Blame view
security/tomoyo/mount.c
6.67 KB
2106ccd97 TOMOYO: Add mount... |
1 2 3 |
/* * security/tomoyo/mount.c * |
0f2a55d5b TOMOYO: Update ke... |
4 |
* Copyright (C) 2005-2011 NTT DATA CORPORATION |
2106ccd97 TOMOYO: Add mount... |
5 6 7 8 |
*/ #include <linux/slab.h> #include "common.h" |
b5bc60b4c TOMOYO: Cleanup p... |
9 10 11 12 13 14 15 16 17 18 |
/* String table for special mount operations. */ static const char * const tomoyo_mounts[TOMOYO_MAX_SPECIAL_MOUNT] = { [TOMOYO_MOUNT_BIND] = "--bind", [TOMOYO_MOUNT_MOVE] = "--move", [TOMOYO_MOUNT_REMOUNT] = "--remount", [TOMOYO_MOUNT_MAKE_UNBINDABLE] = "--make-unbindable", [TOMOYO_MOUNT_MAKE_PRIVATE] = "--make-private", [TOMOYO_MOUNT_MAKE_SLAVE] = "--make-slave", [TOMOYO_MOUNT_MAKE_SHARED] = "--make-shared", }; |
2106ccd97 TOMOYO: Add mount... |
19 20 |
/** |
99a852596 TOMOYO: Use callb... |
21 22 23 24 25 26 27 28 |
* tomoyo_audit_mount_log - Audit mount log. * * @r: Pointer to "struct tomoyo_request_info". * * Returns 0 on success, negative value otherwise. */ static int tomoyo_audit_mount_log(struct tomoyo_request_info *r) { |
eadd99cc8 TOMOYO: Add audit... |
29 30 |
return tomoyo_supervisor(r, "file mount %s %s %s 0x%lX ", |
7c75964f4 TOMOYO: Cleanup p... |
31 |
r->param.mount.dev->name, |
eadd99cc8 TOMOYO: Add audit... |
32 33 34 |
r->param.mount.dir->name, r->param.mount.type->name, r->param.mount.flags); |
99a852596 TOMOYO: Use callb... |
35 |
} |
0df7e8b8f TOMOYO: Cleanup p... |
36 37 38 39 40 41 42 43 |
/** * tomoyo_check_mount_acl - Check permission for path path path number operation. * * @r: Pointer to "struct tomoyo_request_info". * @ptr: Pointer to "struct tomoyo_acl_info". * * Returns true if granted, false otherwise. */ |
484ca79c6 TOMOYO: Use pathn... |
44 |
static bool tomoyo_check_mount_acl(struct tomoyo_request_info *r, |
99a852596 TOMOYO: Use callb... |
45 46 47 48 |
const struct tomoyo_acl_info *ptr) { const struct tomoyo_mount_acl *acl = container_of(ptr, typeof(*acl), head); |
0df7e8b8f TOMOYO: Cleanup p... |
49 50 51 52 53 54 |
return tomoyo_compare_number_union(r->param.mount.flags, &acl->flags) && tomoyo_compare_name_union(r->param.mount.type, &acl->fs_type) && tomoyo_compare_name_union(r->param.mount.dir, &acl->dir_name) && |
99a852596 TOMOYO: Use callb... |
55 |
(!r->param.mount.need_dev || |
0df7e8b8f TOMOYO: Cleanup p... |
56 57 |
tomoyo_compare_name_union(r->param.mount.dev, &acl->dev_name)); |
99a852596 TOMOYO: Use callb... |
58 59 60 |
} /** |
d795ef9e7 TOMOYO: Loosen pa... |
61 |
* tomoyo_mount_acl - Check permission for mount() operation. |
2106ccd97 TOMOYO: Add mount... |
62 63 |
* * @r: Pointer to "struct tomoyo_request_info". |
0f2a55d5b TOMOYO: Update ke... |
64 |
* @dev_name: Name of device file. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
65 66 67 68 69 70 71 72 |
* @dir: Pointer to "struct path". * @type: Name of filesystem type. * @flags: Mount options. * * Returns 0 on success, negative value otherwise. * * Caller holds tomoyo_read_lock(). */ |
808d4e3cf consitify do_moun... |
73 74 |
static int tomoyo_mount_acl(struct tomoyo_request_info *r, const char *dev_name, |
e6641eddf tomoyo: constify ... |
75 |
const struct path *dir, const char *type, |
b5bc60b4c TOMOYO: Cleanup p... |
76 |
unsigned long flags) |
2106ccd97 TOMOYO: Add mount... |
77 |
{ |
97fb35e41 TOMOYO: Enable co... |
78 |
struct tomoyo_obj_info obj = { }; |
2106ccd97 TOMOYO: Add mount... |
79 |
struct path path; |
2106ccd97 TOMOYO: Add mount... |
80 81 82 83 84 85 86 87 88 |
struct file_system_type *fstype = NULL; const char *requested_type = NULL; const char *requested_dir_name = NULL; const char *requested_dev_name = NULL; struct tomoyo_path_info rtype; struct tomoyo_path_info rdev; struct tomoyo_path_info rdir; int need_dev = 0; int error = -ENOMEM; |
97fb35e41 TOMOYO: Enable co... |
89 |
r->obj = &obj; |
2106ccd97 TOMOYO: Add mount... |
90 91 |
/* Get fstype. */ |
c8c57e842 TOMOYO: Support l... |
92 |
requested_type = tomoyo_encode(type); |
2106ccd97 TOMOYO: Add mount... |
93 94 95 96 97 98 |
if (!requested_type) goto out; rtype.name = requested_type; tomoyo_fill_path_info(&rtype); /* Get mount point. */ |
97fb35e41 TOMOYO: Enable co... |
99 |
obj.path2 = *dir; |
2106ccd97 TOMOYO: Add mount... |
100 101 102 103 104 105 106 107 108 |
requested_dir_name = tomoyo_realpath_from_path(dir); if (!requested_dir_name) { error = -ENOMEM; goto out; } rdir.name = requested_dir_name; tomoyo_fill_path_info(&rdir); /* Compare fs name. */ |
b5bc60b4c TOMOYO: Cleanup p... |
109 |
if (type == tomoyo_mounts[TOMOYO_MOUNT_REMOUNT]) { |
2106ccd97 TOMOYO: Add mount... |
110 |
/* dev_name is ignored. */ |
b5bc60b4c TOMOYO: Cleanup p... |
111 112 113 114 |
} else if (type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_PRIVATE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_SLAVE] || type == tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED]) { |
2106ccd97 TOMOYO: Add mount... |
115 |
/* dev_name is ignored. */ |
b5bc60b4c TOMOYO: Cleanup p... |
116 117 |
} else if (type == tomoyo_mounts[TOMOYO_MOUNT_BIND] || type == tomoyo_mounts[TOMOYO_MOUNT_MOVE]) { |
2106ccd97 TOMOYO: Add mount... |
118 119 120 121 122 123 124 125 126 127 128 129 130 |
need_dev = -1; /* dev_name is a directory */ } else { fstype = get_fs_type(type); if (!fstype) { error = -ENODEV; goto out; } if (fstype->fs_flags & FS_REQUIRES_DEV) /* dev_name is a block device file. */ need_dev = 1; } if (need_dev) { /* Get mount point or device file. */ |
4e78c724d TOMOYO: Fix oops ... |
131 |
if (!dev_name || kern_path(dev_name, LOOKUP_FOLLOW, &path)) { |
2106ccd97 TOMOYO: Add mount... |
132 133 134 |
error = -ENOENT; goto out; } |
97fb35e41 TOMOYO: Enable co... |
135 |
obj.path1 = path; |
2106ccd97 TOMOYO: Add mount... |
136 137 138 139 140 141 142 143 144 |
requested_dev_name = tomoyo_realpath_from_path(&path); if (!requested_dev_name) { error = -ENOENT; goto out; } } else { /* Map dev_name to "<NULL>" if no dev_name given. */ if (!dev_name) dev_name = "<NULL>"; |
c8c57e842 TOMOYO: Support l... |
145 |
requested_dev_name = tomoyo_encode(dev_name); |
2106ccd97 TOMOYO: Add mount... |
146 147 148 149 150 151 152 |
if (!requested_dev_name) { error = -ENOMEM; goto out; } } rdev.name = requested_dev_name; tomoyo_fill_path_info(&rdev); |
cf6e9a646 TOMOYO: Pass para... |
153 154 155 156 157 158 |
r->param_type = TOMOYO_TYPE_MOUNT_ACL; r->param.mount.need_dev = need_dev; r->param.mount.dev = &rdev; r->param.mount.dir = &rdir; r->param.mount.type = &rtype; r->param.mount.flags = flags; |
99a852596 TOMOYO: Use callb... |
159 160 161 162 |
do { tomoyo_check_acl(r, tomoyo_check_mount_acl); error = tomoyo_audit_mount_log(r); } while (error == TOMOYO_RETRY_REQUEST); |
2106ccd97 TOMOYO: Add mount... |
163 164 165 166 167 168 |
out: kfree(requested_dev_name); kfree(requested_dir_name); if (fstype) put_filesystem(fstype); kfree(requested_type); |
97fb35e41 TOMOYO: Enable co... |
169 170 171 |
/* Drop refcount obtained by kern_path(). */ if (obj.path1.dentry) path_put(&obj.path1); |
2106ccd97 TOMOYO: Add mount... |
172 173 174 175 |
return error; } /** |
2106ccd97 TOMOYO: Add mount... |
176 177 |
* tomoyo_mount_permission - Check permission for mount() operation. * |
0f2a55d5b TOMOYO: Update ke... |
178 |
* @dev_name: Name of device file. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
179 |
* @path: Pointer to "struct path". |
0f2a55d5b TOMOYO: Update ke... |
180 |
* @type: Name of filesystem type. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
181 |
* @flags: Mount options. |
0f2a55d5b TOMOYO: Update ke... |
182 |
* @data_page: Optional data. Maybe NULL. |
2106ccd97 TOMOYO: Add mount... |
183 184 185 |
* * Returns 0 on success, negative value otherwise. */ |
e6641eddf tomoyo: constify ... |
186 |
int tomoyo_mount_permission(const char *dev_name, const struct path *path, |
b5bc60b4c TOMOYO: Cleanup p... |
187 188 |
const char *type, unsigned long flags, void *data_page) |
2106ccd97 TOMOYO: Add mount... |
189 190 191 192 |
{ struct tomoyo_request_info r; int error; int idx; |
57c2590fb TOMOYO: Update pr... |
193 194 |
if (tomoyo_init_request_info(&r, NULL, TOMOYO_MAC_FILE_MOUNT) == TOMOYO_CONFIG_DISABLED) |
2106ccd97 TOMOYO: Add mount... |
195 |
return 0; |
d795ef9e7 TOMOYO: Loosen pa... |
196 197 198 |
if ((flags & MS_MGC_MSK) == MS_MGC_VAL) flags &= ~MS_MGC_MSK; if (flags & MS_REMOUNT) { |
b5bc60b4c TOMOYO: Cleanup p... |
199 |
type = tomoyo_mounts[TOMOYO_MOUNT_REMOUNT]; |
d795ef9e7 TOMOYO: Loosen pa... |
200 |
flags &= ~MS_REMOUNT; |
df91e4947 TOMOYO: Fix mount... |
201 |
} else if (flags & MS_BIND) { |
b5bc60b4c TOMOYO: Cleanup p... |
202 |
type = tomoyo_mounts[TOMOYO_MOUNT_BIND]; |
d795ef9e7 TOMOYO: Loosen pa... |
203 |
flags &= ~MS_BIND; |
df91e4947 TOMOYO: Fix mount... |
204 205 206 207 208 209 210 211 |
} else if (flags & MS_SHARED) { if (flags & (MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE)) return -EINVAL; type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SHARED]; flags &= ~MS_SHARED; } else if (flags & MS_PRIVATE) { if (flags & (MS_SHARED | MS_SLAVE | MS_UNBINDABLE)) return -EINVAL; |
b5bc60b4c TOMOYO: Cleanup p... |
212 |
type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_PRIVATE]; |
d795ef9e7 TOMOYO: Loosen pa... |
213 |
flags &= ~MS_PRIVATE; |
df91e4947 TOMOYO: Fix mount... |
214 215 216 |
} else if (flags & MS_SLAVE) { if (flags & (MS_SHARED | MS_PRIVATE | MS_UNBINDABLE)) return -EINVAL; |
b5bc60b4c TOMOYO: Cleanup p... |
217 |
type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_SLAVE]; |
d795ef9e7 TOMOYO: Loosen pa... |
218 |
flags &= ~MS_SLAVE; |
df91e4947 TOMOYO: Fix mount... |
219 220 221 222 223 224 225 226 |
} else if (flags & MS_UNBINDABLE) { if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE)) return -EINVAL; type = tomoyo_mounts[TOMOYO_MOUNT_MAKE_UNBINDABLE]; flags &= ~MS_UNBINDABLE; } else if (flags & MS_MOVE) { type = tomoyo_mounts[TOMOYO_MOUNT_MOVE]; flags &= ~MS_MOVE; |
d795ef9e7 TOMOYO: Loosen pa... |
227 |
} |
2106ccd97 TOMOYO: Add mount... |
228 229 230 231 232 233 234 |
if (!type) type = "<NULL>"; idx = tomoyo_read_lock(); error = tomoyo_mount_acl(&r, dev_name, path, type, flags); tomoyo_read_unlock(idx); return error; } |