)]}'
{
  "commit": "f7433243770c77979c396b4c7449a10e9b3521db",
  "tree": "8bcb3d92ddb65b73f1802c5476d75f92814477d8",
  "parents": [
    "26a2a1c9eb88d9aca8891575b3b986812e073872"
  ],
  "author": {
    "name": "Kentaro Takeda",
    "email": "takedakn@nttdata.co.jp",
    "time": "Thu Feb 05 17:18:16 2009 +0900"
  },
  "committer": {
    "name": "James Morris",
    "email": "jmorris@namei.org",
    "time": "Thu Feb 12 15:15:05 2009 +1100"
  },
  "message": "LSM adapter functions.\n\nDAC\u0027s permissions and TOMOYO\u0027s permissions are not one-to-one mapping.\n\nRegarding DAC, there are \"read\", \"write\", \"execute\" permissions.\nRegarding TOMOYO, there are \"allow_read\", \"allow_write\", \"allow_read/write\",\n\"allow_execute\", \"allow_create\", \"allow_unlink\", \"allow_mkdir\", \"allow_rmdir\",\n\"allow_mkfifo\", \"allow_mksock\", \"allow_mkblock\", \"allow_mkchar\",\n\"allow_truncate\", \"allow_symlink\", \"allow_rewrite\", \"allow_link\",\n\"allow_rename\" permissions.\n\n+----------------------------------+----------------------------------+\n| requested operation              | required TOMOYO\u0027s permission     |\n+----------------------------------+----------------------------------+\n| sys_open(O_RDONLY)               | allow_read                       |\n+----------------------------------+----------------------------------+\n| sys_open(O_WRONLY)               | allow_write                      |\n+----------------------------------+----------------------------------+\n| sys_open(O_RDWR)                 | allow_read/write                 |\n+----------------------------------+----------------------------------+\n| open_exec() from do_execve()     | allow_execute                    |\n+----------------------------------+----------------------------------+\n| open_exec() from !do_execve()    | allow_read                       |\n+----------------------------------+----------------------------------+\n| sys_read()                       | (none)                           |\n+----------------------------------+----------------------------------+\n| sys_write()                      | (none)                           |\n+----------------------------------+----------------------------------+\n| sys_mmap()                       | (none)                           |\n+----------------------------------+----------------------------------+\n| sys_uselib()                     | allow_read                       |\n+----------------------------------+----------------------------------+\n| sys_open(O_CREAT)                | allow_create                     |\n+----------------------------------+----------------------------------+\n| sys_open(O_TRUNC)                | allow_truncate                   |\n+----------------------------------+----------------------------------+\n| sys_truncate()                   | allow_truncate                   |\n+----------------------------------+----------------------------------+\n| sys_ftruncate()                  | allow_truncate                   |\n+----------------------------------+----------------------------------+\n| sys_open() without O_APPEND      | allow_rewrite                    |\n+----------------------------------+----------------------------------+\n| setfl() without O_APPEND         | allow_rewrite                    |\n+----------------------------------+----------------------------------+\n| sys_sysctl() for writing         | allow_write                      |\n+----------------------------------+----------------------------------+\n| sys_sysctl() for reading         | allow_read                       |\n+----------------------------------+----------------------------------+\n| sys_unlink()                     | allow_unlink                     |\n+----------------------------------+----------------------------------+\n| sys_mknod(S_IFREG)               | allow_create                     |\n+----------------------------------+----------------------------------+\n| sys_mknod(0)                     | allow_create                     |\n+----------------------------------+----------------------------------+\n| sys_mknod(S_IFIFO)               | allow_mkfifo                     |\n+----------------------------------+----------------------------------+\n| sys_mknod(S_IFSOCK)              | allow_mksock                     |\n+----------------------------------+----------------------------------+\n| sys_bind(AF_UNIX)                | allow_mksock                     |\n+----------------------------------+----------------------------------+\n| sys_mknod(S_IFBLK)               | allow_mkblock                    |\n+----------------------------------+----------------------------------+\n| sys_mknod(S_IFCHR)               | allow_mkchar                     |\n+----------------------------------+----------------------------------+\n| sys_symlink()                    | allow_symlink                    |\n+----------------------------------+----------------------------------+\n| sys_mkdir()                      | allow_mkdir                      |\n+----------------------------------+----------------------------------+\n| sys_rmdir()                      | allow_rmdir                      |\n+----------------------------------+----------------------------------+\n| sys_link()                       | allow_link                       |\n+----------------------------------+----------------------------------+\n| sys_rename()                     | allow_rename                     |\n+----------------------------------+----------------------------------+\n\nTOMOYO requires \"allow_execute\" permission of a pathname passed to do_execve()\nbut does not require \"allow_read\" permission of that pathname.\nLet\u0027s consider 3 patterns (statically linked, dynamically linked,\nshell script). This description is to some degree simplified.\n\n  $ cat hello.c\n  #include \u003cstdio.h\u003e\n  int main() {\n          printf(\"Hello\\n\");\n          return 0;\n  }\n  $ cat hello.sh\n  #! /bin/sh\n  echo \"Hello\"\n  $ gcc -static -o hello-static hello.c\n  $ gcc -o hello-dynamic hello.c\n  $ chmod 755 hello.sh\n\nCase 1 -- Executing hello-static from bash.\n\n  (1) The bash process calls fork() and the child process requests\n      do_execve(\"hello-static\").\n\n  (2) The kernel checks \"allow_execute hello-static\" from \"bash\" domain.\n\n  (3) The kernel calculates \"bash hello-static\" as the domain to transit to.\n\n  (4) The kernel overwrites the child process by \"hello-static\".\n\n  (5) The child process transits to \"bash hello-static\" domain.\n\n  (6) The \"hello-static\" starts and finishes.\n\nCase 2 -- Executing hello-dynamic from bash.\n\n  (1) The bash process calls fork() and the child process requests\n      do_execve(\"hello-dynamic\").\n\n  (2) The kernel checks \"allow_execute hello-dynamic\" from \"bash\" domain.\n\n  (3) The kernel calculates \"bash hello-dynamic\" as the domain to transit to.\n\n  (4) The kernel checks \"allow_read ld-linux.so\" from \"bash hello-dynamic\"\n      domain. I think permission to access ld-linux.so should be charged\n      hello-dynamic program, for \"hello-dynamic needs ld-linux.so\" is not\n      a fault of bash program.\n\n  (5) The kernel overwrites the child process by \"hello-dynamic\".\n\n  (6) The child process transits to \"bash hello-dynamic\" domain.\n\n  (7) The \"hello-dynamic\" starts and finishes.\n\nCase 3 -- Executing hello.sh from bash.\n\n  (1) The bash process calls fork() and the child process requests\n      do_execve(\"hello.sh\").\n\n  (2) The kernel checks \"allow_execute hello.sh\" from \"bash\" domain.\n\n  (3) The kernel calculates \"bash hello.sh\" as the domain to transit to.\n\n  (4) The kernel checks \"allow_read /bin/sh\" from \"bash hello.sh\" domain.\n      I think permission to access /bin/sh should be charged hello.sh program,\n      for \"hello.sh needs /bin/sh\" is not a fault of bash program.\n\n  (5) The kernel overwrites the child process by \"/bin/sh\".\n\n  (6) The child process transits to \"bash hello.sh\" domain.\n\n  (7) The \"/bin/sh\" requests open(\"hello.sh\").\n\n  (8) The kernel checks \"allow_read hello.sh\" from  \"bash hello.sh\" domain.\n\n  (9) The \"/bin/sh\" starts and finishes.\n\nWhether a file is interpreted as a program or not depends on an application.\nThe kernel cannot know whether the file is interpreted as a program or not.\nThus, TOMOYO treats \"hello-static\" \"hello-dynamic\" \"ld-linux.so\" \"hello.sh\"\n\"/bin/sh\" equally as merely files; no distinction between executable and\nnon-executable. Therefore, TOMOYO doesn\u0027t check DAC\u0027s execute permission.\nTOMOYO checks \"allow_read\" permission instead.\n\nCalling do_execve() is a bold gesture that an old program\u0027s instance (i.e.\ncurrent process) is ready to be overwritten by a new program and is ready to\ntransfer control to the new program. To split purview of programs, TOMOYO\nrequires \"allow_execute\" permission of the new program against the old\nprogram\u0027s instance and performs domain transition. If do_execve() succeeds,\nthe old program is no longer responsible against the consequence of the new\nprogram\u0027s behavior. Only the new program is responsible for all consequences.\n\nBut TOMOYO doesn\u0027t require \"allow_read\" permission of the new program.\nIf TOMOYO requires \"allow_read\" permission of the new program, TOMOYO will\nallow an attacker (who hijacked the old program\u0027s instance) to open the new\nprogram and steal data from the new program. Requiring \"allow_read\" permission\nwill widen purview of the old program.\n\nNot requiring \"allow_read\" permission of the new program against the old\nprogram\u0027s instance is my design for reducing purview of the old program.\nTo be able to know whether the current process is in do_execve() or not,\nI want to add in_execve flag to \"task_struct\".\n\nSigned-off-by: Kentaro Takeda \u003ctakedakn@nttdata.co.jp\u003e\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nSigned-off-by: Toshiharu Harada \u003charadats@nttdata.co.jp\u003e\nSigned-off-by: James Morris \u003cjmorris@namei.org\u003e\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "f3ab20758c0f1c3f2377f33e632b79e7a94b2715",
      "new_mode": 33188,
      "new_path": "security/tomoyo/tomoyo.c"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "a0c8f6e0bea4e7b947c2b0247c16a6b5f2238aa3",
      "new_mode": 33188,
      "new_path": "security/tomoyo/tomoyo.h"
    }
  ]
}