1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * security/tomoyo/condition.c
4  *
5  * Copyright (C) 2005-2011  NTT DATA CORPORATION
6  */
7 
8 #include "common.h"
9 #include <linux/slab.h>
10 
11 /* List of "struct tomoyo_condition". */
12 LIST_HEAD(tomoyo_condition_list);
13 
14 /**
15  * tomoyo_argv - Check argv[] in "struct linux_binbrm".
16  *
17  * @index:   Index number of @arg_ptr.
18  * @arg_ptr: Contents of argv[@index].
19  * @argc:    Length of @argv.
20  * @argv:    Pointer to "struct tomoyo_argv".
21  * @checked: Set to true if @argv[@index] was found.
22  *
23  * Returns true on success, false otherwise.
24  */
tomoyo_argv(const unsigned int index,const char * arg_ptr,const int argc,const struct tomoyo_argv * argv,u8 * checked)25 static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
26 			const int argc, const struct tomoyo_argv *argv,
27 			u8 *checked)
28 {
29 	int i;
30 	struct tomoyo_path_info arg;
31 
32 	arg.name = arg_ptr;
33 	for (i = 0; i < argc; argv++, checked++, i++) {
34 		bool result;
35 
36 		if (index != argv->index)
37 			continue;
38 		*checked = 1;
39 		tomoyo_fill_path_info(&arg);
40 		result = tomoyo_path_matches_pattern(&arg, argv->value);
41 		if (argv->is_not)
42 			result = !result;
43 		if (!result)
44 			return false;
45 	}
46 	return true;
47 }
48 
49 /**
50  * tomoyo_envp - Check envp[] in "struct linux_binbrm".
51  *
52  * @env_name:  The name of environment variable.
53  * @env_value: The value of environment variable.
54  * @envc:      Length of @envp.
55  * @envp:      Pointer to "struct tomoyo_envp".
56  * @checked:   Set to true if @envp[@env_name] was found.
57  *
58  * Returns true on success, false otherwise.
59  */
tomoyo_envp(const char * env_name,const char * env_value,const int envc,const struct tomoyo_envp * envp,u8 * checked)60 static bool tomoyo_envp(const char *env_name, const char *env_value,
61 			const int envc, const struct tomoyo_envp *envp,
62 			u8 *checked)
63 {
64 	int i;
65 	struct tomoyo_path_info name;
66 	struct tomoyo_path_info value;
67 
68 	name.name = env_name;
69 	tomoyo_fill_path_info(&name);
70 	value.name = env_value;
71 	tomoyo_fill_path_info(&value);
72 	for (i = 0; i < envc; envp++, checked++, i++) {
73 		bool result;
74 
75 		if (!tomoyo_path_matches_pattern(&name, envp->name))
76 			continue;
77 		*checked = 1;
78 		if (envp->value) {
79 			result = tomoyo_path_matches_pattern(&value,
80 							     envp->value);
81 			if (envp->is_not)
82 				result = !result;
83 		} else {
84 			result = true;
85 			if (!envp->is_not)
86 				result = !result;
87 		}
88 		if (!result)
89 			return false;
90 	}
91 	return true;
92 }
93 
94 /**
95  * tomoyo_scan_bprm - Scan "struct linux_binprm".
96  *
97  * @ee:   Pointer to "struct tomoyo_execve".
98  * @argc: Length of @argc.
99  * @argv: Pointer to "struct tomoyo_argv".
100  * @envc: Length of @envp.
101  * @envp: Pointer to "struct tomoyo_envp".
102  *
103  * Returns true on success, false otherwise.
104  */
tomoyo_scan_bprm(struct tomoyo_execve * ee,const u16 argc,const struct tomoyo_argv * argv,const u16 envc,const struct tomoyo_envp * envp)105 static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
106 			     const u16 argc, const struct tomoyo_argv *argv,
107 			     const u16 envc, const struct tomoyo_envp *envp)
108 {
109 	struct linux_binprm *bprm = ee->bprm;
110 	struct tomoyo_page_dump *dump = &ee->dump;
111 	char *arg_ptr = ee->tmp;
112 	int arg_len = 0;
113 	unsigned long pos = bprm->p;
114 	int offset = pos % PAGE_SIZE;
115 	int argv_count = bprm->argc;
116 	int envp_count = bprm->envc;
117 	bool result = true;
118 	u8 local_checked[32];
119 	u8 *checked;
120 
121 	if (argc + envc <= sizeof(local_checked)) {
122 		checked = local_checked;
123 		memset(local_checked, 0, sizeof(local_checked));
124 	} else {
125 		checked = kzalloc(argc + envc, GFP_NOFS);
126 		if (!checked)
127 			return false;
128 	}
129 	while (argv_count || envp_count) {
130 		if (!tomoyo_dump_page(bprm, pos, dump)) {
131 			result = false;
132 			goto out;
133 		}
134 		pos += PAGE_SIZE - offset;
135 		while (offset < PAGE_SIZE) {
136 			/* Read. */
137 			const char *kaddr = dump->data;
138 			const unsigned char c = kaddr[offset++];
139 
140 			if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
141 				if (c == '\\') {
142 					arg_ptr[arg_len++] = '\\';
143 					arg_ptr[arg_len++] = '\\';
144 				} else if (c > ' ' && c < 127) {
145 					arg_ptr[arg_len++] = c;
146 				} else {
147 					arg_ptr[arg_len++] = '\\';
148 					arg_ptr[arg_len++] = (c >> 6) + '0';
149 					arg_ptr[arg_len++] =
150 						((c >> 3) & 7) + '0';
151 					arg_ptr[arg_len++] = (c & 7) + '0';
152 				}
153 			} else {
154 				arg_ptr[arg_len] = '\0';
155 			}
156 			if (c)
157 				continue;
158 			/* Check. */
159 			if (argv_count) {
160 				if (!tomoyo_argv(bprm->argc - argv_count,
161 						 arg_ptr, argc, argv,
162 						 checked)) {
163 					result = false;
164 					break;
165 				}
166 				argv_count--;
167 			} else if (envp_count) {
168 				char *cp = strchr(arg_ptr, '=');
169 
170 				if (cp) {
171 					*cp = '\0';
172 					if (!tomoyo_envp(arg_ptr, cp + 1,
173 							 envc, envp,
174 							 checked + argc)) {
175 						result = false;
176 						break;
177 					}
178 				}
179 				envp_count--;
180 			} else {
181 				break;
182 			}
183 			arg_len = 0;
184 		}
185 		offset = 0;
186 		if (!result)
187 			break;
188 	}
189 out:
190 	if (result) {
191 		int i;
192 
193 		/* Check not-yet-checked entries. */
194 		for (i = 0; i < argc; i++) {
195 			if (checked[i])
196 				continue;
197 			/*
198 			 * Return true only if all unchecked indexes in
199 			 * bprm->argv[] are not matched.
200 			 */
201 			if (argv[i].is_not)
202 				continue;
203 			result = false;
204 			break;
205 		}
206 		for (i = 0; i < envc; envp++, i++) {
207 			if (checked[argc + i])
208 				continue;
209 			/*
210 			 * Return true only if all unchecked environ variables
211 			 * in bprm->envp[] are either undefined or not matched.
212 			 */
213 			if ((!envp->value && !envp->is_not) ||
214 			    (envp->value && envp->is_not))
215 				continue;
216 			result = false;
217 			break;
218 		}
219 	}
220 	if (checked != local_checked)
221 		kfree(checked);
222 	return result;
223 }
224 
225 /**
226  * tomoyo_scan_exec_realpath - Check "exec.realpath" parameter of "struct tomoyo_condition".
227  *
228  * @file:  Pointer to "struct file".
229  * @ptr:   Pointer to "struct tomoyo_name_union".
230  * @match: True if "exec.realpath=", false if "exec.realpath!=".
231  *
232  * Returns true on success, false otherwise.
233  */
tomoyo_scan_exec_realpath(struct file * file,const struct tomoyo_name_union * ptr,const bool match)234 static bool tomoyo_scan_exec_realpath(struct file *file,
235 				      const struct tomoyo_name_union *ptr,
236 				      const bool match)
237 {
238 	bool result;
239 	struct tomoyo_path_info exe;
240 
241 	if (!file)
242 		return false;
243 	exe.name = tomoyo_realpath_from_path(&file->f_path);
244 	if (!exe.name)
245 		return false;
246 	tomoyo_fill_path_info(&exe);
247 	result = tomoyo_compare_name_union(&exe, ptr);
248 	kfree(exe.name);
249 	return result == match;
250 }
251 
252 /**
253  * tomoyo_get_dqword - tomoyo_get_name() for a quoted string.
254  *
255  * @start: String to save.
256  *
257  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
258  */
tomoyo_get_dqword(char * start)259 static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
260 {
261 	char *cp = start + strlen(start) - 1;
262 
263 	if (cp == start || *start++ != '"' || *cp != '"')
264 		return NULL;
265 	*cp = '\0';
266 	if (*start && !tomoyo_correct_word(start))
267 		return NULL;
268 	return tomoyo_get_name(start);
269 }
270 
271 /**
272  * tomoyo_parse_name_union_quoted - Parse a quoted word.
273  *
274  * @param: Pointer to "struct tomoyo_acl_param".
275  * @ptr:   Pointer to "struct tomoyo_name_union".
276  *
277  * Returns true on success, false otherwise.
278  */
tomoyo_parse_name_union_quoted(struct tomoyo_acl_param * param,struct tomoyo_name_union * ptr)279 static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
280 					   struct tomoyo_name_union *ptr)
281 {
282 	char *filename = param->data;
283 
284 	if (*filename == '@')
285 		return tomoyo_parse_name_union(param, ptr);
286 	ptr->filename = tomoyo_get_dqword(filename);
287 	return ptr->filename != NULL;
288 }
289 
290 /**
291  * tomoyo_parse_argv - Parse an argv[] condition part.
292  *
293  * @left:  Lefthand value.
294  * @right: Righthand value.
295  * @argv:  Pointer to "struct tomoyo_argv".
296  *
297  * Returns true on success, false otherwise.
298  */
tomoyo_parse_argv(char * left,char * right,struct tomoyo_argv * argv)299 static bool tomoyo_parse_argv(char *left, char *right,
300 			      struct tomoyo_argv *argv)
301 {
302 	if (tomoyo_parse_ulong(&argv->index, &left) !=
303 	    TOMOYO_VALUE_TYPE_DECIMAL || *left++ != ']' || *left)
304 		return false;
305 	argv->value = tomoyo_get_dqword(right);
306 	return argv->value != NULL;
307 }
308 
309 /**
310  * tomoyo_parse_envp - Parse an envp[] condition part.
311  *
312  * @left:  Lefthand value.
313  * @right: Righthand value.
314  * @envp:  Pointer to "struct tomoyo_envp".
315  *
316  * Returns true on success, false otherwise.
317  */
tomoyo_parse_envp(char * left,char * right,struct tomoyo_envp * envp)318 static bool tomoyo_parse_envp(char *left, char *right,
319 			      struct tomoyo_envp *envp)
320 {
321 	const struct tomoyo_path_info *name;
322 	const struct tomoyo_path_info *value;
323 	char *cp = left + strlen(left) - 1;
324 
325 	if (*cp-- != ']' || *cp != '"')
326 		goto out;
327 	*cp = '\0';
328 	if (!tomoyo_correct_word(left))
329 		goto out;
330 	name = tomoyo_get_name(left);
331 	if (!name)
332 		goto out;
333 	if (!strcmp(right, "NULL")) {
334 		value = NULL;
335 	} else {
336 		value = tomoyo_get_dqword(right);
337 		if (!value) {
338 			tomoyo_put_name(name);
339 			goto out;
340 		}
341 	}
342 	envp->name = name;
343 	envp->value = value;
344 	return true;
345 out:
346 	return false;
347 }
348 
349 /**
350  * tomoyo_same_condition - Check for duplicated "struct tomoyo_condition" entry.
351  *
352  * @a: Pointer to "struct tomoyo_condition".
353  * @b: Pointer to "struct tomoyo_condition".
354  *
355  * Returns true if @a == @b, false otherwise.
356  */
tomoyo_same_condition(const struct tomoyo_condition * a,const struct tomoyo_condition * b)357 static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
358 					 const struct tomoyo_condition *b)
359 {
360 	return a->size == b->size && a->condc == b->condc &&
361 		a->numbers_count == b->numbers_count &&
362 		a->names_count == b->names_count &&
363 		a->argc == b->argc && a->envc == b->envc &&
364 		a->grant_log == b->grant_log && a->transit == b->transit &&
365 		!memcmp(a + 1, b + 1, a->size - sizeof(*a));
366 }
367 
368 /**
369  * tomoyo_condition_type - Get condition type.
370  *
371  * @word: Keyword string.
372  *
373  * Returns one of values in "enum tomoyo_conditions_index" on success,
374  * TOMOYO_MAX_CONDITION_KEYWORD otherwise.
375  */
tomoyo_condition_type(const char * word)376 static u8 tomoyo_condition_type(const char *word)
377 {
378 	u8 i;
379 
380 	for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
381 		if (!strcmp(word, tomoyo_condition_keyword[i]))
382 			break;
383 	}
384 	return i;
385 }
386 
387 /* Define this to enable debug mode. */
388 /* #define DEBUG_CONDITION */
389 
390 #ifdef DEBUG_CONDITION
391 #define dprintk printk
392 #else
393 #define dprintk(...) do { } while (0)
394 #endif
395 
396 /**
397  * tomoyo_commit_condition - Commit "struct tomoyo_condition".
398  *
399  * @entry: Pointer to "struct tomoyo_condition".
400  *
401  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
402  *
403  * This function merges duplicated entries. This function returns NULL if
404  * @entry is not duplicated but memory quota for policy has exceeded.
405  */
tomoyo_commit_condition(struct tomoyo_condition * entry)406 static struct tomoyo_condition *tomoyo_commit_condition
407 (struct tomoyo_condition *entry)
408 {
409 	struct tomoyo_condition *ptr;
410 	bool found = false;
411 
412 	if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
413 		dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
414 		ptr = NULL;
415 		found = true;
416 		goto out;
417 	}
418 	list_for_each_entry(ptr, &tomoyo_condition_list, head.list) {
419 		if (!tomoyo_same_condition(ptr, entry) ||
420 		    atomic_read(&ptr->head.users) == TOMOYO_GC_IN_PROGRESS)
421 			continue;
422 		/* Same entry found. Share this entry. */
423 		atomic_inc(&ptr->head.users);
424 		found = true;
425 		break;
426 	}
427 	if (!found) {
428 		if (tomoyo_memory_ok(entry)) {
429 			atomic_set(&entry->head.users, 1);
430 			list_add(&entry->head.list, &tomoyo_condition_list);
431 		} else {
432 			found = true;
433 			ptr = NULL;
434 		}
435 	}
436 	mutex_unlock(&tomoyo_policy_lock);
437 out:
438 	if (found) {
439 		tomoyo_del_condition(&entry->head.list);
440 		kfree(entry);
441 		entry = ptr;
442 	}
443 	return entry;
444 }
445 
446 /**
447  * tomoyo_get_transit_preference - Parse domain transition preference for execve().
448  *
449  * @param: Pointer to "struct tomoyo_acl_param".
450  * @e:     Pointer to "struct tomoyo_condition".
451  *
452  * Returns the condition string part.
453  */
tomoyo_get_transit_preference(struct tomoyo_acl_param * param,struct tomoyo_condition * e)454 static char *tomoyo_get_transit_preference(struct tomoyo_acl_param *param,
455 					   struct tomoyo_condition *e)
456 {
457 	char * const pos = param->data;
458 	bool flag;
459 
460 	if (*pos == '<') {
461 		e->transit = tomoyo_get_domainname(param);
462 		goto done;
463 	}
464 	{
465 		char *cp = strchr(pos, ' ');
466 
467 		if (cp)
468 			*cp = '\0';
469 		flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") ||
470 			!strcmp(pos, "initialize") || !strcmp(pos, "reset") ||
471 			!strcmp(pos, "child") || !strcmp(pos, "parent");
472 		if (cp)
473 			*cp = ' ';
474 	}
475 	if (!flag)
476 		return pos;
477 	e->transit = tomoyo_get_name(tomoyo_read_token(param));
478 done:
479 	if (e->transit)
480 		return param->data;
481 	/*
482 	 * Return a bad read-only condition string that will let
483 	 * tomoyo_get_condition() return NULL.
484 	 */
485 	return "/";
486 }
487 
488 /**
489  * tomoyo_get_condition - Parse condition part.
490  *
491  * @param: Pointer to "struct tomoyo_acl_param".
492  *
493  * Returns pointer to "struct tomoyo_condition" on success, NULL otherwise.
494  */
tomoyo_get_condition(struct tomoyo_acl_param * param)495 struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
496 {
497 	struct tomoyo_condition *entry = NULL;
498 	struct tomoyo_condition_element *condp = NULL;
499 	struct tomoyo_number_union *numbers_p = NULL;
500 	struct tomoyo_name_union *names_p = NULL;
501 	struct tomoyo_argv *argv = NULL;
502 	struct tomoyo_envp *envp = NULL;
503 	struct tomoyo_condition e = { };
504 	char * const start_of_string =
505 		tomoyo_get_transit_preference(param, &e);
506 	char * const end_of_string = start_of_string + strlen(start_of_string);
507 	char *pos;
508 
509 rerun:
510 	pos = start_of_string;
511 	while (1) {
512 		u8 left = -1;
513 		u8 right = -1;
514 		char *left_word = pos;
515 		char *cp;
516 		char *right_word;
517 		bool is_not;
518 
519 		if (!*left_word)
520 			break;
521 		/*
522 		 * Since left-hand condition does not allow use of "path_group"
523 		 * or "number_group" and environment variable's names do not
524 		 * accept '=', it is guaranteed that the original line consists
525 		 * of one or more repetition of $left$operator$right blocks
526 		 * where "$left is free from '=' and ' '" and "$operator is
527 		 * either '=' or '!='" and "$right is free from ' '".
528 		 * Therefore, we can reconstruct the original line at the end
529 		 * of dry run even if we overwrite $operator with '\0'.
530 		 */
531 		cp = strchr(pos, ' ');
532 		if (cp) {
533 			*cp = '\0'; /* Will restore later. */
534 			pos = cp + 1;
535 		} else {
536 			pos = "";
537 		}
538 		right_word = strchr(left_word, '=');
539 		if (!right_word || right_word == left_word)
540 			goto out;
541 		is_not = *(right_word - 1) == '!';
542 		if (is_not)
543 			*(right_word++ - 1) = '\0'; /* Will restore later. */
544 		else if (*(right_word + 1) != '=')
545 			*right_word++ = '\0'; /* Will restore later. */
546 		else
547 			goto out;
548 		dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word,
549 			is_not ? "!" : "", right_word);
550 		if (!strcmp(left_word, "grant_log")) {
551 			if (entry) {
552 				if (is_not ||
553 				    entry->grant_log != TOMOYO_GRANTLOG_AUTO)
554 					goto out;
555 				else if (!strcmp(right_word, "yes"))
556 					entry->grant_log = TOMOYO_GRANTLOG_YES;
557 				else if (!strcmp(right_word, "no"))
558 					entry->grant_log = TOMOYO_GRANTLOG_NO;
559 				else
560 					goto out;
561 			}
562 			continue;
563 		}
564 		if (!strncmp(left_word, "exec.argv[", 10)) {
565 			if (!argv) {
566 				e.argc++;
567 				e.condc++;
568 			} else {
569 				e.argc--;
570 				e.condc--;
571 				left = TOMOYO_ARGV_ENTRY;
572 				argv->is_not = is_not;
573 				if (!tomoyo_parse_argv(left_word + 10,
574 						       right_word, argv++))
575 					goto out;
576 			}
577 			goto store_value;
578 		}
579 		if (!strncmp(left_word, "exec.envp[\"", 11)) {
580 			if (!envp) {
581 				e.envc++;
582 				e.condc++;
583 			} else {
584 				e.envc--;
585 				e.condc--;
586 				left = TOMOYO_ENVP_ENTRY;
587 				envp->is_not = is_not;
588 				if (!tomoyo_parse_envp(left_word + 11,
589 						       right_word, envp++))
590 					goto out;
591 			}
592 			goto store_value;
593 		}
594 		left = tomoyo_condition_type(left_word);
595 		dprintk(KERN_WARNING "%u: <%s> left=%u\n", __LINE__, left_word,
596 			left);
597 		if (left == TOMOYO_MAX_CONDITION_KEYWORD) {
598 			if (!numbers_p) {
599 				e.numbers_count++;
600 			} else {
601 				e.numbers_count--;
602 				left = TOMOYO_NUMBER_UNION;
603 				param->data = left_word;
604 				if (*left_word == '@' ||
605 				    !tomoyo_parse_number_union(param,
606 							       numbers_p++))
607 					goto out;
608 			}
609 		}
610 		if (!condp)
611 			e.condc++;
612 		else
613 			e.condc--;
614 		if (left == TOMOYO_EXEC_REALPATH ||
615 		    left == TOMOYO_SYMLINK_TARGET) {
616 			if (!names_p) {
617 				e.names_count++;
618 			} else {
619 				e.names_count--;
620 				right = TOMOYO_NAME_UNION;
621 				param->data = right_word;
622 				if (!tomoyo_parse_name_union_quoted(param,
623 								    names_p++))
624 					goto out;
625 			}
626 			goto store_value;
627 		}
628 		right = tomoyo_condition_type(right_word);
629 		if (right == TOMOYO_MAX_CONDITION_KEYWORD) {
630 			if (!numbers_p) {
631 				e.numbers_count++;
632 			} else {
633 				e.numbers_count--;
634 				right = TOMOYO_NUMBER_UNION;
635 				param->data = right_word;
636 				if (!tomoyo_parse_number_union(param,
637 							       numbers_p++))
638 					goto out;
639 			}
640 		}
641 store_value:
642 		if (!condp) {
643 			dprintk(KERN_WARNING "%u: dry_run left=%u right=%u match=%u\n",
644 				__LINE__, left, right, !is_not);
645 			continue;
646 		}
647 		condp->left = left;
648 		condp->right = right;
649 		condp->equals = !is_not;
650 		dprintk(KERN_WARNING "%u: left=%u right=%u match=%u\n",
651 			__LINE__, condp->left, condp->right,
652 			condp->equals);
653 		condp++;
654 	}
655 	dprintk(KERN_INFO "%u: cond=%u numbers=%u names=%u ac=%u ec=%u\n",
656 		__LINE__, e.condc, e.numbers_count, e.names_count, e.argc,
657 		e.envc);
658 	if (entry) {
659 		BUG_ON(e.names_count | e.numbers_count | e.argc | e.envc |
660 		       e.condc);
661 		return tomoyo_commit_condition(entry);
662 	}
663 	e.size = sizeof(*entry)
664 		+ e.condc * sizeof(struct tomoyo_condition_element)
665 		+ e.numbers_count * sizeof(struct tomoyo_number_union)
666 		+ e.names_count * sizeof(struct tomoyo_name_union)
667 		+ e.argc * sizeof(struct tomoyo_argv)
668 		+ e.envc * sizeof(struct tomoyo_envp);
669 	entry = kzalloc(e.size, GFP_NOFS);
670 	if (!entry)
671 		goto out2;
672 	*entry = e;
673 	e.transit = NULL;
674 	condp = (struct tomoyo_condition_element *) (entry + 1);
675 	numbers_p = (struct tomoyo_number_union *) (condp + e.condc);
676 	names_p = (struct tomoyo_name_union *) (numbers_p + e.numbers_count);
677 	argv = (struct tomoyo_argv *) (names_p + e.names_count);
678 	envp = (struct tomoyo_envp *) (argv + e.argc);
679 	{
680 		bool flag = false;
681 
682 		for (pos = start_of_string; pos < end_of_string; pos++) {
683 			if (*pos)
684 				continue;
685 			if (flag) /* Restore " ". */
686 				*pos = ' ';
687 			else if (*(pos + 1) == '=') /* Restore "!=". */
688 				*pos = '!';
689 			else /* Restore "=". */
690 				*pos = '=';
691 			flag = !flag;
692 		}
693 	}
694 	goto rerun;
695 out:
696 	dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
697 	if (entry) {
698 		tomoyo_del_condition(&entry->head.list);
699 		kfree(entry);
700 	}
701 out2:
702 	tomoyo_put_name(e.transit);
703 	return NULL;
704 }
705 
706 /**
707  * tomoyo_get_attributes - Revalidate "struct inode".
708  *
709  * @obj: Pointer to "struct tomoyo_obj_info".
710  *
711  * Returns nothing.
712  */
tomoyo_get_attributes(struct tomoyo_obj_info * obj)713 void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
714 {
715 	u8 i;
716 	struct dentry *dentry = NULL;
717 
718 	for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
719 		struct inode *inode;
720 
721 		switch (i) {
722 		case TOMOYO_PATH1:
723 			dentry = obj->path1.dentry;
724 			if (!dentry)
725 				continue;
726 			break;
727 		case TOMOYO_PATH2:
728 			dentry = obj->path2.dentry;
729 			if (!dentry)
730 				continue;
731 			break;
732 		default:
733 			if (!dentry)
734 				continue;
735 			dentry = dget_parent(dentry);
736 			break;
737 		}
738 		inode = d_backing_inode(dentry);
739 		if (inode) {
740 			struct tomoyo_mini_stat *stat = &obj->stat[i];
741 
742 			stat->uid  = inode->i_uid;
743 			stat->gid  = inode->i_gid;
744 			stat->ino  = inode->i_ino;
745 			stat->mode = inode->i_mode;
746 			stat->dev  = inode->i_sb->s_dev;
747 			stat->rdev = inode->i_rdev;
748 			obj->stat_valid[i] = true;
749 		}
750 		if (i & 1) /* TOMOYO_PATH1_PARENT or TOMOYO_PATH2_PARENT */
751 			dput(dentry);
752 	}
753 }
754 
755 /**
756  * tomoyo_condition - Check condition part.
757  *
758  * @r:    Pointer to "struct tomoyo_request_info".
759  * @cond: Pointer to "struct tomoyo_condition". Maybe NULL.
760  *
761  * Returns true on success, false otherwise.
762  *
763  * Caller holds tomoyo_read_lock().
764  */
tomoyo_condition(struct tomoyo_request_info * r,const struct tomoyo_condition * cond)765 bool tomoyo_condition(struct tomoyo_request_info *r,
766 		      const struct tomoyo_condition *cond)
767 {
768 	u32 i;
769 	unsigned long min_v[2] = { 0, 0 };
770 	unsigned long max_v[2] = { 0, 0 };
771 	const struct tomoyo_condition_element *condp;
772 	const struct tomoyo_number_union *numbers_p;
773 	const struct tomoyo_name_union *names_p;
774 	const struct tomoyo_argv *argv;
775 	const struct tomoyo_envp *envp;
776 	struct tomoyo_obj_info *obj;
777 	u16 condc;
778 	u16 argc;
779 	u16 envc;
780 	struct linux_binprm *bprm = NULL;
781 
782 	if (!cond)
783 		return true;
784 	condc = cond->condc;
785 	argc = cond->argc;
786 	envc = cond->envc;
787 	obj = r->obj;
788 	if (r->ee)
789 		bprm = r->ee->bprm;
790 	if (!bprm && (argc || envc))
791 		return false;
792 	condp = (struct tomoyo_condition_element *) (cond + 1);
793 	numbers_p = (const struct tomoyo_number_union *) (condp + condc);
794 	names_p = (const struct tomoyo_name_union *)
795 		(numbers_p + cond->numbers_count);
796 	argv = (const struct tomoyo_argv *) (names_p + cond->names_count);
797 	envp = (const struct tomoyo_envp *) (argv + argc);
798 	for (i = 0; i < condc; i++) {
799 		const bool match = condp->equals;
800 		const u8 left = condp->left;
801 		const u8 right = condp->right;
802 		bool is_bitop[2] = { false, false };
803 		u8 j;
804 
805 		condp++;
806 		/* Check argv[] and envp[] later. */
807 		if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
808 			continue;
809 		/* Check string expressions. */
810 		if (right == TOMOYO_NAME_UNION) {
811 			const struct tomoyo_name_union *ptr = names_p++;
812 			struct tomoyo_path_info *symlink;
813 			struct tomoyo_execve *ee;
814 			struct file *file;
815 
816 			switch (left) {
817 			case TOMOYO_SYMLINK_TARGET:
818 				symlink = obj ? obj->symlink_target : NULL;
819 				if (!symlink ||
820 				    !tomoyo_compare_name_union(symlink, ptr)
821 				    == match)
822 					goto out;
823 				break;
824 			case TOMOYO_EXEC_REALPATH:
825 				ee = r->ee;
826 				file = ee ? ee->bprm->file : NULL;
827 				if (!tomoyo_scan_exec_realpath(file, ptr,
828 							       match))
829 					goto out;
830 				break;
831 			}
832 			continue;
833 		}
834 		/* Check numeric or bit-op expressions. */
835 		for (j = 0; j < 2; j++) {
836 			const u8 index = j ? right : left;
837 			unsigned long value = 0;
838 
839 			switch (index) {
840 			case TOMOYO_TASK_UID:
841 				value = from_kuid(&init_user_ns, current_uid());
842 				break;
843 			case TOMOYO_TASK_EUID:
844 				value = from_kuid(&init_user_ns, current_euid());
845 				break;
846 			case TOMOYO_TASK_SUID:
847 				value = from_kuid(&init_user_ns, current_suid());
848 				break;
849 			case TOMOYO_TASK_FSUID:
850 				value = from_kuid(&init_user_ns, current_fsuid());
851 				break;
852 			case TOMOYO_TASK_GID:
853 				value = from_kgid(&init_user_ns, current_gid());
854 				break;
855 			case TOMOYO_TASK_EGID:
856 				value = from_kgid(&init_user_ns, current_egid());
857 				break;
858 			case TOMOYO_TASK_SGID:
859 				value = from_kgid(&init_user_ns, current_sgid());
860 				break;
861 			case TOMOYO_TASK_FSGID:
862 				value = from_kgid(&init_user_ns, current_fsgid());
863 				break;
864 			case TOMOYO_TASK_PID:
865 				value = tomoyo_sys_getpid();
866 				break;
867 			case TOMOYO_TASK_PPID:
868 				value = tomoyo_sys_getppid();
869 				break;
870 			case TOMOYO_TYPE_IS_SOCKET:
871 				value = S_IFSOCK;
872 				break;
873 			case TOMOYO_TYPE_IS_SYMLINK:
874 				value = S_IFLNK;
875 				break;
876 			case TOMOYO_TYPE_IS_FILE:
877 				value = S_IFREG;
878 				break;
879 			case TOMOYO_TYPE_IS_BLOCK_DEV:
880 				value = S_IFBLK;
881 				break;
882 			case TOMOYO_TYPE_IS_DIRECTORY:
883 				value = S_IFDIR;
884 				break;
885 			case TOMOYO_TYPE_IS_CHAR_DEV:
886 				value = S_IFCHR;
887 				break;
888 			case TOMOYO_TYPE_IS_FIFO:
889 				value = S_IFIFO;
890 				break;
891 			case TOMOYO_MODE_SETUID:
892 				value = S_ISUID;
893 				break;
894 			case TOMOYO_MODE_SETGID:
895 				value = S_ISGID;
896 				break;
897 			case TOMOYO_MODE_STICKY:
898 				value = S_ISVTX;
899 				break;
900 			case TOMOYO_MODE_OWNER_READ:
901 				value = 0400;
902 				break;
903 			case TOMOYO_MODE_OWNER_WRITE:
904 				value = 0200;
905 				break;
906 			case TOMOYO_MODE_OWNER_EXECUTE:
907 				value = 0100;
908 				break;
909 			case TOMOYO_MODE_GROUP_READ:
910 				value = 0040;
911 				break;
912 			case TOMOYO_MODE_GROUP_WRITE:
913 				value = 0020;
914 				break;
915 			case TOMOYO_MODE_GROUP_EXECUTE:
916 				value = 0010;
917 				break;
918 			case TOMOYO_MODE_OTHERS_READ:
919 				value = 0004;
920 				break;
921 			case TOMOYO_MODE_OTHERS_WRITE:
922 				value = 0002;
923 				break;
924 			case TOMOYO_MODE_OTHERS_EXECUTE:
925 				value = 0001;
926 				break;
927 			case TOMOYO_EXEC_ARGC:
928 				if (!bprm)
929 					goto out;
930 				value = bprm->argc;
931 				break;
932 			case TOMOYO_EXEC_ENVC:
933 				if (!bprm)
934 					goto out;
935 				value = bprm->envc;
936 				break;
937 			case TOMOYO_NUMBER_UNION:
938 				/* Fetch values later. */
939 				break;
940 			default:
941 				if (!obj)
942 					goto out;
943 				if (!obj->validate_done) {
944 					tomoyo_get_attributes(obj);
945 					obj->validate_done = true;
946 				}
947 				{
948 					u8 stat_index;
949 					struct tomoyo_mini_stat *stat;
950 
951 					switch (index) {
952 					case TOMOYO_PATH1_UID:
953 					case TOMOYO_PATH1_GID:
954 					case TOMOYO_PATH1_INO:
955 					case TOMOYO_PATH1_MAJOR:
956 					case TOMOYO_PATH1_MINOR:
957 					case TOMOYO_PATH1_TYPE:
958 					case TOMOYO_PATH1_DEV_MAJOR:
959 					case TOMOYO_PATH1_DEV_MINOR:
960 					case TOMOYO_PATH1_PERM:
961 						stat_index = TOMOYO_PATH1;
962 						break;
963 					case TOMOYO_PATH2_UID:
964 					case TOMOYO_PATH2_GID:
965 					case TOMOYO_PATH2_INO:
966 					case TOMOYO_PATH2_MAJOR:
967 					case TOMOYO_PATH2_MINOR:
968 					case TOMOYO_PATH2_TYPE:
969 					case TOMOYO_PATH2_DEV_MAJOR:
970 					case TOMOYO_PATH2_DEV_MINOR:
971 					case TOMOYO_PATH2_PERM:
972 						stat_index = TOMOYO_PATH2;
973 						break;
974 					case TOMOYO_PATH1_PARENT_UID:
975 					case TOMOYO_PATH1_PARENT_GID:
976 					case TOMOYO_PATH1_PARENT_INO:
977 					case TOMOYO_PATH1_PARENT_PERM:
978 						stat_index =
979 							TOMOYO_PATH1_PARENT;
980 						break;
981 					case TOMOYO_PATH2_PARENT_UID:
982 					case TOMOYO_PATH2_PARENT_GID:
983 					case TOMOYO_PATH2_PARENT_INO:
984 					case TOMOYO_PATH2_PARENT_PERM:
985 						stat_index =
986 							TOMOYO_PATH2_PARENT;
987 						break;
988 					default:
989 						goto out;
990 					}
991 					if (!obj->stat_valid[stat_index])
992 						goto out;
993 					stat = &obj->stat[stat_index];
994 					switch (index) {
995 					case TOMOYO_PATH1_UID:
996 					case TOMOYO_PATH2_UID:
997 					case TOMOYO_PATH1_PARENT_UID:
998 					case TOMOYO_PATH2_PARENT_UID:
999 						value = from_kuid(&init_user_ns, stat->uid);
1000 						break;
1001 					case TOMOYO_PATH1_GID:
1002 					case TOMOYO_PATH2_GID:
1003 					case TOMOYO_PATH1_PARENT_GID:
1004 					case TOMOYO_PATH2_PARENT_GID:
1005 						value = from_kgid(&init_user_ns, stat->gid);
1006 						break;
1007 					case TOMOYO_PATH1_INO:
1008 					case TOMOYO_PATH2_INO:
1009 					case TOMOYO_PATH1_PARENT_INO:
1010 					case TOMOYO_PATH2_PARENT_INO:
1011 						value = stat->ino;
1012 						break;
1013 					case TOMOYO_PATH1_MAJOR:
1014 					case TOMOYO_PATH2_MAJOR:
1015 						value = MAJOR(stat->dev);
1016 						break;
1017 					case TOMOYO_PATH1_MINOR:
1018 					case TOMOYO_PATH2_MINOR:
1019 						value = MINOR(stat->dev);
1020 						break;
1021 					case TOMOYO_PATH1_TYPE:
1022 					case TOMOYO_PATH2_TYPE:
1023 						value = stat->mode & S_IFMT;
1024 						break;
1025 					case TOMOYO_PATH1_DEV_MAJOR:
1026 					case TOMOYO_PATH2_DEV_MAJOR:
1027 						value = MAJOR(stat->rdev);
1028 						break;
1029 					case TOMOYO_PATH1_DEV_MINOR:
1030 					case TOMOYO_PATH2_DEV_MINOR:
1031 						value = MINOR(stat->rdev);
1032 						break;
1033 					case TOMOYO_PATH1_PERM:
1034 					case TOMOYO_PATH2_PERM:
1035 					case TOMOYO_PATH1_PARENT_PERM:
1036 					case TOMOYO_PATH2_PARENT_PERM:
1037 						value = stat->mode & S_IALLUGO;
1038 						break;
1039 					}
1040 				}
1041 				break;
1042 			}
1043 			max_v[j] = value;
1044 			min_v[j] = value;
1045 			switch (index) {
1046 			case TOMOYO_MODE_SETUID:
1047 			case TOMOYO_MODE_SETGID:
1048 			case TOMOYO_MODE_STICKY:
1049 			case TOMOYO_MODE_OWNER_READ:
1050 			case TOMOYO_MODE_OWNER_WRITE:
1051 			case TOMOYO_MODE_OWNER_EXECUTE:
1052 			case TOMOYO_MODE_GROUP_READ:
1053 			case TOMOYO_MODE_GROUP_WRITE:
1054 			case TOMOYO_MODE_GROUP_EXECUTE:
1055 			case TOMOYO_MODE_OTHERS_READ:
1056 			case TOMOYO_MODE_OTHERS_WRITE:
1057 			case TOMOYO_MODE_OTHERS_EXECUTE:
1058 				is_bitop[j] = true;
1059 			}
1060 		}
1061 		if (left == TOMOYO_NUMBER_UNION) {
1062 			/* Fetch values now. */
1063 			const struct tomoyo_number_union *ptr = numbers_p++;
1064 
1065 			min_v[0] = ptr->values[0];
1066 			max_v[0] = ptr->values[1];
1067 		}
1068 		if (right == TOMOYO_NUMBER_UNION) {
1069 			/* Fetch values now. */
1070 			const struct tomoyo_number_union *ptr = numbers_p++;
1071 
1072 			if (ptr->group) {
1073 				if (tomoyo_number_matches_group(min_v[0],
1074 								max_v[0],
1075 								ptr->group)
1076 				    == match)
1077 					continue;
1078 			} else {
1079 				if ((min_v[0] <= ptr->values[1] &&
1080 				     max_v[0] >= ptr->values[0]) == match)
1081 					continue;
1082 			}
1083 			goto out;
1084 		}
1085 		/*
1086 		 * Bit operation is valid only when counterpart value
1087 		 * represents permission.
1088 		 */
1089 		if (is_bitop[0] && is_bitop[1]) {
1090 			goto out;
1091 		} else if (is_bitop[0]) {
1092 			switch (right) {
1093 			case TOMOYO_PATH1_PERM:
1094 			case TOMOYO_PATH1_PARENT_PERM:
1095 			case TOMOYO_PATH2_PERM:
1096 			case TOMOYO_PATH2_PARENT_PERM:
1097 				if (!(max_v[0] & max_v[1]) == !match)
1098 					continue;
1099 			}
1100 			goto out;
1101 		} else if (is_bitop[1]) {
1102 			switch (left) {
1103 			case TOMOYO_PATH1_PERM:
1104 			case TOMOYO_PATH1_PARENT_PERM:
1105 			case TOMOYO_PATH2_PERM:
1106 			case TOMOYO_PATH2_PARENT_PERM:
1107 				if (!(max_v[0] & max_v[1]) == !match)
1108 					continue;
1109 			}
1110 			goto out;
1111 		}
1112 		/* Normal value range comparison. */
1113 		if ((min_v[0] <= max_v[1] && max_v[0] >= min_v[1]) == match)
1114 			continue;
1115 out:
1116 		return false;
1117 	}
1118 	/* Check argv[] and envp[] now. */
1119 	if (r->ee && (argc || envc))
1120 		return tomoyo_scan_bprm(r->ee, argc, argv, envc, envp);
1121 	return true;
1122 }
1123