[thirdparty/kernel/stable.git] / security / tomoyo / realpath.c

// SPDX-License-Identifier: GPL-2.0
/*
 * security/tomoyo/realpath.c
 *
 * Copyright (C) 2005-2011  NTT DATA CORPORATION
 */

#include "common.h"
#include <linux/magic.h>

/**
 * tomoyo_encode2 - Encode binary string to ascii string.
 *
 * @str:     String in binary format.
 * @str_len: Size of @str in byte.
 *
 * Returns pointer to @str in ascii format on success, NULL otherwise.
 *
 * This function uses kzalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
char *tomoyo_encode2(const char *str, int str_len)
{
	int i;
	int len = 0;
	const char *p = str;
	char *cp;
	char *cp0;

	if (!p)
		return NULL;
	for (i = 0; i < str_len; i++) {
		const unsigned char c = p[i];

		if (c == '\\')
			len += 2;
		else if (c > ' ' && c < 127)
			len++;
		else
			len += 4;
	}
	len++;
	/* Reserve space for appending "/". */
	cp = kzalloc(len + 10, GFP_NOFS);
	if (!cp)
		return NULL;
	cp0 = cp;
	p = str;
	for (i = 0; i < str_len; i++) {
		const unsigned char c = p[i];

		if (c == '\\') {
			*cp++ = '\\';
			*cp++ = '\\';
		} else if (c > ' ' && c < 127) {
			*cp++ = c;
		} else {
			*cp++ = '\\';
			*cp++ = (c >> 6) + '0';
			*cp++ = ((c >> 3) & 7) + '0';
			*cp++ = (c & 7) + '0';
		}
	}
	return cp0;
}

/**
 * tomoyo_encode - Encode binary string to ascii string.
 *
 * @str: String in binary format.
 *
 * Returns pointer to @str in ascii format on success, NULL otherwise.
 *
 * This function uses kzalloc(), so caller must kfree() if this function
 * didn't return NULL.
 */
char *tomoyo_encode(const char *str)
{
	return str ? tomoyo_encode2(str, strlen(str)) : NULL;
}

/**
 * tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
 *
 * @path:   Pointer to "struct path".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 */
static char *tomoyo_get_absolute_path(const struct path *path, char * const buffer,
				      const int buflen)
{
	char *pos = ERR_PTR(-ENOMEM);

	if (buflen >= 256) {
		/* go to whatever namespace root we are under */
		pos = d_absolute_path(path, buffer, buflen - 1);
		if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
			struct inode *inode = d_backing_inode(path->dentry);

			if (inode && S_ISDIR(inode->i_mode)) {
				buffer[buflen - 2] = '/';
				buffer[buflen - 1] = '\0';
			}
		}
	}
	return pos;
}

/**
 * tomoyo_get_dentry_path - Get the path of a dentry.
 *
 * @dentry: Pointer to "struct dentry".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 */
static char *tomoyo_get_dentry_path(struct dentry *dentry, char * const buffer,
				    const int buflen)
{
	char *pos = ERR_PTR(-ENOMEM);

	if (buflen >= 256) {
		pos = dentry_path_raw(dentry, buffer, buflen - 1);
		if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
			struct inode *inode = d_backing_inode(dentry);

			if (inode && S_ISDIR(inode->i_mode)) {
				buffer[buflen - 2] = '/';
				buffer[buflen - 1] = '\0';
			}
		}
	}
	return pos;
}

/**
 * tomoyo_get_local_path - Get the path of a dentry.
 *
 * @dentry: Pointer to "struct dentry".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer on success, an error code otherwise.
 */
static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
				   const int buflen)
{
	struct super_block *sb = dentry->d_sb;
	char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);

	if (IS_ERR(pos))
		return pos;
	/* Convert from $PID to self if $PID is current thread. */
	if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
		char *ep;
		const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);

		if (*ep == '/' && pid && pid ==
		    task_tgid_nr_ns(current, sb->s_fs_info)) {
			pos = ep - 5;
			if (pos < buffer)
				goto out;
			memmove(pos, "/self", 5);
		}
		goto prepend_filesystem_name;
	}
	/* Use filesystem name for unnamed devices. */
	if (!MAJOR(sb->s_dev))
		goto prepend_filesystem_name;
	{
		struct inode *inode = d_backing_inode(sb->s_root);

		/*
		 * Use filesystem name if filesystem does not support rename()
		 * operation.
		 */
		if (!inode->i_op->rename)
			goto prepend_filesystem_name;
	}
	/* Prepend device name. */
	{
		char name[64];
		int name_len;
		const dev_t dev = sb->s_dev;

		name[sizeof(name) - 1] = '\0';
		snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
			 MINOR(dev));
		name_len = strlen(name);
		pos -= name_len;
		if (pos < buffer)
			goto out;
		memmove(pos, name, name_len);
		return pos;
	}
	/* Prepend filesystem name. */
prepend_filesystem_name:
	{
		const char *name = sb->s_type->name;
		const int name_len = strlen(name);

		pos -= name_len + 1;
		if (pos < buffer)
			goto out;
		memmove(pos, name, name_len);
		pos[name_len] = ':';
	}
	return pos;
out:
	return ERR_PTR(-ENOMEM);
}

/**
 * tomoyo_get_socket_name - Get the name of a socket.
 *
 * @path:   Pointer to "struct path".
 * @buffer: Pointer to buffer to return value in.
 * @buflen: Sizeof @buffer.
 *
 * Returns the buffer.
 */
static char *tomoyo_get_socket_name(const struct path *path, char * const buffer,
				    const int buflen)
{
	struct inode *inode = d_backing_inode(path->dentry);
	struct socket *sock = inode ? SOCKET_I(inode) : NULL;
	struct sock *sk = sock ? sock->sk : NULL;

	if (sk) {
		snprintf(buffer, buflen, "socket:[family=%u:type=%u:protocol=%u]",
			 sk->sk_family, sk->sk_type, sk->sk_protocol);
	} else {
		snprintf(buffer, buflen, "socket:[unknown]");
	}
	return buffer;
}

/**
 * tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
 *
 * @path: Pointer to "struct path".
 *
 * Returns the realpath of the given @path on success, NULL otherwise.
 *
 * If dentry is a directory, trailing '/' is appended.
 * Characters out of 0x20 < c < 0x7F range are converted to
 * \ooo style octal string.
 * Character \ is converted to \\ string.
 *
 * These functions use kzalloc(), so the caller must call kfree()
 * if these functions didn't return NULL.
 */
char *tomoyo_realpath_from_path(const struct path *path)
{
	char *buf = NULL;
	char *name = NULL;
	unsigned int buf_len = PAGE_SIZE / 2;
	struct dentry *dentry = path->dentry;
	struct super_block *sb;

	if (!dentry)
		return NULL;
	sb = dentry->d_sb;
	while (1) {
		char *pos;
		struct inode *inode;

		buf_len <<= 1;
		kfree(buf);
		buf = kmalloc(buf_len, GFP_NOFS);
		if (!buf)
			break;
		/* To make sure that pos is '\0' terminated. */
		buf[buf_len - 1] = '\0';
		/* Get better name for socket. */
		if (sb->s_magic == SOCKFS_MAGIC) {
			pos = tomoyo_get_socket_name(path, buf, buf_len - 1);
			goto encode;
		}
		/* For "pipe:[\$]". */
		if (dentry->d_op && dentry->d_op->d_dname) {
			pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
			goto encode;
		}
		inode = d_backing_inode(sb->s_root);
		/*
		 * Get local name for filesystems without rename() operation
		 * or dentry without vfsmount.
		 */
		if (!path->mnt ||
		    (!inode->i_op->rename &&
		     !(sb->s_type->fs_flags & FS_REQUIRES_DEV)))
			pos = tomoyo_get_local_path(path->dentry, buf,
						    buf_len - 1);
		/* Get absolute name for the rest. */
		else {
			pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
			/*
			 * Fall back to local name if absolute name is not
			 * available.
			 */
			if (pos == ERR_PTR(-EINVAL))
				pos = tomoyo_get_local_path(path->dentry, buf,
							    buf_len - 1);
		}
encode:
		if (IS_ERR(pos))
			continue;
		name = tomoyo_encode(pos);
		break;
	}
	kfree(buf);
	if (!name)
		tomoyo_warn_oom(__func__);
	return name;
}

/**
 * tomoyo_realpath_nofollow - Get realpath of a pathname.
 *
 * @pathname: The pathname to solve.
 *
 * Returns the realpath of @pathname on success, NULL otherwise.
 */
char *tomoyo_realpath_nofollow(const char *pathname)
{
	struct path path;

	if (pathname && kern_path(pathname, 0, &path) == 0) {
		char *buf = tomoyo_realpath_from_path(&path);

		path_put(&path);
		return buf;
	}
	return NULL;
}
Commit	Line	Data
b2441318	1	// SPDX-License-Identifier: GPL-2.0
c73bd6d4 KT	2	/*
	3	* security/tomoyo/realpath.c
	4	*
0f2a55d5	5	* Copyright (C) 2005-2011 NTT DATA CORPORATION
c73bd6d4 KT	6	*/
c73bd6d4 KT	7
c73bd6d4	8	#include "common.h"
d10577a8	9	#include <linux/magic.h>
c73bd6d4 KT	10
c73bd6d4 KT	11	/**
059d84db	12	* tomoyo_encode2 - Encode binary string to ascii string.
c73bd6d4	13	*
059d84db TH	14	* @str: String in binary format.
059d84db TH	15	* @str_len: Size of @str in byte.
c73bd6d4	16	*
c8c57e84 TH	17	* Returns pointer to @str in ascii format on success, NULL otherwise.
	18	*
	19	* This function uses kzalloc(), so caller must kfree() if this function
	20	* didn't return NULL.
c73bd6d4	21	*/
059d84db	22	char tomoyo_encode2(const char str, int str_len)
c73bd6d4	23	{
059d84db	24	int i;
c8c57e84 TH	25	int len = 0;
	26	const char *p = str;
	27	char *cp;
	28	char *cp0;
c73bd6d4	29
c8c57e84 TH	30	if (!p)
c8c57e84 TH	31	return NULL;
059d84db TH	32	for (i = 0; i < str_len; i++) {
	33	const unsigned char c = p[i];
	34
c8c57e84 TH	35	if (c == '\\')
	36	len += 2;
	37	else if (c > ' ' && c < 127)
	38	len++;
	39	else
	40	len += 4;
	41	}
	42	len++;
	43	/* Reserve space for appending "/". */
	44	cp = kzalloc(len + 10, GFP_NOFS);
	45	if (!cp)
	46	return NULL;
	47	cp0 = cp;
	48	p = str;
059d84db TH	49	for (i = 0; i < str_len; i++) {
059d84db TH	50	const unsigned char c = p[i];
c8c57e84 TH	51
	52	if (c == '\\') {
	53	*cp++ = '\\';
	54	*cp++ = '\\';
	55	} else if (c > ' ' && c < 127) {
	56	*cp++ = c;
	57	} else {
	58	*cp++ = '\\';
	59	*cp++ = (c >> 6) + '0';
	60	*cp++ = ((c >> 3) & 7) + '0';
	61	*cp++ = (c & 7) + '0';
c73bd6d4	62	}
c73bd6d4	63	}
c8c57e84	64	return cp0;
c73bd6d4 KT	65	}
c73bd6d4 KT	66
059d84db TH	67	/**
	68	* tomoyo_encode - Encode binary string to ascii string.
	69	*
	70	* @str: String in binary format.
	71	*
	72	* Returns pointer to @str in ascii format on success, NULL otherwise.
	73	*
	74	* This function uses kzalloc(), so caller must kfree() if this function
	75	* didn't return NULL.
	76	*/
	77	char tomoyo_encode(const char str)
	78	{
	79	return str ? tomoyo_encode2(str, strlen(str)) : NULL;
	80	}
	81
5625f2e3 TH	82	/**
	83	* tomoyo_get_absolute_path - Get the path of a dentry but ignores chroot'ed root.
	84	*
	85	* @path: Pointer to "struct path".
	86	* @buffer: Pointer to buffer to return value in.
	87	* @buflen: Sizeof @buffer.
	88	*
	89	* Returns the buffer on success, an error code otherwise.
	90	*
	91	* If dentry is a directory, trailing '/' is appended.
	92	*/
22473862	93	static char tomoyo_get_absolute_path(const struct path path, char * const buffer,
5625f2e3 TH	94	const int buflen)
	95	{
	96	char *pos = ERR_PTR(-ENOMEM);
cdcf6723	97
5625f2e3	98	if (buflen >= 256) {
5625f2e3	99	/* go to whatever namespace root we are under */
02125a82	100	pos = d_absolute_path(path, buffer, buflen - 1);
5625f2e3	101	if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
c6f493d6	102	struct inode *inode = d_backing_inode(path->dentry);
cdcf6723	103
5625f2e3 TH	104	if (inode && S_ISDIR(inode->i_mode)) {
	105	buffer[buflen - 2] = '/';
	106	buffer[buflen - 1] = '\0';
	107	}
	108	}
	109	}
	110	return pos;
	111	}
	112
	113	/**
	114	* tomoyo_get_dentry_path - Get the path of a dentry.
	115	*
	116	* @dentry: Pointer to "struct dentry".
	117	* @buffer: Pointer to buffer to return value in.
	118	* @buflen: Sizeof @buffer.
	119	*
	120	* Returns the buffer on success, an error code otherwise.
	121	*
	122	* If dentry is a directory, trailing '/' is appended.
	123	*/
	124	static char tomoyo_get_dentry_path(struct dentry dentry, char * const buffer,
	125	const int buflen)
	126	{
	127	char *pos = ERR_PTR(-ENOMEM);
cdcf6723	128
5625f2e3 TH	129	if (buflen >= 256) {
	130	pos = dentry_path_raw(dentry, buffer, buflen - 1);
	131	if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
c6f493d6	132	struct inode *inode = d_backing_inode(dentry);
cdcf6723	133
5625f2e3 TH	134	if (inode && S_ISDIR(inode->i_mode)) {
	135	buffer[buflen - 2] = '/';
	136	buffer[buflen - 1] = '\0';
	137	}
	138	}
	139	}
	140	return pos;
	141	}
	142
	143	/**
	144	* tomoyo_get_local_path - Get the path of a dentry.
	145	*
	146	* @dentry: Pointer to "struct dentry".
	147	* @buffer: Pointer to buffer to return value in.
	148	* @buflen: Sizeof @buffer.
	149	*
	150	* Returns the buffer on success, an error code otherwise.
	151	*/
	152	static char tomoyo_get_local_path(struct dentry dentry, char * const buffer,
	153	const int buflen)
	154	{
	155	struct super_block *sb = dentry->d_sb;
	156	char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
cdcf6723	157
5625f2e3 TH	158	if (IS_ERR(pos))
	159	return pos;
	160	/* Convert from $PID to self if $PID is current thread. */
	161	if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
	162	char *ep;
	163	const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
cdcf6723	164
5625f2e3 TH	165	if (*ep == '/' && pid && pid ==
	166	task_tgid_nr_ns(current, sb->s_fs_info)) {
	167	pos = ep - 5;
	168	if (pos < buffer)
	169	goto out;
	170	memmove(pos, "/self", 5);
	171	}
	172	goto prepend_filesystem_name;
	173	}
	174	/* Use filesystem name for unnamed devices. */
	175	if (!MAJOR(sb->s_dev))
	176	goto prepend_filesystem_name;
	177	{
c6f493d6	178	struct inode *inode = d_backing_inode(sb->s_root);
cdcf6723	179
5625f2e3 TH	180	/*
	181	* Use filesystem name if filesystem does not support rename()
	182	* operation.
	183	*/
2773bf00	184	if (!inode->i_op->rename)
5625f2e3 TH	185	goto prepend_filesystem_name;
	186	}
	187	/* Prepend device name. */
	188	{
	189	char name[64];
	190	int name_len;
	191	const dev_t dev = sb->s_dev;
cdcf6723	192
5625f2e3 TH	193	name[sizeof(name) - 1] = '\0';
	194	snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
	195	MINOR(dev));
	196	name_len = strlen(name);
	197	pos -= name_len;
	198	if (pos < buffer)
	199	goto out;
	200	memmove(pos, name, name_len);
	201	return pos;
	202	}
	203	/* Prepend filesystem name. */
	204	prepend_filesystem_name:
	205	{
	206	const char *name = sb->s_type->name;
	207	const int name_len = strlen(name);
cdcf6723	208
5625f2e3 TH	209	pos -= name_len + 1;
	210	if (pos < buffer)
	211	goto out;
	212	memmove(pos, name, name_len);
	213	pos[name_len] = ':';
	214	}
	215	return pos;
	216	out:
	217	return ERR_PTR(-ENOMEM);
	218	}
	219
	220	/**
	221	* tomoyo_get_socket_name - Get the name of a socket.
	222	*
	223	* @path: Pointer to "struct path".
	224	* @buffer: Pointer to buffer to return value in.
	225	* @buflen: Sizeof @buffer.
	226	*
	227	* Returns the buffer.
	228	*/
22473862	229	static char tomoyo_get_socket_name(const struct path path, char * const buffer,
5625f2e3 TH	230	const int buflen)
5625f2e3 TH	231	{
c6f493d6	232	struct inode *inode = d_backing_inode(path->dentry);
5625f2e3 TH	233	struct socket *sock = inode ? SOCKET_I(inode) : NULL;
5625f2e3 TH	234	struct sock *sk = sock ? sock->sk : NULL;
cdcf6723	235
5625f2e3	236	if (sk) {
cdcf6723 TH	237	snprintf(buffer, buflen, "socket:[family=%u:type=%u:protocol=%u]",
cdcf6723 TH	238	sk->sk_family, sk->sk_type, sk->sk_protocol);
5625f2e3 TH	239	} else {
	240	snprintf(buffer, buflen, "socket:[unknown]");
	241	}
	242	return buffer;
	243	}
	244
c73bd6d4	245	/**
c8c57e84	246	* tomoyo_realpath_from_path - Returns realpath(3) of the given pathname but ignores chroot'ed root.
c73bd6d4	247	*
c8c57e84	248	* @path: Pointer to "struct path".
c73bd6d4	249	*
c8c57e84	250	* Returns the realpath of the given @path on success, NULL otherwise.
c73bd6d4 KT	251	*
	252	* If dentry is a directory, trailing '/' is appended.
	253	* Characters out of 0x20 < c < 0x7F range are converted to
	254	* \ooo style octal string.
	255	* Character \ is converted to \\ string.
c8c57e84 TH	256	*
	257	* These functions use kzalloc(), so the caller must call kfree()
	258	* if these functions didn't return NULL.
c73bd6d4	259	*/
22473862	260	char tomoyo_realpath_from_path(const struct path path)
c73bd6d4	261	{
c8c57e84 TH	262	char *buf = NULL;
	263	char *name = NULL;
	264	unsigned int buf_len = PAGE_SIZE / 2;
c73bd6d4	265	struct dentry *dentry = path->dentry;
5625f2e3	266	struct super_block *sb;
cdcf6723	267
c8c57e84 TH	268	if (!dentry)
c8c57e84 TH	269	return NULL;
5625f2e3	270	sb = dentry->d_sb;
c8c57e84	271	while (1) {
c8c57e84	272	char *pos;
5625f2e3	273	struct inode *inode;
cdcf6723	274
c8c57e84 TH	275	buf_len <<= 1;
	276	kfree(buf);
	277	buf = kmalloc(buf_len, GFP_NOFS);
	278	if (!buf)
	279	break;
5625f2e3 TH	280	/* To make sure that pos is '\0' terminated. */
5625f2e3 TH	281	buf[buf_len - 1] = '\0';
c8c57e84	282	/* Get better name for socket. */
5625f2e3 TH	283	if (sb->s_magic == SOCKFS_MAGIC) {
	284	pos = tomoyo_get_socket_name(path, buf, buf_len - 1);
	285	goto encode;
c8c57e84	286	}
5625f2e3	287	/* For "pipe:[\$]". */
c8c57e84 TH	288	if (dentry->d_op && dentry->d_op->d_dname) {
c8c57e84 TH	289	pos = dentry->d_op->d_dname(dentry, buf, buf_len - 1);
5625f2e3	290	goto encode;
c73bd6d4	291	}
c6f493d6	292	inode = d_backing_inode(sb->s_root);
5625f2e3 TH	293	/*
	294	* Get local name for filesystems without rename() operation
	295	* or dentry without vfsmount.
	296	*/
8fe7a268	297	if (!path->mnt \|\|
27df4b4a TH	298	(!inode->i_op->rename &&
27df4b4a TH	299	!(sb->s_type->fs_flags & FS_REQUIRES_DEV)))
5625f2e3 TH	300	pos = tomoyo_get_local_path(path->dentry, buf,
	301	buf_len - 1);
	302	/* Get absolute name for the rest. */
1418a3e5	303	else {
5625f2e3	304	pos = tomoyo_get_absolute_path(path, buf, buf_len - 1);
1418a3e5 TH	305	/*
	306	* Fall back to local name if absolute name is not
	307	* available.
	308	*/
	309	if (pos == ERR_PTR(-EINVAL))
	310	pos = tomoyo_get_local_path(path->dentry, buf,
	311	buf_len - 1);
	312	}
5625f2e3	313	encode:
c8c57e84 TH	314	if (IS_ERR(pos))
	315	continue;
	316	name = tomoyo_encode(pos);
	317	break;
c73bd6d4	318	}
8e2d39a1	319	kfree(buf);
c8c57e84 TH	320	if (!name)
c8c57e84 TH	321	tomoyo_warn_oom(__func__);
c8c57e84	322	return name;
c73bd6d4 KT	323	}
c73bd6d4 KT	324
c73bd6d4 KT	325	/**
	326	* tomoyo_realpath_nofollow - Get realpath of a pathname.
	327	*
	328	* @pathname: The pathname to solve.
	329	*
	330	* Returns the realpath of @pathname on success, NULL otherwise.
	331	*/
	332	char tomoyo_realpath_nofollow(const char pathname)
	333	{
e24977d4	334	struct path path;
c73bd6d4	335
e24977d4 AV	336	if (pathname && kern_path(pathname, 0, &path) == 0) {
e24977d4 AV	337	char *buf = tomoyo_realpath_from_path(&path);
cdcf6723	338
e24977d4	339	path_put(&path);
c73bd6d4 KT	340	return buf;
	341	}
	342	return NULL;
	343	}