Tomoyo Linux (undone)

Directory

1. Tomoyo Introduction

2. Tomoyo SourceCode Analysis

1. Introduction

Tomoyo is a lsms (security module) based on the LSM framework implementation

Relevant Link:

http://lxr.free-electrons.com/source/documentation/security/tomoyo.txt

2. Tomoyo SourceCode Analysis

Monitoring log as an example of network connection state function (sys_connect) monitoring (Tomoyo_socket_connect)

/source/security/tomoyo/tomoyo.c

/* * * * * * Tomoyo_socket_connect-check permission for Connect (). * * @sock:     Pointer to "struct socket". * @addr:     Poi Nter to "struct sockaddr". * @addr_len: A Size of @addr. * * Returns 0 on success, negative value otherwise. */int tomoyo_socket_connect (intreturn tomoyo_socket_connect_permission (sock, addr, Addr_len) ;}

/source/security/tomoyo/network.c

/** * Tomoyo_sock_family-get socket ' s family.** @sk: Pointer to "struct sock". * * Returns one of pf_inet, Pf_inet6, Pf_unix or 0.*/Static U8 tomoyo_sock_family (struct sock *SK) {U8 family;If(Tomoyo_kernel_service ())Return0; Family = sk->sk_family;Switch(family) {CasePf_inet:CasePF_INET6:CasePf_unix:ReturnFamilyDefault:Return0; }}/** * Tomoyo_socket_connect_permission-check permission for setting the remote address of a socket.** @sock: Pointer to "St Ruct socket ". * @addr: Pointer to ' struct sockaddr '. * @addr_len: Size of @addr. * * Returns 0 on success, negative value othe Rwise.*/int Tomoyo_socket_connect_permission (struct Socket *sock,struct SOCKADDR *addr,IntAddr_len) {structTomoyo_addr_info address;//Get socket ' s family. (family is the concept of link layer)Const U8 Family = tomoyo_sock_family (sock->SK);//Type of socket (TCP, UDP ...) (Type is the concept of the transport layer)Const unsignedint type = sock->Typeif (!FamilyReturn0; Address.protocol =TypeSwitch(type) {CaseSock_dgram:CaseSOCK_RAW:address.operation =Tomoyo_network_send;Break;CaseSock_stream:CaseSOCK_SEQPACKET:address.operation =Tomoyo_network_connect;Break;Default:Return0; }if (family = =Pf_unix)return tomoyo_check_unix_address (addr, Addr_len, &address);return tomoyo_check_inet_address (addr, Addr_len, Sock->sk->sk_protocol, &address);}/*Structure for holding socket address.*/structTomoyo_addr_info {U8 protocol; U8 operation;structTomoyo_inet_addr_info inet;structTomoyo_unix_addr_info unix0;};Staticint tomoyo_check_inet_address (Conststruct SOCKADDR *addr,Const unsignedint Addr_len,Const U16 Port,struct Tomoyo_addr_info *Address) {struct Tomoyo_inet_addr_info *i = &address->inetSwitch (addr->sa_family) {CaseAF_INET6:if (Addr_len <sin6_len_rfc2133)GotoSkip I->is_ipv6 =True; I->address = (__BE32 *) ((struct sockaddr_in6 *) addr)SIN6_ADDR.S6_ADDR; I->port = ((struct sockaddr_in6 *) addr)Sin6_port;Break;CaseAf_inet:if (Addr_len <sizeofstructSOCKADDR_IN))GotoSkip I->is_ipv6 =Falsestruct sockaddr_in *) Addr)->SIN_ADDR; i->port = ((struct sockaddr_in * ) addr)->sin_port; breakdefaultgoto skip; } if (Address->protocol == Sock_raw) I->port =< Span style= "color: #000000;" > htons (port); return Tomoyo_inet_entry (address); Skip: return 0       

Relevant Link:

Copyright (c) Littlehann All rights reserved

Tomoyo Linux (undone)