1*4882a593Smuzhiyun // SPDX-License-Identifier: GPL-2.0
2*4882a593Smuzhiyun /*
3*4882a593Smuzhiyun * security/tomoyo/environ.c
4*4882a593Smuzhiyun *
5*4882a593Smuzhiyun * Copyright (C) 2005-2011 NTT DATA CORPORATION
6*4882a593Smuzhiyun */
7*4882a593Smuzhiyun
8*4882a593Smuzhiyun #include "common.h"
9*4882a593Smuzhiyun
10*4882a593Smuzhiyun /**
11*4882a593Smuzhiyun * tomoyo_check_env_acl - Check permission for environment variable's name.
12*4882a593Smuzhiyun *
13*4882a593Smuzhiyun * @r: Pointer to "struct tomoyo_request_info".
14*4882a593Smuzhiyun * @ptr: Pointer to "struct tomoyo_acl_info".
15*4882a593Smuzhiyun *
16*4882a593Smuzhiyun * Returns true if granted, false otherwise.
17*4882a593Smuzhiyun */
tomoyo_check_env_acl(struct tomoyo_request_info * r,const struct tomoyo_acl_info * ptr)18*4882a593Smuzhiyun static bool tomoyo_check_env_acl(struct tomoyo_request_info *r,
19*4882a593Smuzhiyun const struct tomoyo_acl_info *ptr)
20*4882a593Smuzhiyun {
21*4882a593Smuzhiyun const struct tomoyo_env_acl *acl =
22*4882a593Smuzhiyun container_of(ptr, typeof(*acl), head);
23*4882a593Smuzhiyun
24*4882a593Smuzhiyun return tomoyo_path_matches_pattern(r->param.environ.name, acl->env);
25*4882a593Smuzhiyun }
26*4882a593Smuzhiyun
27*4882a593Smuzhiyun /**
28*4882a593Smuzhiyun * tomoyo_audit_env_log - Audit environment variable name log.
29*4882a593Smuzhiyun *
30*4882a593Smuzhiyun * @r: Pointer to "struct tomoyo_request_info".
31*4882a593Smuzhiyun *
32*4882a593Smuzhiyun * Returns 0 on success, negative value otherwise.
33*4882a593Smuzhiyun */
tomoyo_audit_env_log(struct tomoyo_request_info * r)34*4882a593Smuzhiyun static int tomoyo_audit_env_log(struct tomoyo_request_info *r)
35*4882a593Smuzhiyun {
36*4882a593Smuzhiyun return tomoyo_supervisor(r, "misc env %s\n",
37*4882a593Smuzhiyun r->param.environ.name->name);
38*4882a593Smuzhiyun }
39*4882a593Smuzhiyun
40*4882a593Smuzhiyun /**
41*4882a593Smuzhiyun * tomoyo_env_perm - Check permission for environment variable's name.
42*4882a593Smuzhiyun *
43*4882a593Smuzhiyun * @r: Pointer to "struct tomoyo_request_info".
44*4882a593Smuzhiyun * @env: The name of environment variable.
45*4882a593Smuzhiyun *
46*4882a593Smuzhiyun * Returns 0 on success, negative value otherwise.
47*4882a593Smuzhiyun *
48*4882a593Smuzhiyun * Caller holds tomoyo_read_lock().
49*4882a593Smuzhiyun */
tomoyo_env_perm(struct tomoyo_request_info * r,const char * env)50*4882a593Smuzhiyun int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env)
51*4882a593Smuzhiyun {
52*4882a593Smuzhiyun struct tomoyo_path_info environ;
53*4882a593Smuzhiyun int error;
54*4882a593Smuzhiyun
55*4882a593Smuzhiyun if (!env || !*env)
56*4882a593Smuzhiyun return 0;
57*4882a593Smuzhiyun environ.name = env;
58*4882a593Smuzhiyun tomoyo_fill_path_info(&environ);
59*4882a593Smuzhiyun r->param_type = TOMOYO_TYPE_ENV_ACL;
60*4882a593Smuzhiyun r->param.environ.name = &environ;
61*4882a593Smuzhiyun do {
62*4882a593Smuzhiyun tomoyo_check_acl(r, tomoyo_check_env_acl);
63*4882a593Smuzhiyun error = tomoyo_audit_env_log(r);
64*4882a593Smuzhiyun } while (error == TOMOYO_RETRY_REQUEST);
65*4882a593Smuzhiyun return error;
66*4882a593Smuzhiyun }
67*4882a593Smuzhiyun
68*4882a593Smuzhiyun /**
69*4882a593Smuzhiyun * tomoyo_same_env_acl - Check for duplicated "struct tomoyo_env_acl" entry.
70*4882a593Smuzhiyun *
71*4882a593Smuzhiyun * @a: Pointer to "struct tomoyo_acl_info".
72*4882a593Smuzhiyun * @b: Pointer to "struct tomoyo_acl_info".
73*4882a593Smuzhiyun *
74*4882a593Smuzhiyun * Returns true if @a == @b, false otherwise.
75*4882a593Smuzhiyun */
tomoyo_same_env_acl(const struct tomoyo_acl_info * a,const struct tomoyo_acl_info * b)76*4882a593Smuzhiyun static bool tomoyo_same_env_acl(const struct tomoyo_acl_info *a,
77*4882a593Smuzhiyun const struct tomoyo_acl_info *b)
78*4882a593Smuzhiyun {
79*4882a593Smuzhiyun const struct tomoyo_env_acl *p1 = container_of(a, typeof(*p1), head);
80*4882a593Smuzhiyun const struct tomoyo_env_acl *p2 = container_of(b, typeof(*p2), head);
81*4882a593Smuzhiyun
82*4882a593Smuzhiyun return p1->env == p2->env;
83*4882a593Smuzhiyun }
84*4882a593Smuzhiyun
85*4882a593Smuzhiyun /**
86*4882a593Smuzhiyun * tomoyo_write_env - Write "struct tomoyo_env_acl" list.
87*4882a593Smuzhiyun *
88*4882a593Smuzhiyun * @param: Pointer to "struct tomoyo_acl_param".
89*4882a593Smuzhiyun *
90*4882a593Smuzhiyun * Returns 0 on success, negative value otherwise.
91*4882a593Smuzhiyun *
92*4882a593Smuzhiyun * Caller holds tomoyo_read_lock().
93*4882a593Smuzhiyun */
tomoyo_write_env(struct tomoyo_acl_param * param)94*4882a593Smuzhiyun static int tomoyo_write_env(struct tomoyo_acl_param *param)
95*4882a593Smuzhiyun {
96*4882a593Smuzhiyun struct tomoyo_env_acl e = { .head.type = TOMOYO_TYPE_ENV_ACL };
97*4882a593Smuzhiyun int error = -ENOMEM;
98*4882a593Smuzhiyun const char *data = tomoyo_read_token(param);
99*4882a593Smuzhiyun
100*4882a593Smuzhiyun if (!tomoyo_correct_word(data) || strchr(data, '='))
101*4882a593Smuzhiyun return -EINVAL;
102*4882a593Smuzhiyun e.env = tomoyo_get_name(data);
103*4882a593Smuzhiyun if (!e.env)
104*4882a593Smuzhiyun return error;
105*4882a593Smuzhiyun error = tomoyo_update_domain(&e.head, sizeof(e), param,
106*4882a593Smuzhiyun tomoyo_same_env_acl, NULL);
107*4882a593Smuzhiyun tomoyo_put_name(e.env);
108*4882a593Smuzhiyun return error;
109*4882a593Smuzhiyun }
110*4882a593Smuzhiyun
111*4882a593Smuzhiyun /**
112*4882a593Smuzhiyun * tomoyo_write_misc - Update environment variable list.
113*4882a593Smuzhiyun *
114*4882a593Smuzhiyun * @param: Pointer to "struct tomoyo_acl_param".
115*4882a593Smuzhiyun *
116*4882a593Smuzhiyun * Returns 0 on success, negative value otherwise.
117*4882a593Smuzhiyun */
tomoyo_write_misc(struct tomoyo_acl_param * param)118*4882a593Smuzhiyun int tomoyo_write_misc(struct tomoyo_acl_param *param)
119*4882a593Smuzhiyun {
120*4882a593Smuzhiyun if (tomoyo_str_starts(¶m->data, "env "))
121*4882a593Smuzhiyun return tomoyo_write_env(param);
122*4882a593Smuzhiyun return -EINVAL;
123*4882a593Smuzhiyun }
124