TOMOYO: Add built-in policy support.
Tetsuo Handa [Sun, 26 Jun 2011 14:22:18 +0000 (23:22 +0900)]
To be able to start using enforcing mode from the early stage of boot sequence,
this patch adds support for built-in policy configuration (and next patch adds
support for activating access control without calling external policy loader
program).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>

security/tomoyo/Makefile
security/tomoyo/common.c
security/tomoyo/common.h
security/tomoyo/memory.c

index b13f7f9..04f676a 100644 (file)
@@ -1 +1,48 @@
 obj-y = audit.o common.o domain.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o
+
+$(obj)/policy/profile.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/profile.conf
+       @touch $@
+
+$(obj)/policy/exception_policy.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating a default policy/exception_policy.conf
+       @echo initialize_domain /sbin/modprobe from any >> $@
+       @echo initialize_domain /sbin/hotplug from any >> $@
+
+$(obj)/policy/domain_policy.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/domain_policy.conf
+       @touch $@
+
+$(obj)/policy/manager.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/manager.conf
+       @touch $@
+
+$(obj)/policy/stat.conf:
+       @mkdir -p $(obj)/policy/
+       @echo Creating an empty policy/stat.conf
+       @touch $@
+
+$(obj)/builtin-policy.h: $(obj)/policy/profile.conf $(obj)/policy/exception_policy.conf $(obj)/policy/domain_policy.conf $(obj)/policy/manager.conf $(obj)/policy/stat.conf
+       @echo Generating built-in policy for TOMOYO 2.4.x.
+       @echo "static char tomoyo_builtin_profile[] __initdata =" > $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/profile.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_exception_policy[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/exception_policy.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_domain_policy[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/domain_policy.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_manager[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/manager.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @echo "static char tomoyo_builtin_stat[] __initdata =" >> $@.tmp
+       @sed -e 's/\\/\\\\/g' -e 's/\"/\\"/g' -e 's/\(.*\)/"\1\\n"/' < $(obj)/policy/stat.conf >> $@.tmp
+       @echo "\"\";" >> $@.tmp
+       @mv $@.tmp $@
+
+$(obj)/common.o: $(obj)/builtin-policy.h
index 7bc0d1d..01e60ad 100644 (file)
@@ -2361,3 +2361,63 @@ void tomoyo_check_profile(void)
        tomoyo_read_unlock(idx);
        printk(KERN_INFO "Mandatory Access Control activated.\n");
 }
+
+/**
+ * tomoyo_load_builtin_policy - Load built-in policy.
+ *
+ * Returns nothing.
+ */
+void __init tomoyo_load_builtin_policy(void)
+{
+       /*
+        * This include file is manually created and contains built-in policy
+        * named "tomoyo_builtin_profile", "tomoyo_builtin_exception_policy",
+        * "tomoyo_builtin_domain_policy", "tomoyo_builtin_manager",
+        * "tomoyo_builtin_stat" in the form of "static char [] __initdata".
+        */
+#include "builtin-policy.h"
+       u8 i;
+       const int idx = tomoyo_read_lock();
+       for (i = 0; i < 5; i++) {
+               struct tomoyo_io_buffer head = { };
+               char *start = "";
+               switch (i) {
+               case 0:
+                       start = tomoyo_builtin_profile;
+                       head.type = TOMOYO_PROFILE;
+                       head.write = tomoyo_write_profile;
+                       break;
+               case 1:
+                       start = tomoyo_builtin_exception_policy;
+                       head.type = TOMOYO_EXCEPTIONPOLICY;
+                       head.write = tomoyo_write_exception;
+                       break;
+               case 2:
+                       start = tomoyo_builtin_domain_policy;
+                       head.type = TOMOYO_DOMAINPOLICY;
+                       head.write = tomoyo_write_domain;
+                       break;
+               case 3:
+                       start = tomoyo_builtin_manager;
+                       head.type = TOMOYO_MANAGER;
+                       head.write = tomoyo_write_manager;
+                       break;
+               case 4:
+                       start = tomoyo_builtin_stat;
+                       head.type = TOMOYO_STAT;
+                       head.write = tomoyo_write_stat;
+                       break;
+               }
+               while (1) {
+                       char *end = strchr(start, '\n');
+                       if (!end)
+                               break;
+                       *end = '\0';
+                       tomoyo_normalize_line(start);
+                       head.write_buf = start;
+                       tomoyo_parse_policy(&head, start);
+                       start = end + 1;
+               }
+       }
+       tomoyo_read_unlock(idx);
+}
index 7984a0e..a15fe29 100644 (file)
@@ -662,6 +662,7 @@ const struct tomoyo_path_info *tomoyo_get_name(const char *name);
 void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp);
 void tomoyo_update_stat(const u8 index);
 void __init tomoyo_mm_init(void);
+void __init tomoyo_load_builtin_policy(void);
 int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
                           const struct tomoyo_path_info *filename);
 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
index 78b6143..46538ce 100644 (file)
@@ -215,14 +215,4 @@ void __init tomoyo_mm_init(void)
        INIT_LIST_HEAD(&tomoyo_kernel_domain.acl_info_list);
        tomoyo_kernel_domain.domainname = tomoyo_get_name("<kernel>");
        list_add_tail_rcu(&tomoyo_kernel_domain.list, &tomoyo_domain_list);
-#if 0
-       /* Will be replaced with tomoyo_load_builtin_policy(). */
-       {
-               /* Load built-in policy. */
-               tomoyo_write_transition_control("/sbin/hotplug", false,
-                                       TOMOYO_TRANSITION_CONTROL_INITIALIZE);
-               tomoyo_write_transition_control("/sbin/modprobe", false,
-                                       TOMOYO_TRANSITION_CONTROL_INITIALIZE);
-       }
-#endif
 }