iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tomoyo: Loosen pathname/domainname validation.

Browse Source 
Since commit e2dc9bf3f5 ("umd: Transform fork_usermode_blob into
fork_usermode_driver") started calling execve() on a program written in
a local mount which is not connected to mount tree,
tomoyo_realpath_from_path() started returning a pathname in
"$fsname:/$pathname" format which violates TOMOYO's domainname rule that
it must start with "<$namespace>" followed by zero or more repetitions of
pathnames which start with '/'.

Since $fsname must not contain '.' since commit 79c0b2df79 ("add
filesystem subtype support"), tomoyo_correct_path() can recognize a token
which appears '/' before '.' appears (e.g. proc:/self/exe ) as a pathname
while rejecting a token which appears '.' before '/' appears (e.g.
exec.realpath="/bin/bash" ) as a condition parameter.

Therefore, accept domainnames which contain pathnames which do not start
with '/' but contain '/' before '.' (e.g. <kernel> tmpfs:/bpfilter_umh ).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
This commit is contained in:
Tetsuo Handa 2020-09-09 20:05:58 +09:00
parent bbf5c97901
commit a207516776
1 changed files with 23 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
security/tomoyo/util.c
View File

@ -143,6 +143,8 @@ char *tomoyo_read_token(struct tomoyo_acl_param *param)
return pos; return pos;
} }
static bool tomoyo_correct_path2(const char *filename, const size_t len);
/** /**
* tomoyo_get_domainname - Read a domainname from a line. * tomoyo_get_domainname - Read a domainname from a line.
* *
@ -157,10 +159,10 @@ const struct tomoyo_path_info *tomoyo_get_domainname
char *pos = start; char *pos = start;
while (*pos) { while (*pos) {
if (*pos++ != ' ' || *pos++ == '/') if (*pos++ != ' ' ||
tomoyo_correct_path2(pos, strchrnul(pos, ' ') - pos))
continue; continue;
pos -= 2; *(pos - 1) = '\0';
*pos++ = '\0';
break; break;
} }
param->data = pos; param->data = pos;
@ -513,6 +515,22 @@ bool tomoyo_correct_word(const char *string)
return tomoyo_correct_word2(string, strlen(string)); return tomoyo_correct_word2(string, strlen(string));
} }
/**
* tomoyo_correct_path2 - Check whether the given pathname follows the naming rules.
*
* @filename: The pathname to check.
* @len: Length of @filename.
*
* Returns true if @filename follows the naming rules, false otherwise.
*/
static bool tomoyo_correct_path2(const char *filename, const size_t len)
{
const char *cp1 = memchr(filename, '/', len);
const char *cp2 = memchr(filename, '.', len);
return cp1 && (!cp2 || (cp1 < cp2)) && tomoyo_correct_word2(filename, len);
}
/** /**
* tomoyo_correct_path - Validate a pathname. * tomoyo_correct_path - Validate a pathname.
* *
@ -523,7 +541,7 @@ bool tomoyo_correct_word(const char *string)
*/ */
bool tomoyo_correct_path(const char *filename) bool tomoyo_correct_path(const char *filename)
{ {
return *filename == '/' && tomoyo_correct_word(filename); return tomoyo_correct_path2(filename, strlen(filename));
} }
/** /**
@ -545,8 +563,7 @@ bool tomoyo_correct_domain(const unsigned char *domainname)
if (!cp) if (!cp)
break; break;
if (*domainname != '/' || if (!tomoyo_correct_path2(domainname, cp - domainname))
!tomoyo_correct_word2(domainname, cp - domainname))
return false; return false;
domainname = cp + 1; domainname = cp + 1;
} }