security/tomoyo/network.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * security/tomoyo/network.c
0004  *
0005  * Copyright (C) 2005-2011  NTT DATA CORPORATION
0006  */
0007
0008 #include "common.h"
0009 #include <linux/slab.h>
0010
0011 /* Structure for holding inet domain socket's address. */
0012 struct tomoyo_inet_addr_info {
0013     __be16 port;           /* In network byte order. */
0014     const __be32 *address; /* In network byte order. */
0015     bool is_ipv6;
0016 };
0017
0018 /* Structure for holding unix domain socket's address. */
0019 struct tomoyo_unix_addr_info {
0020     u8 *addr; /* This may not be '\0' terminated string. */
0021     unsigned int addr_len;
0022 };
0023
0024 /* Structure for holding socket address. */
0025 struct tomoyo_addr_info {
0026     u8 protocol;
0027     u8 operation;
0028     struct tomoyo_inet_addr_info inet;
0029     struct tomoyo_unix_addr_info unix0;
0030 };
0031
0032 /* String table for socket's protocols. */
0033 const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX] = {
0034     [SOCK_STREAM]    = "stream",
0035     [SOCK_DGRAM]     = "dgram",
0036     [SOCK_RAW]       = "raw",
0037     [SOCK_SEQPACKET] = "seqpacket",
0038     [0] = " ", /* Dummy for avoiding NULL pointer dereference. */
0039     [4] = " ", /* Dummy for avoiding NULL pointer dereference. */
0040 };
0041
0042 /**
0043  * tomoyo_parse_ipaddr_union - Parse an IP address.
0044  *
0045  * @param: Pointer to "struct tomoyo_acl_param".
0046  * @ptr:   Pointer to "struct tomoyo_ipaddr_union".
0047  *
0048  * Returns true on success, false otherwise.
0049  */
0050 bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
0051                    struct tomoyo_ipaddr_union *ptr)
0052 {
0053     u8 * const min = ptr->ip[0].in6_u.u6_addr8;
0054     u8 * const max = ptr->ip[1].in6_u.u6_addr8;
0055     char *address = tomoyo_read_token(param);
0056     const char *end;
0057
0058     if (!strchr(address, ':') &&
0059         in4_pton(address, -1, min, '-', &end) > 0) {
0060         ptr->is_ipv6 = false;
0061         if (!*end)
0062             ptr->ip[1].s6_addr32[0] = ptr->ip[0].s6_addr32[0];
0063         else if (*end++ != '-' ||
0064              in4_pton(end, -1, max, '\0', &end) <= 0 || *end)
0065             return false;
0066         return true;
0067     }
0068     if (in6_pton(address, -1, min, '-', &end) > 0) {
0069         ptr->is_ipv6 = true;
0070         if (!*end)
0071             memmove(max, min, sizeof(u16) * 8);
0072         else if (*end++ != '-' ||
0073              in6_pton(end, -1, max, '\0', &end) <= 0 || *end)
0074             return false;
0075         return true;
0076     }
0077     return false;
0078 }
0079
0080 /**
0081  * tomoyo_print_ipv4 - Print an IPv4 address.
0082  *
0083  * @buffer:     Buffer to write to.
0084  * @buffer_len: Size of @buffer.
0085  * @min_ip:     Pointer to __be32.
0086  * @max_ip:     Pointer to __be32.
0087  *
0088  * Returns nothing.
0089  */
0090 static void tomoyo_print_ipv4(char *buffer, const unsigned int buffer_len,
0091                   const __be32 *min_ip, const __be32 *max_ip)
0092 {
0093     snprintf(buffer, buffer_len, "%pI4%c%pI4", min_ip,
0094          *min_ip == *max_ip ? '\0' : '-', max_ip);
0095 }
0096
0097 /**
0098  * tomoyo_print_ipv6 - Print an IPv6 address.
0099  *
0100  * @buffer:     Buffer to write to.
0101  * @buffer_len: Size of @buffer.
0102  * @min_ip:     Pointer to "struct in6_addr".
0103  * @max_ip:     Pointer to "struct in6_addr".
0104  *
0105  * Returns nothing.
0106  */
0107 static void tomoyo_print_ipv6(char *buffer, const unsigned int buffer_len,
0108                   const struct in6_addr *min_ip,
0109                   const struct in6_addr *max_ip)
0110 {
0111     snprintf(buffer, buffer_len, "%pI6c%c%pI6c", min_ip,
0112          !memcmp(min_ip, max_ip, 16) ? '\0' : '-', max_ip);
0113 }
0114
0115 /**
0116  * tomoyo_print_ip - Print an IP address.
0117  *
0118  * @buf:  Buffer to write to.
0119  * @size: Size of @buf.
0120  * @ptr:  Pointer to "struct ipaddr_union".
0121  *
0122  * Returns nothing.
0123  */
0124 void tomoyo_print_ip(char *buf, const unsigned int size,
0125              const struct tomoyo_ipaddr_union *ptr)
0126 {
0127     if (ptr->is_ipv6)
0128         tomoyo_print_ipv6(buf, size, &ptr->ip[0], &ptr->ip[1]);
0129     else
0130         tomoyo_print_ipv4(buf, size, &ptr->ip[0].s6_addr32[0],
0131                   &ptr->ip[1].s6_addr32[0]);
0132 }
0133
0134 /*
0135  * Mapping table from "enum tomoyo_network_acl_index" to
0136  * "enum tomoyo_mac_index" for inet domain socket.
0137  */
0138 static const u8 tomoyo_inet2mac
0139 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
0140     [SOCK_STREAM] = {
0141         [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
0142         [TOMOYO_NETWORK_LISTEN]  =
0143         TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
0144         [TOMOYO_NETWORK_CONNECT] =
0145         TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
0146     },
0147     [SOCK_DGRAM] = {
0148         [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
0149         [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
0150     },
0151     [SOCK_RAW]    = {
0152         [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_INET_RAW_BIND,
0153         [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_INET_RAW_SEND,
0154     },
0155 };
0156
0157 /*
0158  * Mapping table from "enum tomoyo_network_acl_index" to
0159  * "enum tomoyo_mac_index" for unix domain socket.
0160  */
0161 static const u8 tomoyo_unix2mac
0162 [TOMOYO_SOCK_MAX][TOMOYO_MAX_NETWORK_OPERATION] = {
0163     [SOCK_STREAM] = {
0164         [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
0165         [TOMOYO_NETWORK_LISTEN]  =
0166         TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
0167         [TOMOYO_NETWORK_CONNECT] =
0168         TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
0169     },
0170     [SOCK_DGRAM] = {
0171         [TOMOYO_NETWORK_BIND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
0172         [TOMOYO_NETWORK_SEND]    = TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
0173     },
0174     [SOCK_SEQPACKET] = {
0175         [TOMOYO_NETWORK_BIND]    =
0176         TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
0177         [TOMOYO_NETWORK_LISTEN]  =
0178         TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
0179         [TOMOYO_NETWORK_CONNECT] =
0180         TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
0181     },
0182 };
0183
0184 /**
0185  * tomoyo_same_inet_acl - Check for duplicated "struct tomoyo_inet_acl" entry.
0186  *
0187  * @a: Pointer to "struct tomoyo_acl_info".
0188  * @b: Pointer to "struct tomoyo_acl_info".
0189  *
0190  * Returns true if @a == @b except permission bits, false otherwise.
0191  */
0192 static bool tomoyo_same_inet_acl(const struct tomoyo_acl_info *a,
0193                  const struct tomoyo_acl_info *b)
0194 {
0195     const struct tomoyo_inet_acl *p1 = container_of(a, typeof(*p1), head);
0196     const struct tomoyo_inet_acl *p2 = container_of(b, typeof(*p2), head);
0197
0198     return p1->protocol == p2->protocol &&
0199         tomoyo_same_ipaddr_union(&p1->address, &p2->address) &&
0200         tomoyo_same_number_union(&p1->port, &p2->port);
0201 }
0202
0203 /**
0204  * tomoyo_same_unix_acl - Check for duplicated "struct tomoyo_unix_acl" entry.
0205  *
0206  * @a: Pointer to "struct tomoyo_acl_info".
0207  * @b: Pointer to "struct tomoyo_acl_info".
0208  *
0209  * Returns true if @a == @b except permission bits, false otherwise.
0210  */
0211 static bool tomoyo_same_unix_acl(const struct tomoyo_acl_info *a,
0212                  const struct tomoyo_acl_info *b)
0213 {
0214     const struct tomoyo_unix_acl *p1 = container_of(a, typeof(*p1), head);
0215     const struct tomoyo_unix_acl *p2 = container_of(b, typeof(*p2), head);
0216
0217     return p1->protocol == p2->protocol &&
0218         tomoyo_same_name_union(&p1->name, &p2->name);
0219 }
0220
0221 /**
0222  * tomoyo_merge_inet_acl - Merge duplicated "struct tomoyo_inet_acl" entry.
0223  *
0224  * @a:         Pointer to "struct tomoyo_acl_info".
0225  * @b:         Pointer to "struct tomoyo_acl_info".
0226  * @is_delete: True for @a &= ~@b, false for @a |= @b.
0227  *
0228  * Returns true if @a is empty, false otherwise.
0229  */
0230 static bool tomoyo_merge_inet_acl(struct tomoyo_acl_info *a,
0231                   struct tomoyo_acl_info *b,
0232                   const bool is_delete)
0233 {
0234     u8 * const a_perm =
0235         &container_of(a, struct tomoyo_inet_acl, head)->perm;
0236     u8 perm = READ_ONCE(*a_perm);
0237     const u8 b_perm = container_of(b, struct tomoyo_inet_acl, head)->perm;
0238
0239     if (is_delete)
0240         perm &= ~b_perm;
0241     else
0242         perm |= b_perm;
0243     WRITE_ONCE(*a_perm, perm);
0244     return !perm;
0245 }
0246
0247 /**
0248  * tomoyo_merge_unix_acl - Merge duplicated "struct tomoyo_unix_acl" entry.
0249  *
0250  * @a:         Pointer to "struct tomoyo_acl_info".
0251  * @b:         Pointer to "struct tomoyo_acl_info".
0252  * @is_delete: True for @a &= ~@b, false for @a |= @b.
0253  *
0254  * Returns true if @a is empty, false otherwise.
0255  */
0256 static bool tomoyo_merge_unix_acl(struct tomoyo_acl_info *a,
0257                   struct tomoyo_acl_info *b,
0258                   const bool is_delete)
0259 {
0260     u8 * const a_perm =
0261         &container_of(a, struct tomoyo_unix_acl, head)->perm;
0262     u8 perm = READ_ONCE(*a_perm);
0263     const u8 b_perm = container_of(b, struct tomoyo_unix_acl, head)->perm;
0264
0265     if (is_delete)
0266         perm &= ~b_perm;
0267     else
0268         perm |= b_perm;
0269     WRITE_ONCE(*a_perm, perm);
0270     return !perm;
0271 }
0272
0273 /**
0274  * tomoyo_write_inet_network - Write "struct tomoyo_inet_acl" list.
0275  *
0276  * @param: Pointer to "struct tomoyo_acl_param".
0277  *
0278  * Returns 0 on success, negative value otherwise.
0279  *
0280  * Caller holds tomoyo_read_lock().
0281  */
0282 int tomoyo_write_inet_network(struct tomoyo_acl_param *param)
0283 {
0284     struct tomoyo_inet_acl e = { .head.type = TOMOYO_TYPE_INET_ACL };
0285     int error = -EINVAL;
0286     u8 type;
0287     const char *protocol = tomoyo_read_token(param);
0288     const char *operation = tomoyo_read_token(param);
0289
0290     for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
0291         if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
0292             break;
0293     for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
0294         if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
0295             e.perm |= 1 << type;
0296     if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
0297         return -EINVAL;
0298     if (param->data[0] == '@') {
0299         param->data++;
0300         e.address.group =
0301             tomoyo_get_group(param, TOMOYO_ADDRESS_GROUP);
0302         if (!e.address.group)
0303             return -ENOMEM;
0304     } else {
0305         if (!tomoyo_parse_ipaddr_union(param, &e.address))
0306             goto out;
0307     }
0308     if (!tomoyo_parse_number_union(param, &e.port) ||
0309         e.port.values[1] > 65535)
0310         goto out;
0311     error = tomoyo_update_domain(&e.head, sizeof(e), param,
0312                      tomoyo_same_inet_acl,
0313                      tomoyo_merge_inet_acl);
0314 out:
0315     tomoyo_put_group(e.address.group);
0316     tomoyo_put_number_union(&e.port);
0317     return error;
0318 }
0319
0320 /**
0321  * tomoyo_write_unix_network - Write "struct tomoyo_unix_acl" list.
0322  *
0323  * @param: Pointer to "struct tomoyo_acl_param".
0324  *
0325  * Returns 0 on success, negative value otherwise.
0326  */
0327 int tomoyo_write_unix_network(struct tomoyo_acl_param *param)
0328 {
0329     struct tomoyo_unix_acl e = { .head.type = TOMOYO_TYPE_UNIX_ACL };
0330     int error;
0331     u8 type;
0332     const char *protocol = tomoyo_read_token(param);
0333     const char *operation = tomoyo_read_token(param);
0334
0335     for (e.protocol = 0; e.protocol < TOMOYO_SOCK_MAX; e.protocol++)
0336         if (!strcmp(protocol, tomoyo_proto_keyword[e.protocol]))
0337             break;
0338     for (type = 0; type < TOMOYO_MAX_NETWORK_OPERATION; type++)
0339         if (tomoyo_permstr(operation, tomoyo_socket_keyword[type]))
0340             e.perm |= 1 << type;
0341     if (e.protocol == TOMOYO_SOCK_MAX || !e.perm)
0342         return -EINVAL;
0343     if (!tomoyo_parse_name_union(param, &e.name))
0344         return -EINVAL;
0345     error = tomoyo_update_domain(&e.head, sizeof(e), param,
0346                      tomoyo_same_unix_acl,
0347                      tomoyo_merge_unix_acl);
0348     tomoyo_put_name_union(&e.name);
0349     return error;
0350 }
0351
0352 /**
0353  * tomoyo_audit_net_log - Audit network log.
0354  *
0355  * @r:         Pointer to "struct tomoyo_request_info".
0356  * @family:    Name of socket family ("inet" or "unix").
0357  * @protocol:  Name of protocol in @family.
0358  * @operation: Name of socket operation.
0359  * @address:   Name of address.
0360  *
0361  * Returns 0 on success, negative value otherwise.
0362  */
0363 static int tomoyo_audit_net_log(struct tomoyo_request_info *r,
0364                 const char *family, const u8 protocol,
0365                 const u8 operation, const char *address)
0366 {
0367     return tomoyo_supervisor(r, "network %s %s %s %s\n", family,
0368                  tomoyo_proto_keyword[protocol],
0369                  tomoyo_socket_keyword[operation], address);
0370 }
0371
0372 /**
0373  * tomoyo_audit_inet_log - Audit INET network log.
0374  *
0375  * @r: Pointer to "struct tomoyo_request_info".
0376  *
0377  * Returns 0 on success, negative value otherwise.
0378  */
0379 static int tomoyo_audit_inet_log(struct tomoyo_request_info *r)
0380 {
0381     char buf[128];
0382     int len;
0383     const __be32 *address = r->param.inet_network.address;
0384
0385     if (r->param.inet_network.is_ipv6)
0386         tomoyo_print_ipv6(buf, sizeof(buf), (const struct in6_addr *)
0387                   address, (const struct in6_addr *) address);
0388     else
0389         tomoyo_print_ipv4(buf, sizeof(buf), address, address);
0390     len = strlen(buf);
0391     snprintf(buf + len, sizeof(buf) - len, " %u",
0392          r->param.inet_network.port);
0393     return tomoyo_audit_net_log(r, "inet", r->param.inet_network.protocol,
0394                     r->param.inet_network.operation, buf);
0395 }
0396
0397 /**
0398  * tomoyo_audit_unix_log - Audit UNIX network log.
0399  *
0400  * @r: Pointer to "struct tomoyo_request_info".
0401  *
0402  * Returns 0 on success, negative value otherwise.
0403  */
0404 static int tomoyo_audit_unix_log(struct tomoyo_request_info *r)
0405 {
0406     return tomoyo_audit_net_log(r, "unix", r->param.unix_network.protocol,
0407                     r->param.unix_network.operation,
0408                     r->param.unix_network.address->name);
0409 }
0410
0411 /**
0412  * tomoyo_check_inet_acl - Check permission for inet domain socket operation.
0413  *
0414  * @r:   Pointer to "struct tomoyo_request_info".
0415  * @ptr: Pointer to "struct tomoyo_acl_info".
0416  *
0417  * Returns true if granted, false otherwise.
0418  */
0419 static bool tomoyo_check_inet_acl(struct tomoyo_request_info *r,
0420                   const struct tomoyo_acl_info *ptr)
0421 {
0422     const struct tomoyo_inet_acl *acl =
0423         container_of(ptr, typeof(*acl), head);
0424     const u8 size = r->param.inet_network.is_ipv6 ? 16 : 4;
0425
0426     if (!(acl->perm & (1 << r->param.inet_network.operation)) ||
0427         !tomoyo_compare_number_union(r->param.inet_network.port,
0428                      &acl->port))
0429         return false;
0430     if (acl->address.group)
0431         return tomoyo_address_matches_group
0432             (r->param.inet_network.is_ipv6,
0433              r->param.inet_network.address, acl->address.group);
0434     return acl->address.is_ipv6 == r->param.inet_network.is_ipv6 &&
0435         memcmp(&acl->address.ip[0],
0436                r->param.inet_network.address, size) <= 0 &&
0437         memcmp(r->param.inet_network.address,
0438                &acl->address.ip[1], size) <= 0;
0439 }
0440
0441 /**
0442  * tomoyo_check_unix_acl - Check permission for unix domain socket operation.
0443  *
0444  * @r:   Pointer to "struct tomoyo_request_info".
0445  * @ptr: Pointer to "struct tomoyo_acl_info".
0446  *
0447  * Returns true if granted, false otherwise.
0448  */
0449 static bool tomoyo_check_unix_acl(struct tomoyo_request_info *r,
0450                   const struct tomoyo_acl_info *ptr)
0451 {
0452     const struct tomoyo_unix_acl *acl =
0453         container_of(ptr, typeof(*acl), head);
0454
0455     return (acl->perm & (1 << r->param.unix_network.operation)) &&
0456         tomoyo_compare_name_union(r->param.unix_network.address,
0457                       &acl->name);
0458 }
0459
0460 /**
0461  * tomoyo_inet_entry - Check permission for INET network operation.
0462  *
0463  * @address: Pointer to "struct tomoyo_addr_info".
0464  *
0465  * Returns 0 on success, negative value otherwise.
0466  */
0467 static int tomoyo_inet_entry(const struct tomoyo_addr_info *address)
0468 {
0469     const int idx = tomoyo_read_lock();
0470     struct tomoyo_request_info r;
0471     int error = 0;
0472     const u8 type = tomoyo_inet2mac[address->protocol][address->operation];
0473
0474     if (type && tomoyo_init_request_info(&r, NULL, type)
0475         != TOMOYO_CONFIG_DISABLED) {
0476         r.param_type = TOMOYO_TYPE_INET_ACL;
0477         r.param.inet_network.protocol = address->protocol;
0478         r.param.inet_network.operation = address->operation;
0479         r.param.inet_network.is_ipv6 = address->inet.is_ipv6;
0480         r.param.inet_network.address = address->inet.address;
0481         r.param.inet_network.port = ntohs(address->inet.port);
0482         do {
0483             tomoyo_check_acl(&r, tomoyo_check_inet_acl);
0484             error = tomoyo_audit_inet_log(&r);
0485         } while (error == TOMOYO_RETRY_REQUEST);
0486     }
0487     tomoyo_read_unlock(idx);
0488     return error;
0489 }
0490
0491 /**
0492  * tomoyo_check_inet_address - Check permission for inet domain socket's operation.
0493  *
0494  * @addr:     Pointer to "struct sockaddr".
0495  * @addr_len: Size of @addr.
0496  * @port:     Port number.
0497  * @address:  Pointer to "struct tomoyo_addr_info".
0498  *
0499  * Returns 0 on success, negative value otherwise.
0500  */
0501 static int tomoyo_check_inet_address(const struct sockaddr *addr,
0502                      const unsigned int addr_len,
0503                      const u16 port,
0504                      struct tomoyo_addr_info *address)
0505 {
0506     struct tomoyo_inet_addr_info *i = &address->inet;
0507
0508     if (addr_len < offsetofend(struct sockaddr, sa_family))
0509         return 0;
0510     switch (addr->sa_family) {
0511     case AF_INET6:
0512         if (addr_len < SIN6_LEN_RFC2133)
0513             goto skip;
0514         i->is_ipv6 = true;
0515         i->address = (__be32 *)
0516             ((struct sockaddr_in6 *) addr)->sin6_addr.s6_addr;
0517         i->port = ((struct sockaddr_in6 *) addr)->sin6_port;
0518         break;
0519     case AF_INET:
0520         if (addr_len < sizeof(struct sockaddr_in))
0521             goto skip;
0522         i->is_ipv6 = false;
0523         i->address = (__be32 *)
0524             &((struct sockaddr_in *) addr)->sin_addr;
0525         i->port = ((struct sockaddr_in *) addr)->sin_port;
0526         break;
0527     default:
0528         goto skip;
0529     }
0530     if (address->protocol == SOCK_RAW)
0531         i->port = htons(port);
0532     return tomoyo_inet_entry(address);
0533 skip:
0534     return 0;
0535 }
0536
0537 /**
0538  * tomoyo_unix_entry - Check permission for UNIX network operation.
0539  *
0540  * @address: Pointer to "struct tomoyo_addr_info".
0541  *
0542  * Returns 0 on success, negative value otherwise.
0543  */
0544 static int tomoyo_unix_entry(const struct tomoyo_addr_info *address)
0545 {
0546     const int idx = tomoyo_read_lock();
0547     struct tomoyo_request_info r;
0548     int error = 0;
0549     const u8 type = tomoyo_unix2mac[address->protocol][address->operation];
0550
0551     if (type && tomoyo_init_request_info(&r, NULL, type)
0552         != TOMOYO_CONFIG_DISABLED) {
0553         char *buf = address->unix0.addr;
0554         int len = address->unix0.addr_len - sizeof(sa_family_t);
0555
0556         if (len <= 0) {
0557             buf = "anonymous";
0558             len = 9;
0559         } else if (buf[0]) {
0560             len = strnlen(buf, len);
0561         }
0562         buf = tomoyo_encode2(buf, len);
0563         if (buf) {
0564             struct tomoyo_path_info addr;
0565
0566             addr.name = buf;
0567             tomoyo_fill_path_info(&addr);
0568             r.param_type = TOMOYO_TYPE_UNIX_ACL;
0569             r.param.unix_network.protocol = address->protocol;
0570             r.param.unix_network.operation = address->operation;
0571             r.param.unix_network.address = &addr;
0572             do {
0573                 tomoyo_check_acl(&r, tomoyo_check_unix_acl);
0574                 error = tomoyo_audit_unix_log(&r);
0575             } while (error == TOMOYO_RETRY_REQUEST);
0576             kfree(buf);
0577         } else
0578             error = -ENOMEM;
0579     }
0580     tomoyo_read_unlock(idx);
0581     return error;
0582 }
0583
0584 /**
0585  * tomoyo_check_unix_address - Check permission for unix domain socket's operation.
0586  *
0587  * @addr:     Pointer to "struct sockaddr".
0588  * @addr_len: Size of @addr.
0589  * @address:  Pointer to "struct tomoyo_addr_info".
0590  *
0591  * Returns 0 on success, negative value otherwise.
0592  */
0593 static int tomoyo_check_unix_address(struct sockaddr *addr,
0594                      const unsigned int addr_len,
0595                      struct tomoyo_addr_info *address)
0596 {
0597     struct tomoyo_unix_addr_info *u = &address->unix0;
0598
0599     if (addr_len < offsetofend(struct sockaddr, sa_family))
0600         return 0;
0601     if (addr->sa_family != AF_UNIX)
0602         return 0;
0603     u->addr = ((struct sockaddr_un *) addr)->sun_path;
0604     u->addr_len = addr_len;
0605     return tomoyo_unix_entry(address);
0606 }
0607
0608 /**
0609  * tomoyo_kernel_service - Check whether I'm kernel service or not.
0610  *
0611  * Returns true if I'm kernel service, false otherwise.
0612  */
0613 static bool tomoyo_kernel_service(void)
0614 {
0615     /* Nothing to do if I am a kernel service. */
0616     return current->flags & PF_KTHREAD;
0617 }
0618
0619 /**
0620  * tomoyo_sock_family - Get socket's family.
0621  *
0622  * @sk: Pointer to "struct sock".
0623  *
0624  * Returns one of PF_INET, PF_INET6, PF_UNIX or 0.
0625  */
0626 static u8 tomoyo_sock_family(struct sock *sk)
0627 {
0628     u8 family;
0629
0630     if (tomoyo_kernel_service())
0631         return 0;
0632     family = sk->sk_family;
0633     switch (family) {
0634     case PF_INET:
0635     case PF_INET6:
0636     case PF_UNIX:
0637         return family;
0638     default:
0639         return 0;
0640     }
0641 }
0642
0643 /**
0644  * tomoyo_socket_listen_permission - Check permission for listening a socket.
0645  *
0646  * @sock: Pointer to "struct socket".
0647  *
0648  * Returns 0 on success, negative value otherwise.
0649  */
0650 int tomoyo_socket_listen_permission(struct socket *sock)
0651 {
0652     struct tomoyo_addr_info address;
0653     const u8 family = tomoyo_sock_family(sock->sk);
0654     const unsigned int type = sock->type;
0655     struct sockaddr_storage addr;
0656     int addr_len;
0657
0658     if (!family || (type != SOCK_STREAM && type != SOCK_SEQPACKET))
0659         return 0;
0660     {
0661         const int error = sock->ops->getname(sock, (struct sockaddr *)
0662                              &addr, 0);
0663
0664         if (error < 0)
0665             return error;
0666         addr_len = error;
0667     }
0668     address.protocol = type;
0669     address.operation = TOMOYO_NETWORK_LISTEN;
0670     if (family == PF_UNIX)
0671         return tomoyo_check_unix_address((struct sockaddr *) &addr,
0672                          addr_len, &address);
0673     return tomoyo_check_inet_address((struct sockaddr *) &addr, addr_len,
0674                      0, &address);
0675 }
0676
0677 /**
0678  * tomoyo_socket_connect_permission - Check permission for setting the remote address of a socket.
0679  *
0680  * @sock:     Pointer to "struct socket".
0681  * @addr:     Pointer to "struct sockaddr".
0682  * @addr_len: Size of @addr.
0683  *
0684  * Returns 0 on success, negative value otherwise.
0685  */
0686 int tomoyo_socket_connect_permission(struct socket *sock,
0687                      struct sockaddr *addr, int addr_len)
0688 {
0689     struct tomoyo_addr_info address;
0690     const u8 family = tomoyo_sock_family(sock->sk);
0691     const unsigned int type = sock->type;
0692
0693     if (!family)
0694         return 0;
0695     address.protocol = type;
0696     switch (type) {
0697     case SOCK_DGRAM:
0698     case SOCK_RAW:
0699         address.operation = TOMOYO_NETWORK_SEND;
0700         break;
0701     case SOCK_STREAM:
0702     case SOCK_SEQPACKET:
0703         address.operation = TOMOYO_NETWORK_CONNECT;
0704         break;
0705     default:
0706         return 0;
0707     }
0708     if (family == PF_UNIX)
0709         return tomoyo_check_unix_address(addr, addr_len, &address);
0710     return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
0711                      &address);
0712 }
0713
0714 /**
0715  * tomoyo_socket_bind_permission - Check permission for setting the local address of a socket.
0716  *
0717  * @sock:     Pointer to "struct socket".
0718  * @addr:     Pointer to "struct sockaddr".
0719  * @addr_len: Size of @addr.
0720  *
0721  * Returns 0 on success, negative value otherwise.
0722  */
0723 int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
0724                   int addr_len)
0725 {
0726     struct tomoyo_addr_info address;
0727     const u8 family = tomoyo_sock_family(sock->sk);
0728     const unsigned int type = sock->type;
0729
0730     if (!family)
0731         return 0;
0732     switch (type) {
0733     case SOCK_STREAM:
0734     case SOCK_DGRAM:
0735     case SOCK_RAW:
0736     case SOCK_SEQPACKET:
0737         address.protocol = type;
0738         address.operation = TOMOYO_NETWORK_BIND;
0739         break;
0740     default:
0741         return 0;
0742     }
0743     if (family == PF_UNIX)
0744         return tomoyo_check_unix_address(addr, addr_len, &address);
0745     return tomoyo_check_inet_address(addr, addr_len, sock->sk->sk_protocol,
0746                      &address);
0747 }
0748
0749 /**
0750  * tomoyo_socket_sendmsg_permission - Check permission for sending a datagram.
0751  *
0752  * @sock: Pointer to "struct socket".
0753  * @msg:  Pointer to "struct msghdr".
0754  * @size: Unused.
0755  *
0756  * Returns 0 on success, negative value otherwise.
0757  */
0758 int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
0759                      int size)
0760 {
0761     struct tomoyo_addr_info address;
0762     const u8 family = tomoyo_sock_family(sock->sk);
0763     const unsigned int type = sock->type;
0764
0765     if (!msg->msg_name || !family ||
0766         (type != SOCK_DGRAM && type != SOCK_RAW))
0767         return 0;
0768     address.protocol = type;
0769     address.operation = TOMOYO_NETWORK_SEND;
0770     if (family == PF_UNIX)
0771         return tomoyo_check_unix_address((struct sockaddr *)
0772                          msg->msg_name,
0773                          msg->msg_namelen, &address);
0774     return tomoyo_check_inet_address((struct sockaddr *) msg->msg_name,
0775                      msg->msg_namelen,
0776                      sock->sk->sk_protocol, &address);
0777 }