Commit 0617c7ff authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files

TOMOYO: Remove alias keyword. 



Some programs behave differently depending on argv[0] passed to execve().
TOMOYO has "alias" keyword in order to allow administrators to define different
domains if requested pathname passed to execve() is a symlink. But "alias"
keyword is incomplete because this keyword assumes that requested pathname and
argv[0] are identical. Thus, remove "alias" keyword (by this patch) and add
syntax for checking argv[0] (by future patches).

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 7c2ea22e

security/tomoyo/common.c

+0 −12
Original line number Diff line number Diff line
@@ -1177,8 +1177,6 @@ static int tomoyo_write_exception_policy(struct tomoyo_io_buffer *head) 
							      is_delete);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_AGGREGATOR))

		return tomoyo_write_aggregator_policy(data, is_delete);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALIAS))

		return tomoyo_write_alias_policy(data, is_delete);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALLOW_READ))

		return tomoyo_write_globally_readable_policy(data, is_delete);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_FILE_PATTERN))
@@ -1334,16 +1332,6 @@ static bool tomoyo_read_policy(struct tomoyo_io_buffer *head, const int idx) 
				w[1] = ptr->filename->name;

			}

			break;

		case TOMOYO_ID_ALIAS:

			{

				struct tomoyo_alias_entry *ptr =

					container_of(acl, typeof(*ptr), head);

				w[0] = TOMOYO_KEYWORD_ALIAS;

				w[1] = ptr->original_name->name;

				w[2] = " ";

				w[3] = ptr->aliased_name->name;

			}

			break;

		case TOMOYO_ID_AGGREGATOR:

			{

				struct tomoyo_aggregator_entry *ptr =

security/tomoyo/common.h

+5 −25
Original line number Diff line number Diff line
@@ -53,7 +53,6 @@ enum tomoyo_policy_id { 
	TOMOYO_ID_DOMAIN_INITIALIZER,

	TOMOYO_ID_DOMAIN_KEEPER,

	TOMOYO_ID_AGGREGATOR,

	TOMOYO_ID_ALIAS,

	TOMOYO_ID_GLOBALLY_READABLE,

	TOMOYO_ID_PATTERN,

	TOMOYO_ID_NO_REWRITE,
@@ -72,7 +71,6 @@ enum tomoyo_group_id { 


/* Keywords for ACLs. */

#define TOMOYO_KEYWORD_AGGREGATOR                "aggregator "

#define TOMOYO_KEYWORD_ALIAS                     "alias "

#define TOMOYO_KEYWORD_ALLOW_MOUNT               "allow_mount "

#define TOMOYO_KEYWORD_ALLOW_READ                "allow_read "

#define TOMOYO_KEYWORD_DELETE                    "delete "
@@ -682,20 +680,6 @@ struct tomoyo_aggregator_entry { 
	const struct tomoyo_path_info *aggregated_name;

};



/*

 * tomoyo_alias_entry is a structure which is used for holding "alias" entries.

 * It has following fields.

 *

 *  (1) "head" is "struct tomoyo_acl_head".

 *  (2) "original_name" which is a dereferenced pathname.

 *  (3) "aliased_name" which is a symlink's pathname.

 */

struct tomoyo_alias_entry {

	struct tomoyo_acl_head head;

	const struct tomoyo_path_info *original_name;

	const struct tomoyo_path_info *aliased_name;

};



/*

 * tomoyo_policy_manager_entry is a structure which is used for holding list of

 * domainnames or programs which are permitted to modify configuration via
@@ -809,8 +793,6 @@ int tomoyo_mount_permission(char *dev_name, struct path *path, char *type, 
			    unsigned long flags, void *data_page);

/* Create "aggregator" entry in exception policy. */

int tomoyo_write_aggregator_policy(char *data, const bool is_delete);

/* Create "alias" entry in exception policy. */

int tomoyo_write_alias_policy(char *data, const bool is_delete);

/*

 * Create "initialize_domain" and "no_initialize_domain" entry

 * in exception policy.
@@ -868,16 +850,14 @@ void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 
char *tomoyo_encode(const char *str);



/*

 * Returns realpath(3) of the given pathname but ignores chroot'ed root.

 * These functions use kzalloc(), so the caller must call kfree()

 * if these functions didn't return NULL.

 * Returns realpath(3) of the given pathname except that

 * ignores chroot'ed root and does not follow the final symlink.

 */

char *tomoyo_realpath(const char *pathname);

char *tomoyo_realpath_nofollow(const char *pathname);

/*

 * Same with tomoyo_realpath() except that it doesn't follow the final symlink.

 * Returns realpath(3) of the given pathname except that

 * ignores chroot'ed root and the pathname is already solved.

 */

char *tomoyo_realpath_nofollow(const char *pathname);

/* Same with tomoyo_realpath() except that the pathname is already solved. */

char *tomoyo_realpath_from_path(struct path *path);

/* Get patterned pathname. */

const char *tomoyo_file_pattern(const struct tomoyo_path_info *filename);

security/tomoyo/domain.c

+3 −97
Original line number Diff line number Diff line
@@ -467,72 +467,6 @@ int tomoyo_write_aggregator_policy(char *data, const bool is_delete) 
	return tomoyo_update_aggregator_entry(data, cp, is_delete);

}



static bool tomoyo_same_alias_entry(const struct tomoyo_acl_head *a,

				    const struct tomoyo_acl_head *b)

{

	const struct tomoyo_alias_entry *p1 = container_of(a, typeof(*p1),

							   head);

	const struct tomoyo_alias_entry *p2 = container_of(b, typeof(*p2),

							   head);

	return p1->original_name == p2->original_name &&

		p1->aliased_name == p2->aliased_name;

}



/**

 * tomoyo_update_alias_entry - Update "struct tomoyo_alias_entry" list.

 *

 * @original_name: The original program's real name.

 * @aliased_name:  The symbolic program's symbolic link's name.

 * @is_delete:     True if it is a delete request.

 *

 * Returns 0 on success, negative value otherwise.

 *

 * Caller holds tomoyo_read_lock().

 */

static int tomoyo_update_alias_entry(const char *original_name,

				     const char *aliased_name,

				     const bool is_delete)

{

	struct tomoyo_alias_entry e = { };

	int error = is_delete ? -ENOENT : -ENOMEM;



	if (!tomoyo_correct_path(original_name) ||

	    !tomoyo_correct_path(aliased_name))

		return -EINVAL;

	e.original_name = tomoyo_get_name(original_name);

	e.aliased_name = tomoyo_get_name(aliased_name);

	if (!e.original_name || !e.aliased_name ||

	    e.original_name->is_patterned || e.aliased_name->is_patterned)

		goto out; /* No patterns allowed. */

	error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,

				     &tomoyo_policy_list[TOMOYO_ID_ALIAS],

				     tomoyo_same_alias_entry);

 out:

	tomoyo_put_name(e.original_name);

	tomoyo_put_name(e.aliased_name);

	return error;

}



/**

 * tomoyo_write_alias_policy - Write "struct tomoyo_alias_entry" list.

 *

 * @data:      String to parse.

 * @is_delete: True if it is a delete request.

 *

 * Returns 0 on success, negative value otherwise.

 *

 * Caller holds tomoyo_read_lock().

 */

int tomoyo_write_alias_policy(char *data, const bool is_delete)

{

	char *cp = strchr(data, ' ');



	if (!cp)

		return -EINVAL;

	*cp++ = '\0';

	return tomoyo_update_alias_entry(data, cp, is_delete);

}



/**

 * tomoyo_find_or_assign_new_domain - Create a domain.

 *
@@ -606,7 +540,6 @@ int tomoyo_find_next_domain(struct linux_binprm *bprm) 
	int retval = -ENOMEM;

	bool need_kfree = false;

	struct tomoyo_path_info rn = { }; /* real name */

	struct tomoyo_path_info sn = { }; /* symlink name */

	struct tomoyo_path_info ln; /* last name */



	ln.name = tomoyo_get_last_name(old_domain);
@@ -621,39 +554,14 @@ int tomoyo_find_next_domain(struct linux_binprm *bprm) 
		kfree(rn.name);

		need_kfree = false;

	}

	/* Get tomoyo_realpath of program. */

	/* Get symlink's pathname of program. */

	retval = -ENOENT;

	rn.name = tomoyo_realpath(original_name);

	rn.name = tomoyo_realpath_nofollow(original_name);

	if (!rn.name)

		goto out;

	tomoyo_fill_path_info(&rn);

	need_kfree = true;



	/* Get tomoyo_realpath of symbolic link. */

	sn.name = tomoyo_realpath_nofollow(original_name);

	if (!sn.name)

		goto out;

	tomoyo_fill_path_info(&sn);



	/* Check 'alias' directive. */

	if (tomoyo_pathcmp(&rn, &sn)) {

		struct tomoyo_alias_entry *ptr;

		/* Is this program allowed to be called via symbolic links? */

		list_for_each_entry_rcu(ptr,

					&tomoyo_policy_list[TOMOYO_ID_ALIAS],

					head.list) {

			if (ptr->head.is_deleted ||

			    tomoyo_pathcmp(&rn, ptr->original_name) ||

			    tomoyo_pathcmp(&sn, ptr->aliased_name))

				continue;

			kfree(rn.name);

			need_kfree = false;

			/* This is OK because it is read only. */

			rn = *ptr->aliased_name;

			break;

		}

	}



	/* Check 'aggregator' directive. */

	{

		struct tomoyo_aggregator_entry *ptr;
@@ -663,7 +571,6 @@ int tomoyo_find_next_domain(struct linux_binprm *bprm) 
			    !tomoyo_path_matches_pattern(&rn,

							 ptr->original_name))

				continue;

			if (need_kfree)

			kfree(rn.name);

			need_kfree = false;

			/* This is OK because it is read only. */
@@ -729,7 +636,6 @@ int tomoyo_find_next_domain(struct linux_binprm *bprm) 
	bprm->cred->security = domain;

	if (need_kfree)

		kfree(rn.name);

	kfree(sn.name);

	kfree(tmp);

	return retval;

}

security/tomoyo/gc.c

+0 −11
Original line number Diff line number Diff line
@@ -77,14 +77,6 @@ static void tomoyo_del_aggregator(struct list_head *element) 
	tomoyo_put_name(ptr->aggregated_name);

}



static void tomoyo_del_alias(struct list_head *element)

{

	struct tomoyo_alias_entry *ptr =

		container_of(element, typeof(*ptr), head.list);

	tomoyo_put_name(ptr->original_name);

	tomoyo_put_name(ptr->aliased_name);

}



static void tomoyo_del_manager(struct list_head *element)

{

	struct tomoyo_policy_manager_entry *ptr =
@@ -309,9 +301,6 @@ static void tomoyo_kfree_entry(void) 
		case TOMOYO_ID_AGGREGATOR:

			tomoyo_del_aggregator(element);

			break;

		case TOMOYO_ID_ALIAS:

			tomoyo_del_alias(element);

			break;

		case TOMOYO_ID_GLOBALLY_READABLE:

			tomoyo_del_allow_read(element);

			break;

security/tomoyo/realpath.c

+0 −19
Original line number Diff line number Diff line
@@ -161,25 +161,6 @@ char *tomoyo_realpath_from_path(struct path *path) 
	return name;

}



/**

 * tomoyo_realpath - Get realpath of a pathname.

 *

 * @pathname: The pathname to solve.

 *

 * Returns the realpath of @pathname on success, NULL otherwise.

 */

char *tomoyo_realpath(const char *pathname)

{

	struct path path;



	if (pathname && kern_path(pathname, LOOKUP_FOLLOW, &path) == 0) {

		char *buf = tomoyo_realpath_from_path(&path);

		path_put(&path);

		return buf;

	}

	return NULL;

}



/**

 * tomoyo_realpath_nofollow - Get realpath of a pathname.

 *

CRA Git | Maintained and supported by SUSTech CRA and CCSE