common.h revision 7ef612331fb219620cc1abfc2446bb027d388aa0
1/* 2 * security/tomoyo/common.h 3 * 4 * Header file for TOMOYO. 5 * 6 * Copyright (C) 2005-2010 NTT DATA CORPORATION 7 */ 8 9#ifndef _SECURITY_TOMOYO_COMMON_H 10#define _SECURITY_TOMOYO_COMMON_H 11 12#include <linux/ctype.h> 13#include <linux/string.h> 14#include <linux/mm.h> 15#include <linux/file.h> 16#include <linux/kmod.h> 17#include <linux/fs.h> 18#include <linux/sched.h> 19#include <linux/namei.h> 20#include <linux/mount.h> 21#include <linux/list.h> 22#include <linux/cred.h> 23struct linux_binprm; 24 25/********** Constants definitions. **********/ 26 27/* 28 * TOMOYO uses this hash only when appending a string into the string 29 * table. Frequency of appending strings is very low. So we don't need 30 * large (e.g. 64k) hash size. 256 will be sufficient. 31 */ 32#define TOMOYO_HASH_BITS 8 33#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 34 35/* 36 * This is the max length of a token. 37 * 38 * A token consists of only ASCII printable characters. 39 * Non printable characters in a token is represented in \ooo style 40 * octal string. Thus, \ itself is represented as \\. 41 */ 42#define TOMOYO_MAX_PATHNAME_LEN 4000 43 44/* Profile number is an integer between 0 and 255. */ 45#define TOMOYO_MAX_PROFILES 256 46 47/* Keywords for ACLs. */ 48#define TOMOYO_KEYWORD_ALIAS "alias " 49#define TOMOYO_KEYWORD_ALLOW_READ "allow_read " 50#define TOMOYO_KEYWORD_DELETE "delete " 51#define TOMOYO_KEYWORD_DENY_REWRITE "deny_rewrite " 52#define TOMOYO_KEYWORD_FILE_PATTERN "file_pattern " 53#define TOMOYO_KEYWORD_INITIALIZE_DOMAIN "initialize_domain " 54#define TOMOYO_KEYWORD_KEEP_DOMAIN "keep_domain " 55#define TOMOYO_KEYWORD_NO_INITIALIZE_DOMAIN "no_initialize_domain " 56#define TOMOYO_KEYWORD_NO_KEEP_DOMAIN "no_keep_domain " 57#define TOMOYO_KEYWORD_SELECT "select " 58#define TOMOYO_KEYWORD_USE_PROFILE "use_profile " 59#define TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "ignore_global_allow_read" 60/* A domain definition starts with <kernel>. */ 61#define TOMOYO_ROOT_NAME "<kernel>" 62#define TOMOYO_ROOT_NAME_LEN (sizeof(TOMOYO_ROOT_NAME) - 1) 63 64/* Index numbers for Access Controls. */ 65enum tomoyo_mac_index { 66 TOMOYO_MAC_FOR_FILE, /* domain_policy.conf */ 67 TOMOYO_MAX_ACCEPT_ENTRY, 68 TOMOYO_VERBOSE, 69 TOMOYO_MAX_CONTROL_INDEX 70}; 71 72/* Index numbers for Access Controls. */ 73enum tomoyo_acl_entry_type_index { 74 TOMOYO_TYPE_PATH_ACL, 75 TOMOYO_TYPE_PATH2_ACL, 76}; 77 78/* Index numbers for File Controls. */ 79 80/* 81 * TYPE_READ_WRITE_ACL is special. TYPE_READ_WRITE_ACL is automatically set 82 * if both TYPE_READ_ACL and TYPE_WRITE_ACL are set. Both TYPE_READ_ACL and 83 * TYPE_WRITE_ACL are automatically set if TYPE_READ_WRITE_ACL is set. 84 * TYPE_READ_WRITE_ACL is automatically cleared if either TYPE_READ_ACL or 85 * TYPE_WRITE_ACL is cleared. Both TYPE_READ_ACL and TYPE_WRITE_ACL are 86 * automatically cleared if TYPE_READ_WRITE_ACL is cleared. 87 */ 88 89enum tomoyo_path_acl_index { 90 TOMOYO_TYPE_READ_WRITE, 91 TOMOYO_TYPE_EXECUTE, 92 TOMOYO_TYPE_READ, 93 TOMOYO_TYPE_WRITE, 94 TOMOYO_TYPE_CREATE, 95 TOMOYO_TYPE_UNLINK, 96 TOMOYO_TYPE_MKDIR, 97 TOMOYO_TYPE_RMDIR, 98 TOMOYO_TYPE_MKFIFO, 99 TOMOYO_TYPE_MKSOCK, 100 TOMOYO_TYPE_MKBLOCK, 101 TOMOYO_TYPE_MKCHAR, 102 TOMOYO_TYPE_TRUNCATE, 103 TOMOYO_TYPE_SYMLINK, 104 TOMOYO_TYPE_REWRITE, 105 TOMOYO_TYPE_IOCTL, 106 TOMOYO_TYPE_CHMOD, 107 TOMOYO_TYPE_CHOWN, 108 TOMOYO_TYPE_CHGRP, 109 TOMOYO_TYPE_CHROOT, 110 TOMOYO_TYPE_MOUNT, 111 TOMOYO_TYPE_UMOUNT, 112 TOMOYO_MAX_PATH_OPERATION 113}; 114 115enum tomoyo_path2_acl_index { 116 TOMOYO_TYPE_LINK, 117 TOMOYO_TYPE_RENAME, 118 TOMOYO_TYPE_PIVOT_ROOT, 119 TOMOYO_MAX_PATH2_OPERATION 120}; 121 122enum tomoyo_securityfs_interface_index { 123 TOMOYO_DOMAINPOLICY, 124 TOMOYO_EXCEPTIONPOLICY, 125 TOMOYO_DOMAIN_STATUS, 126 TOMOYO_PROCESS_STATUS, 127 TOMOYO_MEMINFO, 128 TOMOYO_SELFDOMAIN, 129 TOMOYO_VERSION, 130 TOMOYO_PROFILE, 131 TOMOYO_MANAGER 132}; 133 134/********** Structure definitions. **********/ 135 136/* 137 * tomoyo_page_buffer is a structure which is used for holding a pathname 138 * obtained from "struct dentry" and "struct vfsmount" pair. 139 * As of now, it is 4096 bytes. If users complain that 4096 bytes is too small 140 * (because TOMOYO escapes non ASCII printable characters using \ooo format), 141 * we will make the buffer larger. 142 */ 143struct tomoyo_page_buffer { 144 char buffer[4096]; 145}; 146 147/* 148 * tomoyo_path_info is a structure which is used for holding a string data 149 * used by TOMOYO. 150 * This structure has several fields for supporting pattern matching. 151 * 152 * (1) "name" is the '\0' terminated string data. 153 * (2) "hash" is full_name_hash(name, strlen(name)). 154 * This allows tomoyo_pathcmp() to compare by hash before actually compare 155 * using strcmp(). 156 * (3) "const_len" is the length of the initial segment of "name" which 157 * consists entirely of non wildcard characters. In other words, the length 158 * which we can compare two strings using strncmp(). 159 * (4) "is_dir" is a bool which is true if "name" ends with "/", 160 * false otherwise. 161 * TOMOYO distinguishes directory and non-directory. A directory ends with 162 * "/" and non-directory does not end with "/". 163 * (5) "is_patterned" is a bool which is true if "name" contains wildcard 164 * characters, false otherwise. This allows TOMOYO to use "hash" and 165 * strcmp() for string comparison if "is_patterned" is false. 166 */ 167struct tomoyo_path_info { 168 const char *name; 169 u32 hash; /* = full_name_hash(name, strlen(name)) */ 170 u16 const_len; /* = tomoyo_const_part_length(name) */ 171 bool is_dir; /* = tomoyo_strendswith(name, "/") */ 172 bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 173}; 174 175/* 176 * tomoyo_name_entry is a structure which is used for linking 177 * "struct tomoyo_path_info" into tomoyo_name_list . 178 */ 179struct tomoyo_name_entry { 180 struct list_head list; 181 atomic_t users; 182 struct tomoyo_path_info entry; 183}; 184 185/* 186 * tomoyo_path_info_with_data is a structure which is used for holding a 187 * pathname obtained from "struct dentry" and "struct vfsmount" pair. 188 * 189 * "struct tomoyo_path_info_with_data" consists of "struct tomoyo_path_info" 190 * and buffer for the pathname, while "struct tomoyo_page_buffer" consists of 191 * buffer for the pathname only. 192 * 193 * "struct tomoyo_path_info_with_data" is intended to allow TOMOYO to release 194 * both "struct tomoyo_path_info" and buffer for the pathname by single kfree() 195 * so that we don't need to return two pointers to the caller. If the caller 196 * puts "struct tomoyo_path_info" on stack memory, we will be able to remove 197 * "struct tomoyo_path_info_with_data". 198 */ 199struct tomoyo_path_info_with_data { 200 /* Keep "head" first, for this pointer is passed to kfree(). */ 201 struct tomoyo_path_info head; 202 char barrier1[16]; /* Safeguard for overrun. */ 203 char body[TOMOYO_MAX_PATHNAME_LEN]; 204 char barrier2[16]; /* Safeguard for overrun. */ 205}; 206 207/* 208 * tomoyo_acl_info is a structure which is used for holding 209 * 210 * (1) "list" which is linked to the ->acl_info_list of 211 * "struct tomoyo_domain_info" 212 * (2) "type" which tells type of the entry (either 213 * "struct tomoyo_path_acl" or "struct tomoyo_path2_acl"). 214 * 215 * Packing "struct tomoyo_acl_info" allows 216 * "struct tomoyo_path_acl" to embed "u8" + "u16" and 217 * "struct tomoyo_path2_acl" to embed "u8" 218 * without enlarging their structure size. 219 */ 220struct tomoyo_acl_info { 221 struct list_head list; 222 u8 type; 223} __packed; 224 225/* 226 * tomoyo_domain_info is a structure which is used for holding permissions 227 * (e.g. "allow_read /lib/libc-2.5.so") given to each domain. 228 * It has following fields. 229 * 230 * (1) "list" which is linked to tomoyo_domain_list . 231 * (2) "acl_info_list" which is linked to "struct tomoyo_acl_info". 232 * (3) "domainname" which holds the name of the domain. 233 * (4) "profile" which remembers profile number assigned to this domain. 234 * (5) "is_deleted" is a bool which is true if this domain is marked as 235 * "deleted", false otherwise. 236 * (6) "quota_warned" is a bool which is used for suppressing warning message 237 * when learning mode learned too much entries. 238 * (7) "ignore_global_allow_read" is a bool which is true if this domain 239 * should ignore "allow_read" directive in exception policy. 240 * (8) "transition_failed" is a bool which is set to true when this domain was 241 * unable to create a new domain at tomoyo_find_next_domain() because the 242 * name of the domain to be created was too long or it could not allocate 243 * memory. If set to true, more than one process continued execve() 244 * without domain transition. 245 * (9) "users" is an atomic_t that holds how many "struct cred"->security 246 * are referring this "struct tomoyo_domain_info". If is_deleted == true 247 * and users == 0, this struct will be kfree()d upon next garbage 248 * collection. 249 * 250 * A domain's lifecycle is an analogy of files on / directory. 251 * Multiple domains with the same domainname cannot be created (as with 252 * creating files with the same filename fails with -EEXIST). 253 * If a process reached a domain, that process can reside in that domain after 254 * that domain is marked as "deleted" (as with a process can access an already 255 * open()ed file after that file was unlink()ed). 256 */ 257struct tomoyo_domain_info { 258 struct list_head list; 259 struct list_head acl_info_list; 260 /* Name of this domain. Never NULL. */ 261 const struct tomoyo_path_info *domainname; 262 u8 profile; /* Profile number to use. */ 263 bool is_deleted; /* Delete flag. */ 264 bool quota_warned; /* Quota warnning flag. */ 265 bool ignore_global_allow_read; /* Ignore "allow_read" flag. */ 266 bool transition_failed; /* Domain transition failed flag. */ 267 atomic_t users; /* Number of referring credentials. */ 268}; 269 270/* 271 * tomoyo_path_acl is a structure which is used for holding an 272 * entry with one pathname operation (e.g. open(), mkdir()). 273 * It has following fields. 274 * 275 * (1) "head" which is a "struct tomoyo_acl_info". 276 * (2) "perm" which is a bitmask of permitted operations. 277 * (3) "filename" is the pathname. 278 * 279 * Directives held by this structure are "allow_read/write", "allow_execute", 280 * "allow_read", "allow_write", "allow_create", "allow_unlink", "allow_mkdir", 281 * "allow_rmdir", "allow_mkfifo", "allow_mksock", "allow_mkblock", 282 * "allow_mkchar", "allow_truncate", "allow_symlink", "allow_rewrite", 283 * "allow_chmod", "allow_chown", "allow_chgrp", "allow_chroot", "allow_mount" 284 * and "allow_unmount". 285 */ 286struct tomoyo_path_acl { 287 struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 288 u8 perm_high; 289 u16 perm; 290 /* Pointer to single pathname. */ 291 const struct tomoyo_path_info *filename; 292}; 293 294/* 295 * tomoyo_path2_acl is a structure which is used for holding an 296 * entry with two pathnames operation (i.e. link(), rename() and pivot_root()). 297 * It has following fields. 298 * 299 * (1) "head" which is a "struct tomoyo_acl_info". 300 * (2) "perm" which is a bitmask of permitted operations. 301 * (3) "filename1" is the source/old pathname. 302 * (4) "filename2" is the destination/new pathname. 303 * 304 * Directives held by this structure are "allow_rename", "allow_link" and 305 * "allow_pivot_root". 306 */ 307struct tomoyo_path2_acl { 308 struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 309 u8 perm; 310 /* Pointer to single pathname. */ 311 const struct tomoyo_path_info *filename1; 312 /* Pointer to single pathname. */ 313 const struct tomoyo_path_info *filename2; 314}; 315 316/* 317 * tomoyo_io_buffer is a structure which is used for reading and modifying 318 * configuration via /sys/kernel/security/tomoyo/ interface. 319 * It has many fields. ->read_var1 , ->read_var2 , ->write_var1 are used as 320 * cursors. 321 * 322 * Since the content of /sys/kernel/security/tomoyo/domain_policy is a list of 323 * "struct tomoyo_domain_info" entries and each "struct tomoyo_domain_info" 324 * entry has a list of "struct tomoyo_acl_info", we need two cursors when 325 * reading (one is for traversing tomoyo_domain_list and the other is for 326 * traversing "struct tomoyo_acl_info"->acl_info_list ). 327 * 328 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 329 * "select ", TOMOYO seeks the cursor ->read_var1 and ->write_var1 to the 330 * domain with the domainname specified by the rest of that line (NULL is set 331 * if seek failed). 332 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 333 * "delete ", TOMOYO deletes an entry or a domain specified by the rest of that 334 * line (->write_var1 is set to NULL if a domain was deleted). 335 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 336 * neither "select " nor "delete ", an entry or a domain specified by that line 337 * is appended. 338 */ 339struct tomoyo_io_buffer { 340 int (*read) (struct tomoyo_io_buffer *); 341 int (*write) (struct tomoyo_io_buffer *); 342 /* Exclusive lock for this structure. */ 343 struct mutex io_sem; 344 /* Index returned by tomoyo_read_lock(). */ 345 int reader_idx; 346 /* The position currently reading from. */ 347 struct list_head *read_var1; 348 /* Extra variables for reading. */ 349 struct list_head *read_var2; 350 /* The position currently writing to. */ 351 struct tomoyo_domain_info *write_var1; 352 /* The step for reading. */ 353 int read_step; 354 /* Buffer for reading. */ 355 char *read_buf; 356 /* EOF flag for reading. */ 357 bool read_eof; 358 /* Read domain ACL of specified PID? */ 359 bool read_single_domain; 360 /* Extra variable for reading. */ 361 u8 read_bit; 362 /* Bytes available for reading. */ 363 int read_avail; 364 /* Size of read buffer. */ 365 int readbuf_size; 366 /* Buffer for writing. */ 367 char *write_buf; 368 /* Bytes available for writing. */ 369 int write_avail; 370 /* Size of write buffer. */ 371 int writebuf_size; 372}; 373 374/* 375 * tomoyo_globally_readable_file_entry is a structure which is used for holding 376 * "allow_read" entries. 377 * It has following fields. 378 * 379 * (1) "list" which is linked to tomoyo_globally_readable_list . 380 * (2) "filename" is a pathname which is allowed to open(O_RDONLY). 381 * (3) "is_deleted" is a bool which is true if marked as deleted, false 382 * otherwise. 383 */ 384struct tomoyo_globally_readable_file_entry { 385 struct list_head list; 386 const struct tomoyo_path_info *filename; 387 bool is_deleted; 388}; 389 390/* 391 * tomoyo_pattern_entry is a structure which is used for holding 392 * "tomoyo_pattern_list" entries. 393 * It has following fields. 394 * 395 * (1) "list" which is linked to tomoyo_pattern_list . 396 * (2) "pattern" is a pathname pattern which is used for converting pathnames 397 * to pathname patterns during learning mode. 398 * (3) "is_deleted" is a bool which is true if marked as deleted, false 399 * otherwise. 400 */ 401struct tomoyo_pattern_entry { 402 struct list_head list; 403 const struct tomoyo_path_info *pattern; 404 bool is_deleted; 405}; 406 407/* 408 * tomoyo_no_rewrite_entry is a structure which is used for holding 409 * "deny_rewrite" entries. 410 * It has following fields. 411 * 412 * (1) "list" which is linked to tomoyo_no_rewrite_list . 413 * (2) "pattern" is a pathname which is by default not permitted to modify 414 * already existing content. 415 * (3) "is_deleted" is a bool which is true if marked as deleted, false 416 * otherwise. 417 */ 418struct tomoyo_no_rewrite_entry { 419 struct list_head list; 420 const struct tomoyo_path_info *pattern; 421 bool is_deleted; 422}; 423 424/* 425 * tomoyo_domain_initializer_entry is a structure which is used for holding 426 * "initialize_domain" and "no_initialize_domain" entries. 427 * It has following fields. 428 * 429 * (1) "list" which is linked to tomoyo_domain_initializer_list . 430 * (2) "domainname" which is "a domainname" or "the last component of a 431 * domainname". This field is NULL if "from" clause is not specified. 432 * (3) "program" which is a program's pathname. 433 * (4) "is_deleted" is a bool which is true if marked as deleted, false 434 * otherwise. 435 * (5) "is_not" is a bool which is true if "no_initialize_domain", false 436 * otherwise. 437 * (6) "is_last_name" is a bool which is true if "domainname" is "the last 438 * component of a domainname", false otherwise. 439 */ 440struct tomoyo_domain_initializer_entry { 441 struct list_head list; 442 const struct tomoyo_path_info *domainname; /* This may be NULL */ 443 const struct tomoyo_path_info *program; 444 bool is_deleted; 445 bool is_not; /* True if this entry is "no_initialize_domain". */ 446 /* True if the domainname is tomoyo_get_last_name(). */ 447 bool is_last_name; 448}; 449 450/* 451 * tomoyo_domain_keeper_entry is a structure which is used for holding 452 * "keep_domain" and "no_keep_domain" entries. 453 * It has following fields. 454 * 455 * (1) "list" which is linked to tomoyo_domain_keeper_list . 456 * (2) "domainname" which is "a domainname" or "the last component of a 457 * domainname". 458 * (3) "program" which is a program's pathname. 459 * This field is NULL if "from" clause is not specified. 460 * (4) "is_deleted" is a bool which is true if marked as deleted, false 461 * otherwise. 462 * (5) "is_not" is a bool which is true if "no_initialize_domain", false 463 * otherwise. 464 * (6) "is_last_name" is a bool which is true if "domainname" is "the last 465 * component of a domainname", false otherwise. 466 */ 467struct tomoyo_domain_keeper_entry { 468 struct list_head list; 469 const struct tomoyo_path_info *domainname; 470 const struct tomoyo_path_info *program; /* This may be NULL */ 471 bool is_deleted; 472 bool is_not; /* True if this entry is "no_keep_domain". */ 473 /* True if the domainname is tomoyo_get_last_name(). */ 474 bool is_last_name; 475}; 476 477/* 478 * tomoyo_alias_entry is a structure which is used for holding "alias" entries. 479 * It has following fields. 480 * 481 * (1) "list" which is linked to tomoyo_alias_list . 482 * (2) "original_name" which is a dereferenced pathname. 483 * (3) "aliased_name" which is a symlink's pathname. 484 * (4) "is_deleted" is a bool which is true if marked as deleted, false 485 * otherwise. 486 */ 487struct tomoyo_alias_entry { 488 struct list_head list; 489 const struct tomoyo_path_info *original_name; 490 const struct tomoyo_path_info *aliased_name; 491 bool is_deleted; 492}; 493 494/* 495 * tomoyo_policy_manager_entry is a structure which is used for holding list of 496 * domainnames or programs which are permitted to modify configuration via 497 * /sys/kernel/security/tomoyo/ interface. 498 * It has following fields. 499 * 500 * (1) "list" which is linked to tomoyo_policy_manager_list . 501 * (2) "manager" is a domainname or a program's pathname. 502 * (3) "is_domain" is a bool which is true if "manager" is a domainname, false 503 * otherwise. 504 * (4) "is_deleted" is a bool which is true if marked as deleted, false 505 * otherwise. 506 */ 507struct tomoyo_policy_manager_entry { 508 struct list_head list; 509 /* A path to program or a domainname. */ 510 const struct tomoyo_path_info *manager; 511 bool is_domain; /* True if manager is a domainname. */ 512 bool is_deleted; /* True if this entry is deleted. */ 513}; 514 515/********** Function prototypes. **********/ 516 517/* Check whether the domain has too many ACL entries to hold. */ 518bool tomoyo_domain_quota_is_ok(struct tomoyo_domain_info * const domain); 519/* Transactional sprintf() for policy dump. */ 520bool tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 521 __attribute__ ((format(printf, 2, 3))); 522/* Check whether the domainname is correct. */ 523bool tomoyo_is_correct_domain(const unsigned char *domainname, 524 const char *function); 525/* Check whether the token is correct. */ 526bool tomoyo_is_correct_path(const char *filename, const s8 start_type, 527 const s8 pattern_type, const s8 end_type, 528 const char *function); 529/* Check whether the token can be a domainname. */ 530bool tomoyo_is_domain_def(const unsigned char *buffer); 531/* Check whether the given filename matches the given pattern. */ 532bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 533 const struct tomoyo_path_info *pattern); 534/* Read "alias" entry in exception policy. */ 535bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head); 536/* 537 * Read "initialize_domain" and "no_initialize_domain" entry 538 * in exception policy. 539 */ 540bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer *head); 541/* Read "keep_domain" and "no_keep_domain" entry in exception policy. */ 542bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer *head); 543/* Read "file_pattern" entry in exception policy. */ 544bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head); 545/* Read "allow_read" entry in exception policy. */ 546bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head); 547/* Read "deny_rewrite" entry in exception policy. */ 548bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head); 549/* Write domain policy violation warning message to console? */ 550bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain); 551/* Convert double path operation to operation name. */ 552const char *tomoyo_path22keyword(const u8 operation); 553/* Get the last component of the given domainname. */ 554const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain); 555/* Get warning message. */ 556const char *tomoyo_get_msg(const bool is_enforce); 557/* Convert single path operation to operation name. */ 558const char *tomoyo_path2keyword(const u8 operation); 559/* Create "alias" entry in exception policy. */ 560int tomoyo_write_alias_policy(char *data, const bool is_delete); 561/* 562 * Create "initialize_domain" and "no_initialize_domain" entry 563 * in exception policy. 564 */ 565int tomoyo_write_domain_initializer_policy(char *data, const bool is_not, 566 const bool is_delete); 567/* Create "keep_domain" and "no_keep_domain" entry in exception policy. */ 568int tomoyo_write_domain_keeper_policy(char *data, const bool is_not, 569 const bool is_delete); 570/* 571 * Create "allow_read/write", "allow_execute", "allow_read", "allow_write", 572 * "allow_create", "allow_unlink", "allow_mkdir", "allow_rmdir", 573 * "allow_mkfifo", "allow_mksock", "allow_mkblock", "allow_mkchar", 574 * "allow_truncate", "allow_symlink", "allow_rewrite", "allow_rename" and 575 * "allow_link" entry in domain policy. 576 */ 577int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain, 578 const bool is_delete); 579/* Create "allow_read" entry in exception policy. */ 580int tomoyo_write_globally_readable_policy(char *data, const bool is_delete); 581/* Create "deny_rewrite" entry in exception policy. */ 582int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete); 583/* Create "file_pattern" entry in exception policy. */ 584int tomoyo_write_pattern_policy(char *data, const bool is_delete); 585/* Find a domain by the given name. */ 586struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 587/* Find or create a domain by the given name. */ 588struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char * 589 domainname, 590 const u8 profile); 591/* Check mode for specified functionality. */ 592unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 593 const u8 index); 594/* Fill in "struct tomoyo_path_info" members. */ 595void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 596/* Run policy loader when /sbin/init starts. */ 597void tomoyo_load_policy(const char *filename); 598 599/* Convert binary string to ascii string. */ 600int tomoyo_encode(char *buffer, int buflen, const char *str); 601 602/* Returns realpath(3) of the given pathname but ignores chroot'ed root. */ 603int tomoyo_realpath_from_path2(struct path *path, char *newname, 604 int newname_len); 605 606/* 607 * Returns realpath(3) of the given pathname but ignores chroot'ed root. 608 * These functions use kzalloc(), so the caller must call kfree() 609 * if these functions didn't return NULL. 610 */ 611char *tomoyo_realpath(const char *pathname); 612/* 613 * Same with tomoyo_realpath() except that it doesn't follow the final symlink. 614 */ 615char *tomoyo_realpath_nofollow(const char *pathname); 616/* Same with tomoyo_realpath() except that the pathname is already solved. */ 617char *tomoyo_realpath_from_path(struct path *path); 618 619/* Check memory quota. */ 620bool tomoyo_memory_ok(void *ptr); 621 622/* 623 * Keep the given name on the RAM. 624 * The RAM is shared, so NEVER try to modify or kfree() the returned name. 625 */ 626const struct tomoyo_path_info *tomoyo_get_name(const char *name); 627 628/* Check for memory usage. */ 629int tomoyo_read_memory_counter(struct tomoyo_io_buffer *head); 630 631/* Set memory quota. */ 632int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head); 633 634/* Initialize realpath related code. */ 635void __init tomoyo_realpath_init(void); 636int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain, 637 const struct tomoyo_path_info *filename); 638int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 639 struct path *path, const int flag); 640int tomoyo_path_perm(struct tomoyo_domain_info *domain, const u8 operation, 641 struct path *path); 642int tomoyo_path2_perm(struct tomoyo_domain_info *domain, const u8 operation, 643 struct path *path1, struct path *path2); 644int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain, 645 struct file *filp); 646int tomoyo_find_next_domain(struct linux_binprm *bprm); 647 648/* Run garbage collector. */ 649void tomoyo_run_gc(void); 650 651void tomoyo_memory_free(void *ptr); 652 653/********** External variable definitions. **********/ 654 655/* Lock for GC. */ 656extern struct srcu_struct tomoyo_ss; 657 658/* The list for "struct tomoyo_domain_info". */ 659extern struct list_head tomoyo_domain_list; 660 661extern struct list_head tomoyo_domain_initializer_list; 662extern struct list_head tomoyo_domain_keeper_list; 663extern struct list_head tomoyo_alias_list; 664extern struct list_head tomoyo_globally_readable_list; 665extern struct list_head tomoyo_pattern_list; 666extern struct list_head tomoyo_no_rewrite_list; 667extern struct list_head tomoyo_policy_manager_list; 668extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 669extern struct mutex tomoyo_name_list_lock; 670 671/* Lock for protecting policy. */ 672extern struct mutex tomoyo_policy_lock; 673 674/* Has /sbin/init started? */ 675extern bool tomoyo_policy_loaded; 676 677/* The kernel's domain. */ 678extern struct tomoyo_domain_info tomoyo_kernel_domain; 679 680/********** Inlined functions. **********/ 681 682static inline int tomoyo_read_lock(void) 683{ 684 return srcu_read_lock(&tomoyo_ss); 685} 686 687static inline void tomoyo_read_unlock(int idx) 688{ 689 srcu_read_unlock(&tomoyo_ss, idx); 690} 691 692/* strcmp() for "struct tomoyo_path_info" structure. */ 693static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 694 const struct tomoyo_path_info *b) 695{ 696 return a->hash != b->hash || strcmp(a->name, b->name); 697} 698 699/** 700 * tomoyo_is_valid - Check whether the character is a valid char. 701 * 702 * @c: The character to check. 703 * 704 * Returns true if @c is a valid character, false otherwise. 705 */ 706static inline bool tomoyo_is_valid(const unsigned char c) 707{ 708 return c > ' ' && c < 127; 709} 710 711/** 712 * tomoyo_is_invalid - Check whether the character is an invalid char. 713 * 714 * @c: The character to check. 715 * 716 * Returns true if @c is an invalid character, false otherwise. 717 */ 718static inline bool tomoyo_is_invalid(const unsigned char c) 719{ 720 return c && (c <= ' ' || c >= 127); 721} 722 723static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 724{ 725 if (name) { 726 struct tomoyo_name_entry *ptr = 727 container_of(name, struct tomoyo_name_entry, entry); 728 atomic_dec(&ptr->users); 729 } 730} 731 732static inline struct tomoyo_domain_info *tomoyo_domain(void) 733{ 734 return current_cred()->security; 735} 736 737static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 738 *task) 739{ 740 return task_cred_xxx(task, security); 741} 742 743/** 744 * list_for_each_cookie - iterate over a list with cookie. 745 * @pos: the &struct list_head to use as a loop cursor. 746 * @cookie: the &struct list_head to use as a cookie. 747 * @head: the head for your list. 748 * 749 * Same with list_for_each_rcu() except that this primitive uses @cookie 750 * so that we can continue iteration. 751 * @cookie must be NULL when iteration starts, and @cookie will become 752 * NULL when iteration finishes. 753 */ 754#define list_for_each_cookie(pos, cookie, head) \ 755 for (({ if (!cookie) \ 756 cookie = head; }), \ 757 pos = rcu_dereference((cookie)->next); \ 758 prefetch(pos->next), pos != (head) || ((cookie) = NULL); \ 759 (cookie) = pos, pos = rcu_dereference(pos->next)) 760 761#endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 762