_len] = '\0';
148 }
149 if (c)
150 continue;
151 /* Check. */
152 if (argv_count) {
153 if (!tomoyo_argv(bprm->argc - argv_count,
154 arg_ptr, argc, argv,
155 checked)) {
156 result = false;
157 break;
158 }
159 argv_count--;
160 } else if (envp_count) {
161 char *cp = strchr(arg_ptr, '=');
162 if (cp) {
163 *cp = '\0';
164 if (!tomoyo_envp(arg_ptr, cp + 1,
165 envc, envp,
166 checked + argc)) {
167 result = false;
168 break;
169 }
170 }
171 envp_count--;
172 } else {
173 break;
174 }
175 arg_len = 0;
176 }
177 offset = 0;
178 if (!result)
179 break;
180 }
181 out:
182 if (result) {
183 int i;
184 /* Check not-yet-checked entries. */
185 for (i = 0; i < argc; i++) {
186 if (checked[i])
187 continue;
188 /*
189 * Return true only if all unchecked indexes in
190 * bprm->argv[] are not matched.
191 */
192 if (argv[i].is_not)
193 continue;
194 result = false;
195 break;
196 }
197 for (i = 0; i < envc; envp++, i++) {
198 if (checked[argc + i])
199 continue;
200 /*
201 * Return true only if all unchecked environ variables
202 * in bprm->envp[] are either undefined or not matched.
203 */
204 if ((!envp->value && !envp->is_not) ||
205 (envp->value && envp->is_not))
206 continue;
207 result = false;
208 break;
209 }
210 }
211 if (checked != local_checked)
212 kfree(checked);
213 return result;
214 }
215
216 /**
217 * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition".
218 *
219 * @file: Pointer to "struct file".
220 * @ptr: Pointer to "struct tomoyo_name_union".
221 * @match: True if "exec.realpath=", false if "exec.realpath!=".
222 *
223 * Returns true on success, false otherwise.
224 */
225 static bool tomoyo_scan_exec_realpath(struct file *file,
226 const struct tomoyo_name_union *ptr,
227 const bool match)
228 {
229 bool result;
230 struct tomoyo_path_info exe;
231 if (!file)
232 return false;
233 exe.name = tomoyo_realpath_from_path(&file->f_path);
234 if (!exe.name)
235 return false;
236 tomoyo_fill_path_info(&exe);
237 result = tomoyo_compare_name_union(&exe, ptr);
238 kfree(exe.name);
239 return result == match;
240 }
241
242 /**
243 * tomoyo_get_dqword - tomoyo_get_name() for a quoted string.
244 *
245 * @start: String to save.
246 *
247 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
248 */
249 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
250 {
251 char *cp = start + strlen(start) - 1;
252 if (cp == start || *start++ != '"' || *cp != '"')
253 return NULL;
254 *cp = '\0';
255 if (*start && !tomoyo_correct_word(start))
256 return NULL;
257 return tomoyo_get_name(start);
258 }
259
260 /**
261 * tomoyo_parse_name_union_quoted - Parse a quoted word.
262 *
263 * @param: Pointer to "struct tomoyo_acl_param".
264 * @ptr: Pointer to "struct tomoyo_name_union".
265 *
266 * Returns true on success, false otherwise.
267 */
268 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
269 struct tomoyo_name_union *ptr)
270 {
271 char *filename = param->data;
272 if (*filename == '@')
273 return tomoyo_parse_name_union(param, ptr);
274 ptr->filename = tomoyo_get_dqword(filename);
275 return ptr->filename != NULL;
276 }
277
278 /**
279 * tomoyo_parse_argv - Parse an argv[] condition part.
280 *
281 * @left: Lefthand value.
282 * @right: Righthand value.
283 * @argv: Pointer to "struct tomoyo_argv".
284 *
285 * Returns true on success, false otherwise.
286 */
287 static bool tomoyo_parse_argv(char *left, char *right,
288 struct tomoyo_argv *argv)
289 {
290 if (tomoyo_parse_ulong(&argv->index, &left) !=
291 TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left)
292 return false;
293 argv->value = tomoyo_get_dqword(right);
294 return argv->value != NULL;
295 }
296
297 /**
298 * tomoyo_parse_envp - Parse an envp[] condition part.
299 *
300 * @left: Lefthand value.
301 * @right: Righthand value.
302 * @envp: Pointer to "struct tomoyo_envp".
303 *
304 * Returns true on success, false otherwise.
305 */
306 static bool tomoyo_parse_envp(char *left, char *right,
307 struct tomoyo_envp *envp)
308 {
309 const struct tomoyo_path_info *name;
310 const struct tomoyo_path_info *value;
311 char *cp = left + strlen(left) - 1;
312 if (*cp-- != ']' || *cp != '"')
313 goto out;
314 *cp = '\0';
315 if (!tomoyo_correct_word(left))
316 goto out;
317 name = tomoyo_get_name(left);
318 if (!name)
319 goto out;
320 if (!strcmp(right, "NULL")) {
321 value = NULL;
322 } else {
323 value = tomoyo_get_dqword(right);
324 if (!value) {
325 tomoyo_put_name(name);
326 goto out;
327 }
328 }
329 envp->name = name;
330 envp->value = value;
331 return true;
332 out:
333 return false;
334 }
335
336 /**
337 * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry.
338 *
339 * @a: Pointer to "struct tomoyo_condition".
340 * @b: Pointer to "struct tomoyo_condition".
341 *
342 * Returns true if @a == @b, false otherwise.
343 */
344 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
345 const struct tomoyo_condition *b)
346 {
347 return a->size == b->size && a->condc == b->condc &&
348 a->numbers_count == b->numbers_count &&
349 a->names_count == b->names_count &&
350 a->argc == b->argc && a->envc == b->envc &&
351 a->grant_log == b->grant_log &&
352 !memcmp(a + 1, b + 1, a->size - sizeof(*a));
353 }
354
355 /**
356 * tomoyo_condition_type - Get condition type.
357 *
358 * @word: Keyword string.
359 *
360 * Returns one of values in "enum tomoyo_conditions_index" on success,
361 * TOMOYO_MAX_CONDITION_KEYWORD otherwise.
362 */
363 static u8 tomoyo_condition_type(const char *word)
364 {
365 u8 i;
366 for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
367 if (!strcmp(word, tomoyo_condition_keyword[i]))
368 break;
369 }
370 return i;
371 }
372
373 /* Define this to enable debug mode. */
374 /* #define DEBUG_CONDITION */
375
376 #ifdef DEBUG_CONDITION
377 #define dprintk printk
378 #else
379 #define dprintk(...) do { } while (0)
380 #endif
381
382 /**
383 * tomoyo_commit_condition - Commit "struct tomoyo_condition".
384 *
385 * @entry: Pointer to "struct tomoyo_condition".
386 *
387 * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
388 *
389 * This function merges duplicated entries. This function returns NULL if
390 * @entry is not duplicated but memory quota for policy has exceeded.
391 */
392 static struct tomoyo_condition *tomoyo_commit_condition
393 (struct tomoyo_condition *entry)
394 {
395 struct tomoyo_condition *ptr;
396 bool found = false;
397 if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
398 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
399 ptr = NULL;
400 found = true;
401 goto out;
402 }
403 list_for_each_entry_rcu(ptr, &tomoyo_condition_list, head.list) {
404 if (!tomoyo_same_condition(ptr, entry))
405 continue;
406 /* Same entry found. Share this entry. */
407 atomic_inc(&ptr->head.users);
408 found = true;
409 break;
410 }
411 if (!found) {
412 if (tomoyo_memory_ok(entry)) {
413 atomic_set(&entry->head.users, 1);
414 list_add_rcu(&entry->head.list,
415 &tomoyo_condition_list);
416 } else {
417 found = true;
418 ptr = NULL;
419 }
420 }
421 mutex_unlock(&tomoyo_policy_lock);
422 out:
423 if (found) {
424 tomoyo_del_condition(&entry->head.list);
425 kfree(entry);
426 entry = ptr;
427 }
428 return entry;
429 }
430
431 /**
432 * tomoyo_get_condition - Parse condition part.
433 *
434 * @param: Pointer to "struct tomoyo_acl_param".
435 *
436 * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
437 */
438 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
439 {
440 struct tomoyo_condition *entry = NULL;
441 struct tomoyo_condition_element *condp = NULL;
442 struct tomoyo_number_union *numbers_p = NULL;
443 struct tomoyo_name_union *names_p = NULL;
444 struct tomoyo_argv *argv = NULL;
445 struct tomoyo_envp *envp = NULL;
446 struct tomoyo_condition e = { };
447 char * const start_of_string = param->data;
448 char * const end_of_string = start_of_string + strlen(start_of_string);
449 char *pos;
450 rerun:
451 pos = start_of_string;
452 while (1) {
453 u8 left = -1;
454 u8 right = -1;
455 char *left_word = pos;
456 char *cp;
457 char *right_word;
458 bool is_not;
459 if (!*left_word)
460 break;
461 /*
462 * Since left-hand condition does not allow use of "path_group"
463 * or "number_group" and environment variable's names do not
464 * accept '=', it is guaranteed that the original line consists
465 * of one or more repetition of $left$operator$right blocks
466 * where "$left is free from '=' and ' '" and "$operator is
467 * either '=' or '!='" and "$right is free from ' '".
468 * Therefore, we can reconstruct the original line at the end
469 * of dry run even if we overwrite $operator with '\0'.
470 */
471 cp = strchr(pos, ' ');
472 if (cp) {
473 *cp = '\0'; /* Will restore later. */
474 pos = cp + 1;
475 } else {
476 pos = "";
477 }
478 right_word = strchr(left_word, '=');
479 if (!right_word || right_word == left_word)
480 goto out;
481 is_not = *(right_word - 1) == '!';
482 if (is_not)
483 *(right_word++ - 1) = '\0'; /* Will restore later. */
484 else if (*(right_word + 1) != '=')
485 *right_word++ = '\0'; /* Will restore later. */
486 else
487 goto out;
488 dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word,
489 is_not ? "!" : "", right_word);
490 if (!strcmp(left_word, "grant_log")) {
491 if (entry) {
492 if (is_not ||
493 entry->grant_log != TOMOYO_GRANTLOG_AUTO)
494 goto out;
495 else if (!strcmp(right_word, "yes"))
496 entry->grant_log = TOMOYO_GRANTLOG_YES;
497 else if (!strcmp(right_word, "no"))
498 entry->grant_log = TOMOYO_GRANTLOG_NO;
499 else
500 goto out;
501 }
502 continue;
503 }
504 if (!strncmp(left_word, "exec.argv[", 10)) {
505 if (!argv) {
506 e.argc++;
507 e.condc++;
508 } else {
509 e.argc--;
510 e.condc--;
511 left = TOMOYO_ARGV_ENTRY;
512 argv->is_not = is_not;
513 if (!tomoyo_parse_argv(left_word + 10,
514 right_word, argv++))
515 goto out;
516 }
517 goto store_value;
518 }
519 if (!strncmp(left_word, "exec.envp[\"", 11)) {
520 if (!envp) {
521 e.envc++;
522 e.condc++;
523 } else {
524 e.envc--;
525 e.condc--;
526 left = TOMOYO_ENVP_ENTRY;
527 envp->is_not = is_not;
528 if (!tomoyo_parse_envp(left_word + 11,
529 right_word, envp++))
530 goto out;
531 }
532 goto store_value;
533 }
534 left = tomoyo_condition_type(left_word);
535 dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word,
536 left);
537 if (left == TOMOYO_MAX_CONDITION_KEYWORD) {
538 if (!numbers_p) {
539 e.numbers_count++;
540 } else {
541 e.numbers_count--;
542 left = TOMOYO_NUMBER_UNION;
543 param->data = left_word;
544 if (*left_word == '@' ||
545 !tomoyo_parse_number_union(param,
546 numbers_p++))
547 goto out;
548 }
549 }
550 if (!condp)
551 e.condc++;
552 else
553 e.condc--;
554 if (left == TOMOYO_EXEC_REALPATH ||
555 left == TOMOYO_SYMLINK_TARGET) {
556 if (!names_p) {
557 e.names_count++;
558 } else {
559 e.names_count--;
560 right = TOMOYO_NAME_UNION;
561 param->data = right_word;
562 if (!tomoyo_parse_name_union_quoted(param,
563 names_p++))
564 goto out;
565 }
566 goto store_value;
567 }
568 right = tomoyo_condition_type(right_word);
569 if (right == TOMOYO_MAX_CONDITION_KEYWORD) {
570 if (!numbers_p) {
571 e.numbers_count++;
572 } else {
573 e.numbers_count--;
574 right = TOMOYO_NUMBER_UNION;
575 param->data = right_word;
576 if (!tomoyo_parse_number_union(param,
577 numbers_p++))
578 goto out;
579 }
580 }
581 store_value:
582 if (!condp) {
583 dprintk(KERN_WARNING "%u: dry_run left=%u right=%u "
584 "match=%u\n", __LINE__, left, right, !is_not);
585 continue;
586 }
587 condp->left = left;
588 condp->right = right;
589 condp->equals = !is_not;
590 dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n",
591 __LINE__, condp->left, condp->right,
592 condp->equals);
593 condp++;
594 }
595 dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n",
596 __LINE__, e.condc, e.numbers_count, e.names_count, e.argc,
597 e.envc);
598 if (entry) {
599 BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc |
600 e.condc);
601 return tomoyo_commit_condition(entry);
602 }
603 e.size = sizeof(*entry)
604 + e.condc * sizeof(struct tomoyo_condition_element)
605 + e.numbers_count * sizeof(struct tomoyo_number_union)
606 + e.names_count * sizeof(struct tomoyo_name_union)
607 + e.argc * sizeof(struct tomoyo_argv)
608 + e.envc * sizeof(struct tomoyo_envp);
609 entry = kzalloc(e.size, GFP_NOFS);
610 if (!entry)
611 return NULL;
612 *entry = e;
613 condp = (struct tomoyo_condition_element *) (entry + 1);
614 numbers_p = (struct tomoyo_number_union *) (condp + e.condc);
615 names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count);
616 argv = (struct tomoyo_argv *) (names_p + e.names_count);
617 envp = (struct tomoyo_envp *) (argv + e.argc);
618 {
619 bool flag = false;
620 for (pos = start_of_string; pos < end_of_string; pos++) {
621 if (*pos)
622 continue;
623 if (flag) /* Restore " ". */
624 *pos = ' ';
625 else if (*(pos + 1) == '=') /* Restore "!=". */
626 *pos = '!';
627 else /* Restore "=". */
628 *pos = '=';
629 flag = !flag;
630 }
631 }
632 goto rerun;
633 out:
634 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
635 if (entry) {
636 tomoyo_del_condition(&entry->head.list);
637 kfree(entry);
638 }
639 return NULL;
640 }
641
642 /**
643 * tomoyo_get_attributes - Revalidate "struct inode".
644 *
645 * @obj: Pointer to "struct tomoyo_obj_info".
646 *
647 * Returns nothing.
648 */
649 void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
650 {
651 u8 i;
652 struct dentry *dentry = NULL;
653
654 for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
655 struct inode *inode;
656 switch (i) {
657 case TOMOYO_PATH1:
658 dentry = obj->path1.dentry;
659 if (!dentry)
660 continue;
661 break;
662 case TOMOYO_PATH2:
663 dentry = obj->path2.dentry;
664 if (!dentry)
665 continue;
666 break;
667 default:
668 if (!dentry)
669 continue;
670 dentry = dget_parent(dentry);
671 break;
672 }
673 inode = dentry->d_inode;
674 if (inode) {
675 struct tomoyo_mini_stat *stat = &obj->stat[i];
676 stat->uid = inode->i_uid;
677 stat->gid = inode->i_gid;
678 stat->ino = inode->i_ino;
679 stat->mode = inode->i_mode;
680 stat->dev = inode->i_sb->s_dev;
681 stat->rdev = inode->i_rdev;
682 obj->stat_valid[i] = true;
683 }
684 if (i & 1) /* i == TOMOYO_PATH1_PARENT ||
685 i == TOMOYO_PATH2_PARENT */
686 dput(dentry);
687 }
688 }
689
690 /**
691 * tomoyo_condition - Check condition part.
692 *
693 * @r: Pointer to "struct tomoyo_request_info".
694 * @cond: Pointer to "struct tomoyo_condition". Maybe NULL.
695 *
696 * Returns true on success, false otherwise.
697 *
698 * Caller holds tomoyo_read_lock().
699 */
700 bool tomoyo_condition(struct tomoyo_request_info *r,
701 const struct tomoyo_condition *cond)
702 {
703 u32 i;
704 unsigned long min_v[2] = { 0, 0 };
705 unsigned long max_v[2] = { 0, 0 };
706 const struct tomoyo_condition_element *condp;
707 const struct tomoyo_number_union *numbers_p;
708 const struct tomoyo_name_union *names_p;
709 const struct tomoyo_argv *argv;
710 const struct tomoyo_envp *envp;
711 struct tomoyo_obj_info *obj;
712 u16 condc;
713 u16 argc;
714 u16 envc;
715 struct linux_binprm *bprm = NULL;
716 if (!cond)
717 return true;
718 condc = cond->condc;
719 argc = cond->argc;
720 envc = cond->envc;
721 obj = r->obj;
722 if (r->ee)
723 bprm = r->ee->bprm;
724 if (!bprm && (argc || envc))
725 return false;
726 condp = (struct tomoyo_condition_element *) (cond + 1);
727 numbers_p = (const struct tomoyo_number_union *) (condp + condc);
728 names_p = (const struct tomoyo_name_union *)
729 (numbers_p + cond->numbers_count);
730 argv = (const struct tomoyo_argv *) (names_p + cond->names_count);
731 envp = (const struct tomoyo_envp *) (argv + argc);
732 for (i = 0; i < condc; i++) {
733 const bool match = condp->equals;
734 const u8 left = condp->left;
735 const u8 right = condp->right;
736 bool is_bitop[2] = { false, false };
737 u8 j;
738 condp++;
739 /* Check argv[] and envp[] later. */
740 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
741 continue;
742 /* Check string expressions. */
743 if (right == TOMOYO_NAME_UNION) {
744 const struct tomoyo_name_union *ptr = names_p++;
745 switch (left) {
746 struct tomoyo_path_info *symlink;
747 struct tomoyo_execve *ee;
748 struct file *file;
749 case TOMOYO_SYMLINK_TARGET:
750 symlink = obj ? obj->symlink_target : NULL;
751 if (!symlink ||
752 !tomoyo_compare_name_union(symlink, ptr)
753 == match)
754 goto out;
755 break;
756 case TOMOYO_EXEC_REALPATH:
757 ee = r->ee;
758 file = ee ? ee->bprm->file : NULL;
759 if (!tomoyo_scan_exec_realpath(file, ptr,
760 match))
761 goto out;
762 break;
763 }
764 continue;
765 }
766 /* Check numeric or bit-op expressions. */
767 for (j = 0; j < 2; j++) {
768 const u8 index = j ? right : left;
769 unsigned long value = 0;
770 switch (index) {
771 case TOMOYO_TASK_UID:
772 value = current_uid();
773 break;
774 case TOMOYO_TASK_EUID:
775 value = current_euid();
776 break;
777 case TOMOYO_TASK_SUID:
778 value = current_suid();
779 break;
780 case TOMOYO_TASK_FSUID:
781 value = current_fsuid();
782 break;
783 case TOMOYO_TASK_GID:
784 value = current_gid();
785 break;
786 case TOMOYO_TASK_EGID:
787 value = current_egid();
788 break;
789 case TOMOYO_TASK_SGID:
790 value = current_sgid();
791 break;
792 case TOMOYO_TASK_FSGID:
793 value = current_fsgid();
794 break;
795 case TOMOYO_TASK_PID:
796 value = tomoyo_sys_getpid();
797 break;
798 case TOMOYO_TASK_PPID:
799 value = tomoyo_sys_getppid();
800 break;
801 case TOMOYO_TYPE_IS_SOCKET:
802 value = S_IFSOCK;
803 break;
804 case TOMOYO_TYPE_IS_SYMLINK:
805 value = S_IFLNK;
806 break;
807 case TOMOYO_TYPE_IS_FILE:
808 value = S_IFREG;
809 break;
810 case TOMOYO_TYPE_IS_BLOCK_DEV:
811 value = S_IFBLK;
812 break;
813 case TOMOYO_TYPE_IS_DIRECTORY:
814 value = S_IFDIR;
815 break;
816 case TOMOYO_TYPE_IS_CHAR_DEV:
817 value = S_IFCHR;
818 break;
819 case TOMOYO_TYPE_IS_FIFO:
820 value = S_IFIFO;
821 break;
822 case TOMOYO_MODE_SETUID:
823 value = S_ISUID;
824 break;
825 case TOMOYO_MODE_SETGID:
826 value = S_ISGID;
827 break;
828 case TOMOYO_MODE_STICKY:
829 value = S_ISVTX;
830 break;
831 case TOMOYO_MODE_OWNER_READ:
832 value = S_IRUSR;
833 break;
834 case TOMOYO_MODE_OWNER_WRITE:
835 value = S_IWUSR;
836 break;
837 case TOMOYO_MODE_OWNER_EXECUTE:
838 value = S_IXUSR;
839 break;
840 case TOMOYO_MODE_GROUP_READ:
841 value = S_IRGRP;
842 break;
843 case TOMOYO_MODE_GROUP_WRITE:
844 value = S_IWGRP;
845 break;
846 case TOMOYO_MODE_GROUP_EXECUTE:
847 value = S_IXGRP;
848 break;
849 case TOMOYO_MODE_OTHERS_READ:
850 value = S_IROTH;
851 break;
852 case TOMOYO_MODE_OTHERS_WRITE:
853 value = S_IWOTH;
854 break;
855 case TOMOYO_MODE_OTHERS_EXECUTE:
856 value = S_IXOTH;
857 break;
858 case TOMOYO_EXEC_ARGC:
859 if (!bprm)
860 goto out;
861 value = bprm->argc;
862 break;
863 case TOMOYO_EXEC_ENVC:
864 if (!bprm)
865 goto out;
866 value = bprm->envc;
867 break;
868 case TOMOYO_NUMBER_UNION:
869 /* Fetch values later. */
870 break;
871 default:
872 if (!obj)
873 goto out;
874 if (!obj->validate_done) {
875 tomoyo_get_attributes(obj);
876 obj->validate_done = true;
877 }
878 {
879 u8 stat_index;
880 struct tomoyo_mini_stat *stat;
881 switch (index) {
882 case TOMOYO_PATH1_UID:
883 case TOMOYO_PATH1_GID:
884 case TOMOYO_PATH1_INO:
885 case TOMOYO_PATH1_MAJOR:
886 case TOMOYO_PATH1_MINOR:
887 case TOMOYO_PATH1_TYPE:
888 case TOMOYO_PATH1_DEV_MAJOR:
889 case TOMOYO_PATH1_DEV_MINOR:
890 case TOMOYO_PATH1_PERM:
891 stat_index = TOMOYO_PATH1;
892 break;
893 case TOMOYO_PATH2_UID:
894 case TOMOYO_PATH2_GID:
895 case TOMOYO_PATH2_INO:
896 case TOMOYO_PATH2_MAJOR:
897 case TOMOYO_PATH2_MINOR:
898 case TOMOYO_PATH2_TYPE:
899 case TOMOYO_PATH2_DEV_MAJOR:
900 case TOMOYO_PATH2_DEV_MINOR:
901 case TOMOYO_PATH2_PERM:
902 stat_index = TOMOYO_PATH2;
903 break;
904 case TOMOYO_PATH1_PARENT_UID:
905 case TOMOYO_PATH1_PARENT_GID:
906 case TOMOYO_PATH1_PARENT_INO:
907 case TOMOYO_PATH1_PARENT_PERM:
908 stat_index =
909 TOMOYO_PATH1_PARENT;
910 break;
911 case TOMOYO_PATH2_PARENT_UID:
912 case TOMOYO_PATH2_PARENT_GID:
913 case TOMOYO_PATH2_PARENT_INO:
914 case TOMOYO_PATH2_PARENT_PERM:
915 stat_index =
916 TOMOYO_PATH2_PARENT;
917 break;
918 default:
919 goto out;
920 }
921 if (!obj->stat_valid[stat_index])
922 goto out;
923 stat = &obj->stat[stat_index];
924 switch (index) {
925 case TOMOYO_PATH1_UID:
926 case TOMOYO_PATH2_UID:
927 case TOMOYO_PATH1_PARENT_UID:
928 case TOMOYO_PATH2_PARENT_UID:
929 value = stat->uid;
930 break;
931 case TOMOYO_PATH1_GID:
932 case TOMOYO_PATH2_GID:
933 case TOMOYO_PATH1_PARENT_GID:
934 case TOMOYO_PATH2_PARENT_GID:
935 value = stat->gid;
936 break;
937 case TOMOYO_PATH1_INO:
938 case TOMOYO_PATH2_INO:
939 case TOMOYO_PATH1_PARENT_INO:
940 case TOMOYO_PATH2_PARENT_INO:
941 value = stat->ino;
942 break;
943 case TOMOYO_PATH1_MAJOR:
944 case TOMOYO_PATH2_MAJOR:
945 value = MAJOR(stat->dev);
946 break;
947 case TOMOYO_PATH1_MINOR:
948 case TOMOYO_PATH2_MINOR:
949 value = MINOR(stat->dev);
950 break;
951 case TOMOYO_PATH1_TYPE:
952 case TOMOYO_PATH2_TYPE:
953 value = stat->mode & S_IFMT;
954 break;
955 case TOMOYO_PATH1_DEV_MAJOR:
956 case TOMOYO_PATH2_DEV_MAJOR:
957 value = MAJOR(stat->rdev);
958 break;
959 case TOMOYO_PATH1_DEV_MINOR:
960 case TOMOYO_PATH2_DEV_MINOR:
961 value = MINOR(stat->rdev);
962 break;
963 case TOMOYO_PATH1_PERM:
964 case TOMOYO_PATH2_PERM:
965 case TOMOYO_PATH1_PARENT_PERM:
966 case TOMOYO_PATH2_PARENT_PERM:
967 value = stat->mode & S_IALLUGO;
968 break;
969 }
970 }
971 break;
972 }
973 max_v[j] = value;
974 min_v[j] = value;
975 switch (index) {
976 case TOMOYO_MODE_SETUID:
977 case TOMOYO_MODE_SETGID:
978 case TOMOYO_MODE_STICKY:
979 case TOMOYO_MODE_OWNER_READ:
980 case TOMOYO_MODE_OWNER_WRITE:
981 case TOMOYO_MODE_OWNER_EXECUTE:
982 case TOMOYO_MODE_GROUP_READ:
983 case TOMOYO_MODE_GROUP_WRITE:
984 case TOMOYO_MODE_GROUP_EXECUTE:
985 case TOMOYO_MODE_OTHERS_READ:
986 case TOMOYO_MODE_OTHERS_WRITE:
987 case TOMOYO_MODE_OTHERS_EXECUTE:
988 is_bitop[j] = true;
989 }
990 }
991 if (left == TOMOYO_NUMBER_UNION) {
992 /* Fetch values now. */
993 const struct tomoyo_number_union *ptr = numbers_p++;
994 min_v[0] = ptr->values[0];
995 max_v[0] = ptr->values[1];
996 }
997 if (right == TOMOYO_NUMBER_UNION) {
998 /* Fetch values now. */
999 const struct tomoyo_number_union *ptr = numbers_p++;
1000 if (ptr->group) {
1001 if (tomoyo_number_matches_group(min_v[0],
1002 max_v[0],
1003 ptr->group)
1004 == match)
1005 continue;
1006 } else {
1007 if ((min_v[0] <= ptr->values[1] &&
1008 max_v[0] >= ptr->values[0]) == match)
1009 continue;
1010 }
1011 goto out;
1012 }
1013 /*
1014 * Bit operation is valid only when counterpart value
1015 * represents permission.
1016 */
1017 if (is_bitop[0] && is_bitop[1]) {
1018 goto out;
1019 } else if (is_bitop[0]) {
1020 switch (right) {
1021 case TOMOYO_PATH1_PERM:
1022 case TOMOYO_PATH1_PARENT_PERM:
1023 case TOMOYO_PATH2_PERM:
1024 case TOMOYO_PATH2_PARENT_PERM:
1025 if (!(max_v[0] & max_v[1]) == !match)
1026 continue;
1027 }
1028 goto out;
1029 } else if (is_bitop[1]) {
1030 switch (left) {
1031 case TOMOYO_PATH1_PERM:
1032 case TOMOYO_PATH1_PARENT_PERM:
1033 case TOMOYO_PATH2_PERM:
1034 case TOMOYO_PATH2_PARENT_PERM:
1035 if (!(max_v[0] & max_v[1]) == !match)
1036 continue;
1037 }
1038 goto out;
1039 }
1040 /* Normal value range comparison. */
1041 if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match)
1042 continue;
1043 out:
1044 return false;
1045 }
1046 /* Check argv[] and envp[] now. */
1047 if (r->ee && (argc || envc))
1048 return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp);
1049 return true;
1050 }
Linus' kernel tree