projects/linux·blob master · refs

780 lines · 21.6 KiB

1// SPDX-License-Identifier: GPL-2.0
2/*
3 * security/tomoyo/network.c
4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */
7
8#include "common.h"
9#include <linux/slab.h>
10
11/* Structure for holding inet domain socket's address. */
12struct tomoyo_inet_addr_info {
13 __be16 port; /* In network byte order. */
14 const __be32 *address; /* In network byte order. */
15 bool is_ipv6;
16};
17
18/* Structure for holding unix domain socket's address. */
19struct tomoyo_unix_addr_info {
20 u8 *addr; /* This may not be '\0' terminated string. */
21 unsigned int addr_len;
22};
23
24/* Structure for holding socket address. */
25struct tomoyo_addr_info {
26 u8 protocol;
27 u8 operation;
28 struct tomoyo_inet_addr_info inet;
29 struct tomoyo_unix_addr_info unix0;
30};
31
32/* String table for socket's protocols. */
33const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = {
34 [SOCK_STREAM] = "stream",
35 [SOCK_DGRAM] = "dgram",
36 [SOCK_RAW] = "raw",
37 [SOCK_SEQPACKET] = "seqpacket",
38 [0] = " ", /* Dummy for avoiding NULL pointer dereference. */
39 [4] = " ", /* Dummy for avoiding NULL pointer dereference. */
40};
41
42/**
43 * tomoyo_parse_ipaddr_union - Parse an IP address.
44 *
45 * @param: Pointer to "struct tomoyo_acl_param".
46 * @ptr: Pointer to "struct tomoyo_ipaddr_union".
47 *
48 * Returns true on success, false otherwise.
49 */
50bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
51 struct tomoyo_ipaddr_union *ptr)
52{
53 u8 * const min = ptr->ip[0].in6_u.u6_addr8;
54 u8 * const max = ptr->ip[1].in6_u.u6_addr8;
55 char *address = tomoyo_read_token(param);
56 const char *end;
57
58 if (!strchr(address, ':') &&
59 in4_pton(address, -1, min, '-', &end) > 0) {
60 ptr->is_ipv6 = false;
61 if (!*end)
62 ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0];
63 else if (*end++ != '-' ||
64 in4_pton(end, -1, max, '\0', &end) <= 0 || *end)
65 return false;
66 return true;
67 }
68 if (in6_pton(address, -1, min, '-', &end) > 0) {
69 ptr->is_ipv6 = true;
70 if (!*end)
71 memmove(max, min, sizeof(u16) * 8);
72 else if (*end++ != '-' ||
73 in6_pton(end, -1, max, '\0', &end) <= 0 || *end)
74 return false;
75 return true;
76 }
77 return false;
78}
79
80/**
81 * tomoyo_print_ipv4 - Print an IPv4 address.
82 *
83 * @buffer: Buffer to write to.
84 * @buffer_len: Size of @buffer.
85 * @min_ip: Pointer to __be32.
86 * @max_ip: Pointer to __be32.
87 *
88 * Returns nothing.
89 */
90static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len,
91 const __be32 *min_ip, const __be32 *max_ip)
92{
93 snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip,
94 *min_ip == *max_ip ? '\0' : '-', max_ip);
95}
96
97/**
98 * tomoyo_print_ipv6 - Print an IPv6 address.
99 *
100 * @buffer: Buffer to write to.
101 * @buffer_len: Size of @buffer.
102 * @min_ip: Pointer to "struct in6_addr".
103 * @max_ip: Pointer to "struct in6_addr".
104 *
105 * Returns nothing.
106 */
107static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len,
108 const struct in6_addr *min_ip,
109 const struct in6_addr *max_ip)
110{
111 snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip,
112 !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip);
113}
114
115/**
116 * tomoyo_print_ip - Print an IP address.
117 *
118 * @buf: Buffer to write to.
119 * @size: Size of @buf.
120 * @ptr: Pointer to "struct ipaddr_union".
121 *
122 * Returns nothing.
123 */
124void tomoyo_print_ip(char *buf, const unsigned int size,
125 const struct tomoyo_ipaddr_union *ptr)
126{
127 if (ptr->is_ipv6)
128 tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]);
129 else
130 tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0],
131 &ptr->ip[1].s6_addr32[0]);
132}
133
134/*
135 * Mapping table from "enum tomoyo_network_acl_index" to
136 * "enum tomoyo_mac_index" for inet domain socket.
137 */
138static const u8 tomoyo_inet2mac
139[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
140 [SOCK_STREAM] = {
141 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
142 [TOMOYO_NETWORK_LISTEN] =
143 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
144 [TOMOYO_NETWORK_CONNECT] =
145 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
146 },
147 [SOCK_DGRAM] = {
148 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
149 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
150 },
151 [SOCK_RAW] = {
152 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_INET_RAW_BIND,
153 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_INET_RAW_SEND,
154 },
155};
156
157/*
158 * Mapping table from "enum tomoyo_network_acl_index" to
159 * "enum tomoyo_mac_index" for unix domain socket.
160 */
161static const u8 tomoyo_unix2mac
162[TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
163 [SOCK_STREAM] = {
164 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
165 [TOMOYO_NETWORK_LISTEN] =
166 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
167 [TOMOYO_NETWORK_CONNECT] =
168 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
169 },
170 [SOCK_DGRAM] = {
171 [TOMOYO_NETWORK_BIND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
172 [TOMOYO_NETWORK_SEND] = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
173 },
174 [SOCK_SEQPACKET] = {
175 [TOMOYO_NETWORK_BIND] =
176 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
177 [TOMOYO_NETWORK_LISTEN] =
178 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
179 [TOMOYO_NETWORK_CONNECT] =
180 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
181 },
182};
183
184/**
185 * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry.
186 *
187 * @a: Pointer to "struct tomoyo_acl_info".
188 * @b: Pointer to "struct tomoyo_acl_info".
189 *
190 * Returns true if @a == @b except permission bits, false otherwise.
191 */
192static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a,
193 const struct tomoyo_acl_info *b)
194{
195 const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head);
196 const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head);
197
198 return p1->protocol == p2->protocol &&
199 tomoyo_same_ipaddr_union(&p1->address, &p2->address) &&
200 tomoyo_same_number_union(&p1->port, &p2->port);
201}
202
203/**
204 * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry.
205 *
206 * @a: Pointer to "struct tomoyo_acl_info".
207 * @b: Pointer to "struct tomoyo_acl_info".
208 *
209 * Returns true if @a == @b except permission bits, false otherwise.
210 */
211static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a,
212 const struct tomoyo_acl_info *b)
213{
214 const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head);
215 const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head);
216
217 return p1->protocol == p2->protocol &&
218 tomoyo_same_name_union(&p1->name, &p2->name);
219}
220
221/**
222 * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry.
223 *
224 * @a: Pointer to "struct tomoyo_acl_info".
225 * @b: Pointer to "struct tomoyo_acl_info".
226 * @is_delete: True for @a &= ~@b, false for @a |= @b.
227 *
228 * Returns true if @a is empty, false otherwise.
229 */
230static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a,
231 struct tomoyo_acl_info *b,
232 const bool is_delete)
233{
234 u8 * const a_perm =
235 &container_of(a, struct tomoyo_inet_acl, head)->perm;
236 u8 perm = READ_ONCE(*a_perm);
237 const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
238
239 if (is_delete)
240 perm &= ~b_perm;
241 else
242 perm |= b_perm;
243 WRITE_ONCE(*a_perm, perm);
244 return !perm;
245}
246
247/**
248 * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry.
249 *
250 * @a: Pointer to "struct tomoyo_acl_info".
251 * @b: Pointer to "struct tomoyo_acl_info".
252 * @is_delete: True for @a &= ~@b, false for @a |= @b.
253 *
254 * Returns true if @a is empty, false otherwise.
255 */
256static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a,
257 struct tomoyo_acl_info *b,
258 const bool is_delete)
259{
260 u8 * const a_perm =
261 &container_of(a, struct tomoyo_unix_acl, head)->perm;
262 u8 perm = READ_ONCE(*a_perm);
263 const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
264
265 if (is_delete)
266 perm &= ~b_perm;
267 else
268 perm |= b_perm;
269 WRITE_ONCE(*a_perm, perm);
270 return !perm;
271}
272
273/**
274 * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list.
275 *
276 * @param: Pointer to "struct tomoyo_acl_param".
277 *
278 * Returns 0 on success, negative value otherwise.
279 *
280 * Caller holds tomoyo_read_lock().
281 */
282int tomoyo_write_inet_network(struct tomoyo_acl_param *param)
283{
284 struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL };
285 int error = -EINVAL;
286 u8 type;
287 const char *protocol = tomoyo_read_token(param);
288 const char *operation = tomoyo_read_token(param);
289
290 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
291 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
292 break;
293 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
294 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
295 e.perm |= 1 << type;
296 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
297 return -EINVAL;
298 if (param->data[0] == '@') {
299 param->data++;
300 e.address.group =
301 tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP);
302 if (!e.address.group)
303 return -ENOMEM;
304 } else {
305 if (!tomoyo_parse_ipaddr_union(param, &e.address))
306 goto out;
307 }
308 if (!tomoyo_parse_number_union(param, &e.port) ||
309 e.port.values[1] > 65535)
310 goto out;
311 error = tomoyo_update_domain(&e.head, sizeof(e), param,
312 tomoyo_same_inet_acl,
313 tomoyo_merge_inet_acl);
314out:
315 tomoyo_put_group(e.address.group);
316 tomoyo_put_number_union(&e.port);
317 return error;
318}
319
320/**
321 * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list.
322 *
323 * @param: Pointer to "struct tomoyo_acl_param".
324 *
325 * Returns 0 on success, negative value otherwise.
326 */
327int tomoyo_write_unix_network(struct tomoyo_acl_param *param)
328{
329 struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL };
330 int error;
331 u8 type;
332 const char *protocol = tomoyo_read_token(param);
333 const char *operation = tomoyo_read_token(param);
334
335 for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
336 if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
337 break;
338 for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
339 if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
340 e.perm |= 1 << type;
341 if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
342 return -EINVAL;
343 if (!tomoyo_parse_name_union(param, &e.name))
344 return -EINVAL;
345 error = tomoyo_update_domain(&e.head, sizeof(e), param,
346 tomoyo_same_unix_acl,
347 tomoyo_merge_unix_acl);
348 tomoyo_put_name_union(&e.name);
349 return error;
350}
351
352/**
353 * tomoyo_audit_net_log - Audit network log.
354 *
355 * @r: Pointer to "struct tomoyo_request_info".
356 * @family: Name of socket family ("inet" or "unix").
357 * @protocol: Name of protocol in @family.
358 * @operation: Name of socket operation.
359 * @address: Name of address.
360 *
361 * Returns 0 on success, negative value otherwise.
362 */
363static int tomoyo_audit_net_log(struct tomoyo_request_info *r,
364 const char *family, const u8 protocol,
365 const u8 operation, const char *address)
366 __must_hold_shared(&tomoyo_ss)
367{
368 return tomoyo_supervisor(r, "network %s %s %s %s\n", family,
369 tomoyo_proto_keyword[protocol],
370 tomoyo_socket_keyword[operation], address);
371}
372
373/**
374 * tomoyo_audit_inet_log - Audit INET network log.
375 *
376 * @r: Pointer to "struct tomoyo_request_info".
377 *
378 * Returns 0 on success, negative value otherwise.
379 */
380static int tomoyo_audit_inet_log(struct tomoyo_request_info *r)
381 __must_hold_shared(&tomoyo_ss)
382{
383 char buf[128];
384 int len;
385 const __be32 *address = r->param.inet_network.address;
386
387 if (r->param.inet_network.is_ipv6)
388 tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *)
389 address, (const struct in6_addr *) address);
390 else
391 tomoyo_print_ipv4(buf, sizeof(buf), address, address);
392 len = strlen(buf);
393 snprintf(buf + len, sizeof(buf) - len, " %u",
394 r->param.inet_network.port);
395 return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol,
396 r->param.inet_network.operation, buf);
397}
398
399/**
400 * tomoyo_audit_unix_log - Audit UNIX network log.
401 *
402 * @r: Pointer to "struct tomoyo_request_info".
403 *
404 * Returns 0 on success, negative value otherwise.
405 */
406static int tomoyo_audit_unix_log(struct tomoyo_request_info *r)
407 __must_hold_shared(&tomoyo_ss)
408{
409 return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol,
410 r->param.unix_network.operation,
411 r->param.unix_network.address->name);
412}
413
414/**
415 * tomoyo_check_inet_acl - Check permission for inet domain socket operation.
416 *
417 * @r: Pointer to "struct tomoyo_request_info".
418 * @ptr: Pointer to "struct tomoyo_acl_info".
419 *
420 * Returns true if granted, false otherwise.
421 */
422static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r,
423 const struct tomoyo_acl_info *ptr)
424{
425 const struct tomoyo_inet_acl *acl =
426 container_of(ptr, typeof(*acl), head);
427 const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4;
428
429 if (!(acl->perm & (1 << r->param.inet_network.operation)) ||
430 !tomoyo_compare_number_union(r->param.inet_network.port,
431 &acl->port))
432 return false;
433 if (acl->address.group)
434 return tomoyo_address_matches_group
435 (r->param.inet_network.is_ipv6,
436 r->param.inet_network.address, acl->address.group);
437 return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 &&
438 memcmp(&acl->address.ip[0],
439 r->param.inet_network.address, size) <= 0 &&
440 memcmp(r->param.inet_network.address,
441 &acl->address.ip[1], size) <= 0;
442}
443
444/**
445 * tomoyo_check_unix_acl - Check permission for unix domain socket operation.
446 *
447 * @r: Pointer to "struct tomoyo_request_info".
448 * @ptr: Pointer to "struct tomoyo_acl_info".
449 *
450 * Returns true if granted, false otherwise.
451 */
452static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r,
453 const struct tomoyo_acl_info *ptr)
454{
455 const struct tomoyo_unix_acl *acl =
456 container_of(ptr, typeof(*acl), head);
457
458 return (acl->perm & (1 << r->param.unix_network.operation)) &&
459 tomoyo_compare_name_union(r->param.unix_network.address,
460 &acl->name);
461}
462
463/**
464 * tomoyo_inet_entry - Check permission for INET network operation.
465 *
466 * @address: Pointer to "struct tomoyo_addr_info".
467 *
468 * Returns 0 on success, negative value otherwise.
469 */
470static int tomoyo_inet_entry(const struct tomoyo_addr_info *address)
471{
472 const int idx = tomoyo_read_lock();
473 struct tomoyo_request_info r;
474 int error = 0;
475 const u8 type = tomoyo_inet2mac[address->protocol][address->operation];
476
477 if (type && tomoyo_init_request_info(&r, NULL, type)
478 != TOMOYO_CONFIG_DISABLED) {
479 r.param_type = TOMOYO_TYPE_INET_ACL;
480 r.param.inet_network.protocol = address->protocol;
481 r.param.inet_network.operation = address->operation;
482 r.param.inet_network.is_ipv6 = address->inet.is_ipv6;
483 r.param.inet_network.address = address->inet.address;
484 r.param.inet_network.port = ntohs(address->inet.port);
485 do {
486 tomoyo_check_acl(&r, tomoyo_check_inet_acl);
487 error = tomoyo_audit_inet_log(&r);
488 } while (error == TOMOYO_RETRY_REQUEST);
489 }
490 tomoyo_read_unlock(idx);
491 return error;
492}
493
494/**
495 * tomoyo_check_inet_address - Check permission for inet domain socket's operation.
496 *
497 * @addr: Pointer to "struct sockaddr".
498 * @addr_len: Size of @addr.
499 * @port: Port number.
500 * @address: Pointer to "struct tomoyo_addr_info".
501 *
502 * Returns 0 on success, negative value otherwise.
503 */
504static int tomoyo_check_inet_address(const struct sockaddr *addr,
505 const unsigned int addr_len,
506 const u16 port,
507 struct tomoyo_addr_info *address)
508{
509 struct tomoyo_inet_addr_info *i = &address->inet;
510
511 if (addr_len < offsetofend(struct sockaddr, sa_family))
512 return 0;
513 switch (addr->sa_family) {
514 case AF_INET6:
515 if (addr_len < SIN6_LEN_RFC2133)
516 goto skip;
517 i->is_ipv6 = true;
518 i->address = (__be32 *)
519 ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;
520 i->port = ((struct sockaddr_in6 *) addr)->sin6_port;
521 break;
522 case AF_INET:
523 if (addr_len < sizeof(struct sockaddr_in))
524 goto skip;
525 i->is_ipv6 = false;
526 i->address = (__be32 *)
527 &((struct sockaddr_in *) addr)->sin_addr;
528 i->port = ((struct sockaddr_in *) addr)->sin_port;
529 break;
530 default:
531 goto skip;
532 }
533 if (address->protocol == SOCK_RAW)
534 i->port = htons(port);
535 return tomoyo_inet_entry(address);
536skip:
537 return 0;
538}
539
540/**
541 * tomoyo_unix_entry - Check permission for UNIX network operation.
542 *
543 * @address: Pointer to "struct tomoyo_addr_info".
544 *
545 * Returns 0 on success, negative value otherwise.
546 */
547static int tomoyo_unix_entry(const struct tomoyo_addr_info *address)
548{
549 const int idx = tomoyo_read_lock();
550 struct tomoyo_request_info r;
551 int error = 0;
552 const u8 type = tomoyo_unix2mac[address->protocol][address->operation];
553
554 if (type && tomoyo_init_request_info(&r, NULL, type)
555 != TOMOYO_CONFIG_DISABLED) {
556 char *buf = address->unix0.addr;
557 int len = address->unix0.addr_len - sizeof(sa_family_t);
558
559 if (len <= 0) {
560 buf = "anonymous";
561 len = 9;
562 } else if (buf[0]) {
563 len = strnlen(buf, len);
564 }
565 buf = tomoyo_encode2(buf, len);
566 if (buf) {
567 struct tomoyo_path_info addr;
568
569 addr.name = buf;
570 tomoyo_fill_path_info(&addr);
571 r.param_type = TOMOYO_TYPE_UNIX_ACL;
572 r.param.unix_network.protocol = address->protocol;
573 r.param.unix_network.operation = address->operation;
574 r.param.unix_network.address = &addr;
575 do {
576 tomoyo_check_acl(&r, tomoyo_check_unix_acl);
577 error = tomoyo_audit_unix_log(&r);
578 } while (error == TOMOYO_RETRY_REQUEST);
579 kfree(buf);
580 } else
581 error = -ENOMEM;
582 }
583 tomoyo_read_unlock(idx);
584 return error;
585}
586
587/**
588 * tomoyo_check_unix_address - Check permission for unix domain socket's operation.
589 *
590 * @addr: Pointer to "struct sockaddr".
591 * @addr_len: Size of @addr.
592 * @address: Pointer to "struct tomoyo_addr_info".
593 *
594 * Returns 0 on success, negative value otherwise.
595 */
596static int tomoyo_check_unix_address(struct sockaddr *addr,
597 const unsigned int addr_len,
598 struct tomoyo_addr_info *address)
599{
600 struct tomoyo_unix_addr_info *u = &address->unix0;
601
602 if (addr_len < offsetofend(struct sockaddr, sa_family))
603 return 0;
604 if (addr->sa_family != AF_UNIX)
605 return 0;
606 u->addr = ((struct sockaddr_un *) addr)->sun_path;
607 u->addr_len = addr_len;
608 return tomoyo_unix_entry(address);
609}
610
611/**
612 * tomoyo_kernel_service - Check whether I'm kernel service or not.
613 *
614 * Returns true if I'm kernel service, false otherwise.
615 */
616static bool tomoyo_kernel_service(void)
617{
618 /* Nothing to do if I am a kernel service. */
619 return current->flags & PF_KTHREAD;
620}
621
622/**
623 * tomoyo_sock_family - Get socket's family.
624 *
625 * @sk: Pointer to "struct sock".
626 *
627 * Returns one of PF_INET, PF_INET6, PF_UNIX or 0.
628 */
629static u8 tomoyo_sock_family(struct sock *sk)
630{
631 u8 family;
632
633 if (tomoyo_kernel_service())
634 return 0;
635 family = sk->sk_family;
636 switch (family) {
637 case PF_INET:
638 case PF_INET6:
639 case PF_UNIX:
640 return family;
641 default:
642 return 0;
643 }
644}
645
646/**
647 * tomoyo_socket_listen_permission - Check permission for listening a socket.
648 *
649 * @sock: Pointer to "struct socket".
650 *
651 * Returns 0 on success, negative value otherwise.
652 */
653int tomoyo_socket_listen_permission(struct socket *sock)
654{
655 struct tomoyo_addr_info address;
656 const u8 family = tomoyo_sock_family(sock->sk);
657 const unsigned int type = sock->type;
658 struct sockaddr_storage addr;
659 int addr_len;
660
661 if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET))
662 return 0;
663 {
664 const int error = sock->ops->getname(sock, (struct sockaddr *)
665 &addr, 0);
666
667 if (error < 0)
668 return error;
669 addr_len = error;
670 }
671 address.protocol = type;
672 address.operation = TOMOYO_NETWORK_LISTEN;
673 if (family == PF_UNIX)
674 return tomoyo_check_unix_address((struct sockaddr *) &addr,
675 addr_len, &address);
676 return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len,
677 0, &address);
678}
679
680/**
681 * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket.
682 *
683 * @sock: Pointer to "struct socket".
684 * @addr: Pointer to "struct sockaddr".
685 * @addr_len: Size of @addr.
686 *
687 * Returns 0 on success, negative value otherwise.
688 */
689int tomoyo_socket_connect_permission(struct socket *sock,
690 struct sockaddr *addr, int addr_len)
691{
692 struct tomoyo_addr_info address;
693 const u8 family = tomoyo_sock_family(sock->sk);
694 const unsigned int type = sock->type;
695
696 if (!family)
697 return 0;
698 address.protocol = type;
699 switch (type) {
700 case SOCK_DGRAM:
701 case SOCK_RAW:
702 address.operation = TOMOYO_NETWORK_SEND;
703 break;
704 case SOCK_STREAM:
705 case SOCK_SEQPACKET:
706 address.operation = TOMOYO_NETWORK_CONNECT;
707 break;
708 default:
709 return 0;
710 }
711 if (family == PF_UNIX)
712 return tomoyo_check_unix_address(addr, addr_len, &address);
713 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
714 &address);
715}
716
717/**
718 * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket.
719 *
720 * @sock: Pointer to "struct socket".
721 * @addr: Pointer to "struct sockaddr".
722 * @addr_len: Size of @addr.
723 *
724 * Returns 0 on success, negative value otherwise.
725 */
726int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
727 int addr_len)
728{
729 struct tomoyo_addr_info address;
730 const u8 family = tomoyo_sock_family(sock->sk);
731 const unsigned int type = sock->type;
732
733 if (!family)
734 return 0;
735 switch (type) {
736 case SOCK_STREAM:
737 case SOCK_DGRAM:
738 case SOCK_RAW:
739 case SOCK_SEQPACKET:
740 address.protocol = type;
741 address.operation = TOMOYO_NETWORK_BIND;
742 break;
743 default:
744 return 0;
745 }
746 if (family == PF_UNIX)
747 return tomoyo_check_unix_address(addr, addr_len, &address);
748 return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
749 &address);
750}
751
752/**
753 * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram.
754 *
755 * @sock: Pointer to "struct socket".
756 * @msg: Pointer to "struct msghdr".
757 * @size: Unused.
758 *
759 * Returns 0 on success, negative value otherwise.
760 */
761int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
762 int size)
763{
764 struct tomoyo_addr_info address;
765 const u8 family = tomoyo_sock_family(sock->sk);
766 const unsigned int type = sock->type;
767
768 if (!msg->msg_name || !family ||
769 (type != SOCK_DGRAM && type != SOCK_RAW))
770 return 0;
771 address.protocol = type;
772 address.operation = TOMOYO_NETWORK_SEND;
773 if (family == PF_UNIX)
774 return tomoyo_check_unix_address((struct sockaddr *)
775 msg->msg_name,
776 msg->msg_namelen, &address);
777 return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name,
778 msg->msg_namelen,
779 sock->sk->sk_protocol, &address);
780}