common.h revision ec8e6a4e062e2edebef91e930c20572c9f4c0dda
1/* 2 * security/tomoyo/common.h 3 * 4 * Header file for TOMOYO. 5 * 6 * Copyright (C) 2005-2010 NTT DATA CORPORATION 7 */ 8 9#ifndef _SECURITY_TOMOYO_COMMON_H 10#define _SECURITY_TOMOYO_COMMON_H 11 12#include <linux/ctype.h> 13#include <linux/string.h> 14#include <linux/mm.h> 15#include <linux/file.h> 16#include <linux/kmod.h> 17#include <linux/fs.h> 18#include <linux/sched.h> 19#include <linux/namei.h> 20#include <linux/mount.h> 21#include <linux/list.h> 22#include <linux/cred.h> 23struct linux_binprm; 24 25/********** Constants definitions. **********/ 26 27/* 28 * TOMOYO uses this hash only when appending a string into the string 29 * table. Frequency of appending strings is very low. So we don't need 30 * large (e.g. 64k) hash size. 256 will be sufficient. 31 */ 32#define TOMOYO_HASH_BITS 8 33#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 34 35/* 36 * This is the max length of a token. 37 * 38 * A token consists of only ASCII printable characters. 39 * Non printable characters in a token is represented in \ooo style 40 * octal string. Thus, \ itself is represented as \\. 41 */ 42#define TOMOYO_MAX_PATHNAME_LEN 4000 43 44/* Profile number is an integer between 0 and 255. */ 45#define TOMOYO_MAX_PROFILES 256 46 47/* Keywords for ACLs. */ 48#define TOMOYO_KEYWORD_ALIAS "alias " 49#define TOMOYO_KEYWORD_ALLOW_READ "allow_read " 50#define TOMOYO_KEYWORD_DELETE "delete " 51#define TOMOYO_KEYWORD_DENY_REWRITE "deny_rewrite " 52#define TOMOYO_KEYWORD_FILE_PATTERN "file_pattern " 53#define TOMOYO_KEYWORD_INITIALIZE_DOMAIN "initialize_domain " 54#define TOMOYO_KEYWORD_KEEP_DOMAIN "keep_domain " 55#define TOMOYO_KEYWORD_NO_INITIALIZE_DOMAIN "no_initialize_domain " 56#define TOMOYO_KEYWORD_NO_KEEP_DOMAIN "no_keep_domain " 57#define TOMOYO_KEYWORD_SELECT "select " 58#define TOMOYO_KEYWORD_USE_PROFILE "use_profile " 59#define TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "ignore_global_allow_read" 60/* A domain definition starts with <kernel>. */ 61#define TOMOYO_ROOT_NAME "<kernel>" 62#define TOMOYO_ROOT_NAME_LEN (sizeof(TOMOYO_ROOT_NAME) - 1) 63 64/* Index numbers for Access Controls. */ 65#define TOMOYO_MAC_FOR_FILE 0 /* domain_policy.conf */ 66#define TOMOYO_MAX_ACCEPT_ENTRY 1 67#define TOMOYO_VERBOSE 2 68#define TOMOYO_MAX_CONTROL_INDEX 3 69 70/* Index numbers for Access Controls. */ 71 72#define TOMOYO_TYPE_SINGLE_PATH_ACL 0 73#define TOMOYO_TYPE_DOUBLE_PATH_ACL 1 74 75/* Index numbers for File Controls. */ 76 77/* 78 * TYPE_READ_WRITE_ACL is special. TYPE_READ_WRITE_ACL is automatically set 79 * if both TYPE_READ_ACL and TYPE_WRITE_ACL are set. Both TYPE_READ_ACL and 80 * TYPE_WRITE_ACL are automatically set if TYPE_READ_WRITE_ACL is set. 81 * TYPE_READ_WRITE_ACL is automatically cleared if either TYPE_READ_ACL or 82 * TYPE_WRITE_ACL is cleared. Both TYPE_READ_ACL and TYPE_WRITE_ACL are 83 * automatically cleared if TYPE_READ_WRITE_ACL is cleared. 84 */ 85 86#define TOMOYO_TYPE_READ_WRITE_ACL 0 87#define TOMOYO_TYPE_EXECUTE_ACL 1 88#define TOMOYO_TYPE_READ_ACL 2 89#define TOMOYO_TYPE_WRITE_ACL 3 90#define TOMOYO_TYPE_CREATE_ACL 4 91#define TOMOYO_TYPE_UNLINK_ACL 5 92#define TOMOYO_TYPE_MKDIR_ACL 6 93#define TOMOYO_TYPE_RMDIR_ACL 7 94#define TOMOYO_TYPE_MKFIFO_ACL 8 95#define TOMOYO_TYPE_MKSOCK_ACL 9 96#define TOMOYO_TYPE_MKBLOCK_ACL 10 97#define TOMOYO_TYPE_MKCHAR_ACL 11 98#define TOMOYO_TYPE_TRUNCATE_ACL 12 99#define TOMOYO_TYPE_SYMLINK_ACL 13 100#define TOMOYO_TYPE_REWRITE_ACL 14 101#define TOMOYO_TYPE_IOCTL_ACL 15 102#define TOMOYO_TYPE_CHMOD_ACL 16 103#define TOMOYO_TYPE_CHOWN_ACL 17 104#define TOMOYO_TYPE_CHGRP_ACL 18 105#define TOMOYO_TYPE_CHROOT_ACL 19 106#define TOMOYO_TYPE_MOUNT_ACL 20 107#define TOMOYO_TYPE_UMOUNT_ACL 21 108#define TOMOYO_MAX_SINGLE_PATH_OPERATION 22 109 110#define TOMOYO_TYPE_LINK_ACL 0 111#define TOMOYO_TYPE_RENAME_ACL 1 112#define TOMOYO_TYPE_PIVOT_ROOT_ACL 2 113#define TOMOYO_MAX_DOUBLE_PATH_OPERATION 3 114 115#define TOMOYO_DOMAINPOLICY 0 116#define TOMOYO_EXCEPTIONPOLICY 1 117#define TOMOYO_DOMAIN_STATUS 2 118#define TOMOYO_PROCESS_STATUS 3 119#define TOMOYO_MEMINFO 4 120#define TOMOYO_SELFDOMAIN 5 121#define TOMOYO_VERSION 6 122#define TOMOYO_PROFILE 7 123#define TOMOYO_MANAGER 8 124 125/********** Structure definitions. **********/ 126 127/* 128 * tomoyo_page_buffer is a structure which is used for holding a pathname 129 * obtained from "struct dentry" and "struct vfsmount" pair. 130 * As of now, it is 4096 bytes. If users complain that 4096 bytes is too small 131 * (because TOMOYO escapes non ASCII printable characters using \ooo format), 132 * we will make the buffer larger. 133 */ 134struct tomoyo_page_buffer { 135 char buffer[4096]; 136}; 137 138/* 139 * tomoyo_path_info is a structure which is used for holding a string data 140 * used by TOMOYO. 141 * This structure has several fields for supporting pattern matching. 142 * 143 * (1) "name" is the '\0' terminated string data. 144 * (2) "hash" is full_name_hash(name, strlen(name)). 145 * This allows tomoyo_pathcmp() to compare by hash before actually compare 146 * using strcmp(). 147 * (3) "const_len" is the length of the initial segment of "name" which 148 * consists entirely of non wildcard characters. In other words, the length 149 * which we can compare two strings using strncmp(). 150 * (4) "is_dir" is a bool which is true if "name" ends with "/", 151 * false otherwise. 152 * TOMOYO distinguishes directory and non-directory. A directory ends with 153 * "/" and non-directory does not end with "/". 154 * (5) "is_patterned" is a bool which is true if "name" contains wildcard 155 * characters, false otherwise. This allows TOMOYO to use "hash" and 156 * strcmp() for string comparison if "is_patterned" is false. 157 */ 158struct tomoyo_path_info { 159 const char *name; 160 u32 hash; /* = full_name_hash(name, strlen(name)) */ 161 u16 const_len; /* = tomoyo_const_part_length(name) */ 162 bool is_dir; /* = tomoyo_strendswith(name, "/") */ 163 bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 164}; 165 166/* 167 * tomoyo_name_entry is a structure which is used for linking 168 * "struct tomoyo_path_info" into tomoyo_name_list . 169 */ 170struct tomoyo_name_entry { 171 struct list_head list; 172 atomic_t users; 173 struct tomoyo_path_info entry; 174}; 175 176/* 177 * tomoyo_path_info_with_data is a structure which is used for holding a 178 * pathname obtained from "struct dentry" and "struct vfsmount" pair. 179 * 180 * "struct tomoyo_path_info_with_data" consists of "struct tomoyo_path_info" 181 * and buffer for the pathname, while "struct tomoyo_page_buffer" consists of 182 * buffer for the pathname only. 183 * 184 * "struct tomoyo_path_info_with_data" is intended to allow TOMOYO to release 185 * both "struct tomoyo_path_info" and buffer for the pathname by single kfree() 186 * so that we don't need to return two pointers to the caller. If the caller 187 * puts "struct tomoyo_path_info" on stack memory, we will be able to remove 188 * "struct tomoyo_path_info_with_data". 189 */ 190struct tomoyo_path_info_with_data { 191 /* Keep "head" first, for this pointer is passed to kfree(). */ 192 struct tomoyo_path_info head; 193 char barrier1[16]; /* Safeguard for overrun. */ 194 char body[TOMOYO_MAX_PATHNAME_LEN]; 195 char barrier2[16]; /* Safeguard for overrun. */ 196}; 197 198/* 199 * tomoyo_acl_info is a structure which is used for holding 200 * 201 * (1) "list" which is linked to the ->acl_info_list of 202 * "struct tomoyo_domain_info" 203 * (2) "type" which tells type of the entry (either 204 * "struct tomoyo_single_path_acl_record" or 205 * "struct tomoyo_double_path_acl_record"). 206 * 207 * Packing "struct tomoyo_acl_info" allows 208 * "struct tomoyo_single_path_acl_record" to embed "u8" + "u16" and 209 * "struct tomoyo_double_path_acl_record" to embed "u8" 210 * without enlarging their structure size. 211 */ 212struct tomoyo_acl_info { 213 struct list_head list; 214 u8 type; 215} __packed; 216 217/* 218 * tomoyo_domain_info is a structure which is used for holding permissions 219 * (e.g. "allow_read /lib/libc-2.5.so") given to each domain. 220 * It has following fields. 221 * 222 * (1) "list" which is linked to tomoyo_domain_list . 223 * (2) "acl_info_list" which is linked to "struct tomoyo_acl_info". 224 * (3) "domainname" which holds the name of the domain. 225 * (4) "profile" which remembers profile number assigned to this domain. 226 * (5) "is_deleted" is a bool which is true if this domain is marked as 227 * "deleted", false otherwise. 228 * (6) "quota_warned" is a bool which is used for suppressing warning message 229 * when learning mode learned too much entries. 230 * (7) "ignore_global_allow_read" is a bool which is true if this domain 231 * should ignore "allow_read" directive in exception policy. 232 * (8) "transition_failed" is a bool which is set to true when this domain was 233 * unable to create a new domain at tomoyo_find_next_domain() because the 234 * name of the domain to be created was too long or it could not allocate 235 * memory. If set to true, more than one process continued execve() 236 * without domain transition. 237 * (9) "users" is an atomic_t that holds how many "struct cred"->security 238 * are referring this "struct tomoyo_domain_info". If is_deleted == true 239 * and users == 0, this struct will be kfree()d upon next garbage 240 * collection. 241 * 242 * A domain's lifecycle is an analogy of files on / directory. 243 * Multiple domains with the same domainname cannot be created (as with 244 * creating files with the same filename fails with -EEXIST). 245 * If a process reached a domain, that process can reside in that domain after 246 * that domain is marked as "deleted" (as with a process can access an already 247 * open()ed file after that file was unlink()ed). 248 */ 249struct tomoyo_domain_info { 250 struct list_head list; 251 struct list_head acl_info_list; 252 /* Name of this domain. Never NULL. */ 253 const struct tomoyo_path_info *domainname; 254 u8 profile; /* Profile number to use. */ 255 bool is_deleted; /* Delete flag. */ 256 bool quota_warned; /* Quota warnning flag. */ 257 bool ignore_global_allow_read; /* Ignore "allow_read" flag. */ 258 bool transition_failed; /* Domain transition failed flag. */ 259 atomic_t users; /* Number of referring credentials. */ 260}; 261 262/* 263 * tomoyo_single_path_acl_record is a structure which is used for holding an 264 * entry with one pathname operation (e.g. open(), mkdir()). 265 * It has following fields. 266 * 267 * (1) "head" which is a "struct tomoyo_acl_info". 268 * (2) "perm" which is a bitmask of permitted operations. 269 * (3) "filename" is the pathname. 270 * 271 * Directives held by this structure are "allow_read/write", "allow_execute", 272 * "allow_read", "allow_write", "allow_create", "allow_unlink", "allow_mkdir", 273 * "allow_rmdir", "allow_mkfifo", "allow_mksock", "allow_mkblock", 274 * "allow_mkchar", "allow_truncate", "allow_symlink", "allow_rewrite", 275 * "allow_chmod", "allow_chown", "allow_chgrp", "allow_chroot", "allow_mount" 276 * and "allow_unmount". 277 */ 278struct tomoyo_single_path_acl_record { 279 struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_SINGLE_PATH_ACL */ 280 u8 perm_high; 281 u16 perm; 282 /* Pointer to single pathname. */ 283 const struct tomoyo_path_info *filename; 284}; 285 286/* 287 * tomoyo_double_path_acl_record is a structure which is used for holding an 288 * entry with two pathnames operation (i.e. link(), rename() and pivot_root()). 289 * It has following fields. 290 * 291 * (1) "head" which is a "struct tomoyo_acl_info". 292 * (2) "perm" which is a bitmask of permitted operations. 293 * (3) "filename1" is the source/old pathname. 294 * (4) "filename2" is the destination/new pathname. 295 * 296 * Directives held by this structure are "allow_rename", "allow_link" and 297 * "allow_pivot_root". 298 */ 299struct tomoyo_double_path_acl_record { 300 struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_DOUBLE_PATH_ACL */ 301 u8 perm; 302 /* Pointer to single pathname. */ 303 const struct tomoyo_path_info *filename1; 304 /* Pointer to single pathname. */ 305 const struct tomoyo_path_info *filename2; 306}; 307 308/* 309 * tomoyo_io_buffer is a structure which is used for reading and modifying 310 * configuration via /sys/kernel/security/tomoyo/ interface. 311 * It has many fields. ->read_var1 , ->read_var2 , ->write_var1 are used as 312 * cursors. 313 * 314 * Since the content of /sys/kernel/security/tomoyo/domain_policy is a list of 315 * "struct tomoyo_domain_info" entries and each "struct tomoyo_domain_info" 316 * entry has a list of "struct tomoyo_acl_info", we need two cursors when 317 * reading (one is for traversing tomoyo_domain_list and the other is for 318 * traversing "struct tomoyo_acl_info"->acl_info_list ). 319 * 320 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 321 * "select ", TOMOYO seeks the cursor ->read_var1 and ->write_var1 to the 322 * domain with the domainname specified by the rest of that line (NULL is set 323 * if seek failed). 324 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 325 * "delete ", TOMOYO deletes an entry or a domain specified by the rest of that 326 * line (->write_var1 is set to NULL if a domain was deleted). 327 * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 328 * neither "select " nor "delete ", an entry or a domain specified by that line 329 * is appended. 330 */ 331struct tomoyo_io_buffer { 332 int (*read) (struct tomoyo_io_buffer *); 333 int (*write) (struct tomoyo_io_buffer *); 334 /* Exclusive lock for this structure. */ 335 struct mutex io_sem; 336 /* Index returned by tomoyo_read_lock(). */ 337 int reader_idx; 338 /* The position currently reading from. */ 339 struct list_head *read_var1; 340 /* Extra variables for reading. */ 341 struct list_head *read_var2; 342 /* The position currently writing to. */ 343 struct tomoyo_domain_info *write_var1; 344 /* The step for reading. */ 345 int read_step; 346 /* Buffer for reading. */ 347 char *read_buf; 348 /* EOF flag for reading. */ 349 bool read_eof; 350 /* Read domain ACL of specified PID? */ 351 bool read_single_domain; 352 /* Extra variable for reading. */ 353 u8 read_bit; 354 /* Bytes available for reading. */ 355 int read_avail; 356 /* Size of read buffer. */ 357 int readbuf_size; 358 /* Buffer for writing. */ 359 char *write_buf; 360 /* Bytes available for writing. */ 361 int write_avail; 362 /* Size of write buffer. */ 363 int writebuf_size; 364}; 365 366/* 367 * tomoyo_globally_readable_file_entry is a structure which is used for holding 368 * "allow_read" entries. 369 * It has following fields. 370 * 371 * (1) "list" which is linked to tomoyo_globally_readable_list . 372 * (2) "filename" is a pathname which is allowed to open(O_RDONLY). 373 * (3) "is_deleted" is a bool which is true if marked as deleted, false 374 * otherwise. 375 */ 376struct tomoyo_globally_readable_file_entry { 377 struct list_head list; 378 const struct tomoyo_path_info *filename; 379 bool is_deleted; 380}; 381 382/* 383 * tomoyo_pattern_entry is a structure which is used for holding 384 * "tomoyo_pattern_list" entries. 385 * It has following fields. 386 * 387 * (1) "list" which is linked to tomoyo_pattern_list . 388 * (2) "pattern" is a pathname pattern which is used for converting pathnames 389 * to pathname patterns during learning mode. 390 * (3) "is_deleted" is a bool which is true if marked as deleted, false 391 * otherwise. 392 */ 393struct tomoyo_pattern_entry { 394 struct list_head list; 395 const struct tomoyo_path_info *pattern; 396 bool is_deleted; 397}; 398 399/* 400 * tomoyo_no_rewrite_entry is a structure which is used for holding 401 * "deny_rewrite" entries. 402 * It has following fields. 403 * 404 * (1) "list" which is linked to tomoyo_no_rewrite_list . 405 * (2) "pattern" is a pathname which is by default not permitted to modify 406 * already existing content. 407 * (3) "is_deleted" is a bool which is true if marked as deleted, false 408 * otherwise. 409 */ 410struct tomoyo_no_rewrite_entry { 411 struct list_head list; 412 const struct tomoyo_path_info *pattern; 413 bool is_deleted; 414}; 415 416/* 417 * tomoyo_domain_initializer_entry is a structure which is used for holding 418 * "initialize_domain" and "no_initialize_domain" entries. 419 * It has following fields. 420 * 421 * (1) "list" which is linked to tomoyo_domain_initializer_list . 422 * (2) "domainname" which is "a domainname" or "the last component of a 423 * domainname". This field is NULL if "from" clause is not specified. 424 * (3) "program" which is a program's pathname. 425 * (4) "is_deleted" is a bool which is true if marked as deleted, false 426 * otherwise. 427 * (5) "is_not" is a bool which is true if "no_initialize_domain", false 428 * otherwise. 429 * (6) "is_last_name" is a bool which is true if "domainname" is "the last 430 * component of a domainname", false otherwise. 431 */ 432struct tomoyo_domain_initializer_entry { 433 struct list_head list; 434 const struct tomoyo_path_info *domainname; /* This may be NULL */ 435 const struct tomoyo_path_info *program; 436 bool is_deleted; 437 bool is_not; /* True if this entry is "no_initialize_domain". */ 438 /* True if the domainname is tomoyo_get_last_name(). */ 439 bool is_last_name; 440}; 441 442/* 443 * tomoyo_domain_keeper_entry is a structure which is used for holding 444 * "keep_domain" and "no_keep_domain" entries. 445 * It has following fields. 446 * 447 * (1) "list" which is linked to tomoyo_domain_keeper_list . 448 * (2) "domainname" which is "a domainname" or "the last component of a 449 * domainname". 450 * (3) "program" which is a program's pathname. 451 * This field is NULL if "from" clause is not specified. 452 * (4) "is_deleted" is a bool which is true if marked as deleted, false 453 * otherwise. 454 * (5) "is_not" is a bool which is true if "no_initialize_domain", false 455 * otherwise. 456 * (6) "is_last_name" is a bool which is true if "domainname" is "the last 457 * component of a domainname", false otherwise. 458 */ 459struct tomoyo_domain_keeper_entry { 460 struct list_head list; 461 const struct tomoyo_path_info *domainname; 462 const struct tomoyo_path_info *program; /* This may be NULL */ 463 bool is_deleted; 464 bool is_not; /* True if this entry is "no_keep_domain". */ 465 /* True if the domainname is tomoyo_get_last_name(). */ 466 bool is_last_name; 467}; 468 469/* 470 * tomoyo_alias_entry is a structure which is used for holding "alias" entries. 471 * It has following fields. 472 * 473 * (1) "list" which is linked to tomoyo_alias_list . 474 * (2) "original_name" which is a dereferenced pathname. 475 * (3) "aliased_name" which is a symlink's pathname. 476 * (4) "is_deleted" is a bool which is true if marked as deleted, false 477 * otherwise. 478 */ 479struct tomoyo_alias_entry { 480 struct list_head list; 481 const struct tomoyo_path_info *original_name; 482 const struct tomoyo_path_info *aliased_name; 483 bool is_deleted; 484}; 485 486/* 487 * tomoyo_policy_manager_entry is a structure which is used for holding list of 488 * domainnames or programs which are permitted to modify configuration via 489 * /sys/kernel/security/tomoyo/ interface. 490 * It has following fields. 491 * 492 * (1) "list" which is linked to tomoyo_policy_manager_list . 493 * (2) "manager" is a domainname or a program's pathname. 494 * (3) "is_domain" is a bool which is true if "manager" is a domainname, false 495 * otherwise. 496 * (4) "is_deleted" is a bool which is true if marked as deleted, false 497 * otherwise. 498 */ 499struct tomoyo_policy_manager_entry { 500 struct list_head list; 501 /* A path to program or a domainname. */ 502 const struct tomoyo_path_info *manager; 503 bool is_domain; /* True if manager is a domainname. */ 504 bool is_deleted; /* True if this entry is deleted. */ 505}; 506 507/********** Function prototypes. **********/ 508 509/* Check whether the domain has too many ACL entries to hold. */ 510bool tomoyo_domain_quota_is_ok(struct tomoyo_domain_info * const domain); 511/* Transactional sprintf() for policy dump. */ 512bool tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 513 __attribute__ ((format(printf, 2, 3))); 514/* Check whether the domainname is correct. */ 515bool tomoyo_is_correct_domain(const unsigned char *domainname, 516 const char *function); 517/* Check whether the token is correct. */ 518bool tomoyo_is_correct_path(const char *filename, const s8 start_type, 519 const s8 pattern_type, const s8 end_type, 520 const char *function); 521/* Check whether the token can be a domainname. */ 522bool tomoyo_is_domain_def(const unsigned char *buffer); 523/* Check whether the given filename matches the given pattern. */ 524bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 525 const struct tomoyo_path_info *pattern); 526/* Read "alias" entry in exception policy. */ 527bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head); 528/* 529 * Read "initialize_domain" and "no_initialize_domain" entry 530 * in exception policy. 531 */ 532bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer *head); 533/* Read "keep_domain" and "no_keep_domain" entry in exception policy. */ 534bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer *head); 535/* Read "file_pattern" entry in exception policy. */ 536bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head); 537/* Read "allow_read" entry in exception policy. */ 538bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head); 539/* Read "deny_rewrite" entry in exception policy. */ 540bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head); 541/* Write domain policy violation warning message to console? */ 542bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain); 543/* Convert double path operation to operation name. */ 544const char *tomoyo_dp2keyword(const u8 operation); 545/* Get the last component of the given domainname. */ 546const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain); 547/* Get warning message. */ 548const char *tomoyo_get_msg(const bool is_enforce); 549/* Convert single path operation to operation name. */ 550const char *tomoyo_sp2keyword(const u8 operation); 551/* Create "alias" entry in exception policy. */ 552int tomoyo_write_alias_policy(char *data, const bool is_delete); 553/* 554 * Create "initialize_domain" and "no_initialize_domain" entry 555 * in exception policy. 556 */ 557int tomoyo_write_domain_initializer_policy(char *data, const bool is_not, 558 const bool is_delete); 559/* Create "keep_domain" and "no_keep_domain" entry in exception policy. */ 560int tomoyo_write_domain_keeper_policy(char *data, const bool is_not, 561 const bool is_delete); 562/* 563 * Create "allow_read/write", "allow_execute", "allow_read", "allow_write", 564 * "allow_create", "allow_unlink", "allow_mkdir", "allow_rmdir", 565 * "allow_mkfifo", "allow_mksock", "allow_mkblock", "allow_mkchar", 566 * "allow_truncate", "allow_symlink", "allow_rewrite", "allow_rename" and 567 * "allow_link" entry in domain policy. 568 */ 569int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain, 570 const bool is_delete); 571/* Create "allow_read" entry in exception policy. */ 572int tomoyo_write_globally_readable_policy(char *data, const bool is_delete); 573/* Create "deny_rewrite" entry in exception policy. */ 574int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete); 575/* Create "file_pattern" entry in exception policy. */ 576int tomoyo_write_pattern_policy(char *data, const bool is_delete); 577/* Find a domain by the given name. */ 578struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 579/* Find or create a domain by the given name. */ 580struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char * 581 domainname, 582 const u8 profile); 583/* Check mode for specified functionality. */ 584unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 585 const u8 index); 586/* Fill in "struct tomoyo_path_info" members. */ 587void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 588/* Run policy loader when /sbin/init starts. */ 589void tomoyo_load_policy(const char *filename); 590 591/* Convert binary string to ascii string. */ 592int tomoyo_encode(char *buffer, int buflen, const char *str); 593 594/* Returns realpath(3) of the given pathname but ignores chroot'ed root. */ 595int tomoyo_realpath_from_path2(struct path *path, char *newname, 596 int newname_len); 597 598/* 599 * Returns realpath(3) of the given pathname but ignores chroot'ed root. 600 * These functions use kzalloc(), so the caller must call kfree() 601 * if these functions didn't return NULL. 602 */ 603char *tomoyo_realpath(const char *pathname); 604/* 605 * Same with tomoyo_realpath() except that it doesn't follow the final symlink. 606 */ 607char *tomoyo_realpath_nofollow(const char *pathname); 608/* Same with tomoyo_realpath() except that the pathname is already solved. */ 609char *tomoyo_realpath_from_path(struct path *path); 610 611/* Check memory quota. */ 612bool tomoyo_memory_ok(void *ptr); 613 614/* 615 * Keep the given name on the RAM. 616 * The RAM is shared, so NEVER try to modify or kfree() the returned name. 617 */ 618const struct tomoyo_path_info *tomoyo_get_name(const char *name); 619 620/* Check for memory usage. */ 621int tomoyo_read_memory_counter(struct tomoyo_io_buffer *head); 622 623/* Set memory quota. */ 624int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head); 625 626/* Initialize realpath related code. */ 627void __init tomoyo_realpath_init(void); 628int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain, 629 const struct tomoyo_path_info *filename); 630int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 631 struct path *path, const int flag); 632int tomoyo_check_1path_perm(struct tomoyo_domain_info *domain, 633 const u8 operation, struct path *path); 634int tomoyo_check_2path_perm(struct tomoyo_domain_info *domain, 635 const u8 operation, struct path *path1, 636 struct path *path2); 637int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain, 638 struct file *filp); 639int tomoyo_find_next_domain(struct linux_binprm *bprm); 640 641/********** External variable definitions. **********/ 642 643/* Lock for GC. */ 644extern struct srcu_struct tomoyo_ss; 645 646/* The list for "struct tomoyo_domain_info". */ 647extern struct list_head tomoyo_domain_list; 648 649/* Lock for protecting policy. */ 650extern struct mutex tomoyo_policy_lock; 651 652/* Has /sbin/init started? */ 653extern bool tomoyo_policy_loaded; 654 655/* The kernel's domain. */ 656extern struct tomoyo_domain_info tomoyo_kernel_domain; 657 658/********** Inlined functions. **********/ 659 660static inline int tomoyo_read_lock(void) 661{ 662 return srcu_read_lock(&tomoyo_ss); 663} 664 665static inline void tomoyo_read_unlock(int idx) 666{ 667 srcu_read_unlock(&tomoyo_ss, idx); 668} 669 670/* strcmp() for "struct tomoyo_path_info" structure. */ 671static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 672 const struct tomoyo_path_info *b) 673{ 674 return a->hash != b->hash || strcmp(a->name, b->name); 675} 676 677/** 678 * tomoyo_is_valid - Check whether the character is a valid char. 679 * 680 * @c: The character to check. 681 * 682 * Returns true if @c is a valid character, false otherwise. 683 */ 684static inline bool tomoyo_is_valid(const unsigned char c) 685{ 686 return c > ' ' && c < 127; 687} 688 689/** 690 * tomoyo_is_invalid - Check whether the character is an invalid char. 691 * 692 * @c: The character to check. 693 * 694 * Returns true if @c is an invalid character, false otherwise. 695 */ 696static inline bool tomoyo_is_invalid(const unsigned char c) 697{ 698 return c && (c <= ' ' || c >= 127); 699} 700 701static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 702{ 703 if (name) { 704 struct tomoyo_name_entry *ptr = 705 container_of(name, struct tomoyo_name_entry, entry); 706 atomic_dec(&ptr->users); 707 } 708} 709 710static inline struct tomoyo_domain_info *tomoyo_domain(void) 711{ 712 return current_cred()->security; 713} 714 715static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 716 *task) 717{ 718 return task_cred_xxx(task, security); 719} 720 721/** 722 * list_for_each_cookie - iterate over a list with cookie. 723 * @pos: the &struct list_head to use as a loop cursor. 724 * @cookie: the &struct list_head to use as a cookie. 725 * @head: the head for your list. 726 * 727 * Same with list_for_each_rcu() except that this primitive uses @cookie 728 * so that we can continue iteration. 729 * @cookie must be NULL when iteration starts, and @cookie will become 730 * NULL when iteration finishes. 731 */ 732#define list_for_each_cookie(pos, cookie, head) \ 733 for (({ if (!cookie) \ 734 cookie = head; }), \ 735 pos = rcu_dereference((cookie)->next); \ 736 prefetch(pos->next), pos != (head) || ((cookie) = NULL); \ 737 (cookie) = pos, pos = rcu_dereference(pos->next)) 738 739#endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 740