niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

Redo of pathname patternization and fix spelling errors.

Browse source 
Tetsuo Handa (3):
   tomoyo: use better patterns for procfs in learning mode
   tomoyo: fix spelling errors
 
 Tanya Agarwal (1):
   tomoyo: fix spelling error
 
  security/tomoyo/common.c        |  145 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------------------
  security/tomoyo/domain.c        |    2 -
  security/tomoyo/securityfs_if.c |    6 +--
  security/tomoyo/tomoyo.c        |    5 --
  4 files changed, 117 insertions(+), 41 deletions(-)
 -----BEGIN PGP SIGNATURE-----
 
 iQJXBAABCABBFiEEQ8gzaWI9etOpbC/HQl8SjQxk9SoFAmerSHojHHBlbmd1aW4t
 a2VybmVsQGktbG92ZS5zYWt1cmEubmUuanAACgkQQl8SjQxk9Sreeg/+KHl8qDxi
 eLbml7ihosJ+qOJhCdHgsboNqoIrPFS7fp89YLwOBoBBsvT1zbqwcKJhAU0bAlFt
 bDHcKnt0anrokzxAhajVlikmnKP4CeW/fFf4m2UXJ7/uYinoYyizutqsduthF6G9
 MwxCpSnReOKsys8tVZyBtCNk53vKk6o0I1GGZ56GG7fNOz6UR81z8mUhJRcqj9Gk
 0gqdfC8RLNbXbygOHbZINM3TUmn/MW9E/ALRU+a1Ay+9ZazJE26R87N7/O7ksDB3
 LGB1OZ6eEJkCMJm583wa2AdmUdaT5DPv7PWVEYkPjFkYjQzPO4GuBONPJHsElM1O
 OybzMuQKlWqMWvFwky7wbUNaKkxqXNm9BVCg1tdbuQubB6moZSUjcZTM4SXnSD5K
 Vn5AGfgLHMJ5nC576ZbyAARYdo3I0ffkv1Ql8sUio3giybLw+QFika1dpQrVupka
 fWZxj3znJXP0sNpunb9ffOMlf92jj/XD9382bBNUbR/aEP50YwvYnAfWek1+H4YI
 kVDFiCb3PVx1pwfJjKezcsN1Rp0JXRFXMDcd0Pm7n0vCs3MdWwJ44/xUICBs/UR2
 B/+ocCQykQDgMYW9LC9fZnZ+A0KfhLJpUNjqX+B2pQR3Cyr51l+BY8QyUlBL3Eci
 XQyX+dqDdh0L7dXyBjowYGvo9cEJ6aNkwQ8=
 =cPFI
 -----END PGP SIGNATURE-----

Merge tag 'tomoyo-pr-20250211' of git://git.code.sf.net/p/tomoyo/tomoyo

Pull tomoyo fixes from Tetsuo Handa:
 "Redo of pathname patternization and fix spelling errors"

* tag 'tomoyo-pr-20250211' of git://git.code.sf.net/p/tomoyo/tomoyo:
  tomoyo: use better patterns for procfs in learning mode
  tomoyo: fix spelling errors
  tomoyo: fix spelling error
This commit is contained in:
Linus Torvalds 2025-02-11 10:19:36 -08:00
commit 09fbf3d502
4 changed files with 117 additions and 41 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

145
security/tomoyo/common.c
View file

@ -1980,6 +1980,114 @@ static int tomoyo_truncate(char *str)
return strlen(start) + 1;
}
/**
* tomoyo_numscan - sscanf() which stores the length of a decimal integer value.
*
* @str: String to scan.
* @head: Leading string that must start with.
* @width: Pointer to "int" for storing length of a decimal integer value after @head.
* @tail: Optional character that must match after a decimal integer value.
*
* Returns whether @str starts with @head and a decimal value follows @head.
*/
static bool tomoyo_numscan(const char *str, const char *head, int *width, const char tail)
{
const char *cp;
const int n = strlen(head);
if (!strncmp(str, head, n)) {
cp = str + n;
while (*cp && *cp >= '0' && *cp <= '9')
cp++;
if (*cp == tail || !tail) {
*width = cp - (str + n);
return *width != 0;
}
}
*width = 0;
return 0;
}
/**
* tomoyo_patternize_path - Make patterns for file path. Used by learning mode.
*
* @buffer: Destination buffer.
* @len: Size of @buffer.
* @entry: Original line.
*
* Returns nothing.
*/
static void tomoyo_patternize_path(char *buffer, const int len, char *entry)
{
int width;
char *cp = entry;
/* Nothing to do if this line is not for "file" related entry. */
if (strncmp(entry, "file ", 5))
goto flush;
/*
* Nothing to do if there is no colon in this line, for this rewriting
* applies to only filesystems where numeric values in the path are volatile.
*/
cp = strchr(entry + 5, ':');
if (!cp) {
cp = entry;
goto flush;
}
/* Flush e.g. "file ioctl" part. */
while (*cp != ' ')
cp--;
*cp++ = '\0';
tomoyo_addprintf(buffer, len, "%s ", entry);
/* e.g. file ioctl pipe:[$INO] $CMD */
if (tomoyo_numscan(cp, "pipe:[", &width, ']')) {
cp += width + 7;
tomoyo_addprintf(buffer, len, "pipe:[\\$]");
goto flush;
}
/* e.g. file ioctl socket:[$INO] $CMD */
if (tomoyo_numscan(cp, "socket:[", &width, ']')) {
cp += width + 9;
tomoyo_addprintf(buffer, len, "socket:[\\$]");
goto flush;
}
if (!strncmp(cp, "proc:/self", 10)) {
/* e.g. file read proc:/self/task/$TID/fdinfo/$FD */
cp += 10;
tomoyo_addprintf(buffer, len, "proc:/self");
} else if (tomoyo_numscan(cp, "proc:/", &width, 0)) {
/* e.g. file read proc:/$PID/task/$TID/fdinfo/$FD */
/*
* Don't patternize $PID part if $PID == 1, for several
* programs access only files in /proc/1/ directory.
*/
cp += width + 6;
if (width == 1 && *(cp - 1) == '1')
tomoyo_addprintf(buffer, len, "proc:/1");
else
tomoyo_addprintf(buffer, len, "proc:/\\$");
} else {
goto flush;
}
/* Patternize $TID part if "/task/" follows. */
if (tomoyo_numscan(cp, "/task/", &width, 0)) {
cp += width + 6;
tomoyo_addprintf(buffer, len, "/task/\\$");
}
/* Patternize $FD part if "/fd/" or "/fdinfo/" follows. */
if (tomoyo_numscan(cp, "/fd/", &width, 0)) {
cp += width + 4;
tomoyo_addprintf(buffer, len, "/fd/\\$");
} else if (tomoyo_numscan(cp, "/fdinfo/", &width, 0)) {
cp += width + 8;
tomoyo_addprintf(buffer, len, "/fdinfo/\\$");
}
flush:
/* Flush remaining part if any. */
if (*cp)
tomoyo_addprintf(buffer, len, "%s", cp);
}
/**
* tomoyo_add_entry - Add an ACL to current thread's domain. Used by learning mode.
*
@ -2003,7 +2111,8 @@ static void tomoyo_add_entry(struct tomoyo_domain_info *domain, char *header)
if (!cp)
return;
*cp++ = '\0';
len = strlen(cp) + 1;
/* Reserve some space for potentially using patterns. */
len = strlen(cp) + 16;
/* strstr() will return NULL if ordering is wrong. */
if (*cp == 'f') {
argv0 = strstr(header, " argv[]={ \"");
@ -2020,40 +2129,10 @@ static void tomoyo_add_entry(struct tomoyo_domain_info *domain, char *header)
if (symlink)
len += tomoyo_truncate(symlink + 1) + 1;
}
buffer = kmalloc(len, GFP_NOFS);
buffer = kmalloc(len, GFP_NOFS | __GFP_ZERO);
if (!buffer)
return;
snprintf(buffer, len - 1, "%s", cp);
if (*cp == 'f' && strchr(buffer, ':')) {
/* Automatically replace 2 or more digits with \$ pattern. */
char *cp2;
/* e.g. file read proc:/$PID/stat */
cp = strstr(buffer, " proc:/");
if (cp && simple_strtoul(cp + 7, &cp2, 10) >= 10 && *cp2 == '/') {
*(cp + 7) = '\\';
*(cp + 8) = '$';
memmove(cp + 9, cp2, strlen(cp2) + 1);
goto ok;
}
/* e.g. file ioctl pipe:[$INO] $CMD */
cp = strstr(buffer, " pipe:[");
if (cp && simple_strtoul(cp + 7, &cp2, 10) >= 10 && *cp2 == ']') {
*(cp + 7) = '\\';
*(cp + 8) = '$';
memmove(cp + 9, cp2, strlen(cp2) + 1);
goto ok;
}
/* e.g. file ioctl socket:[$INO] $CMD */
cp = strstr(buffer, " socket:[");
if (cp && simple_strtoul(cp + 9, &cp2, 10) >= 10 && *cp2 == ']') {
*(cp + 9) = '\\';
*(cp + 10) = '$';
memmove(cp + 11, cp2, strlen(cp2) + 1);
goto ok;
}
}
ok:
tomoyo_patternize_path(buffer, len, cp);
if (realpath)
tomoyo_addprintf(buffer, len, " exec.%s", realpath);
if (argv0)

2
security/tomoyo/domain.c
View file

@ -920,7 +920,7 @@ bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
#ifdef CONFIG_MMU
/*
* This is called at execve() time in order to dig around
* in the argv/environment of the new proceess
* in the argv/environment of the new process
* (represented by bprm).
*/
mmap_read_lock(bprm->mm);

6
security/tomoyo/securityfs_if.c
View file

@ -229,11 +229,11 @@ static void __init tomoyo_create_entry(const char *name, const umode_t mode,
}
/**
* tomoyo_initerface_init - Initialize /sys/kernel/security/tomoyo/ interface.
* tomoyo_interface_init - Initialize /sys/kernel/security/tomoyo/ interface.
*
* Returns 0.
*/
static int __init tomoyo_initerface_init(void)
static int __init tomoyo_interface_init(void)
{
struct tomoyo_domain_info *domain;
struct dentry *tomoyo_dir;
@ -270,4 +270,4 @@ static int __init tomoyo_initerface_init(void)
return 0;
}
fs_initcall(tomoyo_initerface_init);
fs_initcall(tomoyo_interface_init);

5
security/tomoyo/tomoyo.c
View file

@ -549,10 +549,7 @@ static const struct lsm_id tomoyo_lsmid = {
.id = LSM_ID_TOMOYO,
};
/*
* tomoyo_security_ops is a "struct security_operations" which is used for
* registering TOMOYO.
*/
/* tomoyo_hooks is used for registering TOMOYO. */
static struct security_hook_list tomoyo_hooks[] __ro_after_init = {
LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare),
LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds),