f743324377
DAC's permissions and TOMOYO's permissions are not one-to-one mapping.
Regarding DAC, there are "read", "write", "execute" permissions.
Regarding TOMOYO, there are "allow_read", "allow_write", "allow_read/write",
"allow_execute", "allow_create", "allow_unlink", "allow_mkdir", "allow_rmdir",
"allow_mkfifo", "allow_mksock", "allow_mkblock", "allow_mkchar",
"allow_truncate", "allow_symlink", "allow_rewrite", "allow_link",
"allow_rename" permissions.
+----------------------------------+----------------------------------+
| requested operation | required TOMOYO's permission |
+----------------------------------+----------------------------------+
| sys_open(O_RDONLY) | allow_read |
+----------------------------------+----------------------------------+
| sys_open(O_WRONLY) | allow_write |
+----------------------------------+----------------------------------+
| sys_open(O_RDWR) | allow_read/write |
+----------------------------------+----------------------------------+
| open_exec() from do_execve() | allow_execute |
+----------------------------------+----------------------------------+
| open_exec() from !do_execve() | allow_read |
+----------------------------------+----------------------------------+
| sys_read() | (none) |
+----------------------------------+----------------------------------+
| sys_write() | (none) |
+----------------------------------+----------------------------------+
| sys_mmap() | (none) |
+----------------------------------+----------------------------------+
| sys_uselib() | allow_read |
+----------------------------------+----------------------------------+
| sys_open(O_CREAT) | allow_create |
+----------------------------------+----------------------------------+
| sys_open(O_TRUNC) | allow_truncate |
+----------------------------------+----------------------------------+
| sys_truncate() | allow_truncate |
+----------------------------------+----------------------------------+
| sys_ftruncate() | allow_truncate |
+----------------------------------+----------------------------------+
| sys_open() without O_APPEND | allow_rewrite |
+----------------------------------+----------------------------------+
| setfl() without O_APPEND | allow_rewrite |
+----------------------------------+----------------------------------+
| sys_sysctl() for writing | allow_write |
+----------------------------------+----------------------------------+
| sys_sysctl() for reading | allow_read |
+----------------------------------+----------------------------------+
| sys_unlink() | allow_unlink |
+----------------------------------+----------------------------------+
| sys_mknod(S_IFREG) | allow_create |
+----------------------------------+----------------------------------+
| sys_mknod(0) | allow_create |
+----------------------------------+----------------------------------+
| sys_mknod(S_IFIFO) | allow_mkfifo |
+----------------------------------+----------------------------------+
| sys_mknod(S_IFSOCK) | allow_mksock |
+----------------------------------+----------------------------------+
| sys_bind(AF_UNIX) | allow_mksock |
+----------------------------------+----------------------------------+
| sys_mknod(S_IFBLK) | allow_mkblock |
+----------------------------------+----------------------------------+
| sys_mknod(S_IFCHR) | allow_mkchar |
+----------------------------------+----------------------------------+
| sys_symlink() | allow_symlink |
+----------------------------------+----------------------------------+
| sys_mkdir() | allow_mkdir |
+----------------------------------+----------------------------------+
| sys_rmdir() | allow_rmdir |
+----------------------------------+----------------------------------+
| sys_link() | allow_link |
+----------------------------------+----------------------------------+
| sys_rename() | allow_rename |
+----------------------------------+----------------------------------+
TOMOYO requires "allow_execute" permission of a pathname passed to do_execve()
but does not require "allow_read" permission of that pathname.
Let's consider 3 patterns (statically linked, dynamically linked,
shell script). This description is to some degree simplified.
$ cat hello.c
#include <stdio.h>
int main() {
printf("Hello\n");
return 0;
}
$ cat hello.sh
#! /bin/sh
echo "Hello"
$ gcc -static -o hello-static hello.c
$ gcc -o hello-dynamic hello.c
$ chmod 755 hello.sh
Case 1 -- Executing hello-static from bash.
(1) The bash process calls fork() and the child process requests
do_execve("hello-static").
(2) The kernel checks "allow_execute hello-static" from "bash" domain.
(3) The kernel calculates "bash hello-static" as the domain to transit to.
(4) The kernel overwrites the child process by "hello-static".
(5) The child process transits to "bash hello-static" domain.
(6) The "hello-static" starts and finishes.
Case 2 -- Executing hello-dynamic from bash.
(1) The bash process calls fork() and the child process requests
do_execve("hello-dynamic").
(2) The kernel checks "allow_execute hello-dynamic" from "bash" domain.
(3) The kernel calculates "bash hello-dynamic" as the domain to transit to.
(4) The kernel checks "allow_read ld-linux.so" from "bash hello-dynamic"
domain. I think permission to access ld-linux.so should be charged
hello-dynamic program, for "hello-dynamic needs ld-linux.so" is not
a fault of bash program.
(5) The kernel overwrites the child process by "hello-dynamic".
(6) The child process transits to "bash hello-dynamic" domain.
(7) The "hello-dynamic" starts and finishes.
Case 3 -- Executing hello.sh from bash.
(1) The bash process calls fork() and the child process requests
do_execve("hello.sh").
(2) The kernel checks "allow_execute hello.sh" from "bash" domain.
(3) The kernel calculates "bash hello.sh" as the domain to transit to.
(4) The kernel checks "allow_read /bin/sh" from "bash hello.sh" domain.
I think permission to access /bin/sh should be charged hello.sh program,
for "hello.sh needs /bin/sh" is not a fault of bash program.
(5) The kernel overwrites the child process by "/bin/sh".
(6) The child process transits to "bash hello.sh" domain.
(7) The "/bin/sh" requests open("hello.sh").
(8) The kernel checks "allow_read hello.sh" from "bash hello.sh" domain.
(9) The "/bin/sh" starts and finishes.
Whether a file is interpreted as a program or not depends on an application.
The kernel cannot know whether the file is interpreted as a program or not.
Thus, TOMOYO treats "hello-static" "hello-dynamic" "ld-linux.so" "hello.sh"
"/bin/sh" equally as merely files; no distinction between executable and
non-executable. Therefore, TOMOYO doesn't check DAC's execute permission.
TOMOYO checks "allow_read" permission instead.
Calling do_execve() is a bold gesture that an old program's instance (i.e.
current process) is ready to be overwritten by a new program and is ready to
transfer control to the new program. To split purview of programs, TOMOYO
requires "allow_execute" permission of the new program against the old
program's instance and performs domain transition. If do_execve() succeeds,
the old program is no longer responsible against the consequence of the new
program's behavior. Only the new program is responsible for all consequences.
But TOMOYO doesn't require "allow_read" permission of the new program.
If TOMOYO requires "allow_read" permission of the new program, TOMOYO will
allow an attacker (who hijacked the old program's instance) to open the new
program and steal data from the new program. Requiring "allow_read" permission
will widen purview of the old program.
Not requiring "allow_read" permission of the new program against the old
program's instance is my design for reducing purview of the old program.
To be able to know whether the current process is in do_execve() or not,
I want to add in_execve flag to "task_struct".
Signed-off-by: Kentaro Takeda <takedakn@nttdata.co.jp>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Toshiharu Harada <haradats@nttdata.co.jp>
Signed-off-by: James Morris <jmorris@namei.org>
106 lines
3.4 KiB
C
106 lines
3.4 KiB
C
/*
|
|
* security/tomoyo/tomoyo.h
|
|
*
|
|
* Implementation of the Domain-Based Mandatory Access Control.
|
|
*
|
|
* Copyright (C) 2005-2009 NTT DATA CORPORATION
|
|
*
|
|
* Version: 2.2.0-pre 2009/02/01
|
|
*
|
|
*/
|
|
|
|
#ifndef _SECURITY_TOMOYO_TOMOYO_H
|
|
#define _SECURITY_TOMOYO_TOMOYO_H
|
|
|
|
struct tomoyo_path_info;
|
|
struct path;
|
|
struct inode;
|
|
struct linux_binprm;
|
|
struct pt_regs;
|
|
struct tomoyo_page_buffer;
|
|
|
|
int tomoyo_check_file_perm(struct tomoyo_domain_info *domain,
|
|
const char *filename, const u8 perm);
|
|
int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain,
|
|
const struct tomoyo_path_info *filename,
|
|
struct tomoyo_page_buffer *buf);
|
|
int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
|
|
struct path *path, const int flag);
|
|
int tomoyo_check_1path_perm(struct tomoyo_domain_info *domain,
|
|
const u8 operation, struct path *path);
|
|
int tomoyo_check_2path_perm(struct tomoyo_domain_info *domain,
|
|
const u8 operation, struct path *path1,
|
|
struct path *path2);
|
|
int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain,
|
|
struct file *filp);
|
|
int tomoyo_find_next_domain(struct linux_binprm *bprm,
|
|
struct tomoyo_domain_info **next_domain);
|
|
|
|
/* Index numbers for Access Controls. */
|
|
|
|
#define TOMOYO_TYPE_SINGLE_PATH_ACL 0
|
|
#define TOMOYO_TYPE_DOUBLE_PATH_ACL 1
|
|
|
|
/* Index numbers for File Controls. */
|
|
|
|
/*
|
|
* TYPE_READ_WRITE_ACL is special. TYPE_READ_WRITE_ACL is automatically set
|
|
* if both TYPE_READ_ACL and TYPE_WRITE_ACL are set. Both TYPE_READ_ACL and
|
|
* TYPE_WRITE_ACL are automatically set if TYPE_READ_WRITE_ACL is set.
|
|
* TYPE_READ_WRITE_ACL is automatically cleared if either TYPE_READ_ACL or
|
|
* TYPE_WRITE_ACL is cleared. Both TYPE_READ_ACL and TYPE_WRITE_ACL are
|
|
* automatically cleared if TYPE_READ_WRITE_ACL is cleared.
|
|
*/
|
|
|
|
#define TOMOYO_TYPE_READ_WRITE_ACL 0
|
|
#define TOMOYO_TYPE_EXECUTE_ACL 1
|
|
#define TOMOYO_TYPE_READ_ACL 2
|
|
#define TOMOYO_TYPE_WRITE_ACL 3
|
|
#define TOMOYO_TYPE_CREATE_ACL 4
|
|
#define TOMOYO_TYPE_UNLINK_ACL 5
|
|
#define TOMOYO_TYPE_MKDIR_ACL 6
|
|
#define TOMOYO_TYPE_RMDIR_ACL 7
|
|
#define TOMOYO_TYPE_MKFIFO_ACL 8
|
|
#define TOMOYO_TYPE_MKSOCK_ACL 9
|
|
#define TOMOYO_TYPE_MKBLOCK_ACL 10
|
|
#define TOMOYO_TYPE_MKCHAR_ACL 11
|
|
#define TOMOYO_TYPE_TRUNCATE_ACL 12
|
|
#define TOMOYO_TYPE_SYMLINK_ACL 13
|
|
#define TOMOYO_TYPE_REWRITE_ACL 14
|
|
#define TOMOYO_MAX_SINGLE_PATH_OPERATION 15
|
|
|
|
#define TOMOYO_TYPE_LINK_ACL 0
|
|
#define TOMOYO_TYPE_RENAME_ACL 1
|
|
#define TOMOYO_MAX_DOUBLE_PATH_OPERATION 2
|
|
|
|
#define TOMOYO_DOMAINPOLICY 0
|
|
#define TOMOYO_EXCEPTIONPOLICY 1
|
|
#define TOMOYO_DOMAIN_STATUS 2
|
|
#define TOMOYO_PROCESS_STATUS 3
|
|
#define TOMOYO_MEMINFO 4
|
|
#define TOMOYO_SELFDOMAIN 5
|
|
#define TOMOYO_VERSION 6
|
|
#define TOMOYO_PROFILE 7
|
|
#define TOMOYO_MANAGER 8
|
|
|
|
extern struct tomoyo_domain_info tomoyo_kernel_domain;
|
|
|
|
static inline struct tomoyo_domain_info *tomoyo_domain(void)
|
|
{
|
|
return current_cred()->security;
|
|
}
|
|
|
|
/* Caller holds tasklist_lock spinlock. */
|
|
static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct
|
|
*task)
|
|
{
|
|
/***** CRITICAL SECTION START *****/
|
|
const struct cred *cred = get_task_cred(task);
|
|
struct tomoyo_domain_info *domain = cred->security;
|
|
|
|
put_cred(cred);
|
|
return domain;
|
|
/***** CRITICAL SECTION END *****/
|
|
}
|
|
|
|
#endif /* !defined(_SECURITY_TOMOYO_TOMOYO_H) */
|