dasharo/linux
0
0
Fork 0
mirror of https://github.com/Dasharo/linux.git synced 2026-03-06 15:25:10 -08:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'tomoyo-pr-20250123' of git://git.code.sf.net/p/tomoyo/tomoyo

Browse Source 
Pull tomoyo updates from Tetsuo Handa:
 "Small changes to improve usability"

* tag 'tomoyo-pr-20250123' of git://git.code.sf.net/p/tomoyo/tomoyo:
  tomoyo: automatically use patterns for several situations in learning mode
  tomoyo: use realpath if symlink's pathname refers to procfs
  tomoyo: don't emit warning in tomoyo_write_control()
This commit is contained in:
Linus Torvalds
2025-01-22 20:25:00 -08:00
parent de5817bbfb 08ae2487b2
commit ad2aec7c96
2 changed files with 40 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
security/tomoyo/common.c
View File

@@ -2024,6 +2024,36 @@ static void tomoyo_add_entry(struct tomoyo_domain_info *domain, char *header)
if (!buffer)
return;
snprintf(buffer, len - 1, "%s", cp);
if (*cp == 'f' && strchr(buffer, ':')) {
/* Automatically replace 2 or more digits with \$ pattern. */
char *cp2;
/* e.g. file read proc:/$PID/stat */
cp = strstr(buffer, " proc:/");
if (cp && simple_strtoul(cp + 7, &cp2, 10) >= 10 && *cp2 == '/') {
*(cp + 7) = '\\';
*(cp + 8) = '$';
memmove(cp + 9, cp2, strlen(cp2) + 1);
goto ok;
}
/* e.g. file ioctl pipe:[$INO] $CMD */
cp = strstr(buffer, " pipe:[");
if (cp && simple_strtoul(cp + 7, &cp2, 10) >= 10 && *cp2 == ']') {
*(cp + 7) = '\\';
*(cp + 8) = '$';
memmove(cp + 9, cp2, strlen(cp2) + 1);
goto ok;
}
/* e.g. file ioctl socket:[$INO] $CMD */
cp = strstr(buffer, " socket:[");
if (cp && simple_strtoul(cp + 9, &cp2, 10) >= 10 && *cp2 == ']') {
*(cp + 9) = '\\';
*(cp + 10) = '$';
memmove(cp + 11, cp2, strlen(cp2) + 1);
goto ok;
}
}
ok:
if (realpath)
tomoyo_addprintf(buffer, len, " exec.%s", realpath);
if (argv0)
@@ -2665,7 +2695,7 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
if (head->w.avail >= head->writebuf_size - 1) {
const int len = head->writebuf_size * 2;
char *cp = kzalloc(len, GFP_NOFS);
char *cp = kzalloc(len, GFP_NOFS | __GFP_NOWARN);
if (!cp) {
error = -ENOMEM;

11
security/tomoyo/domain.c
View File

@@ -722,10 +722,17 @@ int tomoyo_find_next_domain(struct linux_binprm *bprm)
ee->bprm = bprm;
ee->r.obj = &ee->obj;
ee->obj.path1 = bprm->file->f_path;
/* Get symlink's pathname of program. */
/*
* Get symlink's pathname of program, but fallback to realpath if
* symlink's pathname does not exist or symlink's pathname refers
* to proc filesystem (e.g. /dev/fd/<num> or /proc/self/fd/<num> ).
*/
exename.name = tomoyo_realpath_nofollow(original_name);
if (exename.name && !strncmp(exename.name, "proc:/", 6)) {
kfree(exename.name);
exename.name = NULL;
}
if (!exename.name) {
/* Fallback to realpath if symlink's pathname does not exist. */
exename.name = tomoyo_realpath_from_path(&bprm->file->f_path);
if (!exename.name)
goto out;