70acf7aebbdaad0dd3cc46a2c6dbf8fc3458b41e
[linux-2.6.git] / security / tomoyo / domain.c
1 /*
2  * security/tomoyo/domain.c
3  *
4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
5  */
6
7 #include "common.h"
8 #include <linux/binfmts.h>
9 #include <linux/slab.h>
10
11 /* Variables definitions.*/
12
13 /* The initial domain. */
14 struct tomoyo_domain_info tomoyo_kernel_domain;
15
16 /**
17  * tomoyo_update_policy - Update an entry for exception policy.
18  *
19  * @new_entry:       Pointer to "struct tomoyo_acl_info".
20  * @size:            Size of @new_entry in bytes.
21  * @param:           Pointer to "struct tomoyo_acl_param".
22  * @check_duplicate: Callback function to find duplicated entry.
23  *
24  * Returns 0 on success, negative value otherwise.
25  *
26  * Caller holds tomoyo_read_lock().
27  */
28 int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
29                          struct tomoyo_acl_param *param,
30                          bool (*check_duplicate) (const struct tomoyo_acl_head
31                                                   *,
32                                                   const struct tomoyo_acl_head
33                                                   *))
34 {
35         int error = param->is_delete ? -ENOENT : -ENOMEM;
36         struct tomoyo_acl_head *entry;
37         struct list_head *list = param->list;
38
39         if (mutex_lock_interruptible(&tomoyo_policy_lock))
40                 return -ENOMEM;
41         list_for_each_entry_rcu(entry, list, list) {
42                 if (!check_duplicate(entry, new_entry))
43                         continue;
44                 entry->is_deleted = param->is_delete;
45                 error = 0;
46                 break;
47         }
48         if (error && !param->is_delete) {
49                 entry = tomoyo_commit_ok(new_entry, size);
50                 if (entry) {
51                         list_add_tail_rcu(&entry->list, list);
52                         error = 0;
53                 }
54         }
55         mutex_unlock(&tomoyo_policy_lock);
56         return error;
57 }
58
59 /**
60  * tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
61  *
62  * @a: Pointer to "struct tomoyo_acl_info".
63  * @b: Pointer to "struct tomoyo_acl_info".
64  *
65  * Returns true if @a == @b, false otherwise.
66  */
67 static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
68                                         const struct tomoyo_acl_info *b)
69 {
70         return a->type == b->type && a->cond == b->cond;
71 }
72
73 /**
74  * tomoyo_update_domain - Update an entry for domain policy.
75  *
76  * @new_entry:       Pointer to "struct tomoyo_acl_info".
77  * @size:            Size of @new_entry in bytes.
78  * @param:           Pointer to "struct tomoyo_acl_param".
79  * @check_duplicate: Callback function to find duplicated entry.
80  * @merge_duplicate: Callback function to merge duplicated entry.
81  *
82  * Returns 0 on success, negative value otherwise.
83  *
84  * Caller holds tomoyo_read_lock().
85  */
86 int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
87                          struct tomoyo_acl_param *param,
88                          bool (*check_duplicate) (const struct tomoyo_acl_info
89                                                   *,
90                                                   const struct tomoyo_acl_info
91                                                   *),
92                          bool (*merge_duplicate) (struct tomoyo_acl_info *,
93                                                   struct tomoyo_acl_info *,
94                                                   const bool))
95 {
96         const bool is_delete = param->is_delete;
97         int error = is_delete ? -ENOENT : -ENOMEM;
98         struct tomoyo_acl_info *entry;
99         struct list_head * const list = param->list;
100
101         if (param->data[0]) {
102                 new_entry->cond = tomoyo_get_condition(param);
103                 if (!new_entry->cond)
104                         return -EINVAL;
105                 /*
106                  * Domain transition preference is allowed for only
107                  * "file execute" entries.
108                  */
109                 if (new_entry->cond->transit &&
110                     !(new_entry->type == TOMOYO_TYPE_PATH_ACL &&
111                       container_of(new_entry, struct tomoyo_path_acl, head)
112                       ->perm == 1 << TOMOYO_TYPE_EXECUTE))
113                         goto out;
114         }
115         if (mutex_lock_interruptible(&tomoyo_policy_lock))
116                 goto out;
117         list_for_each_entry_rcu(entry, list, list) {
118                 if (!tomoyo_same_acl_head(entry, new_entry) ||
119                     !check_duplicate(entry, new_entry))
120                         continue;
121                 if (merge_duplicate)
122                         entry->is_deleted = merge_duplicate(entry, new_entry,
123                                                             is_delete);
124                 else
125                         entry->is_deleted = is_delete;
126                 error = 0;
127                 break;
128         }
129         if (error && !is_delete) {
130                 entry = tomoyo_commit_ok(new_entry, size);
131                 if (entry) {
132                         list_add_tail_rcu(&entry->list, list);
133                         error = 0;
134                 }
135         }
136         mutex_unlock(&tomoyo_policy_lock);
137 out:
138         tomoyo_put_condition(new_entry->cond);
139         return error;
140 }
141
142 /**
143  * tomoyo_check_acl - Do permission check.
144  *
145  * @r:           Pointer to "struct tomoyo_request_info".
146  * @check_entry: Callback function to check type specific parameters.
147  *
148  * Returns 0 on success, negative value otherwise.
149  *
150  * Caller holds tomoyo_read_lock().
151  */
152 void tomoyo_check_acl(struct tomoyo_request_info *r,
153                       bool (*check_entry) (struct tomoyo_request_info *,
154                                            const struct tomoyo_acl_info *))
155 {
156         const struct tomoyo_domain_info *domain = r->domain;
157         struct tomoyo_acl_info *ptr;
158         bool retried = false;
159         const struct list_head *list = &domain->acl_info_list;
160
161 retry:
162         list_for_each_entry_rcu(ptr, list, list) {
163                 if (ptr->is_deleted || ptr->type != r->param_type)
164                         continue;
165                 if (!check_entry(r, ptr))
166                         continue;
167                 if (!tomoyo_condition(r, ptr->cond))
168                         continue;
169                 r->matched_acl = ptr;
170                 r->granted = true;
171                 return;
172         }
173         if (!retried) {
174                 retried = true;
175                 list = &domain->ns->acl_group[domain->group];
176                 goto retry;
177         }
178         r->granted = false;
179 }
180
181 /* The list for "struct tomoyo_domain_info". */
182 LIST_HEAD(tomoyo_domain_list);
183
184 /**
185  * tomoyo_last_word - Get last component of a domainname.
186  *
187  * @name: Domainname to check.
188  *
189  * Returns the last word of @domainname.
190  */
191 static const char *tomoyo_last_word(const char *name)
192 {
193         const char *cp = strrchr(name, ' ');
194         if (cp)
195                 return cp + 1;
196         return name;
197 }
198
199 /**
200  * tomoyo_same_transition_control - Check for duplicated "struct tomoyo_transition_control" entry.
201  *
202  * @a: Pointer to "struct tomoyo_acl_head".
203  * @b: Pointer to "struct tomoyo_acl_head".
204  *
205  * Returns true if @a == @b, false otherwise.
206  */
207 static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
208                                            const struct tomoyo_acl_head *b)
209 {
210         const struct tomoyo_transition_control *p1 = container_of(a,
211                                                                   typeof(*p1),
212                                                                   head);
213         const struct tomoyo_transition_control *p2 = container_of(b,
214                                                                   typeof(*p2),
215                                                                   head);
216         return p1->type == p2->type && p1->is_last_name == p2->is_last_name
217                 && p1->domainname == p2->domainname
218                 && p1->program == p2->program;
219 }
220
221 /**
222  * tomoyo_write_transition_control - Write "struct tomoyo_transition_control" list.
223  *
224  * @param: Pointer to "struct tomoyo_acl_param".
225  * @type:  Type of this entry.
226  *
227  * Returns 0 on success, negative value otherwise.
228  */
229 int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
230                                     const u8 type)
231 {
232         struct tomoyo_transition_control e = { .type = type };
233         int error = param->is_delete ? -ENOENT : -ENOMEM;
234         char *program = param->data;
235         char *domainname = strstr(program, " from ");
236         if (domainname) {
237                 *domainname = '\0';
238                 domainname += 6;
239         } else if (type == TOMOYO_TRANSITION_CONTROL_NO_KEEP ||
240                    type == TOMOYO_TRANSITION_CONTROL_KEEP) {
241                 domainname = program;
242                 program = NULL;
243         }
244         if (program && strcmp(program, "any")) {
245                 if (!tomoyo_correct_path(program))
246                         return -EINVAL;
247                 e.program = tomoyo_get_name(program);
248                 if (!e.program)
249                         goto out;
250         }
251         if (domainname && strcmp(domainname, "any")) {
252                 if (!tomoyo_correct_domain(domainname)) {
253                         if (!tomoyo_correct_path(domainname))
254                                 goto out;
255                         e.is_last_name = true;
256                 }
257                 e.domainname = tomoyo_get_name(domainname);
258                 if (!e.domainname)
259                         goto out;
260         }
261         param->list = &param->ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
262         error = tomoyo_update_policy(&e.head, sizeof(e), param,
263                                      tomoyo_same_transition_control);
264 out:
265         tomoyo_put_name(e.domainname);
266         tomoyo_put_name(e.program);
267         return error;
268 }
269
270 /**
271  * tomoyo_scan_transition - Try to find specific domain transition type.
272  *
273  * @list:       Pointer to "struct list_head".
274  * @domainname: The name of current domain.
275  * @program:    The name of requested program.
276  * @last_name:  The last component of @domainname.
277  * @type:       One of values in "enum tomoyo_transition_type".
278  *
279  * Returns true if found one, false otherwise.
280  *
281  * Caller holds tomoyo_read_lock().
282  */
283 static inline bool tomoyo_scan_transition
284 (const struct list_head *list, const struct tomoyo_path_info *domainname,
285  const struct tomoyo_path_info *program, const char *last_name,
286  const enum tomoyo_transition_type type)
287 {
288         const struct tomoyo_transition_control *ptr;
289         list_for_each_entry_rcu(ptr, list, head.list) {
290                 if (ptr->head.is_deleted || ptr->type != type)
291                         continue;
292                 if (ptr->domainname) {
293                         if (!ptr->is_last_name) {
294                                 if (ptr->domainname != domainname)
295                                         continue;
296                         } else {
297                                 /*
298                                  * Use direct strcmp() since this is
299                                  * unlikely used.
300                                  */
301                                 if (strcmp(ptr->domainname->name, last_name))
302                                         continue;
303                         }
304                 }
305                 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
306                         continue;
307                 return true;
308         }
309         return false;
310 }
311
312 /**
313  * tomoyo_transition_type - Get domain transition type.
314  *
315  * @ns:         Pointer to "struct tomoyo_policy_namespace".
316  * @domainname: The name of current domain.
317  * @program:    The name of requested program.
318  *
319  * Returns TOMOYO_TRANSITION_CONTROL_TRANSIT if executing @program causes
320  * domain transition across namespaces, TOMOYO_TRANSITION_CONTROL_INITIALIZE if
321  * executing @program reinitializes domain transition within that namespace,
322  * TOMOYO_TRANSITION_CONTROL_KEEP if executing @program stays at @domainname ,
323  * others otherwise.
324  *
325  * Caller holds tomoyo_read_lock().
326  */
327 static enum tomoyo_transition_type tomoyo_transition_type
328 (const struct tomoyo_policy_namespace *ns,
329  const struct tomoyo_path_info *domainname,
330  const struct tomoyo_path_info *program)
331 {
332         const char *last_name = tomoyo_last_word(domainname->name);
333         enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
334         while (type < TOMOYO_MAX_TRANSITION_TYPE) {
335                 const struct list_head * const list =
336                         &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
337                 if (!tomoyo_scan_transition(list, domainname, program,
338                                             last_name, type)) {
339                         type++;
340                         continue;
341                 }
342                 if (type != TOMOYO_TRANSITION_CONTROL_NO_RESET &&
343                     type != TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE)
344                         break;
345                 /*
346                  * Do not check for reset_domain if no_reset_domain matched.
347                  * Do not check for initialize_domain if no_initialize_domain
348                  * matched.
349                  */
350                 type++;
351                 type++;
352         }
353         return type;
354 }
355
356 /**
357  * tomoyo_same_aggregator - Check for duplicated "struct tomoyo_aggregator" entry.
358  *
359  * @a: Pointer to "struct tomoyo_acl_head".
360  * @b: Pointer to "struct tomoyo_acl_head".
361  *
362  * Returns true if @a == @b, false otherwise.
363  */
364 static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
365                                    const struct tomoyo_acl_head *b)
366 {
367         const struct tomoyo_aggregator *p1 = container_of(a, typeof(*p1),
368                                                           head);
369         const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
370                                                           head);
371         return p1->original_name == p2->original_name &&
372                 p1->aggregated_name == p2->aggregated_name;
373 }
374
375 /**
376  * tomoyo_write_aggregator - Write "struct tomoyo_aggregator" list.
377  *
378  * @param: Pointer to "struct tomoyo_acl_param".
379  *
380  * Returns 0 on success, negative value otherwise.
381  *
382  * Caller holds tomoyo_read_lock().
383  */
384 int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
385 {
386         struct tomoyo_aggregator e = { };
387         int error = param->is_delete ? -ENOENT : -ENOMEM;
388         const char *original_name = tomoyo_read_token(param);
389         const char *aggregated_name = tomoyo_read_token(param);
390         if (!tomoyo_correct_word(original_name) ||
391             !tomoyo_correct_path(aggregated_name))
392                 return -EINVAL;
393         e.original_name = tomoyo_get_name(original_name);
394         e.aggregated_name = tomoyo_get_name(aggregated_name);
395         if (!e.original_name || !e.aggregated_name ||
396             e.aggregated_name->is_patterned) /* No patterns allowed. */
397                 goto out;
398         param->list = &param->ns->policy_list[TOMOYO_ID_AGGREGATOR];
399         error = tomoyo_update_policy(&e.head, sizeof(e), param,
400                                      tomoyo_same_aggregator);
401 out:
402         tomoyo_put_name(e.original_name);
403         tomoyo_put_name(e.aggregated_name);
404         return error;
405 }
406
407 /**
408  * tomoyo_find_namespace - Find specified namespace.
409  *
410  * @name: Name of namespace to find.
411  * @len:  Length of @name.
412  *
413  * Returns pointer to "struct tomoyo_policy_namespace" if found,
414  * NULL otherwise.
415  *
416  * Caller holds tomoyo_read_lock().
417  */
418 static struct tomoyo_policy_namespace *tomoyo_find_namespace
419 (const char *name, const unsigned int len)
420 {
421         struct tomoyo_policy_namespace *ns;
422         list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
423                 if (strncmp(name, ns->name, len) ||
424                     (name[len] && name[len] != ' '))
425                         continue;
426                 return ns;
427         }
428         return NULL;
429 }
430
431 /**
432  * tomoyo_assign_namespace - Create a new namespace.
433  *
434  * @domainname: Name of namespace to create.
435  *
436  * Returns pointer to "struct tomoyo_policy_namespace" on success,
437  * NULL otherwise.
438  *
439  * Caller holds tomoyo_read_lock().
440  */
441 struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
442 {
443         struct tomoyo_policy_namespace *ptr;
444         struct tomoyo_policy_namespace *entry;
445         const char *cp = domainname;
446         unsigned int len = 0;
447         while (*cp && *cp++ != ' ')
448                 len++;
449         ptr = tomoyo_find_namespace(domainname, len);
450         if (ptr)
451                 return ptr;
452         if (len >= TOMOYO_EXEC_TMPSIZE - 10 || !tomoyo_domain_def(domainname))
453                 return NULL;
454         entry = kzalloc(sizeof(*entry) + len + 1, GFP_NOFS);
455         if (!entry)
456                 return NULL;
457         if (mutex_lock_interruptible(&tomoyo_policy_lock))
458                 goto out;
459         ptr = tomoyo_find_namespace(domainname, len);
460         if (!ptr && tomoyo_memory_ok(entry)) {
461                 char *name = (char *) (entry + 1);
462                 ptr = entry;
463                 memmove(name, domainname, len);
464                 name[len] = '\0';
465                 entry->name = name;
466                 tomoyo_init_policy_namespace(entry);
467                 entry = NULL;
468         }
469         mutex_unlock(&tomoyo_policy_lock);
470 out:
471         kfree(entry);
472         return ptr;
473 }
474
475 /**
476  * tomoyo_namespace_jump - Check for namespace jump.
477  *
478  * @domainname: Name of domain.
479  *
480  * Returns true if namespace differs, false otherwise.
481  */
482 static bool tomoyo_namespace_jump(const char *domainname)
483 {
484         const char *namespace = tomoyo_current_namespace()->name;
485         const int len = strlen(namespace);
486         return strncmp(domainname, namespace, len) ||
487                 (domainname[len] && domainname[len] != ' ');
488 }
489
490 /**
491  * tomoyo_assign_domain - Create a domain or a namespace.
492  *
493  * @domainname: The name of domain.
494  * @transit:    True if transit to domain found or created.
495  *
496  * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
497  *
498  * Caller holds tomoyo_read_lock().
499  */
500 struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
501                                                 const bool transit)
502 {
503         struct tomoyo_domain_info e = { };
504         struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
505         bool created = false;
506         if (entry) {
507                 if (transit) {
508                         /*
509                          * Since namespace is created at runtime, profiles may
510                          * not be created by the moment the process transits to
511                          * that domain. Do not perform domain transition if
512                          * profile for that domain is not yet created.
513                          */
514                         if (!entry->ns->profile_ptr[entry->profile])
515                                 return NULL;
516                 }
517                 return entry;
518         }
519         /* Requested domain does not exist. */
520         /* Don't create requested domain if domainname is invalid. */
521         if (strlen(domainname) >= TOMOYO_EXEC_TMPSIZE - 10 ||
522             !tomoyo_correct_domain(domainname))
523                 return NULL;
524         /*
525          * Since definition of profiles and acl_groups may differ across
526          * namespaces, do not inherit "use_profile" and "use_group" settings
527          * by automatically creating requested domain upon domain transition.
528          */
529         if (transit && tomoyo_namespace_jump(domainname))
530                 return NULL;
531         e.ns = tomoyo_assign_namespace(domainname);
532         if (!e.ns)
533                 return NULL;
534         /*
535          * "use_profile" and "use_group" settings for automatically created
536          * domains are inherited from current domain. These are 0 for manually
537          * created domains.
538          */
539         if (transit) {
540                 const struct tomoyo_domain_info *domain = tomoyo_domain();
541                 e.profile = domain->profile;
542                 e.group = domain->group;
543         }
544         e.domainname = tomoyo_get_name(domainname);
545         if (!e.domainname)
546                 return NULL;
547         if (mutex_lock_interruptible(&tomoyo_policy_lock))
548                 goto out;
549         entry = tomoyo_find_domain(domainname);
550         if (!entry) {
551                 entry = tomoyo_commit_ok(&e, sizeof(e));
552                 if (entry) {
553                         INIT_LIST_HEAD(&entry->acl_info_list);
554                         list_add_tail_rcu(&entry->list, &tomoyo_domain_list);
555                         created = true;
556                 }
557         }
558         mutex_unlock(&tomoyo_policy_lock);
559 out:
560         tomoyo_put_name(e.domainname);
561         if (entry && transit) {
562                 if (created) {
563                         struct tomoyo_request_info r;
564                         tomoyo_init_request_info(&r, entry,
565                                                  TOMOYO_MAC_FILE_EXECUTE);
566                         r.granted = false;
567                         tomoyo_write_log(&r, "use_profile %u\n",
568                                          entry->profile);
569                         tomoyo_write_log(&r, "use_group %u\n", entry->group);
570                         tomoyo_update_stat(TOMOYO_STAT_POLICY_UPDATES);
571                 }
572         }
573         return entry;
574 }
575
576 /**
577  * tomoyo_environ - Check permission for environment variable names.
578  *
579  * @ee: Pointer to "struct tomoyo_execve".
580  *
581  * Returns 0 on success, negative value otherwise.
582  */
583 static int tomoyo_environ(struct tomoyo_execve *ee)
584 {
585         struct tomoyo_request_info *r = &ee->r;
586         struct linux_binprm *bprm = ee->bprm;
587         /* env_page.data is allocated by tomoyo_dump_page(). */
588         struct tomoyo_page_dump env_page = { };
589         char *arg_ptr; /* Size is TOMOYO_EXEC_TMPSIZE bytes */
590         int arg_len = 0;
591         unsigned long pos = bprm->p;
592         int offset = pos % PAGE_SIZE;
593         int argv_count = bprm->argc;
594         int envp_count = bprm->envc;
595         int error = -ENOMEM;
596
597         ee->r.type = TOMOYO_MAC_ENVIRON;
598         ee->r.profile = r->domain->profile;
599         ee->r.mode = tomoyo_get_mode(r->domain->ns, ee->r.profile,
600                                      TOMOYO_MAC_ENVIRON);
601         if (!r->mode || !envp_count)
602                 return 0;
603         arg_ptr = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
604         if (!arg_ptr)
605                 goto out;
606         while (error == -ENOMEM) {
607                 if (!tomoyo_dump_page(bprm, pos, &env_page))
608                         goto out;
609                 pos += PAGE_SIZE - offset;
610                 /* Read. */
611                 while (argv_count && offset < PAGE_SIZE) {
612                         if (!env_page.data[offset++])
613                                 argv_count--;
614                 }
615                 if (argv_count) {
616                         offset = 0;
617                         continue;
618                 }
619                 while (offset < PAGE_SIZE) {
620                         const unsigned char c = env_page.data[offset++];
621
622                         if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
623                                 if (c == '=') {
624                                         arg_ptr[arg_len++] = '\0';
625                                 } else if (c == '\\') {
626                                         arg_ptr[arg_len++] = '\\';
627                                         arg_ptr[arg_len++] = '\\';
628                                 } else if (c > ' ' && c < 127) {
629                                         arg_ptr[arg_len++] = c;
630                                 } else {
631                                         arg_ptr[arg_len++] = '\\';
632                                         arg_ptr[arg_len++] = (c >> 6) + '0';
633                                         arg_ptr[arg_len++]
634                                                 = ((c >> 3) & 7) + '0';
635                                         arg_ptr[arg_len++] = (c & 7) + '0';
636                                 }
637                         } else {
638                                 arg_ptr[arg_len] = '\0';
639                         }
640                         if (c)
641                                 continue;
642                         if (tomoyo_env_perm(r, arg_ptr)) {
643                                 error = -EPERM;
644                                 break;
645                         }
646                         if (!--envp_count) {
647                                 error = 0;
648                                 break;
649                         }
650                         arg_len = 0;
651                 }
652                 offset = 0;
653         }
654 out:
655         if (r->mode != TOMOYO_CONFIG_ENFORCING)
656                 error = 0;
657         kfree(env_page.data);
658         kfree(arg_ptr);
659         return error;
660 }
661
662 /**
663  * tomoyo_find_next_domain - Find a domain.
664  *
665  * @bprm: Pointer to "struct linux_binprm".
666  *
667  * Returns 0 on success, negative value otherwise.
668  *
669  * Caller holds tomoyo_read_lock().
670  */
671 int tomoyo_find_next_domain(struct linux_binprm *bprm)
672 {
673         struct tomoyo_domain_info *old_domain = tomoyo_domain();
674         struct tomoyo_domain_info *domain = NULL;
675         const char *original_name = bprm->filename;
676         int retval = -ENOMEM;
677         bool reject_on_transition_failure = false;
678         const struct tomoyo_path_info *candidate;
679         struct tomoyo_path_info exename;
680         struct tomoyo_execve *ee = kzalloc(sizeof(*ee), GFP_NOFS);
681
682         if (!ee)
683                 return -ENOMEM;
684         ee->tmp = kzalloc(TOMOYO_EXEC_TMPSIZE, GFP_NOFS);
685         if (!ee->tmp) {
686                 kfree(ee);
687                 return -ENOMEM;
688         }
689         /* ee->dump->data is allocated by tomoyo_dump_page(). */
690         tomoyo_init_request_info(&ee->r, NULL, TOMOYO_MAC_FILE_EXECUTE);
691         ee->r.ee = ee;
692         ee->bprm = bprm;
693         ee->r.obj = &ee->obj;
694         ee->obj.path1 = bprm->file->f_path;
695         /* Get symlink's pathname of program. */
696         retval = -ENOENT;
697         exename.name = tomoyo_realpath_nofollow(original_name);
698         if (!exename.name)
699                 goto out;
700         tomoyo_fill_path_info(&exename);
701 retry:
702         /* Check 'aggregator' directive. */
703         {
704                 struct tomoyo_aggregator *ptr;
705                 struct list_head *list =
706                         &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
707                 /* Check 'aggregator' directive. */
708                 candidate = &exename;
709                 list_for_each_entry_rcu(ptr, list, head.list) {
710                         if (ptr->head.is_deleted ||
711                             !tomoyo_path_matches_pattern(&exename,
712                                                          ptr->original_name))
713                                 continue;
714                         candidate = ptr->aggregated_name;
715                         break;
716                 }
717         }
718
719         /* Check execute permission. */
720         retval = tomoyo_execute_permission(&ee->r, candidate);
721         if (retval == TOMOYO_RETRY_REQUEST)
722                 goto retry;
723         if (retval < 0)
724                 goto out;
725         /*
726          * To be able to specify domainnames with wildcards, use the
727          * pathname specified in the policy (which may contain
728          * wildcard) rather than the pathname passed to execve()
729          * (which never contains wildcard).
730          */
731         if (ee->r.param.path.matched_path)
732                 candidate = ee->r.param.path.matched_path;
733
734         /*
735          * Check for domain transition preference if "file execute" matched.
736          * If preference is given, make do_execve() fail if domain transition
737          * has failed, for domain transition preference should be used with
738          * destination domain defined.
739          */
740         if (ee->transition) {
741                 const char *domainname = ee->transition->name;
742                 reject_on_transition_failure = true;
743                 if (!strcmp(domainname, "keep"))
744                         goto force_keep_domain;
745                 if (!strcmp(domainname, "child"))
746                         goto force_child_domain;
747                 if (!strcmp(domainname, "reset"))
748                         goto force_reset_domain;
749                 if (!strcmp(domainname, "initialize"))
750                         goto force_initialize_domain;
751                 if (!strcmp(domainname, "parent")) {
752                         char *cp;
753                         strncpy(ee->tmp, old_domain->domainname->name,
754                                 TOMOYO_EXEC_TMPSIZE - 1);
755                         cp = strrchr(ee->tmp, ' ');
756                         if (cp)
757                                 *cp = '\0';
758                 } else if (*domainname == '<')
759                         strncpy(ee->tmp, domainname, TOMOYO_EXEC_TMPSIZE - 1);
760                 else
761                         snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
762                                  old_domain->domainname->name, domainname);
763                 goto force_jump_domain;
764         }
765         /*
766          * No domain transition preference specified.
767          * Calculate domain to transit to.
768          */
769         switch (tomoyo_transition_type(old_domain->ns, old_domain->domainname,
770                                        candidate)) {
771         case TOMOYO_TRANSITION_CONTROL_RESET:
772 force_reset_domain:
773                 /* Transit to the root of specified namespace. */
774                 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "<%s>",
775                          candidate->name);
776                 /*
777                  * Make do_execve() fail if domain transition across namespaces
778                  * has failed.
779                  */
780                 reject_on_transition_failure = true;
781                 break;
782         case TOMOYO_TRANSITION_CONTROL_INITIALIZE:
783 force_initialize_domain:
784                 /* Transit to the child of current namespace's root. */
785                 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
786                          old_domain->ns->name, candidate->name);
787                 break;
788         case TOMOYO_TRANSITION_CONTROL_KEEP:
789 force_keep_domain:
790                 /* Keep current domain. */
791                 domain = old_domain;
792                 break;
793         default:
794                 if (old_domain == &tomoyo_kernel_domain &&
795                     !tomoyo_policy_loaded) {
796                         /*
797                          * Needn't to transit from kernel domain before
798                          * starting /sbin/init. But transit from kernel domain
799                          * if executing initializers because they might start
800                          * before /sbin/init.
801                          */
802                         domain = old_domain;
803                         break;
804                 }
805 force_child_domain:
806                 /* Normal domain transition. */
807                 snprintf(ee->tmp, TOMOYO_EXEC_TMPSIZE - 1, "%s %s",
808                          old_domain->domainname->name, candidate->name);
809                 break;
810         }
811 force_jump_domain:
812         if (!domain)
813                 domain = tomoyo_assign_domain(ee->tmp, true);
814         if (domain)
815                 retval = 0;
816         else if (reject_on_transition_failure) {
817                 printk(KERN_WARNING "ERROR: Domain '%s' not ready.\n",
818                        ee->tmp);
819                 retval = -ENOMEM;
820         } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING)
821                 retval = -ENOMEM;
822         else {
823                 retval = 0;
824                 if (!old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED]) {
825                         old_domain->flags[TOMOYO_DIF_TRANSITION_FAILED] = true;
826                         ee->r.granted = false;
827                         tomoyo_write_log(&ee->r, "%s", tomoyo_dif
828                                          [TOMOYO_DIF_TRANSITION_FAILED]);
829                         printk(KERN_WARNING
830                                "ERROR: Domain '%s' not defined.\n", ee->tmp);
831                 }
832         }
833  out:
834         if (!domain)
835                 domain = old_domain;
836         /* Update reference count on "struct tomoyo_domain_info". */
837         atomic_inc(&domain->users);
838         bprm->cred->security = domain;
839         kfree(exename.name);
840         if (!retval) {
841                 ee->r.domain = domain;
842                 retval = tomoyo_environ(ee);
843         }
844         kfree(ee->tmp);
845         kfree(ee->dump.data);
846         kfree(ee);
847         return retval;
848 }
849
850 /**
851  * tomoyo_dump_page - Dump a page to buffer.
852  *
853  * @bprm: Pointer to "struct linux_binprm".
854  * @pos:  Location to dump.
855  * @dump: Poiner to "struct tomoyo_page_dump".
856  *
857  * Returns true on success, false otherwise.
858  */
859 bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
860                       struct tomoyo_page_dump *dump)
861 {
862         struct page *page;
863
864         /* dump->data is released by tomoyo_find_next_domain(). */
865         if (!dump->data) {
866                 dump->data = kzalloc(PAGE_SIZE, GFP_NOFS);
867                 if (!dump->data)
868                         return false;
869         }
870         /* Same with get_arg_page(bprm, pos, 0) in fs/exec.c */
871 #ifdef CONFIG_MMU
872         if (get_user_pages(current, bprm->mm, pos, 1, 0, 1, &page, NULL) <= 0)
873                 return false;
874 #else
875         page = bprm->page[pos / PAGE_SIZE];
876 #endif
877         if (page != dump->page) {
878                 const unsigned int offset = pos % PAGE_SIZE;
879                 /*
880                  * Maybe kmap()/kunmap() should be used here.
881                  * But remove_arg_zero() uses kmap_atomic()/kunmap_atomic().
882                  * So do I.
883                  */
884                 char *kaddr = kmap_atomic(page, KM_USER0);
885
886                 dump->page = page;
887                 memcpy(dump->data + offset, kaddr + offset,
888                        PAGE_SIZE - offset);
889                 kunmap_atomic(kaddr, KM_USER0);
890         }
891         /* Same with put_arg_page(page) in fs/exec.c */
892 #ifdef CONFIG_MMU
893         put_page(page);
894 #endif
895         return true;
896 }