inode.c 10.5 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22
/*
 *  inode.c - securityfs
 *
 *  Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License version
 *	2 as published by the Free Software Foundation.
 *
 *  Based on fs/debugfs/inode.c which had the following copyright notice:
 *    Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
 *    Copyright (C) 2004 IBM Inc.
 */

/* #define DEBUG */
#include <linux/module.h>
#include <linux/fs.h>
#include <linux/mount.h>
#include <linux/pagemap.h>
#include <linux/init.h>
#include <linux/namei.h>
#include <linux/security.h>
23
#include <linux/lsm_hooks.h>
Mimi Zohar's avatar
Mimi Zohar committed
24
#include <linux/magic.h>
25 26 27 28

static struct vfsmount *mount;
static int mount_count;

29 30 31 32 33 34 35 36 37 38 39 40 41
static void securityfs_evict_inode(struct inode *inode)
{
	truncate_inode_pages_final(&inode->i_data);
	clear_inode(inode);
	if (S_ISLNK(inode->i_mode))
		kfree(inode->i_link);
}

static const struct super_operations securityfs_super_operations = {
	.statfs		= simple_statfs,
	.evict_inode	= securityfs_evict_inode,
};

42 43
static int fill_super(struct super_block *sb, void *data, int silent)
{
44
	static const struct tree_descr files[] = {{""}};
45 46 47 48 49 50 51
	int error;

	error = simple_fill_super(sb, SECURITYFS_MAGIC, files);
	if (error)
		return error;

	sb->s_op = &securityfs_super_operations;
52

53
	return 0;
54 55
}

Al Viro's avatar
Al Viro committed
56
static struct dentry *get_sb(struct file_system_type *fs_type,
57
		  int flags, const char *dev_name,
Al Viro's avatar
Al Viro committed
58
		  void *data)
59
{
Al Viro's avatar
Al Viro committed
60
	return mount_single(fs_type, flags, data, fill_super);
61 62 63 64 65
}

static struct file_system_type fs_type = {
	.owner =	THIS_MODULE,
	.name =		"securityfs",
Al Viro's avatar
Al Viro committed
66
	.mount =	get_sb,
67 68 69 70
	.kill_sb =	kill_litter_super,
};

/**
71
 * securityfs_create_dentry - create a dentry in the securityfs filesystem
72 73 74 75
 *
 * @name: a pointer to a string containing the name of the file to create.
 * @mode: the permission that the file should have
 * @parent: a pointer to the parent dentry for this file.  This should be a
76
 *          directory dentry if set.  If this parameter is %NULL, then the
77 78
 *          file will be created in the root of the securityfs filesystem.
 * @data: a pointer to something that the caller will want to get to later
79
 *        on.  The inode.i_private pointer will point to this value on
80 81 82
 *        the open() call.
 * @fops: a pointer to a struct file_operations that should be used for
 *        this file.
83 84
 * @iops: a point to a struct of inode_operations that should be used for
 *        this file/dir
85
 *
86 87 88 89 90
 * This is the basic "create a file/dir/symlink" function for
 * securityfs.  It allows for a wide range of flexibility in creating
 * a file, or a directory (if you want to create a directory, the
 * securityfs_create_dir() function is recommended to be used
 * instead).
91
 *
92
 * This function returns a pointer to a dentry if it succeeds.  This
93 94 95 96
 * pointer must be passed to the securityfs_remove() function when the
 * file is to be removed (no automatic cleanup happens if your module
 * is unloaded, you are responsible here).  If an error occurs, the
 * function will return the error value (via ERR_PTR).
97
 *
98
 * If securityfs is not enabled in the kernel, the value %-ENODEV is
99
 * returned.
100
 */
101 102 103 104
static struct dentry *securityfs_create_dentry(const char *name, umode_t mode,
					struct dentry *parent, void *data,
					const struct file_operations *fops,
					const struct inode_operations *iops)
105
{
106 107
	struct dentry *dentry;
	struct inode *dir, *inode;
108 109
	int error;

110
	if (!(mode & S_IFMT))
111 112
		mode = (mode & S_IALLUGO) | S_IFREG;

113 114
	pr_debug("securityfs: creating file '%s'\n",name);

115
	error = simple_pin_fs(&fs_type, &mount, &mount_count);
116 117 118 119 120 121
	if (error)
		return ERR_PTR(error);

	if (!parent)
		parent = mount->mnt_root;

122
	dir = d_inode(parent);
123

Al Viro's avatar
Al Viro committed
124
	inode_lock(dir);
125 126 127 128
	dentry = lookup_one_len(name, parent, strlen(name));
	if (IS_ERR(dentry))
		goto out;

129
	if (d_really_is_positive(dentry)) {
130 131
		error = -EEXIST;
		goto out1;
132 133
	}

134 135 136 137
	inode = new_inode(dir->i_sb);
	if (!inode) {
		error = -ENOMEM;
		goto out1;
138 139
	}

140 141
	inode->i_ino = get_next_ino();
	inode->i_mode = mode;
142
	inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
143
	inode->i_private = data;
144
	if (S_ISDIR(mode)) {
145 146 147 148
		inode->i_op = &simple_dir_inode_operations;
		inode->i_fop = &simple_dir_operations;
		inc_nlink(inode);
		inc_nlink(dir);
149 150 151
	} else if (S_ISLNK(mode)) {
		inode->i_op = iops ? iops : &simple_symlink_inode_operations;
		inode->i_link = data;
152 153
	} else {
		inode->i_fop = fops;
154
	}
155 156
	d_instantiate(dentry, inode);
	dget(dentry);
Al Viro's avatar
Al Viro committed
157
	inode_unlock(dir);
158 159 160 161 162 163
	return dentry;

out1:
	dput(dentry);
	dentry = ERR_PTR(error);
out:
Al Viro's avatar
Al Viro committed
164
	inode_unlock(dir);
165
	simple_release_fs(&mount, &mount_count);
166 167
	return dentry;
}
168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199

/**
 * securityfs_create_file - create a file in the securityfs filesystem
 *
 * @name: a pointer to a string containing the name of the file to create.
 * @mode: the permission that the file should have
 * @parent: a pointer to the parent dentry for this file.  This should be a
 *          directory dentry if set.  If this parameter is %NULL, then the
 *          file will be created in the root of the securityfs filesystem.
 * @data: a pointer to something that the caller will want to get to later
 *        on.  The inode.i_private pointer will point to this value on
 *        the open() call.
 * @fops: a pointer to a struct file_operations that should be used for
 *        this file.
 *
 * This function creates a file in securityfs with the given @name.
 *
 * This function returns a pointer to a dentry if it succeeds.  This
 * pointer must be passed to the securityfs_remove() function when the file is
 * to be removed (no automatic cleanup happens if your module is unloaded,
 * you are responsible here).  If an error occurs, the function will return
 * the error value (via ERR_PTR).
 *
 * If securityfs is not enabled in the kernel, the value %-ENODEV is
 * returned.
 */
struct dentry *securityfs_create_file(const char *name, umode_t mode,
				      struct dentry *parent, void *data,
				      const struct file_operations *fops)
{
	return securityfs_create_dentry(name, mode, parent, data, fops, NULL);
}
200 201 202 203 204 205 206 207
EXPORT_SYMBOL_GPL(securityfs_create_file);

/**
 * securityfs_create_dir - create a directory in the securityfs filesystem
 *
 * @name: a pointer to a string containing the name of the directory to
 *        create.
 * @parent: a pointer to the parent dentry for this file.  This should be a
208
 *          directory dentry if set.  If this parameter is %NULL, then the
209 210
 *          directory will be created in the root of the securityfs filesystem.
 *
211
 * This function creates a directory in securityfs with the given @name.
212
 *
213
 * This function returns a pointer to a dentry if it succeeds.  This
214 215
 * pointer must be passed to the securityfs_remove() function when the file is
 * to be removed (no automatic cleanup happens if your module is unloaded,
216 217
 * you are responsible here).  If an error occurs, the function will return
 * the error value (via ERR_PTR).
218
 *
219
 * If securityfs is not enabled in the kernel, the value %-ENODEV is
220
 * returned.
221 222 223
 */
struct dentry *securityfs_create_dir(const char *name, struct dentry *parent)
{
224
	return securityfs_create_file(name, S_IFDIR | 0755, parent, NULL, NULL);
225 226 227
}
EXPORT_SYMBOL_GPL(securityfs_create_dir);

228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275
/**
 * securityfs_create_symlink - create a symlink in the securityfs filesystem
 *
 * @name: a pointer to a string containing the name of the symlink to
 *        create.
 * @parent: a pointer to the parent dentry for the symlink.  This should be a
 *          directory dentry if set.  If this parameter is %NULL, then the
 *          directory will be created in the root of the securityfs filesystem.
 * @target: a pointer to a string containing the name of the symlink's target.
 *          If this parameter is %NULL, then the @iops parameter needs to be
 *          setup to handle .readlink and .get_link inode_operations.
 * @iops: a pointer to the struct inode_operations to use for the symlink. If
 *        this parameter is %NULL, then the default simple_symlink_inode
 *        operations will be used.
 *
 * This function creates a symlink in securityfs with the given @name.
 *
 * This function returns a pointer to a dentry if it succeeds.  This
 * pointer must be passed to the securityfs_remove() function when the file is
 * to be removed (no automatic cleanup happens if your module is unloaded,
 * you are responsible here).  If an error occurs, the function will return
 * the error value (via ERR_PTR).
 *
 * If securityfs is not enabled in the kernel, the value %-ENODEV is
 * returned.
 */
struct dentry *securityfs_create_symlink(const char *name,
					 struct dentry *parent,
					 const char *target,
					 const struct inode_operations *iops)
{
	struct dentry *dent;
	char *link = NULL;

	if (target) {
		link = kstrdup(target, GFP_KERNEL);
		if (!link)
			return ERR_PTR(-ENOMEM);
	}
	dent = securityfs_create_dentry(name, S_IFLNK | 0444, parent,
					link, NULL, iops);
	if (IS_ERR(dent))
		kfree(link);

	return dent;
}
EXPORT_SYMBOL_GPL(securityfs_create_symlink);

276 277 278
/**
 * securityfs_remove - removes a file or directory from the securityfs filesystem
 *
279
 * @dentry: a pointer to a the dentry of the file or directory to be removed.
280 281 282 283 284 285
 *
 * This function removes a file or directory in securityfs that was previously
 * created with a call to another securityfs function (like
 * securityfs_create_file() or variants thereof.)
 *
 * This function is required to be called in order for the file to be
286 287
 * removed. No automatic cleanup of files will happen when a module is
 * removed; you are responsible here.
288 289 290
 */
void securityfs_remove(struct dentry *dentry)
{
291
	struct inode *dir;
292

293
	if (!dentry || IS_ERR(dentry))
294 295
		return;

296 297
	dir = d_inode(dentry->d_parent);
	inode_lock(dir);
Al Viro's avatar
Al Viro committed
298 299
	if (simple_positive(dentry)) {
		if (d_is_dir(dentry))
300
			simple_rmdir(dir, dentry);
Al Viro's avatar
Al Viro committed
301
		else
302
			simple_unlink(dir, dentry);
Al Viro's avatar
Al Viro committed
303
		dput(dentry);
304
	}
305
	inode_unlock(dir);
306 307 308 309
	simple_release_fs(&mount, &mount_count);
}
EXPORT_SYMBOL_GPL(securityfs_remove);

310 311 312 313 314 315 316 317 318 319 320 321 322 323 324
#ifdef CONFIG_SECURITY
static struct dentry *lsm_dentry;
static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
			loff_t *ppos)
{
	return simple_read_from_buffer(buf, count, ppos, lsm_names,
		strlen(lsm_names));
}

static const struct file_operations lsm_ops = {
	.read = lsm_read,
	.llseek = generic_file_llseek,
};
#endif

325 326 327 328
static int __init securityfs_init(void)
{
	int retval;

329 330 331
	retval = sysfs_create_mount_point(kernel_kobj, "security");
	if (retval)
		return retval;
332 333

	retval = register_filesystem(&fs_type);
334
	if (retval) {
335
		sysfs_remove_mount_point(kernel_kobj, "security");
336 337 338 339 340 341 342
		return retval;
	}
#ifdef CONFIG_SECURITY
	lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
						&lsm_ops);
#endif
	return 0;
343 344 345 346 347
}

core_initcall(securityfs_init);
MODULE_LICENSE("GPL");