TOMOYO: Add environment variable name restriction support.

This patch adds support for checking environment variable's names.
Although TOMOYO already provides ability to check argv[]/envp[] passed to
execve() requests,

  file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="bar"

will reject execution of /bin/sh if environment variable LD_LIBRARY_PATH is not
defined. To grant execution of /bin/sh if LD_LIBRARY_PATH is not defined,
administrators have to specify like

  file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]="/system/lib"
  file execute /bin/sh exec.envp["LD_LIBRARY_PATH"]=NULL

. Since there are many environment variables whereas conditional checks are
applied as "&&", it is difficult to cover all combinations. Therefore, this
patch supports conditional checks that are applied as "||", by specifying like

  file execute /bin/sh
  misc env LD_LIBRARY_PATH exec.envp["LD_LIBRARY_PATH"]="/system/lib"

which means "grant execution of /bin/sh if environment variable is not defined
or is defined and its value is /system/lib".

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 9 insertions, 5 deletions

diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index 6a4195a4b93c..cb7d507b6312 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -42,6 +42,8 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
         [TOMOYO_MAC_FILE_MOUNT]      = TOMOYO_MAC_CATEGORY_FILE,
         [TOMOYO_MAC_FILE_UMOUNT]     = TOMOYO_MAC_CATEGORY_FILE,
         [TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
+        /* CONFIG::misc group */
+        [TOMOYO_MAC_ENVIRON]         = TOMOYO_MAC_CATEGORY_MISC,
 };
 
 /**
@@ -920,15 +922,17 @@ int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile,
                     const u8 index)
 {
         u8 mode;
-        const u8 category = TOMOYO_MAC_CATEGORY_FILE;
+        struct tomoyo_profile *p;
+
         if (!tomoyo_policy_loaded)
                 return TOMOYO_CONFIG_DISABLED;
-        mode = tomoyo_profile(ns, profile)->config[index];
+        p = tomoyo_profile(ns, profile);
+        mode = p->config[index];
         if (mode == TOMOYO_CONFIG_USE_DEFAULT)
-                mode = tomoyo_profile(ns, profile)->config
-                        [category + TOMOYO_MAX_MAC_INDEX];
+                mode = p->config[tomoyo_index2category[index]
+                                 + TOMOYO_MAX_MAC_INDEX];
         if (mode == TOMOYO_CONFIG_USE_DEFAULT)
-                mode = tomoyo_profile(ns, profile)->default_config;
+                mode = p->default_config;
         return mode & 3;
 }