@@ -3,6 +3,7 @@ config SECURITY_TOMOYO
depends on SECURITY
select SECURITYFS
select SECURITY_PATH
+ select SECURITY_NETWORK
default n
help
This selects TOMOYO Linux, pathname-based access control.
@@ -1 +1 @@
-obj-y = common.o realpath.o tomoyo.o domain.o file.o
+obj-y = common.o realpath.o tomoyo.o domain.o file.o network.o
@@ -12,6 +12,7 @@
#include <linux/uaccess.h>
#include <linux/security.h>
#include <linux/hardirq.h>
+#include <linux/kernel.h>
#include "realpath.h"
#include "common.h"
#include "tomoyo.h"
@@ -35,6 +36,7 @@ static struct {
const unsigned int max_value;
} tomoyo_control_array[TOMOYO_MAX_CONTROL_INDEX] = {
[TOMOYO_MAC_FOR_FILE] = { "MAC_FOR_FILE", 0, 3 },
+ [TOMOYO_MAC_FOR_NETWORK] = { "MAC_FOR_NETWORK", 0, 3 },
[TOMOYO_MAX_ACCEPT_ENTRY] = { "MAX_ACCEPT_ENTRY", 2048, INT_MAX },
[TOMOYO_VERBOSE] = { "TOMOYO_VERBOSE", 1, 1 },
};
@@ -836,6 +838,9 @@ bool tomoyo_domain_quota_is_ok(struct to
if (perm & (1 << TOMOYO_TYPE_RENAME_ACL))
count++;
break;
+ case TOMOYO_TYPE_IP_NETWORK_ACL:
+ count++;
+ break;
}
}
up_read(&tomoyo_domain_acl_info_list_lock);
@@ -1290,6 +1295,8 @@ static int tomoyo_write_domain_policy(st
TOMOYO_DOMAIN_FLAGS_IGNORE_GLOBAL_ALLOW_READ);
return 0;
}
+ if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALLOW_NETWORK))
+ return tomoyo_write_network_policy(data, domain, is_delete);
return tomoyo_write_file_policy(data, domain, is_delete);
}
@@ -1378,6 +1385,107 @@ static bool tomoyo_print_double_path_acl
}
/**
+ * tomoyo_print_ipv4_entry - Print IPv4 address of a network ACL entry.
+ *
+ * @head: Pointer to "struct tomoyo_io_buffer".
+ * @ptr: Pointer to "struct tomoyo_ip_network_acl_record".
+ *
+ * Returns true on success, false otherwise.
+ */
+static bool tomoyo_print_ipv4_entry(struct tomoyo_io_buffer *head,
+ struct tomoyo_ip_network_acl_record *ptr)
+{
+ const u32 min_address = htonl(ptr->u.ipv4.min);
+ const u32 max_address = htonl(ptr->u.ipv4.max);
+ if (!tomoyo_io_printf(head, "%pI4", &min_address))
+ return false;
+ if (min_address != max_address
+ && !tomoyo_io_printf(head, "-%pI4", &max_address))
+ return false;
+ return true;
+}
+
+/**
+ * tomoyo_print_ipv6_entry - Print IPv6 address of a network ACL entry.
+ *
+ * @head: Pointer to "struct tomoyo_io_buffer".
+ * @ptr: Pointer to "struct tomoyo_ip_network_acl_record".
+ *
+ * Returns true on success, false otherwise.
+ */
+static bool tomoyo_print_ipv6_entry(struct tomoyo_io_buffer *head,
+ struct tomoyo_ip_network_acl_record *ptr)
+{
+ char buf[64];
+ const struct in6_addr *min_address = ptr->u.ipv6.min;
+ const struct in6_addr *max_address = ptr->u.ipv6.max;
+ tomoyo_print_ipv6(buf, sizeof(buf), min_address);
+ if (!tomoyo_io_printf(head, "%s", buf))
+ return false;
+ if (min_address != max_address) {
+ tomoyo_print_ipv6(buf, sizeof(buf), max_address);
+ if (!tomoyo_io_printf(head, "-%s", buf))
+ return false;
+ }
+ return true;
+}
+
+/**
+ * tomoyo_print_port_entry - Print port number of a network ACL entry.
+ *
+ * @head: Pointer to "struct tomoyo_io_buffer".
+ * @ptr: Pointer to "struct tomoyo_ip_network_acl_record".
+ *
+ * Returns true on success, false otherwise.
+ */
+static bool tomoyo_print_port_entry(struct tomoyo_io_buffer *head,
+ struct tomoyo_ip_network_acl_record *ptr)
+{
+ const u16 min_port = ptr->min_port;
+ const u16 max_port = ptr->max_port;
+ if (!tomoyo_io_printf(head, " %u", min_port))
+ return false;
+ if (min_port != max_port && !tomoyo_io_printf(head, "-%u", max_port))
+ return false;
+ if (!tomoyo_io_printf(head, "\n"))
+ return false;
+ return true;
+}
+
+/**
+ * tomoyo_print_network_acl - Print a network ACL entry.
+ *
+ * @head: Pointer to "struct tomoyo_io_buffer".
+ * @ptr: Pointer to "struct tomoyo_ip_network_acl_record".
+ *
+ * Returns true on success, false otherwise.
+ */
+static bool tomoyo_print_network_acl(struct tomoyo_io_buffer *head,
+ struct tomoyo_ip_network_acl_record *ptr)
+{
+ int pos = head->read_avail;
+ if (!tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_NETWORK "%s ",
+ tomoyo_net2keyword(ptr->operation_type)))
+ goto out;
+ switch (ptr->record_type) {
+ case TOMOYO_IP_RECORD_TYPE_IPv4:
+ if (!tomoyo_print_ipv4_entry(head, ptr))
+ goto out;
+ break;
+ case TOMOYO_IP_RECORD_TYPE_IPv6:
+ if (!tomoyo_print_ipv6_entry(head, ptr))
+ goto out;
+ break;
+ }
+ if (!tomoyo_print_port_entry(head, ptr))
+ goto out;
+ return true;
+ out:
+ head->read_avail = pos;
+ return false;
+}
+
+/**
* tomoyo_print_entry - Print an ACL entry.
*
* @head: Pointer to "struct tomoyo_io_buffer".
@@ -1406,6 +1514,13 @@ static bool tomoyo_print_entry(struct to
head);
return tomoyo_print_double_path_acl(head, acl);
}
+ if (acl_type == TOMOYO_TYPE_IP_NETWORK_ACL) {
+ struct tomoyo_ip_network_acl_record *acl
+ = container_of(ptr,
+ struct tomoyo_ip_network_acl_record,
+ head);
+ return tomoyo_print_network_acl(head, acl);
+ }
BUG(); /* This must not happen. */
return false;
}
@@ -2068,6 +2183,9 @@ void *tomoyo_alloc_acl_element(const u8
case TOMOYO_TYPE_DOUBLE_PATH_ACL:
len = sizeof(struct tomoyo_double_path_acl_record);
break;
+ case TOMOYO_TYPE_IP_NETWORK_ACL:
+ len = sizeof(struct tomoyo_ip_network_acl_record);
+ break;
default:
return NULL;
}
@@ -130,8 +130,59 @@ struct tomoyo_double_path_acl_record {
const struct tomoyo_path_info *filename2;
};
+/* Structure for "allow_network" directive. */
+struct tomoyo_ip_network_acl_record {
+ struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_IP_NETWORK_ACL */
+ /*
+ * operation_type takes one of the following constants.
+ * NETWORK_ACL_UDP_BIND for UDP's bind() operation.
+ * NETWORK_ACL_UDP_CONNECT for UDP's connect()/send()/recv()
+ * operation.
+ * NETWORK_ACL_TCP_BIND for TCP's bind() operation.
+ * NETWORK_ACL_TCP_LISTEN for TCP's listen() operation.
+ * NETWORK_ACL_TCP_CONNECT for TCP's connect() operation.
+ * NETWORK_ACL_TCP_ACCEPT for TCP's accept() operation.
+ * NETWORK_ACL_RAW_BIND for IP's bind() operation.
+ * NETWORK_ACL_RAW_CONNECT for IP's connect()/send()/recv()
+ * operation.
+ */
+ u8 operation_type;
+ /*
+ * record_type takes one of the following constants.
+ * TOMOYO_IP_RECORD_TYPE_IPv4
+ * if u points to an IPv4 address.
+ * TOMOYO_IP_RECORD_TYPE_IPv6
+ * if u points to an IPv6 address.
+ */
+ u8 record_type;
+ /* Start of port number range. */
+ u16 min_port;
+ /* End of port number range. */
+ u16 max_port;
+ union {
+ struct {
+ /* Start of IPv4 address range. Host endian. */
+ u32 min;
+ /* End of IPv4 address range. Host endian. */
+ u32 max;
+ } ipv4;
+ struct {
+ /* Start of IPv6 address range. Big endian. */
+ const struct in6_addr *min;
+ /* End of IPv6 address range. Big endian. */
+ const struct in6_addr *max;
+ } ipv6;
+ } u;
+};
+
+enum tomoyo_ip_record_type {
+ TOMOYO_IP_RECORD_TYPE_IPv4,
+ TOMOYO_IP_RECORD_TYPE_IPv6
+};
+
/* Keywords for ACLs. */
#define TOMOYO_KEYWORD_ALIAS "alias "
+#define TOMOYO_KEYWORD_ALLOW_NETWORK "allow_network "
#define TOMOYO_KEYWORD_ALLOW_READ "allow_read "
#define TOMOYO_KEYWORD_DELETE "delete "
#define TOMOYO_KEYWORD_DENY_REWRITE "deny_rewrite "
@@ -149,9 +200,10 @@ struct tomoyo_double_path_acl_record {
/* Index numbers for Access Controls. */
#define TOMOYO_MAC_FOR_FILE 0 /* domain_policy.conf */
-#define TOMOYO_MAX_ACCEPT_ENTRY 1
-#define TOMOYO_VERBOSE 2
-#define TOMOYO_MAX_CONTROL_INDEX 3
+#define TOMOYO_MAC_FOR_NETWORK 1
+#define TOMOYO_MAX_ACCEPT_ENTRY 2
+#define TOMOYO_VERBOSE 3
+#define TOMOYO_MAX_CONTROL_INDEX 4
/* Structure for reading/writing policy via securityfs interfaces. */
struct tomoyo_io_buffer {
@@ -204,6 +256,9 @@ bool tomoyo_is_domain_def(const unsigned
/* Check whether the given filename matches the given pattern. */
bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
const struct tomoyo_path_info *pattern);
+/* Print an IPv6 address. */
+void tomoyo_print_ipv6(char *buffer, const int buffer_len,
+ const struct in6_addr *ip);
/* Read "alias" entry in exception policy. */
bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head);
/*
@@ -275,6 +330,13 @@ void tomoyo_load_policy(const char *file
/* Change "struct tomoyo_domain_info"->flags. */
void tomoyo_set_domain_flag(struct tomoyo_domain_info *domain,
const bool is_delete, const u8 flags);
+/* Read "allow_network" entry in domain policy. */
+bool tomoyo_read_network_policy(struct tomoyo_io_buffer *head);
+/* Create "allow_network" entry in domain policy. */
+int tomoyo_write_network_policy(char *data, struct tomoyo_domain_info *domain,
+ const bool is_delete);
+/* Convert network operation index to network operation name. */
+const char *tomoyo_net2keyword(const u8 operation);
/* strcmp() for "struct tomoyo_path_info" structure. */
static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a,
@@ -0,0 +1,930 @@
+/*
+ * security/tomoyo/network.c
+ *
+ * Implementation of the Domain-Based Mandatory Access Control.
+ *
+ * Copyright (C) 2005-2009 NTT DATA CORPORATION
+ *
+ * Version: 2.3.0-pre 2009/04/15
+ *
+ */
+
+#include "common.h"
+#include "tomoyo.h"
+#include "realpath.h"
+
+#include <linux/net.h>
+#include <linux/inet.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include <net/udp.h>
+
+/* Index numbers for Network Controls. */
+enum tomoyo_network_acl_index {
+ NETWORK_ACL_UDP_BIND,
+ NETWORK_ACL_UDP_CONNECT,
+ NETWORK_ACL_TCP_BIND,
+ NETWORK_ACL_TCP_LISTEN,
+ NETWORK_ACL_TCP_CONNECT,
+ NETWORK_ACL_TCP_ACCEPT,
+ NETWORK_ACL_RAW_BIND,
+ NETWORK_ACL_RAW_CONNECT
+};
+
+/**
+ * tomoyo_save_ipv6_address - Keep the given IPv6 address on the RAM.
+ *
+ * @addr: Pointer to "struct in6_addr".
+ *
+ * Returns pointer to "struct in6_addr" on success, NULL otherwise.
+ *
+ * The RAM is shared, so NEVER try to modify or kfree() the returned address.
+ */
+static const struct in6_addr *tomoyo_save_ipv6_address(const struct in6_addr *
+ addr)
+{
+ static const u8 tomoyo_block_size = 16;
+ struct tomoyo_addr_list {
+ /* Workaround for gcc 4.3's bug. */
+ struct in6_addr addr[16]; /* = tomoyo_block_size */
+ struct list_head list;
+ u32 in_use_count;
+ };
+ static LIST_HEAD(tomoyo_address_list);
+ struct tomoyo_addr_list *ptr;
+ static DEFINE_MUTEX(lock);
+ u8 i = tomoyo_block_size;
+ if (!addr)
+ return NULL;
+ /*
+ * Since reader calls down_read(&tomoyo_domain_acl_info_list_lock),
+ * this lock can remain as local lock.
+ */
+ mutex_lock(&lock);
+ list_for_each_entry(ptr, &tomoyo_address_list, list) {
+ for (i = 0; i < ptr->in_use_count; i++) {
+ if (!memcmp(&ptr->addr[i], addr, sizeof(*addr)))
+ goto ok;
+ }
+ if (i < tomoyo_block_size)
+ break;
+ }
+ if (i == tomoyo_block_size) {
+ ptr = tomoyo_alloc_element(sizeof(*ptr));
+ if (!ptr)
+ goto ok;
+ list_add_tail(&ptr->list, &tomoyo_address_list);
+ i = 0;
+ }
+ ptr->addr[ptr->in_use_count++] = *addr;
+ ok:
+ mutex_unlock(&lock);
+ return ptr ? &ptr->addr[i] : NULL;
+}
+
+/**
+ * tomoyo_parse_ip_address - Parse an IP address.
+ *
+ * @address: String to parse.
+ * @min: Pointer to store min address.
+ * @max: Pointer to store max address.
+ *
+ * Returns 2 if @address is an IPv6, 1 if @address is an IPv4, 0 otherwise.
+ */
+static int tomoyo_parse_ip_address(char *address, u16 *min, u16 *max)
+{
+ /* "%pI6" is not supported for sscanf(). */
+ int count = sscanf(address, "%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx"
+ "-%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
+ &min[0], &min[1], &min[2], &min[3],
+ &min[4], &min[5], &min[6], &min[7],
+ &max[0], &max[1], &max[2], &max[3],
+ &max[4], &max[5], &max[6], &max[7]);
+ if (count == 8 || count == 16) {
+ u8 i;
+ if (count == 8)
+ memmove(max, min, sizeof(u16) * 8);
+ for (i = 0; i < 8; i++) {
+ min[i] = htons(min[i]);
+ max[i] = htons(max[i]);
+ }
+ return 2;
+ }
+ /* "%pI4" is not supported for sscanf(). */
+ count = sscanf(address, "%hu.%hu.%hu.%hu-%hu.%hu.%hu.%hu",
+ &min[0], &min[1], &min[2], &min[3],
+ &max[0], &max[1], &max[2], &max[3]);
+ if (count == 4 || count == 8) {
+ u32 ip = htonl((((u8) min[0]) << 24) + (((u8) min[1]) << 16)
+ + (((u8) min[2]) << 8) + (u8) min[3]);
+ memmove(min, &ip, sizeof(ip));
+ if (count == 8)
+ ip = htonl((((u8) max[0]) << 24) + (((u8) max[1]) << 16)
+ + (((u8) max[2]) << 8) + (u8) max[3]);
+ memmove(max, &ip, sizeof(ip));
+ return 1;
+ }
+ return 0;
+}
+
+/**
+ * tomoyo_print_ipv6 - Print an IPv6 address.
+ *
+ * @buffer: Buffer to write to.
+ * @buffer_len: Size of @buffer.
+ * @ip: Pointer to "struct in6_addr".
+ *
+ * To make output shortest, TOMOYO doesn't use "%pI6".
+ *
+ * Returns nothing.
+ */
+void tomoyo_print_ipv6(char *buffer, const int buffer_len,
+ const struct in6_addr *ip)
+{
+ memset(buffer, 0, buffer_len);
+ snprintf(buffer, buffer_len - 1, "%x:%x:%x:%x:%x:%x:%x:%x",
+ ntohs(ip->s6_addr16[0]), ntohs(ip->s6_addr16[1]),
+ ntohs(ip->s6_addr16[2]), ntohs(ip->s6_addr16[3]),
+ ntohs(ip->s6_addr16[4]), ntohs(ip->s6_addr16[5]),
+ ntohs(ip->s6_addr16[6]), ntohs(ip->s6_addr16[7]));
+}
+
+/**
+ * tomoyo_net2keyword - Convert network operation index to network operation name.
+ *
+ * @operation: Type of operation.
+ *
+ * Returns the name of operation.
+ */
+const char *tomoyo_net2keyword(const u8 operation)
+{
+ const char *keyword = "unknown";
+ switch (operation) {
+ case NETWORK_ACL_UDP_BIND:
+ keyword = "UDP bind";
+ break;
+ case NETWORK_ACL_UDP_CONNECT:
+ keyword = "UDP connect";
+ break;
+ case NETWORK_ACL_TCP_BIND:
+ keyword = "TCP bind";
+ break;
+ case NETWORK_ACL_TCP_LISTEN:
+ keyword = "TCP listen";
+ break;
+ case NETWORK_ACL_TCP_CONNECT:
+ keyword = "TCP connect";
+ break;
+ case NETWORK_ACL_TCP_ACCEPT:
+ keyword = "TCP accept";
+ break;
+ case NETWORK_ACL_RAW_BIND:
+ keyword = "RAW bind";
+ break;
+ case NETWORK_ACL_RAW_CONNECT:
+ keyword = "RAW connect";
+ break;
+ }
+ return keyword;
+}
+
+/**
+ * tomoyo_update_network_entry - Update "struct tomoyo_ip_network_acl_record" list.
+ *
+ * @operation: Type of operation.
+ * @record_type: Type of address.
+ * @min_address: Start of IPv4 or IPv6 address range.
+ * @max_address: End of IPv4 or IPv6 address range.
+ * @min_port: Start of port number range.
+ * @max_port: End of port number range.
+ * @domain: Pointer to "struct tomoyo_domain_info".
+ * @is_delete: True if it is a delete request.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_update_network_entry(const u8 operation, const u8 record_type,
+ const u32 *min_address,
+ const u32 *max_address,
+ const u16 min_port, const u16 max_port,
+ struct tomoyo_domain_info *domain,
+ const bool is_delete)
+{
+ struct tomoyo_acl_info *ptr;
+ struct tomoyo_ip_network_acl_record *acl;
+ int error = -ENOMEM;
+ /* using host byte order to allow u32 comparison than memcmp().*/
+ const u32 min_ip = ntohl(*min_address);
+ const u32 max_ip = ntohl(*max_address);
+ const struct in6_addr *saved_min_address = NULL;
+ const struct in6_addr *saved_max_address = NULL;
+ if (!domain)
+ return -EINVAL;
+ if (record_type != TOMOYO_IP_RECORD_TYPE_IPv6)
+ goto not_ipv6;
+ saved_min_address = tomoyo_save_ipv6_address((struct in6_addr *)
+ min_address);
+ saved_max_address = tomoyo_save_ipv6_address((struct in6_addr *)
+ max_address);
+ if (!saved_min_address || !saved_max_address)
+ return -ENOMEM;
+ not_ipv6:
+ /***** EXCLUSIVE SECTION START *****/
+ down_write(&tomoyo_domain_acl_info_list_lock);
+ if (is_delete)
+ goto delete;
+ list_for_each_entry(ptr, &domain->acl_info_list, list) {
+ if (tomoyo_acl_type1(ptr) != TOMOYO_TYPE_IP_NETWORK_ACL)
+ continue;
+ acl = container_of(ptr, struct tomoyo_ip_network_acl_record,
+ head);
+ if (acl->operation_type != operation ||
+ acl->record_type != record_type ||
+ acl->min_port != min_port || max_port != acl->max_port)
+ continue;
+ if (record_type == TOMOYO_IP_RECORD_TYPE_IPv4) {
+ if (acl->u.ipv4.min != min_ip ||
+ max_ip != acl->u.ipv4.max)
+ continue;
+ } else if (record_type == TOMOYO_IP_RECORD_TYPE_IPv6) {
+ if (acl->u.ipv6.min != saved_min_address ||
+ saved_max_address != acl->u.ipv6.max)
+ continue;
+ }
+ ptr->type &= ~TOMOYO_ACL_DELETED;
+ error = 0;
+ goto out;
+ }
+ /* Not found. Append it to the tail. */
+ acl = tomoyo_alloc_acl_element(TOMOYO_TYPE_IP_NETWORK_ACL);
+ if (!acl)
+ goto out;
+ acl->operation_type = operation;
+ acl->record_type = record_type;
+ if (record_type == TOMOYO_IP_RECORD_TYPE_IPv4) {
+ acl->u.ipv4.min = min_ip;
+ acl->u.ipv4.max = max_ip;
+ } else {
+ acl->u.ipv6.min = saved_min_address;
+ acl->u.ipv6.max = saved_max_address;
+ }
+ acl->min_port = min_port;
+ acl->max_port = max_port;
+ list_add_tail(&acl->head.list, &domain->acl_info_list);
+ error = 0;
+ goto out;
+ delete:
+ error = -ENOENT;
+ list_for_each_entry(ptr, &domain->acl_info_list, list) {
+ if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_IP_NETWORK_ACL)
+ continue;
+ acl = container_of(ptr, struct tomoyo_ip_network_acl_record,
+ head);
+ if (acl->operation_type != operation ||
+ acl->record_type != record_type ||
+ acl->min_port != min_port || max_port != acl->max_port)
+ continue;
+ if (record_type == TOMOYO_IP_RECORD_TYPE_IPv4) {
+ if (acl->u.ipv4.min != min_ip ||
+ max_ip != acl->u.ipv4.max)
+ continue;
+ } else if (record_type == TOMOYO_IP_RECORD_TYPE_IPv6) {
+ if (acl->u.ipv6.min != saved_min_address ||
+ saved_max_address != acl->u.ipv6.max)
+ continue;
+ }
+ ptr->type |= TOMOYO_ACL_DELETED;
+ error = 0;
+ break;
+ }
+ out:
+ up_write(&tomoyo_domain_acl_info_list_lock);
+ /***** EXCLUSIVE SECTION START *****/
+ return error;
+}
+
+/**
+ * tomoyo_check_network_entry - Check permission for network operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @operation: Type of operation.
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_check_network_entry(const bool is_ipv6, const u8 operation,
+ const u32 *address, const u16 port)
+{
+ struct tomoyo_acl_info *ptr;
+ const char *keyword = tomoyo_net2keyword(operation);
+ struct tomoyo_domain_info *domain = tomoyo_domain();
+ const int mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_NETWORK);
+ const bool is_enforce = (mode == 3);
+ /* using host byte order to allow u32 comparison than memcmp().*/
+ const u32 ip = ntohl(*address);
+ bool found = false;
+ char buf[64];
+ if (!mode)
+ return 0;
+ down_read(&tomoyo_domain_acl_info_list_lock);
+ list_for_each_entry(ptr, &domain->acl_info_list, list) {
+ struct tomoyo_ip_network_acl_record *acl;
+ if (tomoyo_acl_type2(ptr) != TOMOYO_TYPE_IP_NETWORK_ACL)
+ continue;
+ acl = container_of(ptr, struct tomoyo_ip_network_acl_record,
+ head);
+ if (acl->operation_type != operation || port < acl->min_port ||
+ acl->max_port < port)
+ continue;
+ if (acl->record_type == TOMOYO_IP_RECORD_TYPE_IPv4) {
+ if (is_ipv6 ||
+ ip < acl->u.ipv4.min || acl->u.ipv4.max < ip)
+ continue;
+ } else {
+ if (!is_ipv6 ||
+ memcmp(acl->u.ipv6.min, address, 16) > 0 ||
+ memcmp(address, acl->u.ipv6.max, 16) > 0)
+ continue;
+ }
+ found = true;
+ break;
+ }
+ up_read(&tomoyo_domain_acl_info_list_lock);
+ if (found)
+ return 0;
+ memset(buf, 0, sizeof(buf));
+ if (is_ipv6)
+ tomoyo_print_ipv6(buf, sizeof(buf),
+ (const struct in6_addr *) address);
+ else
+ snprintf(buf, sizeof(buf) - 1, "%pI4", address);
+ if (tomoyo_verbose_mode(domain))
+ printk(KERN_WARNING "TOMOYO-%s: %s to %s %u denied for %s\n",
+ tomoyo_get_msg(is_enforce), keyword, buf, port,
+ tomoyo_get_last_name(domain));
+ if (is_enforce)
+ return -EPERM;
+ if (mode == 1 && tomoyo_domain_quota_is_ok(domain))
+ tomoyo_update_network_entry(operation, is_ipv6 ?
+ TOMOYO_IP_RECORD_TYPE_IPv6 :
+ TOMOYO_IP_RECORD_TYPE_IPv4,
+ address, address, port, port,
+ domain, false);
+ return 0;
+}
+
+/**
+ * tomoyo_write_network_policy - Write "struct tomoyo_ip_network_acl_record" list.
+ *
+ * @data: String to parse.
+ * @domain: Pointer to "struct tomoyo_domain_info".
+ * @is_delete: True if it is a delete request.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_write_network_policy(char *data, struct tomoyo_domain_info *domain,
+ const bool is_delete)
+{
+ u8 sock_type;
+ u8 operation;
+ u8 record_type;
+ u16 min_address[8];
+ u16 max_address[8];
+ u16 min_port;
+ u16 max_port;
+ u8 count;
+ char *cp1 = strchr(data, ' ');
+ char *cp2;
+ if (!cp1)
+ goto out;
+ cp1++;
+ if (!strncmp(data, "TCP ", 4))
+ sock_type = SOCK_STREAM;
+ else if (!strncmp(data, "UDP ", 4))
+ sock_type = SOCK_DGRAM;
+ else if (!strncmp(data, "RAW ", 4))
+ sock_type = SOCK_RAW;
+ else
+ goto out;
+ cp2 = strchr(cp1, ' ');
+ if (!cp2)
+ goto out;
+ cp2++;
+ if (!strncmp(cp1, "bind ", 5))
+ switch (sock_type) {
+ case SOCK_STREAM:
+ operation = NETWORK_ACL_TCP_BIND;
+ break;
+ case SOCK_DGRAM:
+ operation = NETWORK_ACL_UDP_BIND;
+ break;
+ default:
+ operation = NETWORK_ACL_RAW_BIND;
+ }
+ else if (!strncmp(cp1, "connect ", 8))
+ switch (sock_type) {
+ case SOCK_STREAM:
+ operation = NETWORK_ACL_TCP_CONNECT;
+ break;
+ case SOCK_DGRAM:
+ operation = NETWORK_ACL_UDP_CONNECT;
+ break;
+ default:
+ operation = NETWORK_ACL_RAW_CONNECT;
+ }
+ else if (sock_type == SOCK_STREAM && !strncmp(cp1, "listen ", 7))
+ operation = NETWORK_ACL_TCP_LISTEN;
+ else if (sock_type == SOCK_STREAM && !strncmp(cp1, "accept ", 7))
+ operation = NETWORK_ACL_TCP_ACCEPT;
+ else
+ goto out;
+ cp1 = strchr(cp2, ' ');
+ if (!cp1)
+ goto out;
+ *cp1++ = '\0';
+ switch (tomoyo_parse_ip_address(cp2, min_address, max_address)) {
+ case 2:
+ record_type = TOMOYO_IP_RECORD_TYPE_IPv6;
+ break;
+ case 1:
+ record_type = TOMOYO_IP_RECORD_TYPE_IPv4;
+ break;
+ default:
+ goto out;
+ }
+ if (strchr(cp1, ' '))
+ goto out;
+ count = sscanf(cp1, "%hu-%hu", &min_port, &max_port);
+ if (count != 1 && count != 2)
+ goto out;
+ if (count == 1)
+ max_port = min_port;
+ return tomoyo_update_network_entry(operation, record_type,
+ (u32 *) min_address,
+ (u32 *) max_address,
+ min_port, max_port, domain,
+ is_delete);
+ out:
+ return -EINVAL;
+}
+
+/**
+ * tomoyo_check_network_listen_acl - Check permission for listen() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static inline int tomoyo_check_network_listen_acl(const bool is_ipv6,
+ const u8 *address,
+ const u16 port)
+{
+ return tomoyo_check_network_entry(is_ipv6, NETWORK_ACL_TCP_LISTEN,
+ (const u32 *) address, ntohs(port));
+}
+
+/**
+ * tomoyo_check_network_connect_acl - Check permission for connect() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @sock_type: Type of socket. (TCP or UDP or RAW)
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static inline int tomoyo_check_network_connect_acl(const bool is_ipv6,
+ const int sock_type,
+ const u8 *address,
+ const u16 port)
+{
+ u8 operation;
+ switch (sock_type) {
+ case SOCK_STREAM:
+ operation = NETWORK_ACL_TCP_CONNECT;
+ break;
+ case SOCK_DGRAM:
+ operation = NETWORK_ACL_UDP_CONNECT;
+ break;
+ default:
+ operation = NETWORK_ACL_RAW_CONNECT;
+ }
+ return tomoyo_check_network_entry(is_ipv6, operation,
+ (const u32 *) address, ntohs(port));
+}
+
+/**
+ * tomoyo_check_network_bind_acl - Check permission for bind() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @sock_type: Type of socket. (TCP or UDP or RAW)
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static int tomoyo_check_network_bind_acl(const bool is_ipv6,
+ const int sock_type,
+ const u8 *address, const u16 port)
+{
+ u8 operation;
+ switch (sock_type) {
+ case SOCK_STREAM:
+ operation = NETWORK_ACL_TCP_BIND;
+ break;
+ case SOCK_DGRAM:
+ operation = NETWORK_ACL_UDP_BIND;
+ break;
+ default:
+ operation = NETWORK_ACL_RAW_BIND;
+ }
+ return tomoyo_check_network_entry(is_ipv6, operation,
+ (const u32 *) address, ntohs(port));
+}
+
+/**
+ * tomoyo_check_network_accept_acl - Check permission for accept() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static inline int tomoyo_check_network_accept_acl(const bool is_ipv6,
+ const u8 *address,
+ const u16 port)
+{
+ return tomoyo_check_network_entry(is_ipv6, NETWORK_ACL_TCP_ACCEPT,
+ (const u32 *) address, ntohs(port));
+}
+
+/**
+ * tomoyo_check_network_sendmsg_acl - Check permission for sendmsg() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @sock_type: Type of socket. (UDP or RAW)
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static inline int tomoyo_check_network_sendmsg_acl(const bool is_ipv6,
+ const int sock_type,
+ const u8 *address,
+ const u16 port)
+{
+ u8 operation;
+ if (sock_type == SOCK_DGRAM)
+ operation = NETWORK_ACL_UDP_CONNECT;
+ else
+ operation = NETWORK_ACL_RAW_CONNECT;
+ return tomoyo_check_network_entry(is_ipv6, operation,
+ (const u32 *) address, ntohs(port));
+}
+
+/**
+ * tomoyo_check_network_recvmsg_acl - Check permission for recvmsg() operation.
+ *
+ * @is_ipv6: True if @address is an IPv6 address.
+ * @sock_type: Type of socket. (UDP or RAW)
+ * @address: An IPv4 or IPv6 address.
+ * @port: Port number.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+static inline int tomoyo_check_network_recvmsg_acl(const bool is_ipv6,
+ const int sock_type,
+ const u8 *address,
+ const u16 port)
+{
+ const u8 operation
+ = (sock_type == SOCK_DGRAM) ?
+ NETWORK_ACL_UDP_CONNECT : NETWORK_ACL_RAW_CONNECT;
+ return tomoyo_check_network_entry(is_ipv6, operation,
+ (const u32 *) address, ntohs(port));
+}
+
+#define MAX_SOCK_ADDR 128 /* net/socket.c */
+
+/**
+ * tomoyo_socket_listen_permission - Check permission for listening a TCP socket.
+ *
+ * @sock: Pointer to "struct socket".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_listen_permission(struct socket *sock)
+{
+ int error = 0;
+ char addr[MAX_SOCK_ADDR];
+ int addr_len;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ if (sock->type != SOCK_STREAM)
+ return 0;
+ switch (sock->sk->sk_family) {
+ case PF_INET:
+ case PF_INET6:
+ break;
+ default:
+ return 0;
+ }
+ if (sock->ops->getname(sock, (struct sockaddr *) addr, &addr_len, 0))
+ return -EPERM;
+ switch (((struct sockaddr *) addr)->sa_family) {
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr4;
+ case AF_INET6:
+ addr6 = (struct sockaddr_in6 *) addr;
+ error = tomoyo_check_network_listen_acl(true, addr6->sin6_addr.
+ s6_addr,
+ addr6->sin6_port);
+ break;
+ case AF_INET:
+ addr4 = (struct sockaddr_in *) addr;
+ error = tomoyo_check_network_listen_acl(false,
+ (u8 *) &addr4->sin_addr,
+ addr4->sin_port);
+ break;
+ }
+ return error;
+}
+
+/**
+ * tomoyo_socket_connect_permission - Check permission for setting the remote IP address/port pair of a socket.
+ *
+ * @sock: Pointer to "struct socket".
+ * @addr: Pointer to "struct sockaddr".
+ * @len: Size of @addr in bytes.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_connect_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len)
+{
+ int error = 0;
+ const unsigned int type = sock->type;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ switch (type) {
+ case SOCK_STREAM:
+ case SOCK_DGRAM:
+ case SOCK_RAW:
+ break;
+ default:
+ return 0;
+ }
+ switch (addr->sa_family) {
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr4;
+ u16 port;
+ case AF_INET6:
+ if (addr_len < SIN6_LEN_RFC2133)
+ break;
+ addr6 = (struct sockaddr_in6 *) addr;
+ if (type != SOCK_RAW)
+ port = addr6->sin6_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_connect_acl(true, type,
+ addr6->sin6_addr.
+ s6_addr, port);
+ break;
+ case AF_INET:
+ if (addr_len < sizeof(struct sockaddr_in))
+ break;
+ addr4 = (struct sockaddr_in *) addr;
+ if (type != SOCK_RAW)
+ port = addr4->sin_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_connect_acl(false, type, (u8 *)
+ &addr4->sin_addr,
+ port);
+ break;
+ }
+ return error;
+}
+
+/**
+ * tomoyo_socket_bind_permission - Check permission for setting the local IP address/port pair of a socket.
+ *
+ * @sock: Pointer to "struct socket".
+ * @addr: Pointer to "struct sockaddr".
+ * @len: Size of @addr in bytes.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len)
+{
+ int error = 0;
+ const unsigned int type = sock->type;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ switch (type) {
+ case SOCK_STREAM:
+ case SOCK_DGRAM:
+ case SOCK_RAW:
+ break;
+ default:
+ return 0;
+ }
+ switch (addr->sa_family) {
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr4;
+ u16 port;
+ case AF_INET6:
+ if (addr_len < SIN6_LEN_RFC2133)
+ break;
+ addr6 = (struct sockaddr_in6 *) addr;
+ if (type != SOCK_RAW)
+ port = addr6->sin6_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_bind_acl(true, type,
+ addr6->sin6_addr.s6_addr,
+ port);
+ break;
+ case AF_INET:
+ if (addr_len < sizeof(struct sockaddr_in))
+ break;
+ addr4 = (struct sockaddr_in *) addr;
+ if (type != SOCK_RAW)
+ port = addr4->sin_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_bind_acl(false, type,
+ (u8 *) &addr4->sin_addr,
+ port);
+ break;
+ }
+ return error;
+}
+
+/**
+ * tomoyo_socket_accept_permission - Check permission for accepting a TCP socket.
+ *
+ * @sock: Pointer to "struct socket".
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_accept_permission(struct socket *sock)
+{
+ int error = 0;
+ struct sockaddr_storage addr;
+ int addr_len;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ switch (sock->sk->sk_family) {
+ case PF_INET:
+ case PF_INET6:
+ break;
+ default:
+ return 0;
+ }
+ error = sock->ops->getname(sock, (struct sockaddr *) &addr, &addr_len,
+ 2);
+ if (error)
+ return error;
+ switch (((struct sockaddr *) &addr)->sa_family) {
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr4;
+ case AF_INET6:
+ addr6 = (struct sockaddr_in6 *) &addr;
+ error = tomoyo_check_network_accept_acl(true, addr6->sin6_addr.
+ s6_addr,
+ addr6->sin6_port);
+ break;
+ case AF_INET:
+ addr4 = (struct sockaddr_in *) &addr;
+ error = tomoyo_check_network_accept_acl(false, (u8 *) &addr4->
+ sin_addr,
+ addr4->sin_port);
+ break;
+ }
+ if (error)
+ error = -ECONNABORTED; /* Hope less harmful than -EPERM. */
+ return error;
+}
+
+/**
+ * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram via a UDP or RAW socket.
+ *
+ * @sock: Pointer to "struct socket".
+ * @addr: Pointer to "struct sockaddr".
+ * @addr_len: Size of @addr in bytes.
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_sendmsg_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len)
+{
+ int error = 0;
+ const int type = sock->type;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ if (!addr || (type != SOCK_DGRAM && type != SOCK_RAW))
+ return 0;
+ switch (addr->sa_family) {
+ struct sockaddr_in6 *addr6;
+ struct sockaddr_in *addr4;
+ u16 port;
+ case AF_INET6:
+ if (addr_len < SIN6_LEN_RFC2133)
+ break;
+ addr6 = (struct sockaddr_in6 *) addr;
+ if (type == SOCK_DGRAM)
+ port = addr6->sin6_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_sendmsg_acl(true, type,
+ addr6->sin6_addr.
+ s6_addr, port);
+ break;
+ case AF_INET:
+ if (addr_len < sizeof(struct sockaddr_in))
+ break;
+ addr4 = (struct sockaddr_in *) addr;
+ if (type == SOCK_DGRAM)
+ port = addr4->sin_port;
+ else
+ port = htons(sock->sk->sk_protocol);
+ error = tomoyo_check_network_sendmsg_acl(false, type, (u8 *)
+ &addr4->sin_addr,
+ port);
+ break;
+ }
+ return error;
+}
+
+/**
+ * tomoyo_socket_recv_datagram_permission - Check permission for receiving a datagram via a UDP or RAW socket.
+ *
+ * @sk: Pointer to "struct sock".
+ * @skb: Pointer to "struct sk_buff".
+ * @flags: Flags for recvmsg().
+ *
+ * Returns 0 on success, negative value otherwise.
+ */
+int tomoyo_socket_recv_datagram_permission(struct sock *sk, struct sk_buff *skb,
+ const unsigned int flags)
+{
+ int error = 0;
+ const unsigned int type = sk->sk_type;
+ /* Nothing to do if I can't sleep. */
+ if (in_atomic())
+ return 0;
+ /* Nothing to do if I am a kernel service. */
+ if (segment_eq(get_fs(), KERNEL_DS))
+ return 0;
+ if (type != SOCK_DGRAM && type != SOCK_RAW)
+ return 0;
+
+ switch (sk->sk_family) {
+ struct in6_addr sin6;
+ struct in_addr sin4;
+ u16 port;
+ case PF_INET6:
+ if (type == SOCK_DGRAM) { /* UDP IPv6 */
+ if (skb->protocol == htons(ETH_P_IP)) {
+ ipv6_addr_set(&sin6, 0, 0, htonl(0xffff),
+ ip_hdr(skb)->saddr);
+ } else {
+ ipv6_addr_copy(&sin6, &ipv6_hdr(skb)->saddr);
+ }
+ port = udp_hdr(skb)->source;
+ } else { /* RAW IPv6 */
+ ipv6_addr_copy(&sin6, &ipv6_hdr(skb)->saddr);
+ port = htons(sk->sk_protocol);
+ }
+ error = tomoyo_check_network_recvmsg_acl(true, type,
+ (u8 *) &sin6, port);
+ break;
+ case PF_INET:
+ if (type == SOCK_DGRAM) { /* UDP IPv4 */
+ sin4.s_addr = ip_hdr(skb)->saddr;
+ port = udp_hdr(skb)->source;
+ } else { /* RAW IPv4 */
+ sin4.s_addr = ip_hdr(skb)->saddr;
+ port = htons(sk->sk_protocol);
+ }
+ error = tomoyo_check_network_recvmsg_acl(false, type,
+ (u8 *) &sin4, port);
+ break;
+ }
+ if (!error)
+ return 0;
+ /* Hope less harmful than -EPERM. */
+ return -EAGAIN;
+}
@@ -10,6 +10,7 @@
*/
#include <linux/security.h>
+#include <linux/socket.h>
#include "common.h"
#include "tomoyo.h"
#include "realpath.h"
@@ -256,6 +257,45 @@ static int tomoyo_dentry_open(struct fil
return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags);
}
+static int tomoyo_socket_bind(struct socket *sock, struct sockaddr *address,
+ int addrlen)
+{
+ return tomoyo_socket_bind_permission(sock, address, addrlen);
+}
+
+static int tomoyo_socket_connect(struct socket *sock, struct sockaddr *address,
+ int addrlen)
+{
+ return tomoyo_socket_connect_permission(sock, address, addrlen);
+}
+
+static int tomoyo_socket_listen(struct socket *sock, int backlog)
+{
+ return tomoyo_socket_listen_permission(sock);
+}
+
+static int tomoyo_socket_post_accept(struct socket *sock,
+ struct socket *newsock)
+{
+ return tomoyo_socket_accept_permission(newsock);
+}
+
+static int tomoyo_socket_sendmsg(struct socket *sock, struct msghdr *msg,
+ int size)
+{
+ return tomoyo_socket_sendmsg_permission(sock, (struct sockaddr *)
+ msg->msg_name,
+ msg->msg_namelen);
+}
+
+
+static int tomoyo_socket_post_recv_datagram(struct sock *sk,
+ struct sk_buff *skb,
+ unsigned int flags)
+{
+ return tomoyo_socket_recv_datagram_permission(sk, skb, flags);
+}
+
static struct security_operations tomoyo_security_ops = {
.name = "tomoyo",
.cred_prepare = tomoyo_cred_prepare,
@@ -274,6 +314,12 @@ static struct security_operations tomoyo
.path_mknod = tomoyo_path_mknod,
.path_link = tomoyo_path_link,
.path_rename = tomoyo_path_rename,
+ .socket_bind = tomoyo_socket_bind,
+ .socket_listen = tomoyo_socket_listen,
+ .socket_connect = tomoyo_socket_connect,
+ .socket_sendmsg = tomoyo_socket_sendmsg,
+ .socket_post_recv_datagram = tomoyo_socket_post_recv_datagram,
+ .socket_post_accept = tomoyo_socket_post_accept,
};
static int __init tomoyo_init(void)
@@ -36,10 +36,27 @@ int tomoyo_check_rewrite_permission(stru
int tomoyo_find_next_domain(struct linux_binprm *bprm,
struct tomoyo_domain_info **next_domain);
+struct sock;
+struct sk_buff;
+struct socket;
+struct sockaddr;
+int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len);
+int tomoyo_socket_connect_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len);
+int tomoyo_socket_listen_permission(struct socket *sock);
+int tomoyo_socket_accept_permission(struct socket *sock);
+int tomoyo_socket_sendmsg_permission(struct socket *sock, struct sockaddr *addr,
+ int addr_len);
+int tomoyo_socket_recv_datagram_permission(struct sock *sk, struct sk_buff *skb,
+ const unsigned int flags);
+
+
/* Index numbers for Access Controls. */
#define TOMOYO_TYPE_SINGLE_PATH_ACL 0
#define TOMOYO_TYPE_DOUBLE_PATH_ACL 1
+#define TOMOYO_TYPE_IP_NETWORK_ACL 2
/* Index numbers for File Controls. */