Commit 7c2ea22e authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris
Browse files

TOMOYO: Merge path_group and number_group. 



Use common code for "path_group" and "number_group".

Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 31845e8c

security/tomoyo/Makefile

+1 −1
Original line number Diff line number Diff line 
obj-y = common.o domain.o file.o gc.o load_policy.o memory.o mount.o number_group.o path_group.o realpath.o securityfs_if.o tomoyo.o util.o
 
obj-y = common.o domain.o file.o gc.o group.o load_policy.o memory.o mount.o realpath.o securityfs_if.o tomoyo.o util.o

security/tomoyo/common.c

+2 −2
Original line number Diff line number Diff line
@@ -1186,9 +1186,9 @@ static int tomoyo_write_exception_policy(struct tomoyo_io_buffer *head) 
	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_DENY_REWRITE))

		return tomoyo_write_no_rewrite_policy(data, is_delete);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_PATH_GROUP))

		return tomoyo_write_path_group_policy(data, is_delete);

		return tomoyo_write_group(data, is_delete, TOMOYO_PATH_GROUP);

	if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NUMBER_GROUP))

		return tomoyo_write_number_group_policy(data, is_delete);

		return tomoyo_write_group(data, is_delete, TOMOYO_NUMBER_GROUP);

	return -EINVAL;

}

security/tomoyo/common.h

+6 −7
Original line number Diff line number Diff line
@@ -838,12 +838,10 @@ int tomoyo_write_mount_policy(char *data, struct tomoyo_domain_info *domain, 
int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete);

/* Create "file_pattern" entry in exception policy. */

int tomoyo_write_pattern_policy(char *data, const bool is_delete);

/* Create "path_group" entry in exception policy. */

int tomoyo_write_path_group_policy(char *data, const bool is_delete);

/* Create "path_group"/"number_group" entry in exception policy. */

int tomoyo_write_group(char *data, const bool is_delete, const u8 type);

int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)

     __attribute__ ((format(printf, 2, 3)));

/* Create "number_group" entry in exception policy. */

int tomoyo_write_number_group_policy(char *data, const bool is_delete);

/* Find a domain by the given name. */

struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname);

/* Find or create a domain by the given name. */
@@ -851,9 +849,10 @@ struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char * 
							    domainname,

							    const u8 profile);

struct tomoyo_profile *tomoyo_profile(const u8 profile);

/* Allocate memory for "struct tomoyo_path_group". */

struct tomoyo_group *tomoyo_get_path_group(const char *group_name);

struct tomoyo_group *tomoyo_get_number_group(const char *group_name);

/*

 * Allocate memory for "struct tomoyo_path_group"/"struct tomoyo_number_group".

 */

struct tomoyo_group *tomoyo_get_group(const char *group_name, const u8 type);



/* Check mode for specified functionality. */

unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain,

security/tomoyo/gc.c

+14 −22
Original line number Diff line number Diff line
@@ -266,33 +266,25 @@ static void tomoyo_collect_entry(void) 
				goto unlock;

		}

	}

	{

	for (i = 0; i < TOMOYO_MAX_GROUP; i++) {

		struct list_head *list = &tomoyo_group_list[i];

		int id;

		struct tomoyo_group *group;

		list_for_each_entry_rcu(group,

					&tomoyo_group_list[TOMOYO_PATH_GROUP],

					list) {

			tomoyo_collect_member(&group->member_list,

					      TOMOYO_ID_PATH_GROUP);

			if (!list_empty(&group->member_list) ||

			    atomic_read(&group->users))

				continue;

			if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP,

					      &group->list))

				goto unlock;

		}

		switch (i) {

		case 0:

			id = TOMOYO_ID_PATH_GROUP;

			break;

		default:

			id = TOMOYO_ID_NUMBER_GROUP;

			break;

		}

	{

		struct tomoyo_group *group;

		list_for_each_entry_rcu(group,

					&tomoyo_group_list[TOMOYO_NUMBER_GROUP],

					list) {

			tomoyo_collect_member(&group->member_list,

					      TOMOYO_ID_NUMBER_GROUP);

		list_for_each_entry(group, list, list) {

			if (!tomoyo_collect_member(&group->member_list, id))

				goto unlock;

			if (!list_empty(&group->member_list) ||

			    atomic_read(&group->users))

				continue;

			if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP,

					      &group->list))

			if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))

				goto unlock;

		}

	}

security/tomoyo/number_group.c→security/tomoyo/group.c

+130 −0
Original line number Diff line number Diff line 
/*

 * security/tomoyo/number_group.c

 * security/tomoyo/group.c

 *

 * Copyright (C) 2005-2009  NTT DATA CORPORATION

 * Copyright (C) 2005-2010  NTT DATA CORPORATION

 */



#include <linux/slab.h>

#include "common.h"



/**

 * tomoyo_get_group - Allocate memory for "struct tomoyo_number_group".

 *

 * @group_name: The name of number group.

 *

 * Returns pointer to "struct tomoyo_number_group" on success,

 * NULL otherwise.

 */

struct tomoyo_group *tomoyo_get_number_group(const char *group_name)

static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,

				const struct tomoyo_acl_head *b)

{

	struct tomoyo_group *entry = NULL;

	struct tomoyo_group *group = NULL;

	const struct tomoyo_path_info *saved_group_name;

	int error = -ENOMEM;

	if (!tomoyo_correct_word(group_name))

		return NULL;

	saved_group_name = tomoyo_get_name(group_name);

	if (!saved_group_name)

		return NULL;

	entry = kzalloc(sizeof(*entry), GFP_NOFS);

	if (mutex_lock_interruptible(&tomoyo_policy_lock))

		goto out;

	list_for_each_entry_rcu(group, &tomoyo_group_list[TOMOYO_NUMBER_GROUP],

				list) {

		if (saved_group_name != group->group_name)

			continue;

		atomic_inc(&group->users);

		error = 0;

		break;

	}

	if (error && tomoyo_memory_ok(entry)) {

		INIT_LIST_HEAD(&entry->member_list);

		entry->group_name = saved_group_name;

		saved_group_name = NULL;

		atomic_set(&entry->users, 1);

		list_add_tail_rcu(&entry->list,

				  &tomoyo_group_list[TOMOYO_NUMBER_GROUP]);

		group = entry;

		entry = NULL;

		error = 0;

	}

	mutex_unlock(&tomoyo_policy_lock);

 out:

	tomoyo_put_name(saved_group_name);

	kfree(entry);

	return !error ? group : NULL;

	return container_of(a, struct tomoyo_path_group, head)->member_name ==

		container_of(b, struct tomoyo_path_group, head)->member_name;

}



static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,

				  const struct tomoyo_acl_head *b)

{

	return !memcmp(&container_of(a, struct tomoyo_number_group,

				     head)->number,

		       &container_of(b, struct tomoyo_number_group,

				     head)->number,

		       sizeof(container_of(a,

					   struct tomoyo_number_group,

					   head)->number));

	return !memcmp(&container_of(a, struct tomoyo_number_group, head)

		       ->number,

		       &container_of(b, struct tomoyo_number_group, head)

		       ->number,

		       sizeof(container_of(a, struct tomoyo_number_group, head)

			      ->number));

}



/**

 * tomoyo_write_number_group_policy - Write "struct tomoyo_number_group" list.

 * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group" list.

 *

 * @data:      String to parse.

 * @is_delete: True if it is a delete request.

 * @type:      Type of this group.

 *

 * Returns 0 on success, nagative value otherwise.

 * Returns 0 on success, negative value otherwise.

 */

int tomoyo_write_number_group_policy(char *data, const bool is_delete)

int tomoyo_write_group(char *data, const bool is_delete, const u8 type)

{

	struct tomoyo_group *group;

	struct tomoyo_number_group e = { };

	int error;

	struct list_head *member;

	char *w[2];

	if (!tomoyo_tokenize(data, w, sizeof(w)))

		return -EINVAL;

	if (w[1][0] == '@' || !tomoyo_parse_number_union(w[1], &e.number) ||

	    e.number.values[0] > e.number.values[1])

	int error = -EINVAL;

	if (!tomoyo_tokenize(data, w, sizeof(w)) || !w[1][0])

		return -EINVAL;

	group = tomoyo_get_number_group(w[0]);

	group = tomoyo_get_group(w[0], type);

	if (!group)

		return -ENOMEM;

	member = &group->member_list;

	if (type == TOMOYO_PATH_GROUP) {

		struct tomoyo_path_group e = { };

		e.member_name = tomoyo_get_name(w[1]);

		if (!e.member_name) {

			error = -ENOMEM;

			goto out;

		}

		error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,

					     member, tomoyo_same_path_group);

		tomoyo_put_name(e.member_name);

	} else if (type == TOMOYO_NUMBER_GROUP) {

		struct tomoyo_number_group e = { };

		if (w[1][0] == '@'

		    || !tomoyo_parse_number_union(w[1], &e.number)

		    || e.number.values[0] > e.number.values[1])

			goto out;

		error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,

				     &group->member_list,

				     tomoyo_same_number_group);

					     member, tomoyo_same_number_group);

		/*

		 * tomoyo_put_number_union() is not needed because

		 * w[1][0] != '@'.

		 */

	}

 out:

	tomoyo_put_group(group);

	return error;

}



/**

 * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.

 *

 * @pathname:        The name of pathname.

 * @group:           Pointer to "struct tomoyo_path_group".

 *

 * Returns true if @pathname matches pathnames in @group, false otherwise.

 *

 * Caller holds tomoyo_read_lock().

 */

bool tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,

			       const struct tomoyo_group *group)

{

	struct tomoyo_path_group *member;

	bool matched = false;

	list_for_each_entry_rcu(member, &group->member_list, head.list) {

		if (member->head.is_deleted)

			continue;

		if (!tomoyo_path_matches_pattern(pathname, member->member_name))

			continue;

		matched = true;

		break;

	}

	return matched;

}



/**

 * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.

 *