security/tomoyo/network.c

   1 /*
   2  * security/tomoyo/network.c
   3  *
   4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
   5  */
   6
   7 #include "common.h"
   8 #include <linux/slab.h>
   9
  10 /* Structure for holding inet domain socket's address. */
  11 struct tomoyo_inet_addr_info {
  12         __be16 port;           /* In network byte order. */
  13         const __be32 *address; /* In network byte order. */
  14         bool is_ipv6;
  15 };
  16
  17 /* Structure for holding unix domain socket's address. */
  18 struct tomoyo_unix_addr_info {
  19         u8 *addr; /* This may not be '\0' terminated string. */
  20         unsigned int addr_len;
  21 };
  22
  23 /* Structure for holding socket address. */
  24 struct tomoyo_addr_info {
  25         u8 protocol;
  26         u8 operation;
  27         struct tomoyo_inet_addr_info inet;
  28         struct tomoyo_unix_addr_info unix0;
  29 };
  30
  31 /* String table for socket's protocols. */
  32 const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = {
  33         [SOCK_STREAM]    = "stream",
  34         [SOCK_DGRAM]     = "dgram",
  35         [SOCK_RAW]       = "raw",
  36         [SOCK_SEQPACKET] = "seqpacket",
  37         [0] = " ", /* Dummy for avoiding NULL pointer dereference. */
  38         [4] = " ", /* Dummy for avoiding NULL pointer dereference. */
  39 };
  40
  41 /**
  42  * tomoyo_parse_ipaddr_union - Parse an IP address.
  43  *
  44  * @param: Pointer to "struct tomoyo_acl_param".
  45  * @ptr:   Pointer to "struct tomoyo_ipaddr_union".
  46  *
  47  * Returns true on success, false otherwise.
  48  */
  49 bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
  50                                struct tomoyo_ipaddr_union *ptr)
  51 {
  52         u8 * const min = ptr->ip[0].in6_u.u6_addr8;
  53         u8 * const max = ptr->ip[1].in6_u.u6_addr8;
  54         char *address = tomoyo_read_token(param);
  55         const char *end;
  56
  57         if (!strchr(address, ':') &&
  58             in4_pton(address, -1, min, '-', &end) > 0) {
  59                 ptr->is_ipv6 = false;
  60                 if (!*end)
  61                         ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0];
  62                 else if (*end++ != '-' ||
  63                          in4_pton(end, -1, max, '\0', &end) <= 0 || *end)
  64                         return false;
  65                 return true;
  66         }
  67         if (in6_pton(address, -1, min, '-', &end) > 0) {
  68                 ptr->is_ipv6 = true;
  69                 if (!*end)
  70                         memmove(max, min, sizeof(u16) * 8);
  71                 else if (*end++ != '-' ||
  72                          in6_pton(end, -1, max, '\0', &end) <= 0 || *end)
  73                         return false;
  74                 return true;
  75         }
  76         return false;
  77 }
  78
  79 /**
  80  * tomoyo_print_ipv4 - Print an IPv4 address.
  81  *
  82  * @buffer:     Buffer to write to.
  83  * @buffer_len: Size of @buffer.
  84  * @min_ip:     Pointer to __be32.
  85  * @max_ip:     Pointer to __be32.
  86  *
  87  * Returns nothing.
  88  */
  89 static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len,
  90                               const __be32 *min_ip, const __be32 *max_ip)
  91 {
  92         snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip,
  93                  *min_ip == *max_ip ? '\0' : '-', max_ip);
  94 }
  95
  96 /**
  97  * tomoyo_print_ipv6 - Print an IPv6 address.
  98  *
  99  * @buffer:     Buffer to write to.
 100  * @buffer_len: Size of @buffer.
 101  * @min_ip:     Pointer to "struct in6_addr".
 102  * @max_ip:     Pointer to "struct in6_addr".
 103  *
 104  * Returns nothing.
 105  */
 106 static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len,
 107                               const struct in6_addr *min_ip,
 108                               const struct in6_addr *max_ip)
 109 {
 110         snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip,
 111                  !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip);
 112 }
 113
 114 /**
 115  * tomoyo_print_ip - Print an IP address.
 116  *
 117  * @buf:  Buffer to write to.
 118  * @size: Size of @buf.
 119  * @ptr:  Pointer to "struct ipaddr_union".
 120  *
 121  * Returns nothing.
 122  */
 123 void tomoyo_print_ip(char *buf, const unsigned int size,
 124                      const struct tomoyo_ipaddr_union *ptr)
 125 {
 126         if (ptr->is_ipv6)
 127                 tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]);
 128         else
 129                 tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0],
 130                                   &ptr->ip[1].s6_addr32[0]);
 131 }
 132
 133 /*
 134  * Mapping table from "enum tomoyo_network_acl_index" to
 135  * "enum tomoyo_mac_index" for inet domain socket.
 136  */
 137 static const u8 tomoyo_inet2mac
 138 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
 139         [SOCK_STREAM] = {
 140                 [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
 141                 [TOMOYO_NETWORK_LISTEN]  =
 142                 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
 143                 [TOMOYO_NETWORK_CONNECT] =
 144                 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
 145         },
 146         [SOCK_DGRAM] = {
 147                 [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
 148                 [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
 149         },
 150         [SOCK_RAW]    = {
 151                 [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_RAW_BIND,
 152                 [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_RAW_SEND,
 153         },
 154 };
 155
 156 /*
 157  * Mapping table from "enum tomoyo_network_acl_index" to
 158  * "enum tomoyo_mac_index" for unix domain socket.
 159  */
 160 static const u8 tomoyo_unix2mac
 161 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
 162         [SOCK_STREAM] = {
 163                 [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
 164                 [TOMOYO_NETWORK_LISTEN]  =
 165                 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
 166                 [TOMOYO_NETWORK_CONNECT] =
 167                 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
 168         },
 169         [SOCK_DGRAM] = {
 170                 [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
 171                 [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
 172         },
 173         [SOCK_SEQPACKET] = {
 174                 [TOMOYO_NETWORK_BIND]    =
 175                 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
 176                 [TOMOYO_NETWORK_LISTEN]  =
 177                 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
 178                 [TOMOYO_NETWORK_CONNECT] =
 179                 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
 180         },
 181 };
 182
 183 /**
 184  * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry.
 185  *
 186  * @a: Pointer to "struct tomoyo_acl_info".
 187  * @b: Pointer to "struct tomoyo_acl_info".
 188  *
 189  * Returns true if @a == @b except permission bits, false otherwise.
 190  */
 191 static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a,
 192                                  const struct tomoyo_acl_info *b)
 193 {
 194         const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head);
 195         const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head);
 196
 197         return p1->protocol == p2->protocol &&
 198                 tomoyo_same_ipaddr_union(&p1->address, &p2->address) &&
 199                 tomoyo_same_number_union(&p1->port, &p2->port);
 200 }
 201
 202 /**
 203  * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry.
 204  *
 205  * @a: Pointer to "struct tomoyo_acl_info".
 206  * @b: Pointer to "struct tomoyo_acl_info".
 207  *
 208  * Returns true if @a == @b except permission bits, false otherwise.
 209  */
 210 static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a,
 211                                  const struct tomoyo_acl_info *b)
 212 {
 213         const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head);
 214         const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head);
 215
 216         return p1->protocol == p2->protocol &&
 217                 tomoyo_same_name_union(&p1->name, &p2->name);
 218 }
 219
 220 /**
 221  * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry.
 222  *
 223  * @a:         Pointer to "struct tomoyo_acl_info".
 224  * @b:         Pointer to "struct tomoyo_acl_info".
 225  * @is_delete: True for @a &= ~@b, false for @a |= @b.
 226  *
 227  * Returns true if @a is empty, false otherwise.
 228  */
 229 static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a,
 230                                   struct tomoyo_acl_info *b,
 231                                   const bool is_delete)
 232 {
 233         u8 * const a_perm =
 234                 &container_of(a, struct tomoyo_inet_acl, head)->perm;
 235         u8 perm = *a_perm;
 236         const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
 237
 238         if (is_delete)
 239                 perm &= ~b_perm;
 240         else
 241                 perm |= b_perm;
 242         *a_perm = perm;
 243         return !perm;
 244 }
 245
 246 /**
 247  * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry.
 248  *
 249  * @a:         Pointer to "struct tomoyo_acl_info".
 250  * @b:         Pointer to "struct tomoyo_acl_info".
 251  * @is_delete: True for @a &= ~@b, false for @a |= @b.
 252  *
 253  * Returns true if @a is empty, false otherwise.
 254  */
 255 static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a,
 256                                   struct tomoyo_acl_info *b,
 257                                   const bool is_delete)
 258 {
 259         u8 * const a_perm =
 260                 &container_of(a, struct tomoyo_unix_acl, head)->perm;
 261         u8 perm = *a_perm;
 262         const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
 263
 264         if (is_delete)
 265                 perm &= ~b_perm;
 266         else
 267                 perm |= b_perm;
 268         *a_perm = perm;
 269         return !perm;
 270 }
 271
 272 /**
 273  * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list.
 274  *
 275  * @param: Pointer to "struct tomoyo_acl_param".
 276  *
 277  * Returns 0 on success, negative value otherwise.
 278  *
 279  * Caller holds tomoyo_read_lock().
 280  */
 281 int tomoyo_write_inet_network(struct tomoyo_acl_param *param)
 282 {
 283         struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL };
 284         int error = -EINVAL;
 285         u8 type;
 286         const char *protocol = tomoyo_read_token(param);
 287         const char *operation = tomoyo_read_token(param);
 288
 289         for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
 290                 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
 291                         break;
 292         for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
 293                 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
 294                         e.perm |= 1 << type;
 295         if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
 296                 return -EINVAL;
 297         if (param->data[0] == '@') {
 298                 param->data++;
 299                 e.address.group =
 300                         tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP);
 301                 if (!e.address.group)
 302                         return -ENOMEM;
 303         } else {
 304                 if (!tomoyo_parse_ipaddr_union(param, &e.address))
 305                         goto out;
 306         }
 307         if (!tomoyo_parse_number_union(param, &e.port) ||
 308             e.port.values[1] > 65535)
 309                 goto out;
 310         error = tomoyo_update_domain(&e.head, sizeof(e), param,
 311                                      tomoyo_same_inet_acl,
 312                                      tomoyo_merge_inet_acl);
 313 out:
 314         tomoyo_put_group(e.address.group);
 315         tomoyo_put_number_union(&e.port);
 316         return error;
 317 }
 318
 319 /**
 320  * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list.
 321  *
 322  * @param: Pointer to "struct tomoyo_acl_param".
 323  *
 324  * Returns 0 on success, negative value otherwise.
 325  */
 326 int tomoyo_write_unix_network(struct tomoyo_acl_param *param)
 327 {
 328         struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL };
 329         int error;
 330         u8 type;
 331         const char *protocol = tomoyo_read_token(param);
 332         const char *operation = tomoyo_read_token(param);
 333
 334         for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
 335                 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
 336                         break;
 337         for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
 338                 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
 339                         e.perm |= 1 << type;
 340         if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
 341                 return -EINVAL;
 342         if (!tomoyo_parse_name_union(param, &e.name))
 343                 return -EINVAL;
 344         error = tomoyo_update_domain(&e.head, sizeof(e), param,
 345                                      tomoyo_same_unix_acl,
 346                                      tomoyo_merge_unix_acl);
 347         tomoyo_put_name_union(&e.name);
 348         return error;
 349 }
 350
 351 /**
 352  * tomoyo_audit_net_log - Audit network log.
 353  *
 354  * @r:         Pointer to "struct tomoyo_request_info".
 355  * @family:    Name of socket family ("inet" or "unix").
 356  * @protocol:  Name of protocol in @family.
 357  * @operation: Name of socket operation.
 358  * @address:   Name of address.
 359  *
 360  * Returns 0 on success, negative value otherwise.
 361  */
 362 static int tomoyo_audit_net_log(struct tomoyo_request_info *r,
 363                                 const char *family, const u8 protocol,
 364                                 const u8 operation, const char *address)
 365 {
 366         return tomoyo_supervisor(r, "network %s %s %s %s\n", family,
 367                                  tomoyo_proto_keyword[protocol],
 368                                  tomoyo_socket_keyword[operation], address);
 369 }
 370
 371 /**
 372  * tomoyo_audit_inet_log - Audit INET network log.
 373  *
 374  * @r: Pointer to "struct tomoyo_request_info".
 375  *
 376  * Returns 0 on success, negative value otherwise.
 377  */
 378 static int tomoyo_audit_inet_log(struct tomoyo_request_info *r)
 379 {
 380         char buf[128];
 381         int len;
 382         const __be32 *address = r->param.inet_network.address;
 383
 384         if (r->param.inet_network.is_ipv6)
 385                 tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *)
 386                                   address, (const struct in6_addr *) address);
 387         else
 388                 tomoyo_print_ipv4(buf, sizeof(buf), address, address);
 389         len = strlen(buf);
 390         snprintf(buf + len, sizeof(buf) - len, " %u",
 391                  r->param.inet_network.port);
 392         return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol,
 393                                     r->param.inet_network.operation, buf);
 394 }
 395
 396 /**
 397  * tomoyo_audit_unix_log - Audit UNIX network log.
 398  *
 399  * @r: Pointer to "struct tomoyo_request_info".
 400  *
 401  * Returns 0 on success, negative value otherwise.
 402  */
 403 static int tomoyo_audit_unix_log(struct tomoyo_request_info *r)
 404 {
 405         return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol,
 406                                     r->param.unix_network.operation,
 407                                     r->param.unix_network.address->name);
 408 }
 409
 410 /**
 411  * tomoyo_check_inet_acl - Check permission for inet domain socket operation.
 412  *
 413  * @r:   Pointer to "struct tomoyo_request_info".
 414  * @ptr: Pointer to "struct tomoyo_acl_info".
 415  *
 416  * Returns true if granted, false otherwise.
 417  */
 418 static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r,
 419                                   const struct tomoyo_acl_info *ptr)
 420 {
 421         const struct tomoyo_inet_acl *acl =
 422                 container_of(ptr, typeof(*acl), head);
 423         const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4;
 424
 425         if (!(acl->perm & (1 << r->param.inet_network.operation)) ||
 426             !tomoyo_compare_number_union(r->param.inet_network.port,
 427                                          &acl->port))
 428                 return false;
 429         if (acl->address.group)
 430                 return tomoyo_address_matches_group
 431                         (r->param.inet_network.is_ipv6,
 432                          r->param.inet_network.address, acl->address.group);
 433         return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 &&
 434                 memcmp(&acl->address.ip[0],
 435                        r->param.inet_network.address, size) <= 0 &&
 436                 memcmp(r->param.inet_network.address,
 437                        &acl->address.ip[1], size) <= 0;
 438 }
 439
 440 /**
 441  * tomoyo_check_unix_acl - Check permission for unix domain socket operation.
 442  *
 443  * @r:   Pointer to "struct tomoyo_request_info".
 444  * @ptr: Pointer to "struct tomoyo_acl_info".
 445  *
 446  * Returns true if granted, false otherwise.
 447  */
 448 static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r,
 449                                   const struct tomoyo_acl_info *ptr)
 450 {
 451         const struct tomoyo_unix_acl *acl =
 452                 container_of(ptr, typeof(*acl), head);
 453
 454         return (acl->perm & (1 << r->param.unix_network.operation)) &&
 455                 tomoyo_compare_name_union(r->param.unix_network.address,
 456                                           &acl->name);
 457 }
 458
 459 /**
 460  * tomoyo_inet_entry - Check permission for INET network operation.
 461  *
 462  * @address: Pointer to "struct tomoyo_addr_info".
 463  *
 464  * Returns 0 on success, negative value otherwise.
 465  */
 466 static int tomoyo_inet_entry(const struct tomoyo_addr_info *address)
 467 {
 468         const int idx = tomoyo_read_lock();
 469         struct tomoyo_request_info r;
 470         int error = 0;
 471         const u8 type = tomoyo_inet2mac[address->protocol][address->operation];
 472
 473         if (type && tomoyo_init_request_info(&r, NULL, type)
 474             != TOMOYO_CONFIG_DISABLED) {
 475                 r.param_type = TOMOYO_TYPE_INET_ACL;
 476                 r.param.inet_network.protocol = address->protocol;
 477                 r.param.inet_network.operation = address->operation;
 478                 r.param.inet_network.is_ipv6 = address->inet.is_ipv6;
 479                 r.param.inet_network.address = address->inet.address;
 480                 r.param.inet_network.port = ntohs(address->inet.port);
 481                 do {
 482                         tomoyo_check_acl(&r, tomoyo_check_inet_acl);
 483                         error = tomoyo_audit_inet_log(&r);
 484                 } while (error == TOMOYO_RETRY_REQUEST);
 485         }
 486         tomoyo_read_unlock(idx);
 487         return error;
 488 }
 489
 490 /**
 491  * tomoyo_check_inet_address - Check permission for inet domain socket's operation.
 492  *
 493  * @addr:     Pointer to "struct sockaddr".
 494  * @addr_len: Size of @addr.
 495  * @port:     Port number.
 496  * @address:  Pointer to "struct tomoyo_addr_info".
 497  *
 498  * Returns 0 on success, negative value otherwise.
 499  */
 500 static int tomoyo_check_inet_address(const struct sockaddr *addr,
 501                                      const unsigned int addr_len,
 502                                      const u16 port,
 503                                      struct tomoyo_addr_info *address)
 504 {
 505         struct tomoyo_inet_addr_info *i = &address->inet;
 506
 507         switch (addr->sa_family) {
 508         case AF_INET6:
 509                 if (addr_len < SIN6_LEN_RFC2133)
 510                         goto skip;
 511                 i->is_ipv6 = true;
 512                 i->address = (__be32 *)
 513                         ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;
 514                 i->port = ((struct sockaddr_in6 *) addr)->sin6_port;
 515                 break;
 516         case AF_INET:
 517                 if (addr_len < sizeof(struct sockaddr_in))
 518                         goto skip;
 519                 i->is_ipv6 = false;
 520                 i->address = (__be32 *)
 521                         &((struct sockaddr_in *) addr)->sin_addr;
 522                 i->port = ((struct sockaddr_in *) addr)->sin_port;
 523                 break;
 524         default:
 525                 goto skip;
 526         }
 527         if (address->protocol == SOCK_RAW)
 528                 i->port = htons(port);
 529         return tomoyo_inet_entry(address);
 530 skip:
 531         return 0;
 532 }
 533
 534 /**
 535  * tomoyo_unix_entry - Check permission for UNIX network operation.
 536  *
 537  * @address: Pointer to "struct tomoyo_addr_info".
 538  *
 539  * Returns 0 on success, negative value otherwise.
 540  */
 541 static int tomoyo_unix_entry(const struct tomoyo_addr_info *address)
 542 {
 543         const int idx = tomoyo_read_lock();
 544         struct tomoyo_request_info r;
 545         int error = 0;
 546         const u8 type = tomoyo_unix2mac[address->protocol][address->operation];
 547
 548         if (type && tomoyo_init_request_info(&r, NULL, type)
 549             != TOMOYO_CONFIG_DISABLED) {
 550                 char *buf = address->unix0.addr;
 551                 int len = address->unix0.addr_len - sizeof(sa_family_t);
 552
 553                 if (len <= 0) {
 554                         buf = "anonymous";
 555                         len = 9;
 556                 } else if (buf[0]) {
 557                         len = strnlen(buf, len);
 558                 }
 559                 buf = tomoyo_encode2(buf, len);
 560                 if (buf) {
 561                         struct tomoyo_path_info addr;
 562
 563                         addr.name = buf;
 564                         tomoyo_fill_path_info(&addr);
 565                         r.param_type = TOMOYO_TYPE_UNIX_ACL;
 566                         r.param.unix_network.protocol = address->protocol;
 567                         r.param.unix_network.operation = address->operation;
 568                         r.param.unix_network.address = &addr;
 569                         do {
 570                                 tomoyo_check_acl(&r, tomoyo_check_unix_acl);
 571                                 error = tomoyo_audit_unix_log(&r);
 572                         } while (error == TOMOYO_RETRY_REQUEST);
 573                         kfree(buf);
 574                 } else
 575                         error = -ENOMEM;
 576         }
 577         tomoyo_read_unlock(idx);
 578         return error;
 579 }
 580
 581 /**
 582  * tomoyo_check_unix_address - Check permission for unix domain socket's operation.
 583  *
 584  * @addr:     Pointer to "struct sockaddr".
 585  * @addr_len: Size of @addr.
 586  * @address:  Pointer to "struct tomoyo_addr_info".
 587  *
 588  * Returns 0 on success, negative value otherwise.
 589  */
 590 static int tomoyo_check_unix_address(struct sockaddr *addr,
 591                                      const unsigned int addr_len,
 592                                      struct tomoyo_addr_info *address)
 593 {
 594         struct tomoyo_unix_addr_info *u = &address->unix0;
 595
 596         if (addr->sa_family != AF_UNIX)
 597                 return 0;
 598         u->addr = ((struct sockaddr_un *) addr)->sun_path;
 599         u->addr_len = addr_len;
 600         return tomoyo_unix_entry(address);
 601 }
 602
 603 /**
 604  * tomoyo_kernel_service - Check whether I'm kernel service or not.
 605  *
 606  * Returns true if I'm kernel service, false otherwise.
 607  */
 608 static bool tomoyo_kernel_service(void)
 609 {
 610         /* Nothing to do if I am a kernel service. */
 611         return segment_eq(get_fs(), KERNEL_DS);
 612 }
 613
 614 /**
 615  * tomoyo_sock_family - Get socket's family.
 616  *
 617  * @sk: Pointer to "struct sock".
 618  *
 619  * Returns one of PF_INET, PF_INET6, PF_UNIX or 0.
 620  */
 621 static u8 tomoyo_sock_family(struct sock *sk)
 622 {
 623         u8 family;
 624
 625         if (tomoyo_kernel_service())
 626                 return 0;
 627         family = sk->sk_family;
 628         switch (family) {
 629         case PF_INET:
 630         case PF_INET6:
 631         case PF_UNIX:
 632                 return family;
 633         default:
 634                 return 0;
 635         }
 636 }
 637
 638 /**
 639  * tomoyo_socket_listen_permission - Check permission for listening a socket.
 640  *
 641  * @sock: Pointer to "struct socket".
 642  *
 643  * Returns 0 on success, negative value otherwise.
 644  */
 645 int tomoyo_socket_listen_permission(struct socket *sock)
 646 {
 647         struct tomoyo_addr_info address;
 648         const u8 family = tomoyo_sock_family(sock->sk);
 649         const unsigned int type = sock->type;
 650         struct sockaddr_storage addr;
 651         int addr_len;
 652
 653         if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET))
 654                 return 0;
 655         {
 656                 const int error = sock->ops->getname(sock, (struct sockaddr *)
 657                                                      &addr, &addr_len, 0);
 658
 659                 if (error)
 660                         return error;
 661         }
 662         address.protocol = type;
 663         address.operation = TOMOYO_NETWORK_LISTEN;
 664         if (family == PF_UNIX)
 665                 return tomoyo_check_unix_address((struct sockaddr *) &addr,
 666                                                  addr_len, &address);
 667         return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len,
 668                                          0, &address);
 669 }
 670
 671 /**
 672  * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket.
 673  *
 674  * @sock:     Pointer to "struct socket".
 675  * @addr:     Pointer to "struct sockaddr".
 676  * @addr_len: Size of @addr.
 677  *
 678  * Returns 0 on success, negative value otherwise.
 679  */
 680 int tomoyo_socket_connect_permission(struct socket *sock,
 681                                      struct sockaddr *addr, int addr_len)
 682 {
 683         struct tomoyo_addr_info address;
 684         const u8 family = tomoyo_sock_family(sock->sk);
 685         const unsigned int type = sock->type;
 686
 687         if (!family)
 688                 return 0;
 689         address.protocol = type;
 690         switch (type) {
 691         case SOCK_DGRAM:
 692         case SOCK_RAW:
 693                 address.operation = TOMOYO_NETWORK_SEND;
 694                 break;
 695         case SOCK_STREAM:
 696         case SOCK_SEQPACKET:
 697                 address.operation = TOMOYO_NETWORK_CONNECT;
 698                 break;
 699         default:
 700                 return 0;
 701         }
 702         if (family == PF_UNIX)
 703                 return tomoyo_check_unix_address(addr, addr_len, &address);
 704         return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
 705                                          &address);
 706 }
 707
 708 /**
 709  * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket.
 710  *
 711  * @sock:     Pointer to "struct socket".
 712  * @addr:     Pointer to "struct sockaddr".
 713  * @addr_len: Size of @addr.
 714  *
 715  * Returns 0 on success, negative value otherwise.
 716  */
 717 int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
 718                                   int addr_len)
 719 {
 720         struct tomoyo_addr_info address;
 721         const u8 family = tomoyo_sock_family(sock->sk);
 722         const unsigned int type = sock->type;
 723
 724         if (!family)
 725                 return 0;
 726         switch (type) {
 727         case SOCK_STREAM:
 728         case SOCK_DGRAM:
 729         case SOCK_RAW:
 730         case SOCK_SEQPACKET:
 731                 address.protocol = type;
 732                 address.operation = TOMOYO_NETWORK_BIND;
 733                 break;
 734         default:
 735                 return 0;
 736         }
 737         if (family == PF_UNIX)
 738                 return tomoyo_check_unix_address(addr, addr_len, &address);
 739         return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
 740                                          &address);
 741 }
 742
 743 /**
 744  * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram.
 745  *
 746  * @sock: Pointer to "struct socket".
 747  * @msg:  Pointer to "struct msghdr".
 748  * @size: Unused.
 749  *
 750  * Returns 0 on success, negative value otherwise.
 751  */
 752 int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
 753                                      int size)
 754 {
 755         struct tomoyo_addr_info address;
 756         const u8 family = tomoyo_sock_family(sock->sk);
 757         const unsigned int type = sock->type;
 758
 759         if (!msg->msg_name || !family ||
 760             (type != SOCK_DGRAM && type != SOCK_RAW))
 761                 return 0;
 762         address.protocol = type;
 763         address.operation = TOMOYO_NETWORK_SEND;
 764         if (family == PF_UNIX)
 765                 return tomoyo_check_unix_address((struct sockaddr *)
 766                                                  msg->msg_name,
 767                                                  msg->msg_namelen, &address);
 768         return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name,
 769                                          msg->msg_namelen,
 770                                          sock->sk->sk_protocol, &address);
 771 }