linux/security/tomoyo/network.c
<<
>>
Prefs
   1/*
   2 * security/tomoyo/network.c
   3 *
   4 * Copyright (C) 2005-2011  NTT DATA CORPORATION
   5 */
   6
   7#include "common.h"
   8#include <linux/slab.h>
   9
  10/* Structure for holding inet domain socket's address. */
  11struct tomoyo_inet_addr_info {
  12        __be16 port;           /* In network byte order. */
  13        const __be32 *address; /* In network byte order. */
  14        bool is_ipv6;
  15};
  16
  17/* Structure for holding unix domain socket's address. */
  18struct tomoyo_unix_addr_info {
  19        u8 *addr; /* This may not be '\0' terminated string. */
  20        unsigned int addr_len;
  21};
  22
  23/* Structure for holding socket address. */
  24struct tomoyo_addr_info {
  25        u8 protocol;
  26        u8 operation;
  27        struct tomoyo_inet_addr_info inet;
  28        struct tomoyo_unix_addr_info unix0;
  29};
  30
  31/* String table for socket's protocols. */
  32const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = {
  33        [SOCK_STREAM]    = "stream",
  34        [SOCK_DGRAM]     = "dgram",
  35        [SOCK_RAW]       = "raw",
  36        [SOCK_SEQPACKET] = "seqpacket",
  37        [0] = " ", /* Dummy for avoiding NULL pointer dereference. */
  38        [4] = " ", /* Dummy for avoiding NULL pointer dereference. */
  39};
  40
  41/**
  42 * tomoyo_parse_ipaddr_union - Parse an IP address.
  43 *
  44 * @param: Pointer to "struct tomoyo_acl_param".
  45 * @ptr:   Pointer to "struct tomoyo_ipaddr_union".
  46 *
  47 * Returns true on success, false otherwise.
  48 */
  49bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
  50                               struct tomoyo_ipaddr_union *ptr)
  51{
  52        u8 * const min = ptr->ip[0].in6_u.u6_addr8;
  53        u8 * const max = ptr->ip[1].in6_u.u6_addr8;
  54        char *address = tomoyo_read_token(param);
  55        const char *end;
  56
  57        if (!strchr(address, ':') &&
  58            in4_pton(address, -1, min, '-', &end) > 0) {
  59                ptr->is_ipv6 = false;
  60                if (!*end)
  61                        ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0];
  62                else if (*end++ != '-' ||
  63                         in4_pton(end, -1, max, '\0', &end) <= 0 || *end)
  64                        return false;
  65                return true;
  66        }
  67        if (in6_pton(address, -1, min, '-', &end) > 0) {
  68                ptr->is_ipv6 = true;
  69                if (!*end)
  70                        memmove(max, min, sizeof(u16) * 8);
  71                else if (*end++ != '-' ||
  72                         in6_pton(end, -1, max, '\0', &end) <= 0 || *end)
  73                        return false;
  74                return true;
  75        }
  76        return false;
  77}
  78
  79/**
  80 * tomoyo_print_ipv4 - Print an IPv4 address.
  81 *
  82 * @buffer:     Buffer to write to.
  83 * @buffer_len: Size of @buffer.
  84 * @min_ip:     Pointer to __be32.
  85 * @max_ip:     Pointer to __be32.
  86 *
  87 * Returns nothing.
  88 */
  89static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len,
  90                              const __be32 *min_ip, const __be32 *max_ip)
  91{
  92        snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip,
  93                 *min_ip == *max_ip ? '\0' : '-', max_ip);
  94}
  95
  96/**
  97 * tomoyo_print_ipv6 - Print an IPv6 address.
  98 *
  99 * @buffer:     Buffer to write to.
 100 * @buffer_len: Size of @buffer.
 101 * @min_ip:     Pointer to "struct in6_addr".
 102 * @max_ip:     Pointer to "struct in6_addr".
 103 *
 104 * Returns nothing.
 105 */
 106static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len,
 107                              const struct in6_addr *min_ip,
 108                              const struct in6_addr *max_ip)
 109{
 110        snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip,
 111                 !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip);
 112}
 113
 114/**
 115 * tomoyo_print_ip - Print an IP address.
 116 *
 117 * @buf:  Buffer to write to.
 118 * @size: Size of @buf.
 119 * @ptr:  Pointer to "struct ipaddr_union".
 120 *
 121 * Returns nothing.
 122 */
 123void tomoyo_print_ip(char *buf, const unsigned int size,
 124                     const struct tomoyo_ipaddr_union *ptr)
 125{
 126        if (ptr->is_ipv6)
 127                tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]);
 128        else
 129                tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0],
 130                                  &ptr->ip[1].s6_addr32[0]);
 131}
 132
 133/*
 134 * Mapping table from "enum tomoyo_network_acl_index" to
 135 * "enum tomoyo_mac_index" for inet domain socket.
 136 */
 137static const u8 tomoyo_inet2mac
 138[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
 139        [SOCK_STREAM] = {
 140                [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
 141                [TOMOYO_NETWORK_LISTEN]  =
 142                TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
 143                [TOMOYO_NETWORK_CONNECT] =
 144                TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
 145        },
 146        [SOCK_DGRAM] = {
 147                [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
 148                [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
 149        },
 150        [SOCK_RAW]    = {
 151                [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_RAW_BIND,
 152                [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_RAW_SEND,
 153        },
 154};
 155
 156/*
 157 * Mapping table from "enum tomoyo_network_acl_index" to
 158 * "enum tomoyo_mac_index" for unix domain socket.
 159 */
 160static const u8 tomoyo_unix2mac
 161[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
 162        [SOCK_STREAM] = {
 163                [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
 164                [TOMOYO_NETWORK_LISTEN]  =
 165                TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
 166                [TOMOYO_NETWORK_CONNECT] =
 167                TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
 168        },
 169        [SOCK_DGRAM] = {
 170                [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
 171                [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
 172        },
 173        [SOCK_SEQPACKET] = {
 174                [TOMOYO_NETWORK_BIND]    =
 175                TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
 176                [TOMOYO_NETWORK_LISTEN]  =
 177                TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
 178                [TOMOYO_NETWORK_CONNECT] =
 179                TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
 180        },
 181};
 182
 183/**
 184 * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry.
 185 *
 186 * @a: Pointer to "struct tomoyo_acl_info".
 187 * @b: Pointer to "struct tomoyo_acl_info".
 188 *
 189 * Returns true if @a == @b except permission bits, false otherwise.
 190 */
 191static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a,
 192                                 const struct tomoyo_acl_info *b)
 193{
 194        const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head);
 195        const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head);
 196
 197        return p1->protocol == p2->protocol &&
 198                tomoyo_same_ipaddr_union(&p1->address, &p2->address) &&
 199                tomoyo_same_number_union(&p1->port, &p2->port);
 200}
 201
 202/**
 203 * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry.
 204 *
 205 * @a: Pointer to "struct tomoyo_acl_info".
 206 * @b: Pointer to "struct tomoyo_acl_info".
 207 *
 208 * Returns true if @a == @b except permission bits, false otherwise.
 209 */
 210static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a,
 211                                 const struct tomoyo_acl_info *b)
 212{
 213        const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head);
 214        const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head);
 215
 216        return p1->protocol == p2->protocol &&
 217                tomoyo_same_name_union(&p1->name, &p2->name);
 218}
 219
 220/**
 221 * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry.
 222 *
 223 * @a:         Pointer to "struct tomoyo_acl_info".
 224 * @b:         Pointer to "struct tomoyo_acl_info".
 225 * @is_delete: True for @a &= ~@b, false for @a |= @b.
 226 *
 227 * Returns true if @a is empty, false otherwise.
 228 */
 229static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a,
 230                                  struct tomoyo_acl_info *b,
 231                                  const bool is_delete)
 232{
 233        u8 * const a_perm =
 234                &container_of(a, struct tomoyo_inet_acl, head)->perm;
 235        u8 perm = *a_perm;
 236        const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
 237
 238        if (is_delete)
 239                perm &= ~b_perm;
 240        else
 241                perm |= b_perm;
 242        *a_perm = perm;
 243        return !perm;
 244}
 245
 246/**
 247 * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry.
 248 *
 249 * @a:         Pointer to "struct tomoyo_acl_info".
 250 * @b:         Pointer to "struct tomoyo_acl_info".
 251 * @is_delete: True for @a &= ~@b, false for @a |= @b.
 252 *
 253 * Returns true if @a is empty, false otherwise.
 254 */
 255static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a,
 256                                  struct tomoyo_acl_info *b,
 257                                  const bool is_delete)
 258{
 259        u8 * const a_perm =
 260                &container_of(a, struct tomoyo_unix_acl, head)->perm;
 261        u8 perm = *a_perm;
 262        const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
 263
 264        if (is_delete)
 265                perm &= ~b_perm;
 266        else
 267                perm |= b_perm;
 268        *a_perm = perm;
 269        return !perm;
 270}
 271
 272/**
 273 * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list.
 274 *
 275 * @param: Pointer to "struct tomoyo_acl_param".
 276 *
 277 * Returns 0 on success, negative value otherwise.
 278 *
 279 * Caller holds tomoyo_read_lock().
 280 */
 281int tomoyo_write_inet_network(struct tomoyo_acl_param *param)
 282{
 283        struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL };
 284        int error = -EINVAL;
 285        u8 type;
 286        const char *protocol = tomoyo_read_token(param);
 287        const char *operation = tomoyo_read_token(param);
 288
 289        for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
 290                if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
 291                        break;
 292        for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
 293                if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
 294                        e.perm |= 1 << type;
 295        if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
 296                return -EINVAL;
 297        if (param->data[0] == '@') {
 298                param->data++;
 299                e.address.group =
 300                        tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP);
 301                if (!e.address.group)
 302                        return -ENOMEM;
 303        } else {
 304                if (!tomoyo_parse_ipaddr_union(param, &e.address))
 305                        goto out;
 306        }
 307        if (!tomoyo_parse_number_union(param, &e.port) ||
 308            e.port.values[1] > 65535)
 309                goto out;
 310        error = tomoyo_update_domain(&e.head, sizeof(e), param,
 311                                     tomoyo_same_inet_acl,
 312                                     tomoyo_merge_inet_acl);
 313out:
 314        tomoyo_put_group(e.address.group);
 315        tomoyo_put_number_union(&e.port);
 316        return error;
 317}
 318
 319/**
 320 * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list.
 321 *
 322 * @param: Pointer to "struct tomoyo_acl_param".
 323 *
 324 * Returns 0 on success, negative value otherwise.
 325 */
 326int tomoyo_write_unix_network(struct tomoyo_acl_param *param)
 327{
 328        struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL };
 329        int error;
 330        u8 type;
 331        const char *protocol = tomoyo_read_token(param);
 332        const char *operation = tomoyo_read_token(param);
 333
 334        for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
 335                if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
 336                        break;
 337        for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
 338                if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
 339                        e.perm |= 1 << type;
 340        if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
 341                return -EINVAL;
 342        if (!tomoyo_parse_name_union(param, &e.name))
 343                return -EINVAL;
 344        error = tomoyo_update_domain(&e.head, sizeof(e), param,
 345                                     tomoyo_same_unix_acl,
 346                                     tomoyo_merge_unix_acl);
 347        tomoyo_put_name_union(&e.name);
 348        return error;
 349}
 350
 351/**
 352 * tomoyo_audit_net_log - Audit network log.
 353 *
 354 * @r:         Pointer to "struct tomoyo_request_info".
 355 * @family:    Name of socket family ("inet" or "unix").
 356 * @protocol:  Name of protocol in @family.
 357 * @operation: Name of socket operation.
 358 * @address:   Name of address.
 359 *
 360 * Returns 0 on success, negative value otherwise.
 361 */
 362static int tomoyo_audit_net_log(struct tomoyo_request_info *r,
 363                                const char *family, const u8 protocol,
 364                                const u8 operation, const char *address)
 365{
 366        return tomoyo_supervisor(r, "network %s %s %s %s\n", family,
 367                                 tomoyo_proto_keyword[protocol],
 368                                 tomoyo_socket_keyword[operation], address);
 369}
 370
 371/**
 372 * tomoyo_audit_inet_log - Audit INET network log.
 373 *
 374 * @r: Pointer to "struct tomoyo_request_info".
 375 *
 376 * Returns 0 on success, negative value otherwise.
 377 */
 378static int tomoyo_audit_inet_log(struct tomoyo_request_info *r)
 379{
 380        char buf[128];
 381        int len;
 382        const __be32 *address = r->param.inet_network.address;
 383
 384        if (r->param.inet_network.is_ipv6)
 385                tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *)
 386                                  address, (const struct in6_addr *) address);
 387        else
 388                tomoyo_print_ipv4(buf, sizeof(buf), address, address);
 389        len = strlen(buf);
 390        snprintf(buf + len, sizeof(buf) - len, " %u",
 391                 r->param.inet_network.port);
 392        return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol,
 393                                    r->param.inet_network.operation, buf);
 394}
 395
 396/**
 397 * tomoyo_audit_unix_log - Audit UNIX network log.
 398 *
 399 * @r: Pointer to "struct tomoyo_request_info".
 400 *
 401 * Returns 0 on success, negative value otherwise.
 402 */
 403static int tomoyo_audit_unix_log(struct tomoyo_request_info *r)
 404{
 405        return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol,
 406                                    r->param.unix_network.operation,
 407                                    r->param.unix_network.address->name);
 408}
 409
 410/**
 411 * tomoyo_check_inet_acl - Check permission for inet domain socket operation.
 412 *
 413 * @r:   Pointer to "struct tomoyo_request_info".
 414 * @ptr: Pointer to "struct tomoyo_acl_info".
 415 *
 416 * Returns true if granted, false otherwise.
 417 */
 418static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r,
 419                                  const struct tomoyo_acl_info *ptr)
 420{
 421        const struct tomoyo_inet_acl *acl =
 422                container_of(ptr, typeof(*acl), head);
 423        const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4;
 424
 425        if (!(acl->perm & (1 << r->param.inet_network.operation)) ||
 426            !tomoyo_compare_number_union(r->param.inet_network.port,
 427                                         &acl->port))
 428                return false;
 429        if (acl->address.group)
 430                return tomoyo_address_matches_group
 431                        (r->param.inet_network.is_ipv6,
 432                         r->param.inet_network.address, acl->address.group);
 433        return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 &&
 434                memcmp(&acl->address.ip[0],
 435                       r->param.inet_network.address, size) <= 0 &&
 436                memcmp(r->param.inet_network.address,
 437                       &acl->address.ip[1], size) <= 0;
 438}
 439
 440/**
 441 * tomoyo_check_unix_acl - Check permission for unix domain socket operation.
 442 *
 443 * @r:   Pointer to "struct tomoyo_request_info".
 444 * @ptr: Pointer to "struct tomoyo_acl_info".
 445 *
 446 * Returns true if granted, false otherwise.
 447 */
 448static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r,
 449                                  const struct tomoyo_acl_info *ptr)
 450{
 451        const struct tomoyo_unix_acl *acl =
 452                container_of(ptr, typeof(*acl), head);
 453
 454        return (acl->perm & (1 << r->param.unix_network.operation)) &&
 455                tomoyo_compare_name_union(r->param.unix_network.address,
 456                                          &acl->name);
 457}
 458
 459/**
 460 * tomoyo_inet_entry - Check permission for INET network operation.
 461 *
 462 * @address: Pointer to "struct tomoyo_addr_info".
 463 *
 464 * Returns 0 on success, negative value otherwise.
 465 */
 466static int tomoyo_inet_entry(const struct tomoyo_addr_info *address)
 467{
 468        const int idx = tomoyo_read_lock();
 469        struct tomoyo_request_info r;
 470        int error = 0;
 471        const u8 type = tomoyo_inet2mac[address->protocol][address->operation];
 472
 473        if (type && tomoyo_init_request_info(&r, NULL, type)
 474            != TOMOYO_CONFIG_DISABLED) {
 475                r.param_type = TOMOYO_TYPE_INET_ACL;
 476                r.param.inet_network.protocol = address->protocol;
 477                r.param.inet_network.operation = address->operation;
 478                r.param.inet_network.is_ipv6 = address->inet.is_ipv6;
 479                r.param.inet_network.address = address->inet.address;
 480                r.param.inet_network.port = ntohs(address->inet.port);
 481                do {
 482                        tomoyo_check_acl(&r, tomoyo_check_inet_acl);
 483                        error = tomoyo_audit_inet_log(&r);
 484                } while (error == TOMOYO_RETRY_REQUEST);
 485        }
 486        tomoyo_read_unlock(idx);
 487        return error;
 488}
 489
 490/**
 491 * tomoyo_check_inet_address - Check permission for inet domain socket's operation.
 492 *
 493 * @addr:     Pointer to "struct sockaddr".
 494 * @addr_len: Size of @addr.
 495 * @port:     Port number.
 496 * @address:  Pointer to "struct tomoyo_addr_info".
 497 *
 498 * Returns 0 on success, negative value otherwise.
 499 */
 500static int tomoyo_check_inet_address(const struct sockaddr *addr,
 501                                     const unsigned int addr_len,
 502                                     const u16 port,
 503                                     struct tomoyo_addr_info *address)
 504{
 505        struct tomoyo_inet_addr_info *i = &address->inet;
 506
 507        switch (addr->sa_family) {
 508        case AF_INET6:
 509                if (addr_len < SIN6_LEN_RFC2133)
 510                        goto skip;
 511                i->is_ipv6 = true;
 512                i->address = (__be32 *)
 513                        ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;
 514                i->port = ((struct sockaddr_in6 *) addr)->sin6_port;
 515                break;
 516        case AF_INET:
 517                if (addr_len < sizeof(struct sockaddr_in))
 518                        goto skip;
 519                i->is_ipv6 = false;
 520                i->address = (__be32 *)
 521                        &((struct sockaddr_in *) addr)->sin_addr;
 522                i->port = ((struct sockaddr_in *) addr)->sin_port;
 523                break;
 524        default:
 525                goto skip;
 526        }
 527        if (address->protocol == SOCK_RAW)
 528                i->port = htons(port);
 529        return tomoyo_inet_entry(address);
 530skip:
 531        return 0;
 532}
 533
 534/**
 535 * tomoyo_unix_entry - Check permission for UNIX network operation.
 536 *
 537 * @address: Pointer to "struct tomoyo_addr_info".
 538 *
 539 * Returns 0 on success, negative value otherwise.
 540 */
 541static int tomoyo_unix_entry(const struct tomoyo_addr_info *address)
 542{
 543        const int idx = tomoyo_read_lock();
 544        struct tomoyo_request_info r;
 545        int error = 0;
 546        const u8 type = tomoyo_unix2mac[address->protocol][address->operation];
 547
 548        if (type && tomoyo_init_request_info(&r, NULL, type)
 549            != TOMOYO_CONFIG_DISABLED) {
 550                char *buf = address->unix0.addr;
 551                int len = address->unix0.addr_len - sizeof(sa_family_t);
 552
 553                if (len <= 0) {
 554                        buf = "anonymous";
 555                        len = 9;
 556                } else if (buf[0]) {
 557                        len = strnlen(buf, len);
 558                }
 559                buf = tomoyo_encode2(buf, len);
 560                if (buf) {
 561                        struct tomoyo_path_info addr;
 562
 563                        addr.name = buf;
 564                        tomoyo_fill_path_info(&addr);
 565                        r.param_type = TOMOYO_TYPE_UNIX_ACL;
 566                        r.param.unix_network.protocol = address->protocol;
 567                        r.param.unix_network.operation = address->operation;
 568                        r.param.unix_network.address = &addr;
 569                        do {
 570                                tomoyo_check_acl(&r, tomoyo_check_unix_acl);
 571                                error = tomoyo_audit_unix_log(&r);
 572                        } while (error == TOMOYO_RETRY_REQUEST);
 573                        kfree(buf);
 574                } else
 575                        error = -ENOMEM;
 576        }
 577        tomoyo_read_unlock(idx);
 578        return error;
 579}
 580
 581/**
 582 * tomoyo_check_unix_address - Check permission for unix domain socket's operation.
 583 *
 584 * @addr:     Pointer to "struct sockaddr".
 585 * @addr_len: Size of @addr.
 586 * @address:  Pointer to "struct tomoyo_addr_info".
 587 *
 588 * Returns 0 on success, negative value otherwise.
 589 */
 590static int tomoyo_check_unix_address(struct sockaddr *addr,
 591                                     const unsigned int addr_len,
 592                                     struct tomoyo_addr_info *address)
 593{
 594        struct tomoyo_unix_addr_info *u = &address->unix0;
 595
 596        if (addr->sa_family != AF_UNIX)
 597                return 0;
 598        u->addr = ((struct sockaddr_un *) addr)->sun_path;
 599        u->addr_len = addr_len;
 600        return tomoyo_unix_entry(address);
 601}
 602
 603/**
 604 * tomoyo_kernel_service - Check whether I'm kernel service or not.
 605 *
 606 * Returns true if I'm kernel service, false otherwise.
 607 */
 608static bool tomoyo_kernel_service(void)
 609{
 610        /* Nothing to do if I am a kernel service. */
 611        return segment_eq(get_fs(), KERNEL_DS);
 612}
 613
 614/**
 615 * tomoyo_sock_family - Get socket's family.
 616 *
 617 * @sk: Pointer to "struct sock".
 618 *
 619 * Returns one of PF_INET, PF_INET6, PF_UNIX or 0.
 620 */
 621static u8 tomoyo_sock_family(struct sock *sk)
 622{
 623        u8 family;
 624
 625        if (tomoyo_kernel_service())
 626                return 0;
 627        family = sk->sk_family;
 628        switch (family) {
 629        case PF_INET:
 630        case PF_INET6:
 631        case PF_UNIX:
 632                return family;
 633        default:
 634                return 0;
 635        }
 636}
 637
 638/**
 639 * tomoyo_socket_listen_permission - Check permission for listening a socket.
 640 *
 641 * @sock: Pointer to "struct socket".
 642 *
 643 * Returns 0 on success, negative value otherwise.
 644 */
 645int tomoyo_socket_listen_permission(struct socket *sock)
 646{
 647        struct tomoyo_addr_info address;
 648        const u8 family = tomoyo_sock_family(sock->sk);
 649        const unsigned int type = sock->type;
 650        struct sockaddr_storage addr;
 651        int addr_len;
 652
 653        if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET))
 654                return 0;
 655        {
 656                const int error = sock->ops->getname(sock, (struct sockaddr *)
 657                                                     &addr, &addr_len, 0);
 658
 659                if (error)
 660                        return error;
 661        }
 662        address.protocol = type;
 663        address.operation = TOMOYO_NETWORK_LISTEN;
 664        if (family == PF_UNIX)
 665                return tomoyo_check_unix_address((struct sockaddr *) &addr,
 666                                                 addr_len, &address);
 667        return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len,
 668                                         0, &address);
 669}
 670
 671/**
 672 * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket.
 673 *
 674 * @sock:     Pointer to "struct socket".
 675 * @addr:     Pointer to "struct sockaddr".
 676 * @addr_len: Size of @addr.
 677 *
 678 * Returns 0 on success, negative value otherwise.
 679 */
 680int tomoyo_socket_connect_permission(struct socket *sock,
 681                                     struct sockaddr *addr, int addr_len)
 682{
 683        struct tomoyo_addr_info address;
 684        const u8 family = tomoyo_sock_family(sock->sk);
 685        const unsigned int type = sock->type;
 686
 687        if (!family)
 688                return 0;
 689        address.protocol = type;
 690        switch (type) {
 691        case SOCK_DGRAM:
 692        case SOCK_RAW:
 693                address.operation = TOMOYO_NETWORK_SEND;
 694                break;
 695        case SOCK_STREAM:
 696        case SOCK_SEQPACKET:
 697                address.operation = TOMOYO_NETWORK_CONNECT;
 698                break;
 699        default:
 700                return 0;
 701        }
 702        if (family == PF_UNIX)
 703                return tomoyo_check_unix_address(addr, addr_len, &address);
 704        return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
 705                                         &address);
 706}
 707
 708/**
 709 * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket.
 710 *
 711 * @sock:     Pointer to "struct socket".
 712 * @addr:     Pointer to "struct sockaddr".
 713 * @addr_len: Size of @addr.
 714 *
 715 * Returns 0 on success, negative value otherwise.
 716 */
 717int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
 718                                  int addr_len)
 719{
 720        struct tomoyo_addr_info address;
 721        const u8 family = tomoyo_sock_family(sock->sk);
 722        const unsigned int type = sock->type;
 723
 724        if (!family)
 725                return 0;
 726        switch (type) {
 727        case SOCK_STREAM:
 728        case SOCK_DGRAM:
 729        case SOCK_RAW:
 730        case SOCK_SEQPACKET:
 731                address.protocol = type;
 732                address.operation = TOMOYO_NETWORK_BIND;
 733                break;
 734        default:
 735                return 0;
 736        }
 737        if (family == PF_UNIX)
 738                return tomoyo_check_unix_address(addr, addr_len, &address);
 739        return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
 740                                         &address);
 741}
 742
 743/**
 744 * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram.
 745 *
 746 * @sock: Pointer to "struct socket".
 747 * @msg:  Pointer to "struct msghdr".
 748 * @size: Unused.
 749 *
 750 * Returns 0 on success, negative value otherwise.
 751 */
 752int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
 753                                     int size)
 754{
 755        struct tomoyo_addr_info address;
 756        const u8 family = tomoyo_sock_family(sock->sk);
 757        const unsigned int type = sock->type;
 758
 759        if (!msg->msg_name || !family ||
 760            (type != SOCK_DGRAM && type != SOCK_RAW))
 761                return 0;
 762        address.protocol = type;
 763        address.operation = TOMOYO_NETWORK_SEND;
 764        if (family == PF_UNIX)
 765                return tomoyo_check_unix_address((struct sockaddr *)
 766                                                 msg->msg_name,
 767                                                 msg->msg_namelen, &address);
 768        return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name,
 769                                         msg->msg_namelen,
 770                                         sock->sk->sk_protocol, &address);
 771}
 772
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.