2 * security/tomoyo/realpath.c
4 * Get the canonicalized absolute pathnames. The basis for TOMOYO.
6 * Copyright (C) 2005-2009 NTT DATA CORPORATION
8 * Version: 2.2.0 2009/04/01
12 #include <linux/types.h>
13 #include <linux/mount.h>
14 #include <linux/mnt_namespace.h>
15 #include <linux/fs_struct.h>
16 #include <linux/hash.h>
17 #include <linux/magic.h>
23 * tomoyo_encode: Convert binary string to ascii string.
25 * @buffer: Buffer for ASCII string.
26 * @buflen: Size of @buffer.
27 * @str: Binary string.
29 * Returns 0 on success, -ENOMEM otherwise.
31 int tomoyo_encode(char *buffer
, int buflen
, const char *str
)
34 const unsigned char c
= *(unsigned char *) str
++;
36 if (tomoyo_is_valid(c
)) {
57 *buffer
++ = (c
>> 6) + '0';
58 *buffer
++ = ((c
>> 3) & 7) + '0';
59 *buffer
++ = (c
& 7) + '0';
65 * tomoyo_realpath_from_path2 - Returns realpath(3) of the given dentry but ignores chroot'ed root.
67 * @path: Pointer to "struct path".
68 * @newname: Pointer to buffer to return value in.
69 * @newname_len: Size of @newname.
71 * Returns 0 on success, negative value otherwise.
73 * If dentry is a directory, trailing '/' is appended.
74 * Characters out of 0x20 < c < 0x7F range are converted to
75 * \ooo style octal string.
76 * Character \ is converted to \\ string.
78 int tomoyo_realpath_from_path2(struct path
*path
, char *newname
,
82 struct dentry
*dentry
= path
->dentry
;
85 if (!dentry
|| !path
->mnt
|| !newname
|| newname_len
<= 2048)
87 if (dentry
->d_op
&& dentry
->d_op
->d_dname
) {
88 /* For "socket:[\$]" and "pipe:[\$]". */
89 static const int offset
= 1536;
90 sp
= dentry
->d_op
->d_dname(dentry
, newname
+ offset
,
91 newname_len
- offset
);
93 /* Taken from d_namespace_path(). */
95 struct path ns_root
= { };
98 read_lock(¤t
->fs
->lock
);
99 root
= current
->fs
->root
;
101 read_unlock(¤t
->fs
->lock
);
102 spin_lock(&vfsmount_lock
);
103 if (root
.mnt
&& root
.mnt
->mnt_ns
)
104 ns_root
.mnt
= mntget(root
.mnt
->mnt_ns
->root
);
106 ns_root
.dentry
= dget(ns_root
.mnt
->mnt_root
);
107 spin_unlock(&vfsmount_lock
);
108 spin_lock(&dcache_lock
);
110 sp
= __d_path(path
, &tmp
, newname
, newname_len
);
111 spin_unlock(&dcache_lock
);
114 /* Prepend "/proc" prefix if using internal proc vfs mount. */
115 if (!IS_ERR(sp
) && (path
->mnt
->mnt_parent
== path
->mnt
) &&
116 (path
->mnt
->mnt_sb
->s_magic
== PROC_SUPER_MAGIC
)) {
119 memcpy(sp
, "/proc", 5);
121 sp
= ERR_PTR(-ENOMEM
);
127 error
= tomoyo_encode(newname
, sp
- newname
, sp
);
128 /* Append trailing '/' if dentry is a directory. */
129 if (!error
&& dentry
->d_inode
&& S_ISDIR(dentry
->d_inode
->i_mode
)
131 sp
= newname
+ strlen(newname
);
132 if (*(sp
- 1) != '/') {
133 if (sp
< newname
+ newname_len
- 4) {
142 printk(KERN_WARNING
"tomoyo_realpath: Pathname too long.\n");
147 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
149 * @path: Pointer to "struct path".
151 * Returns the realpath of the given @path on success, NULL otherwise.
153 * These functions use tomoyo_alloc(), so the caller must call tomoyo_free()
154 * if these functions didn't return NULL.
156 char *tomoyo_realpath_from_path(struct path
*path
)
158 char *buf
= tomoyo_alloc(sizeof(struct tomoyo_page_buffer
));
160 BUILD_BUG_ON(sizeof(struct tomoyo_page_buffer
)
161 <= TOMOYO_MAX_PATHNAME_LEN
- 1);
164 if (tomoyo_realpath_from_path2(path
, buf
,
165 TOMOYO_MAX_PATHNAME_LEN
- 1) == 0)
172 * tomoyo_realpath - Get realpath of a pathname.
174 * @pathname: The pathname to solve.
176 * Returns the realpath of @pathname on success, NULL otherwise.
178 char *tomoyo_realpath(const char *pathname
)
182 if (pathname
&& kern_path(pathname
, LOOKUP_FOLLOW
, &path
) == 0) {
183 char *buf
= tomoyo_realpath_from_path(&path
);
191 * tomoyo_realpath_nofollow - Get realpath of a pathname.
193 * @pathname: The pathname to solve.
195 * Returns the realpath of @pathname on success, NULL otherwise.
197 char *tomoyo_realpath_nofollow(const char *pathname
)
201 if (pathname
&& kern_path(pathname
, 0, &path
) == 0) {
202 char *buf
= tomoyo_realpath_from_path(&path
);
209 /* Memory allocated for non-string data. */
210 static unsigned int tomoyo_allocated_memory_for_elements
;
211 /* Quota for holding non-string data. */
212 static unsigned int tomoyo_quota_for_elements
;
215 * tomoyo_alloc_element - Allocate permanent memory for structures.
217 * @size: Size in bytes.
219 * Returns pointer to allocated memory on success, NULL otherwise.
221 * Memory has to be zeroed.
222 * The RAM is chunked, so NEVER try to kfree() the returned pointer.
224 void *tomoyo_alloc_element(const unsigned int size
)
227 static DEFINE_MUTEX(lock
);
228 static unsigned int buf_used_len
= PATH_MAX
;
230 /*Assumes sizeof(void *) >= sizeof(long) is true. */
231 const unsigned int word_aligned_size
232 = roundup(size
, max(sizeof(void *), sizeof(long)));
233 if (word_aligned_size
> PATH_MAX
)
236 if (buf_used_len
+ word_aligned_size
> PATH_MAX
) {
237 if (!tomoyo_quota_for_elements
||
238 tomoyo_allocated_memory_for_elements
239 + PATH_MAX
<= tomoyo_quota_for_elements
)
240 ptr
= kzalloc(PATH_MAX
, GFP_KERNEL
);
242 printk(KERN_WARNING
"ERROR: Out of memory "
243 "for tomoyo_alloc_element().\n");
244 if (!tomoyo_policy_loaded
)
245 panic("MAC Initialization failed.\n");
248 tomoyo_allocated_memory_for_elements
+= PATH_MAX
;
249 buf_used_len
= word_aligned_size
;
252 } else if (word_aligned_size
) {
254 ptr
= buf
+ buf_used_len
;
255 buf_used_len
+= word_aligned_size
;
256 for (i
= 0; i
< word_aligned_size
; i
++) {
259 printk(KERN_ERR
"WARNING: Reserved memory was tainted! "
260 "The system might go wrong.\n");
268 /* Memory allocated for string data in bytes. */
269 static unsigned int tomoyo_allocated_memory_for_savename
;
270 /* Quota for holding string data in bytes. */
271 static unsigned int tomoyo_quota_for_savename
;
274 * TOMOYO uses this hash only when appending a string into the string
275 * table. Frequency of appending strings is very low. So we don't need
276 * large (e.g. 64k) hash size. 256 will be sufficient.
278 #define TOMOYO_HASH_BITS 8
279 #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
282 * tomoyo_name_entry is a structure which is used for linking
283 * "struct tomoyo_path_info" into tomoyo_name_list .
285 * Since tomoyo_name_list manages a list of strings which are shared by
286 * multiple processes (whereas "struct tomoyo_path_info" inside
287 * "struct tomoyo_path_info_with_data" is not shared), a reference counter will
288 * be added to "struct tomoyo_name_entry" rather than "struct tomoyo_path_info"
289 * when TOMOYO starts supporting garbage collector.
291 struct tomoyo_name_entry
{
292 struct list_head list
;
293 struct tomoyo_path_info entry
;
296 /* Structure for available memory region. */
297 struct tomoyo_free_memory_block_list
{
298 struct list_head list
;
299 char *ptr
; /* Pointer to a free area. */
300 int len
; /* Length of the area. */
304 * tomoyo_name_list is used for holding string data used by TOMOYO.
305 * Since same string data is likely used for multiple times (e.g.
306 * "/lib/libc-2.5.so"), TOMOYO shares string data in the form of
307 * "const struct tomoyo_path_info *".
309 static struct list_head tomoyo_name_list
[TOMOYO_MAX_HASH
];
312 * tomoyo_save_name - Allocate permanent memory for string data.
314 * @name: The string to store into the permernent memory.
316 * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
318 * The RAM is shared, so NEVER try to modify or kfree() the returned name.
320 const struct tomoyo_path_info
*tomoyo_save_name(const char *name
)
322 static LIST_HEAD(fmb_list
);
323 static DEFINE_MUTEX(lock
);
324 struct tomoyo_name_entry
*ptr
;
326 /* fmb contains available size in bytes.
327 fmb is removed from the fmb_list when fmb->len becomes 0. */
328 struct tomoyo_free_memory_block_list
*fmb
;
331 struct list_head
*head
;
335 len
= strlen(name
) + 1;
336 if (len
> TOMOYO_MAX_PATHNAME_LEN
) {
337 printk(KERN_WARNING
"ERROR: Name too long "
338 "for tomoyo_save_name().\n");
341 hash
= full_name_hash((const unsigned char *) name
, len
- 1);
342 head
= &tomoyo_name_list
[hash_long(hash
, TOMOYO_HASH_BITS
)];
345 list_for_each_entry(ptr
, head
, list
) {
346 if (hash
== ptr
->entry
.hash
&& !strcmp(name
, ptr
->entry
.name
))
349 list_for_each_entry(fmb
, &fmb_list
, list
) {
353 if (!tomoyo_quota_for_savename
||
354 tomoyo_allocated_memory_for_savename
+ PATH_MAX
355 <= tomoyo_quota_for_savename
)
356 cp
= kzalloc(PATH_MAX
, GFP_KERNEL
);
359 fmb
= kzalloc(sizeof(*fmb
), GFP_KERNEL
);
363 printk(KERN_WARNING
"ERROR: Out of memory "
364 "for tomoyo_save_name().\n");
365 if (!tomoyo_policy_loaded
)
366 panic("MAC Initialization failed.\n");
370 tomoyo_allocated_memory_for_savename
+= PATH_MAX
;
371 list_add(&fmb
->list
, &fmb_list
);
375 ptr
= tomoyo_alloc_element(sizeof(*ptr
));
378 ptr
->entry
.name
= fmb
->ptr
;
379 memmove(fmb
->ptr
, name
, len
);
380 tomoyo_fill_path_info(&ptr
->entry
);
383 list_add_tail(&ptr
->list
, head
);
385 list_del(&fmb
->list
);
390 return ptr
? &ptr
->entry
: NULL
;
394 * tomoyo_realpath_init - Initialize realpath related code.
396 void __init
tomoyo_realpath_init(void)
400 BUILD_BUG_ON(TOMOYO_MAX_PATHNAME_LEN
> PATH_MAX
);
401 for (i
= 0; i
< TOMOYO_MAX_HASH
; i
++)
402 INIT_LIST_HEAD(&tomoyo_name_list
[i
]);
403 INIT_LIST_HEAD(&tomoyo_kernel_domain
.acl_info_list
);
404 tomoyo_kernel_domain
.domainname
= tomoyo_save_name(TOMOYO_ROOT_NAME
);
406 * tomoyo_read_lock() is not needed because this function is
407 * called before the first "delete" request.
409 list_add_tail_rcu(&tomoyo_kernel_domain
.list
, &tomoyo_domain_list
);
410 if (tomoyo_find_domain(TOMOYO_ROOT_NAME
) != &tomoyo_kernel_domain
)
411 panic("Can't register tomoyo_kernel_domain");
414 /* Memory allocated for temporary purpose. */
415 static atomic_t tomoyo_dynamic_memory_size
;
418 * tomoyo_alloc - Allocate memory for temporary purpose.
420 * @size: Size in bytes.
422 * Returns pointer to allocated memory on success, NULL otherwise.
424 void *tomoyo_alloc(const size_t size
)
426 void *p
= kzalloc(size
, GFP_KERNEL
);
428 atomic_add(ksize(p
), &tomoyo_dynamic_memory_size
);
433 * tomoyo_free - Release memory allocated by tomoyo_alloc().
435 * @p: Pointer returned by tomoyo_alloc(). May be NULL.
439 void tomoyo_free(const void *p
)
442 atomic_sub(ksize(p
), &tomoyo_dynamic_memory_size
);
448 * tomoyo_read_memory_counter - Check for memory usage in bytes.
450 * @head: Pointer to "struct tomoyo_io_buffer".
452 * Returns memory usage.
454 int tomoyo_read_memory_counter(struct tomoyo_io_buffer
*head
)
456 if (!head
->read_eof
) {
457 const unsigned int shared
458 = tomoyo_allocated_memory_for_savename
;
459 const unsigned int private
460 = tomoyo_allocated_memory_for_elements
;
461 const unsigned int dynamic
462 = atomic_read(&tomoyo_dynamic_memory_size
);
465 memset(buffer
, 0, sizeof(buffer
));
466 if (tomoyo_quota_for_savename
)
467 snprintf(buffer
, sizeof(buffer
) - 1,
469 tomoyo_quota_for_savename
);
472 tomoyo_io_printf(head
, "Shared: %10u%s\n", shared
, buffer
);
473 if (tomoyo_quota_for_elements
)
474 snprintf(buffer
, sizeof(buffer
) - 1,
476 tomoyo_quota_for_elements
);
479 tomoyo_io_printf(head
, "Private: %10u%s\n", private, buffer
);
480 tomoyo_io_printf(head
, "Dynamic: %10u\n", dynamic
);
481 tomoyo_io_printf(head
, "Total: %10u\n",
482 shared
+ private + dynamic
);
483 head
->read_eof
= true;
489 * tomoyo_write_memory_quota - Set memory quota.
491 * @head: Pointer to "struct tomoyo_io_buffer".
495 int tomoyo_write_memory_quota(struct tomoyo_io_buffer
*head
)
497 char *data
= head
->write_buf
;
500 if (sscanf(data
, "Shared: %u", &size
) == 1)
501 tomoyo_quota_for_savename
= size
;
502 else if (sscanf(data
, "Private: %u", &size
) == 1)
503 tomoyo_quota_for_elements
= size
;