TOMOYO: Rename directives. (0d2171d7) · Commits · EulixOS / Software / Kernel

security/tomoyo/common.c

+99 −48

Original line number	Original line	Diff line number	Diff line
	@@ -56,7 +56,7 @@ static const char *tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
	[TOMOYO_MAC_FILE_IOCTL] = "file::ioctl",		[TOMOYO_MAC_FILE_IOCTL] = "file::ioctl",
	[TOMOYO_MAC_FILE_CHROOT] = "file::chroot",		[TOMOYO_MAC_FILE_CHROOT] = "file::chroot",
	[TOMOYO_MAC_FILE_MOUNT] = "file::mount",		[TOMOYO_MAC_FILE_MOUNT] = "file::mount",
	[TOMOYO_MAC_FILE_UMOUNT] = "file::umount",		[TOMOYO_MAC_FILE_UMOUNT] = "file::unmount",
	[TOMOYO_MAC_FILE_PIVOT_ROOT] = "file::pivot_root",		[TOMOYO_MAC_FILE_PIVOT_ROOT] = "file::pivot_root",
	[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",		[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAC_CATEGORY_FILE] = "file",
	};		};
	@@ -171,17 +171,43 @@ void tomoyo_io_printf(struct tomoyo_io_buffer head, const char fmt, ...)
	tomoyo_set_string(head, head->read_buf + pos);		tomoyo_set_string(head, head->read_buf + pos);
	}		}

			/**
			* tomoyo_set_space - Put a space to "struct tomoyo_io_buffer" structure.
			*
			* @head: Pointer to "struct tomoyo_io_buffer".
			*
			* Returns nothing.
			*/
	static void tomoyo_set_space(struct tomoyo_io_buffer *head)		static void tomoyo_set_space(struct tomoyo_io_buffer *head)
	{		{
	tomoyo_set_string(head, " ");		tomoyo_set_string(head, " ");
	}		}

			/**
			* tomoyo_set_lf - Put a line feed to "struct tomoyo_io_buffer" structure.
			*
			* @head: Pointer to "struct tomoyo_io_buffer".
			*
			* Returns nothing.
			*/
	static bool tomoyo_set_lf(struct tomoyo_io_buffer *head)		static bool tomoyo_set_lf(struct tomoyo_io_buffer *head)
	{		{
	tomoyo_set_string(head, "\n");		tomoyo_set_string(head, "\n");
	return !head->r.w_pos;		return !head->r.w_pos;
	}		}

			/**
			* tomoyo_set_slash - Put a shash to "struct tomoyo_io_buffer" structure.
			*
			* @head: Pointer to "struct tomoyo_io_buffer".
			*
			* Returns nothing.
			*/
			static void tomoyo_set_slash(struct tomoyo_io_buffer *head)
			{
			tomoyo_set_string(head, "/");
			}

	/**		/**
	* tomoyo_print_name_union - Print a tomoyo_name_union.		* tomoyo_print_name_union - Print a tomoyo_name_union.
	*		*
	@@ -913,19 +939,17 @@ static int tomoyo_write_domain(struct tomoyo_io_buffer *head)
	}		}

	/**		/**
	* tomoyo_fns - Find next set bit.		* tomoyo_set_group - Print category name.
	*		*
	* @perm: 8 bits value.		* @head: Pointer to "struct tomoyo_io_buffer".
	* @bit: First bit to find.		* @category: Category name.
	*		*
	* Returns next on-bit on success, 8 otherwise.		* Returns nothing.
	*/		*/
	static u8 tomoyo_fns(const u8 perm, u8 bit)		static void tomoyo_set_group(struct tomoyo_io_buffer *head,
			const char *category)
	{		{
	for ( ; bit < 8; bit++)		tomoyo_set_string(head, category);
	if (perm & (1 << bit))
	break;
	return bit;
	}		}

	/**		/**
	@@ -940,58 +964,94 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
	struct tomoyo_acl_info *acl)		struct tomoyo_acl_info *acl)
	{		{
	const u8 acl_type = acl->type;		const u8 acl_type = acl->type;
			bool first = true;
	u8 bit;		u8 bit;

	if (acl->is_deleted)		if (acl->is_deleted)
	return true;		return true;
	next:
	bit = head->r.bit;
	if (!tomoyo_flush(head))		if (!tomoyo_flush(head))
	return false;		return false;
	else if (acl_type == TOMOYO_TYPE_PATH_ACL) {		else if (acl_type == TOMOYO_TYPE_PATH_ACL) {
	struct tomoyo_path_acl *ptr =		struct tomoyo_path_acl *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	const u16 perm = ptr->perm;		const u16 perm = ptr->perm;
	for ( ; bit < TOMOYO_MAX_PATH_OPERATION; bit++) {		for (bit = 0; bit < TOMOYO_MAX_PATH_OPERATION; bit++) {
	if (!(perm & (1 << bit)))		if (!(perm & (1 << bit)))
	continue;		continue;
	if (head->r.print_execute_only &&		if (head->r.print_execute_only &&
	bit != TOMOYO_TYPE_EXECUTE)		bit != TOMOYO_TYPE_EXECUTE)
	continue;		continue;
	break;		if (first) {
			tomoyo_set_group(head, "file ");
			first = false;
			} else {
			tomoyo_set_slash(head);
	}		}
	if (bit >= TOMOYO_MAX_PATH_OPERATION)		tomoyo_set_string(head, tomoyo_path_keyword[bit]);
	goto done;		}
	tomoyo_io_printf(head, "allow_%s", tomoyo_path_keyword[bit]);		if (first)
			return true;
	tomoyo_print_name_union(head, &ptr->name);		tomoyo_print_name_union(head, &ptr->name);
	} else if (head->r.print_execute_only) {		} else if (head->r.print_execute_only) {
	return true;		return true;
	} else if (acl_type == TOMOYO_TYPE_PATH2_ACL) {		} else if (acl_type == TOMOYO_TYPE_PATH2_ACL) {
	struct tomoyo_path2_acl *ptr =		struct tomoyo_path2_acl *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	bit = tomoyo_fns(ptr->perm, bit);		const u8 perm = ptr->perm;
	if (bit >= TOMOYO_MAX_PATH2_OPERATION)		for (bit = 0; bit < TOMOYO_MAX_PATH2_OPERATION; bit++) {
	goto done;		if (!(perm & (1 << bit)))
	tomoyo_io_printf(head, "allow_%s", tomoyo_path2_keyword[bit]);		continue;
			if (first) {
			tomoyo_set_group(head, "file ");
			first = false;
			} else {
			tomoyo_set_slash(head);
			}
			tomoyo_set_string(head, tomoyo_mac_keywords
			[tomoyo_pp2mac[bit]]);
			}
			if (first)
			return true;
	tomoyo_print_name_union(head, &ptr->name1);		tomoyo_print_name_union(head, &ptr->name1);
	tomoyo_print_name_union(head, &ptr->name2);		tomoyo_print_name_union(head, &ptr->name2);
	} else if (acl_type == TOMOYO_TYPE_PATH_NUMBER_ACL) {		} else if (acl_type == TOMOYO_TYPE_PATH_NUMBER_ACL) {
	struct tomoyo_path_number_acl *ptr =		struct tomoyo_path_number_acl *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	bit = tomoyo_fns(ptr->perm, bit);		const u8 perm = ptr->perm;
	if (bit >= TOMOYO_MAX_PATH_NUMBER_OPERATION)		for (bit = 0; bit < TOMOYO_MAX_PATH_NUMBER_OPERATION; bit++) {
	goto done;		if (!(perm & (1 << bit)))
	tomoyo_io_printf(head, "allow_%s",		continue;
	tomoyo_path_number_keyword[bit]);		if (first) {
			tomoyo_set_group(head, "file ");
			first = false;
			} else {
			tomoyo_set_slash(head);
			}
			tomoyo_set_string(head, tomoyo_mac_keywords
			[tomoyo_pn2mac[bit]]);
			}
			if (first)
			return true;
	tomoyo_print_name_union(head, &ptr->name);		tomoyo_print_name_union(head, &ptr->name);
	tomoyo_print_number_union(head, &ptr->number);		tomoyo_print_number_union(head, &ptr->number);
	} else if (acl_type == TOMOYO_TYPE_MKDEV_ACL) {		} else if (acl_type == TOMOYO_TYPE_MKDEV_ACL) {
	struct tomoyo_mkdev_acl *ptr =		struct tomoyo_mkdev_acl *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	bit = tomoyo_fns(ptr->perm, bit);		const u8 perm = ptr->perm;
	if (bit >= TOMOYO_MAX_MKDEV_OPERATION)		for (bit = 0; bit < TOMOYO_MAX_MKDEV_OPERATION; bit++) {
	goto done;		if (!(perm & (1 << bit)))
	tomoyo_io_printf(head, "allow_%s", tomoyo_mkdev_keyword[bit]);		continue;
			if (first) {
			tomoyo_set_group(head, "file ");
			first = false;
			} else {
			tomoyo_set_slash(head);
			}
			tomoyo_set_string(head, tomoyo_mac_keywords
			[tomoyo_pnnn2mac[bit]]);
			}
			if (first)
			return true;
	tomoyo_print_name_union(head, &ptr->name);		tomoyo_print_name_union(head, &ptr->name);
	tomoyo_print_number_union(head, &ptr->mode);		tomoyo_print_number_union(head, &ptr->mode);
	tomoyo_print_number_union(head, &ptr->major);		tomoyo_print_number_union(head, &ptr->major);
	@@ -999,18 +1059,13 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
	} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {		} else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
	struct tomoyo_mount_acl *ptr =		struct tomoyo_mount_acl *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	tomoyo_io_printf(head, "allow_mount");		tomoyo_set_group(head, "file mount");
	tomoyo_print_name_union(head, &ptr->dev_name);		tomoyo_print_name_union(head, &ptr->dev_name);
	tomoyo_print_name_union(head, &ptr->dir_name);		tomoyo_print_name_union(head, &ptr->dir_name);
	tomoyo_print_name_union(head, &ptr->fs_type);		tomoyo_print_name_union(head, &ptr->fs_type);
	tomoyo_print_number_union(head, &ptr->flags);		tomoyo_print_number_union(head, &ptr->flags);
	}		}
	head->r.bit = bit + 1;		tomoyo_set_lf(head);
	tomoyo_io_printf(head, "\n");
	if (acl_type != TOMOYO_TYPE_MOUNT_ACL)
	goto next;
	done:
	head->r.bit = 0;
	return true;		return true;
	}		}

	@@ -1316,18 +1371,14 @@ static bool tomoyo_read_policy(struct tomoyo_io_buffer *head, const int idx)
	{		{
	struct tomoyo_transition_control *ptr =		struct tomoyo_transition_control *ptr =
	container_of(acl, typeof(*ptr), head);		container_of(acl, typeof(*ptr), head);
	tomoyo_set_string(head,		tomoyo_set_string(head, tomoyo_transition_type
	tomoyo_transition_type
	[ptr->type]);		[ptr->type]);
	if (ptr->program)		tomoyo_set_string(head, ptr->program ?
	tomoyo_set_string(head,		ptr->program->name : "any");
	ptr->program->name);
	if (ptr->program && ptr->domainname)
	tomoyo_set_string(head, " from ");		tomoyo_set_string(head, " from ");
	if (ptr->domainname)		tomoyo_set_string(head, ptr->domainname ?
	tomoyo_set_string(head,		ptr->domainname->name :
	ptr->domainname->		"any");
	name);
	}		}
	break;		break;
	case TOMOYO_ID_AGGREGATOR:		case TOMOYO_ID_AGGREGATOR:

security/tomoyo/common.h

+5 −1

Original line number	Original line	Diff line number	Diff line
	@@ -404,7 +404,7 @@ struct tomoyo_acl_param {
	bool is_delete;		bool is_delete;
	};		};

	#define TOMOYO_MAX_IO_READ_QUEUE 32		#define TOMOYO_MAX_IO_READ_QUEUE 64

	/*		/*
	* Structure for reading/writing policy via /sys/kernel/security/tomoyo		* Structure for reading/writing policy via /sys/kernel/security/tomoyo
	@@ -639,6 +639,10 @@ extern const char *tomoyo_mkdev_keyword[TOMOYO_MAX_MKDEV_OPERATION];
	extern const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION];		extern const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION];
	extern const char *tomoyo_path_number_keyword[TOMOYO_MAX_PATH_NUMBER_OPERATION];		extern const char *tomoyo_path_number_keyword[TOMOYO_MAX_PATH_NUMBER_OPERATION];

			extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
			extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION];
			extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];

	extern unsigned int tomoyo_quota_for_query;		extern unsigned int tomoyo_quota_for_query;
	extern unsigned int tomoyo_query_memory_size;		extern unsigned int tomoyo_query_memory_size;

security/tomoyo/domain.c

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -209,14 +209,14 @@ int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
	domainname = program;		domainname = program;
	program = NULL;		program = NULL;
	}		}
	if (program) {		if (program && strcmp(program, "any")) {
	if (!tomoyo_correct_path(program))		if (!tomoyo_correct_path(program))
	return -EINVAL;		return -EINVAL;
	e.program = tomoyo_get_name(program);		e.program = tomoyo_get_name(program);
	if (!e.program)		if (!e.program)
	goto out;		goto out;
	}		}
	if (domainname) {		if (domainname && strcmp(domainname, "any")) {
	if (!tomoyo_correct_domain(domainname)) {		if (!tomoyo_correct_domain(domainname)) {
	if (!tomoyo_correct_path(domainname))		if (!tomoyo_correct_path(domainname))
	goto out;		goto out;

security/tomoyo/file.c

+7 −8

Original line number	Original line	Diff line number	Diff line
	@@ -69,7 +69,7 @@ static const u8 tomoyo_p2mac[TOMOYO_MAX_PATH_OPERATION] = {
	/*		/*
	* Mapping table from "enum tomoyo_mkdev_acl_index" to "enum tomoyo_mac_index".		* Mapping table from "enum tomoyo_mkdev_acl_index" to "enum tomoyo_mac_index".
	*/		*/
	static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION] = {		const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION] = {
	[TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK,		[TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK,
	[TOMOYO_TYPE_MKCHAR] = TOMOYO_MAC_FILE_MKCHAR,		[TOMOYO_TYPE_MKCHAR] = TOMOYO_MAC_FILE_MKCHAR,
	};		};
	@@ -77,7 +77,7 @@ static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION] = {
	/*		/*
	* Mapping table from "enum tomoyo_path2_acl_index" to "enum tomoyo_mac_index".		* Mapping table from "enum tomoyo_path2_acl_index" to "enum tomoyo_mac_index".
	*/		*/
	static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {		const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {
	[TOMOYO_TYPE_LINK] = TOMOYO_MAC_FILE_LINK,		[TOMOYO_TYPE_LINK] = TOMOYO_MAC_FILE_LINK,
	[TOMOYO_TYPE_RENAME] = TOMOYO_MAC_FILE_RENAME,		[TOMOYO_TYPE_RENAME] = TOMOYO_MAC_FILE_RENAME,
	[TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT,		[TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT,
	@@ -87,7 +87,7 @@ static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {
	* Mapping table from "enum tomoyo_path_number_acl_index" to		* Mapping table from "enum tomoyo_path_number_acl_index" to
	* "enum tomoyo_mac_index".		* "enum tomoyo_mac_index".
	*/		*/
	static const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {		const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
	[TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE,		[TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE,
	[TOMOYO_TYPE_MKDIR] = TOMOYO_MAC_FILE_MKDIR,		[TOMOYO_TYPE_MKDIR] = TOMOYO_MAC_FILE_MKDIR,
	[TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO,		[TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO,
	@@ -211,8 +211,7 @@ static int tomoyo_audit_path_log(struct tomoyo_request_info *r)
	if (r->granted)		if (r->granted)
	return 0;		return 0;
	tomoyo_warn_log(r, "%s %s", operation, filename->name);		tomoyo_warn_log(r, "%s %s", operation, filename->name);
	return tomoyo_supervisor(r, "allow_%s %s\n", operation,		return tomoyo_supervisor(r, "file %s %s\n", operation, filename->name);
	filename->name);
	}		}

	/**		/**
	@@ -231,7 +230,7 @@ static int tomoyo_audit_path2_log(struct tomoyo_request_info *r)
	return 0;		return 0;
	tomoyo_warn_log(r, "%s %s %s", operation, filename1->name,		tomoyo_warn_log(r, "%s %s %s", operation, filename1->name,
	filename2->name);		filename2->name);
	return tomoyo_supervisor(r, "allow_%s %s %s\n", operation,		return tomoyo_supervisor(r, "file %s %s %s\n", operation,
	filename1->name, filename2->name);		filename1->name, filename2->name);
	}		}

	@@ -253,7 +252,7 @@ static int tomoyo_audit_mkdev_log(struct tomoyo_request_info *r)
	return 0;		return 0;
	tomoyo_warn_log(r, "%s %s 0%o %u %u", operation, filename->name, mode,		tomoyo_warn_log(r, "%s %s 0%o %u %u", operation, filename->name, mode,
	major, minor);		major, minor);
	return tomoyo_supervisor(r, "allow_%s %s 0%o %u %u\n", operation,		return tomoyo_supervisor(r, "file %s %s 0%o %u %u\n", operation,
	filename->name, mode, major, minor);		filename->name, mode, major, minor);
	}		}

	@@ -291,7 +290,7 @@ static int tomoyo_audit_path_number_log(struct tomoyo_request_info *r)
	tomoyo_print_ulong(buffer, sizeof(buffer), r->param.path_number.number,		tomoyo_print_ulong(buffer, sizeof(buffer), r->param.path_number.number,
	radix);		radix);
	tomoyo_warn_log(r, "%s %s %s", operation, filename->name, buffer);		tomoyo_warn_log(r, "%s %s %s", operation, filename->name, buffer);
	return tomoyo_supervisor(r, "allow_%s %s %s\n", operation,		return tomoyo_supervisor(r, "file %s %s %s\n", operation,
	filename->name, buffer);		filename->name, buffer);
	}		}