Blame view
security/tomoyo/mount.c
6.7 KB
b24413180 License cleanup: ... |
1 |
// SPDX-License-Identifier: GPL-2.0 |
2106ccd97 TOMOYO: Add mount... |
2 3 4 |
/* * security/tomoyo/mount.c * |
0f2a55d5b TOMOYO: Update ke... |
5 |
* Copyright (C) 2005-2011 NTT DATA CORPORATION |
2106ccd97 TOMOYO: Add mount... |
6 7 8 9 |
*/ #include <linux/slab.h> #include "common.h" |
b5bc60b4c TOMOYO: Cleanup p... |
10 11 12 13 14 15 16 17 18 19 |
/* String table for special mount operations. */ static const char * const tomoyo_mounts[TOMOYO_MAX_SPECIAL_MOUNT] = { [TOMOYO_MOUNT_BIND] = "--bind", [TOMOYO_MOUNT_MOVE] = "--move", [TOMOYO_MOUNT_REMOUNT] = "--remount", [TOMOYO_MOUNT_MAKE_UNBINDABLE] = "--make-unbindable", [TOMOYO_MOUNT_MAKE_PRIVATE] = "--make-private", [TOMOYO_MOUNT_MAKE_SLAVE] = "--make-slave", [TOMOYO_MOUNT_MAKE_SHARED] = "--make-shared", }; |
2106ccd97 TOMOYO: Add mount... |
20 21 |
/** |
99a852596 TOMOYO: Use callb... |
22 23 24 25 26 27 28 29 |
* tomoyo_audit_mount_log - Audit mount log. * * @r: Pointer to "struct tomoyo_request_info". * * Returns 0 on success, negative value otherwise. */ static int tomoyo_audit_mount_log(struct tomoyo_request_info *r) { |
eadd99cc8 TOMOYO: Add audit... |
30 31 |
return tomoyo_supervisor(r, "file mount %s %s %s 0x%lX ", |
7c75964f4 TOMOYO: Cleanup p... |
32 |
r->param.mount.dev->name, |
eadd99cc8 TOMOYO: Add audit... |
33 34 35 |
r->param.mount.dir->name, r->param.mount.type->name, r->param.mount.flags); |
99a852596 TOMOYO: Use callb... |
36 |
} |
0df7e8b8f TOMOYO: Cleanup p... |
37 38 39 40 41 42 43 44 |
/** * tomoyo_check_mount_acl - Check permission for path path path number operation. * * @r: Pointer to "struct tomoyo_request_info". * @ptr: Pointer to "struct tomoyo_acl_info". * * Returns true if granted, false otherwise. */ |
484ca79c6 TOMOYO: Use pathn... |
45 |
static bool tomoyo_check_mount_acl(struct tomoyo_request_info *r, |
99a852596 TOMOYO: Use callb... |
46 47 48 49 |
const struct tomoyo_acl_info *ptr) { const struct tomoyo_mount_acl *acl = container_of(ptr, typeof(*acl), head); |
0df7e8b8f TOMOYO: Cleanup p... |
50 51 52 53 54 55 |
return tomoyo_compare_number_union(r->param.mount.flags, &acl->flags) && tomoyo_compare_name_union(r->param.mount.type, &acl->fs_type) && tomoyo_compare_name_union(r->param.mount.dir, &acl->dir_name) && |
99a852596 TOMOYO: Use callb... |
56 |
(!r->param.mount.need_dev || |
0df7e8b8f TOMOYO: Cleanup p... |
57 58 |
tomoyo_compare_name_union(r->param.mount.dev, &acl->dev_name)); |
99a852596 TOMOYO: Use callb... |
59 60 61 |
} /** |
d795ef9e7 TOMOYO: Loosen pa... |
62 |
* tomoyo_mount_acl - Check permission for mount() operation. |
2106ccd97 TOMOYO: Add mount... |
63 64 |
* * @r: Pointer to "struct tomoyo_request_info". |
0f2a55d5b TOMOYO: Update ke... |
65 |
* @dev_name: Name of device file. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
66 67 68 69 70 71 72 73 |
* @dir: Pointer to "struct path". * @type: Name of filesystem type. * @flags: Mount options. * * Returns 0 on success, negative value otherwise. * * Caller holds tomoyo_read_lock(). */ |
808d4e3cf consitify do_moun... |
74 75 |
static int tomoyo_mount_acl(struct tomoyo_request_info *r, const char *dev_name, |
e6641eddf tomoyo: constify ... |
76 |
const struct path *dir, const char *type, |
b5bc60b4c TOMOYO: Cleanup p... |
77 |
unsigned long flags) |
2106ccd97 TOMOYO: Add mount... |
78 |
{ |
97fb35e41 TOMOYO: Enable co... |
79 |
struct tomoyo_obj_info obj = { }; |
2106ccd97 TOMOYO: Add mount... |
80 |
struct path path; |
2106ccd97 TOMOYO: Add mount... |
81 82 83 84 85 86 87 88 89 |
struct file_system_type *fstype = NULL; const char *requested_type = NULL; const char *requested_dir_name = NULL; const char *requested_dev_name = NULL; struct tomoyo_path_info rtype; struct tomoyo_path_info rdev; struct tomoyo_path_info rdir; int need_dev = 0; int error = -ENOMEM; |
97fb35e41 TOMOYO: Enable co... |
90 |
r->obj = &obj; |
2106ccd97 TOMOYO: Add mount... |
91 92 |
/* Get fstype. */ |
c8c57e842 TOMOYO: Support l... |
93 |
requested_type = tomoyo_encode(type); |
2106ccd97 TOMOYO: Add mount... |
94 95 96 97 98 99 |
if (!requested_type) goto out; rtype.name = requested_type; tomoyo_fill_path_info(&rtype); /* Get mount point. */ |
97fb35e41 TOMOYO: Enable co... |
100 |
obj.path2 = *dir; |
2106ccd97 TOMOYO: Add mount... |
101 102 103 104 105 106 107 108 109 |
requested_dir_name = tomoyo_realpath_from_path(dir); if (!requested_dir_name) { error = -ENOMEM; goto out; } rdir.name = requested_dir_name; tomoyo_fill_path_info(&rdir); /* Compare fs name. */ |
b5bc60b4c TOMOYO: Cleanup p... |
110 |
if (type == tomoyo_mounts[TOMOYO_MOUNT_REMOUNT]) { |
2106ccd97 TOMOYO: Add mount... |
111 |
/* dev_name is ignored. */ |
b5bc60b4c TOMOYO: Cleanup p... |
112 113 114 115 |
} else if (type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_PRIVATE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_SLAVE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED]) { |
2106ccd97 TOMOYO: Add mount... |
116 |
/* dev_name is ignored. */ |
b5bc60b4c TOMOYO: Cleanup p... |
117 118 |
} else if (type == tomoyo_mounts[TOMOYO_MOUNT_BIND] || type == tomoyo_mounts[TOMOYO_MOUNT_MOVE]) { |
2106ccd97 TOMOYO: Add mount... |
119 120 121 122 123 124 125 126 127 128 129 130 131 |
need_dev = -1; /* dev_name is a directory */ } else { fstype = get_fs_type(type); if (!fstype) { error = -ENODEV; goto out; } if (fstype->fs_flags & FS_REQUIRES_DEV) /* dev_name is a block device file. */ need_dev = 1; } if (need_dev) { /* Get mount point or device file. */ |
4e78c724d TOMOYO: Fix oops ... |
132 |
if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) { |
2106ccd97 TOMOYO: Add mount... |
133 134 135 |
error = -ENOENT; goto out; } |
97fb35e41 TOMOYO: Enable co... |
136 |
obj.path1 = path; |
2106ccd97 TOMOYO: Add mount... |
137 138 139 140 141 142 143 144 145 |
requested_dev_name = tomoyo_realpath_from_path(&path); if (!requested_dev_name) { error = -ENOENT; goto out; } } else { /* Map dev_name to "<NULL>" if no dev_name given. */ if (!dev_name) dev_name = "<NULL>"; |
c8c57e842 TOMOYO: Support l... |
146 |
requested_dev_name = tomoyo_encode(dev_name); |
2106ccd97 TOMOYO: Add mount... |
147 148 149 150 151 152 153 |
if (!requested_dev_name) { error = -ENOMEM; goto out; } } rdev.name = requested_dev_name; tomoyo_fill_path_info(&rdev); |
cf6e9a646 TOMOYO: Pass para... |
154 155 156 157 158 159 |
r->param_type = TOMOYO_TYPE_MOUNT_ACL; r->param.mount.need_dev = need_dev; r->param.mount.dev = &rdev; r->param.mount.dir = &rdir; r->param.mount.type = &rtype; r->param.mount.flags = flags; |
99a852596 TOMOYO: Use callb... |
160 161 162 163 |
do { tomoyo_check_acl(r, tomoyo_check_mount_acl); error = tomoyo_audit_mount_log(r); } while (error == TOMOYO_RETRY_REQUEST); |
2106ccd97 TOMOYO: Add mount... |
164 165 166 167 168 169 |
out: kfree(requested_dev_name); kfree(requested_dir_name); if (fstype) put_filesystem(fstype); kfree(requested_type); |
97fb35e41 TOMOYO: Enable co... |
170 171 172 |
/* Drop refcount obtained by kern_path(). */ if (obj.path1.dentry) path_put(&obj.path1); |
2106ccd97 TOMOYO: Add mount... |
173 174 175 176 |
return error; } /** |
2106ccd97 TOMOYO: Add mount... |
177 178 |
* tomoyo_mount_permission - Check permission for mount() operation. * |
0f2a55d5b TOMOYO: Update ke... |
179 |
* @dev_name: Name of device file. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
180 |
* @path: Pointer to "struct path". |
0f2a55d5b TOMOYO: Update ke... |
181 |
* @type: Name of filesystem type. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
182 |
* @flags: Mount options. |
0f2a55d5b TOMOYO: Update ke... |
183 |
* @data_page: Optional data. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
184 185 186 |
* * Returns 0 on success, negative value otherwise. */ |
e6641eddf tomoyo: constify ... |
187 |
int tomoyo_mount_permission(const char *dev_name, const struct path *path, |
b5bc60b4c TOMOYO: Cleanup p... |
188 189 |
const char *type, unsigned long flags, void *data_page) |
2106ccd97 TOMOYO: Add mount... |
190 191 192 193 |
{ struct tomoyo_request_info r; int error; int idx; |
57c2590fb TOMOYO: Update pr... |
194 195 |
if (tomoyo_init_request_info(&r, NULL, TOMOYO_MAC_FILE_MOUNT) == TOMOYO_CONFIG_DISABLED) |
2106ccd97 TOMOYO: Add mount... |
196 |
return 0; |
d795ef9e7 TOMOYO: Loosen pa... |
197 198 199 |
if ((flags & MS_MGC_MSK) == MS_MGC_VAL) flags &= ~MS_MGC_MSK; if (flags & MS_REMOUNT) { |
b5bc60b4c TOMOYO: Cleanup p... |
200 |
type = tomoyo_mounts[TOMOYO_MOUNT_REMOUNT]; |
d795ef9e7 TOMOYO: Loosen pa... |
201 |
flags &= ~MS_REMOUNT; |
df91e4947 TOMOYO: Fix mount... |
202 |
} else if (flags & MS_BIND) { |
b5bc60b4c TOMOYO: Cleanup p... |
203 |
type = tomoyo_mounts[TOMOYO_MOUNT_BIND]; |
d795ef9e7 TOMOYO: Loosen pa... |
204 |
flags &= ~MS_BIND; |
df91e4947 TOMOYO: Fix mount... |
205 206 207 208 209 210 211 212 |
} else if (flags & MS_SHARED) { if (flags & (MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) return -EINVAL; type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED]; flags &= ~MS_SHARED; } else if (flags & MS_PRIVATE) { if (flags & (MS_SHARED | MS_SLAVE | MS_UNBINDABLE)) return -EINVAL; |
b5bc60b4c TOMOYO: Cleanup p... |
213 |
type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_PRIVATE]; |
d795ef9e7 TOMOYO: Loosen pa... |
214 |
flags &= ~MS_PRIVATE; |
df91e4947 TOMOYO: Fix mount... |
215 216 217 |
} else if (flags & MS_SLAVE) { if (flags & (MS_SHARED | MS_PRIVATE | MS_UNBINDABLE)) return -EINVAL; |
b5bc60b4c TOMOYO: Cleanup p... |
218 |
type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SLAVE]; |
d795ef9e7 TOMOYO: Loosen pa... |
219 |
flags &= ~MS_SLAVE; |
df91e4947 TOMOYO: Fix mount... |
220 221 222 223 224 225 226 227 |
} else if (flags & MS_UNBINDABLE) { if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE)) return -EINVAL; type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE]; flags &= ~MS_UNBINDABLE; } else if (flags & MS_MOVE) { type = tomoyo_mounts[TOMOYO_MOUNT_MOVE]; flags &= ~MS_MOVE; |
d795ef9e7 TOMOYO: Loosen pa... |
228 |
} |
2106ccd97 TOMOYO: Add mount... |
229 230 231 232 233 234 235 |
if (!type) type = "<NULL>"; idx = tomoyo_read_lock(); error = tomoyo_mount_acl(&r, dev_name, path, type, flags); tomoyo_read_unlock(idx); return error; } |