mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-17 10:46:33 +00:00
8b985bbfab
One of concerns for enabling TOMOYO in prebuilt kernels is that distributor wants to avoid bloating kernel packages. Although boot-time kernel command line options allows selecting built-in LSMs to enable, file size increase of vmlinux and memory footprint increase of vmlinux caused by builtin-but- not-enabled LSMs remains. If it becomes possible to make LSMs dynamically appendable after boot using loadable kernel modules, these problems will go away. Another of concerns for enabling TOMOYO in prebuilt kernels is that who can provide support when distributor cannot provide support. Due to "those who compiled kernel code is expected to provide support for that kernel code" spell, TOMOYO is failing to get enabled in Fedora distribution [1]. The point of loadable kernel module is to share the workload. If it becomes possible to make LSMs dynamically appendable after boot using loadable kernel modules, as with people can use device drivers not supported by distributors but provided by third party device vendors, we can break this spell and can lower the barrier for using TOMOYO. This patch is intended for demonstrating that there is nothing difficult for supporting TOMOYO-like loadable LSM modules. For now we need to live with a mixture of built-in part and loadable part because fully loadable LSM modules are not supported since Linux 2.6.24 [2] and number of LSMs which can reserve static call slots is determined at compile time in Linux 6.12. Major changes in this patch are described below. There are no behavior changes as long as TOMOYO is built into vmlinux. Add CONFIG_SECURITY_TOMOYO_LKM as "bool" instead of changing CONFIG_SECURITY_TOMOYO from "bool" to "tristate", for something went wrong with how Makefile is evaluated if I choose "tristate". Add proxy.c for serving as a bridge between vmlinux and tomoyo.ko . Move callback functions from init.c to proxy.c when building as a loadable LSM module. init.c is built-in part and remains for reserving static call slots. proxy.c contains module's init function and tells init.c location of callback functions, making it possible to use static call for tomoyo.ko . By deferring initialization of "struct tomoyo_task" until tomoyo.ko is loaded, threads created between init.c reserved LSM hooks and proxy.c updates LSM hooks will have NULL "struct tomoyo_task" instances. Assuming that tomoyo.ko is loaded by the moment when the global init process starts, initialize "struct tomoyo_task" instance for current thread as a kernel thread when tomoyo_task(current) is called for the first time. There is a hack for exporting currently not-exported functions. This hack will be removed after all relevant functions are exported. Link: https://bugzilla.redhat.com/show_bug.cgi?id=542986 [1] Link: https://lkml.kernel.org/r/caafb609-8bef-4840-a080-81537356fc60@I-love.SAKURA.ne.jp [2] Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
123 lines
2.9 KiB
C
123 lines
2.9 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* security/tomoyo/load_policy.c
|
|
*
|
|
* Copyright (C) 2005-2011 NTT DATA CORPORATION
|
|
*/
|
|
|
|
#include "common.h"
|
|
|
|
#ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER
|
|
|
|
/*
|
|
* Path to the policy loader. (default = CONFIG_SECURITY_TOMOYO_POLICY_LOADER)
|
|
*/
|
|
static const char *tomoyo_loader;
|
|
|
|
/**
|
|
* tomoyo_loader_setup - Set policy loader.
|
|
*
|
|
* @str: Program to use as a policy loader (e.g. /sbin/tomoyo-init ).
|
|
*
|
|
* Returns 0.
|
|
*/
|
|
static int __init tomoyo_loader_setup(char *str)
|
|
{
|
|
tomoyo_loader = str;
|
|
return 1;
|
|
}
|
|
|
|
__setup("TOMOYO_loader=", tomoyo_loader_setup);
|
|
|
|
/**
|
|
* tomoyo_policy_loader_exists - Check whether /sbin/tomoyo-init exists.
|
|
*
|
|
* Returns true if /sbin/tomoyo-init exists, false otherwise.
|
|
*/
|
|
static bool tomoyo_policy_loader_exists(void)
|
|
{
|
|
struct path path;
|
|
|
|
if (!tomoyo_loader)
|
|
tomoyo_loader = CONFIG_SECURITY_TOMOYO_POLICY_LOADER;
|
|
if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
|
|
pr_info("Not activating Mandatory Access Control as %s does not exist.\n",
|
|
tomoyo_loader);
|
|
return false;
|
|
}
|
|
path_put(&path);
|
|
return true;
|
|
}
|
|
|
|
/*
|
|
* Path to the trigger. (default = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER)
|
|
*/
|
|
static const char *tomoyo_trigger;
|
|
|
|
/**
|
|
* tomoyo_trigger_setup - Set trigger for activation.
|
|
*
|
|
* @str: Program to use as an activation trigger (e.g. /sbin/init ).
|
|
*
|
|
* Returns 0.
|
|
*/
|
|
static int __init tomoyo_trigger_setup(char *str)
|
|
{
|
|
tomoyo_trigger = str;
|
|
return 1;
|
|
}
|
|
|
|
__setup("TOMOYO_trigger=", tomoyo_trigger_setup);
|
|
|
|
/**
|
|
* tomoyo_load_policy - Run external policy loader to load policy.
|
|
*
|
|
* @filename: The program about to start.
|
|
*
|
|
* This function checks whether @filename is /sbin/init , and if so
|
|
* invoke /sbin/tomoyo-init and wait for the termination of /sbin/tomoyo-init
|
|
* and then continues invocation of /sbin/init.
|
|
* /sbin/tomoyo-init reads policy files in /etc/tomoyo/ directory and
|
|
* writes to /sys/kernel/security/tomoyo/ interfaces.
|
|
*
|
|
* Returns nothing.
|
|
*/
|
|
void tomoyo_load_policy(const char *filename)
|
|
{
|
|
static bool done;
|
|
char *argv[2];
|
|
char *envp[3];
|
|
|
|
if (tomoyo_policy_loaded || done)
|
|
return;
|
|
if (!tomoyo_trigger)
|
|
tomoyo_trigger = CONFIG_SECURITY_TOMOYO_ACTIVATION_TRIGGER;
|
|
if (strcmp(filename, tomoyo_trigger))
|
|
return;
|
|
if (!tomoyo_policy_loader_exists())
|
|
return;
|
|
done = true;
|
|
#ifdef CONFIG_SECURITY_TOMOYO_LKM
|
|
/* Load tomoyo.ko if not yet loaded. */
|
|
if (!tomoyo_ops.check_profile)
|
|
request_module("tomoyo");
|
|
/* Check if tomoyo.ko was successfully loaded. */
|
|
if (!tomoyo_ops.check_profile)
|
|
panic("Failed to load tomoyo module.");
|
|
#endif
|
|
pr_info("Calling %s to load policy. Please wait.\n", tomoyo_loader);
|
|
argv[0] = (char *) tomoyo_loader;
|
|
argv[1] = NULL;
|
|
envp[0] = "HOME=/";
|
|
envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
|
|
envp[2] = NULL;
|
|
call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
|
|
#ifdef CONFIG_SECURITY_TOMOYO_LKM
|
|
tomoyo_ops.check_profile();
|
|
#else
|
|
tomoyo_check_profile();
|
|
#endif
|
|
}
|
|
|
|
#endif
|