Skip to content

Commit

Permalink
---
Browse files Browse the repository at this point in the history 
yaml
---
r: 260916
b: refs/heads/master
c: 0df7e8b
h: refs/heads/master
v: v3
  • Loading branch information
Tetsuo Handa authored and James Morris committed Jun 28, 2011
1 parent eee8889 commit 0e84f44
Show file tree
Hide file tree
Showing 10 changed files with 411 additions and 154 deletions.
2 changes: 1 addition & 1 deletion [refs]
View file
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
refs/heads/master: b5bc60b4ce313b6dbb42e7d32915dcf0a07c2a68
refs/heads/master: 0df7e8b8f1c25c10820bdc679555f2fbfb897ca0
43 changes: 19 additions & 24 deletions trunk/security/tomoyo/common.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ static void tomoyo_print_name_union(struct tomoyo_io_buffer *head,
const struct tomoyo_name_union *ptr)
{
tomoyo_set_space(head);
if (ptr->is_group) {
if (ptr->group) {
tomoyo_set_string(head, "@");
tomoyo_set_string(head, ptr->group->group_name->name);
} else {
Expand All @@ -210,15 +210,15 @@ static void tomoyo_print_number_union(struct tomoyo_io_buffer *head,
const struct tomoyo_number_union *ptr)
{
tomoyo_set_space(head);
if (ptr->is_group) {
if (ptr->group) {
tomoyo_set_string(head, "@");
tomoyo_set_string(head, ptr->group->group_name->name);
} else {
int i;
unsigned long min = ptr->values[0];
const unsigned long max = ptr->values[1];
u8 min_type = ptr->min_type;
const u8 max_type = ptr->max_type;
u8 min_type = ptr->value_type[0];
const u8 max_type = ptr->value_type[1];
char buffer[128];
buffer[0] = '\0';
for (i = 0; i < 2; i++) {
Expand Down Expand Up @@ -769,7 +769,7 @@ static bool tomoyo_select_one(struct tomoyo_io_buffer *head, const char *data)
domain = tomoyo_find_domain(data + 7);
} else
return false;
head->write_var1 = domain;
head->w.domain = domain;
/* Accessing read_buf is safe because head->io_sem is held. */
if (!head->read_buf)
return true; /* Do nothing if open(O_WRONLY). */
Expand Down Expand Up @@ -847,7 +847,7 @@ static int tomoyo_write_domain2(char *data, struct tomoyo_domain_info *domain,
static int tomoyo_write_domain(struct tomoyo_io_buffer *head)
{
char *data = head->write_buf;
struct tomoyo_domain_info *domain = head->write_var1;
struct tomoyo_domain_info *domain = head->w.domain;
bool is_delete = false;
bool is_select = false;
unsigned int profile;
Expand All @@ -869,7 +869,7 @@ static int tomoyo_write_domain(struct tomoyo_io_buffer *head)
domain = tomoyo_find_domain(data);
else
domain = tomoyo_assign_domain(data, 0);
head->write_var1 = domain;
head->w.domain = domain;
return 0;
}
if (!domain)
Expand Down Expand Up @@ -1250,7 +1250,7 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
{
list_for_each_cookie(head->r.group, &tomoyo_group_list[idx]) {
struct tomoyo_group *group =
list_entry(head->r.group, typeof(*group), list);
list_entry(head->r.group, typeof(*group), head.list);
list_for_each_cookie(head->r.acl, &group->member_list) {
struct tomoyo_acl_head *ptr =
list_entry(head->r.acl, typeof(*ptr), list);
Expand Down Expand Up @@ -1874,19 +1874,18 @@ int tomoyo_poll_control(struct file *file, poll_table *wait)
/**
* tomoyo_read_control - read() for /sys/kernel/security/tomoyo/ interface.
*
* @file: Pointer to "struct file".
* @head: Pointer to "struct tomoyo_io_buffer".
* @buffer: Poiner to buffer to write to.
* @buffer_len: Size of @buffer.
*
* Returns bytes read on success, negative value otherwise.
*
* Caller holds tomoyo_read_lock().
*/
int tomoyo_read_control(struct file *file, char __user *buffer,
int tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
const int buffer_len)
{
int len;
struct tomoyo_io_buffer *head = file->private_data;

if (!head->read)
return -ENOSYS;
Expand All @@ -1906,18 +1905,17 @@ int tomoyo_read_control(struct file *file, char __user *buffer,
/**
* tomoyo_write_control - write() for /sys/kernel/security/tomoyo/ interface.
*
* @file: Pointer to "struct file".
* @head: Pointer to "struct tomoyo_io_buffer".
* @buffer: Pointer to buffer to read from.
* @buffer_len: Size of @buffer.
*
* Returns @buffer_len on success, negative value otherwise.
*
* Caller holds tomoyo_read_lock().
*/
int tomoyo_write_control(struct file *file, const char __user *buffer,
const int buffer_len)
int tomoyo_write_control(struct tomoyo_io_buffer *head,
const char __user *buffer, const int buffer_len)
{
struct tomoyo_io_buffer *head = file->private_data;
int error = buffer_len;
int avail_len = buffer_len;
char *cp0 = head->write_buf;
Expand All @@ -1935,7 +1933,7 @@ int tomoyo_write_control(struct file *file, const char __user *buffer,
/* Read a line and dispatch it to the policy handler. */
while (avail_len > 0) {
char c;
if (head->write_avail >= head->writebuf_size - 1) {
if (head->w.avail >= head->writebuf_size - 1) {
error = -ENOMEM;
break;
} else if (get_user(c, buffer)) {
Expand All @@ -1944,11 +1942,11 @@ int tomoyo_write_control(struct file *file, const char __user *buffer,
}
buffer++;
avail_len--;
cp0[head->write_avail++] = c;
cp0[head->w.avail++] = c;
if (c != '\n')
continue;
cp0[head->write_avail - 1] = '\0';
head->write_avail = 0;
cp0[head->w.avail - 1] = '\0';
head->w.avail = 0;
tomoyo_normalize_line(cp0);
head->write(head);
}
Expand All @@ -1959,15 +1957,14 @@ int tomoyo_write_control(struct file *file, const char __user *buffer,
/**
* tomoyo_close_control - close() for /sys/kernel/security/tomoyo/ interface.
*
* @file: Pointer to "struct file".
* @head: Pointer to "struct tomoyo_io_buffer".
*
* Releases memory and returns 0.
*
* Caller looses tomoyo_read_lock().
*/
int tomoyo_close_control(struct file *file)
int tomoyo_close_control(struct tomoyo_io_buffer *head)
{
struct tomoyo_io_buffer *head = file->private_data;
const bool is_write = !!head->write_buf;

/*
Expand All @@ -1984,8 +1981,6 @@ int tomoyo_close_control(struct file *file)
kfree(head->write_buf);
head->write_buf = NULL;
kfree(head);
head = NULL;
file->private_data = NULL;
if (is_write)
tomoyo_run_gc();
return 0;
Expand Down
78 changes: 24 additions & 54 deletions trunk/security/tomoyo/common.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,12 @@ struct tomoyo_acl_head {
bool is_deleted;
} __packed;

/* Common header for shared entries. */
struct tomoyo_shared_acl_head {
struct list_head list;
atomic_t users;
} __packed;

/* Structure for request info. */
struct tomoyo_request_info {
struct tomoyo_domain_info *domain;
Expand Down Expand Up @@ -281,8 +287,7 @@ struct tomoyo_path_info {

/* Structure for holding string data. */
struct tomoyo_name {
struct list_head list;
atomic_t users;
struct tomoyo_shared_acl_head head;
struct tomoyo_path_info entry;
};

Expand All @@ -291,27 +296,21 @@ struct tomoyo_name_union {
/* Either @filename or @group is NULL. */
const struct tomoyo_path_info *filename;
struct tomoyo_group *group;
/* True if @group != NULL, false if @filename != NULL. */
u8 is_group;
};

/* Structure for holding a number. */
struct tomoyo_number_union {
unsigned long values[2];
struct tomoyo_group *group; /* Maybe NULL. */
/* One of values in "enum tomoyo_value_type". */
u8 min_type;
u8 max_type;
/* True if @group != NULL, false otherwise. */
u8 is_group;
u8 value_type[2];
};

/* Structure for "path_group"/"number_group" directive. */
struct tomoyo_group {
struct list_head list;
struct tomoyo_shared_acl_head head;
const struct tomoyo_path_info *group_name;
struct list_head member_list;
atomic_t users;
};

/* Structure for "path_group" directive. */
Expand Down Expand Up @@ -429,16 +428,18 @@ struct tomoyo_io_buffer {
bool print_execute_only;
const char *w[TOMOYO_MAX_IO_READ_QUEUE];
} r;
/* The position currently writing to. */
struct tomoyo_domain_info *write_var1;
struct {
/* The position currently writing to. */
struct tomoyo_domain_info *domain;
/* Bytes available for writing. */
int avail;
} w;
/* Buffer for reading. */
char *read_buf;
/* Size of read buffer. */
int readbuf_size;
/* Buffer for writing. */
char *write_buf;
/* Bytes available for writing. */
int write_avail;
/* Size of write buffer. */
int writebuf_size;
/* Type of this interface. */
Expand Down Expand Up @@ -500,12 +501,12 @@ void tomoyo_warn_log(struct tomoyo_request_info *r, const char *fmt, ...)
__attribute__ ((format(printf, 2, 3)));
void tomoyo_check_profile(void);
int tomoyo_open_control(const u8 type, struct file *file);
int tomoyo_close_control(struct file *file);
int tomoyo_close_control(struct tomoyo_io_buffer *head);
int tomoyo_poll_control(struct file *file, poll_table *wait);
int tomoyo_read_control(struct file *file, char __user *buffer,
int tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
const int buffer_len);
int tomoyo_write_control(struct file *file, const char __user *buffer,
const int buffer_len);
int tomoyo_write_control(struct tomoyo_io_buffer *head,
const char __user *buffer, const int buffer_len);
bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r);
void tomoyo_warn_oom(const char *function);
const struct tomoyo_path_info *
Expand Down Expand Up @@ -671,30 +672,6 @@ static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a,
return a->hash != b->hash || strcmp(a->name, b->name);
}

/**
* tomoyo_valid - Check whether the character is a valid char.
*
* @c: The character to check.
*
* Returns true if @c is a valid character, false otherwise.
*/
static inline bool tomoyo_valid(const unsigned char c)
{
return c > ' ' && c < 127;
}

/**
* tomoyo_invalid - Check whether the character is an invalid char.
*
* @c: The character to check.
*
* Returns true if @c is an invalid character, false otherwise.
*/
static inline bool tomoyo_invalid(const unsigned char c)
{
return c && (c <= ' ' || c >= 127);
}

/**
* tomoyo_put_name - Drop reference on "struct tomoyo_name".
*
Expand All @@ -707,7 +684,7 @@ static inline void tomoyo_put_name(const struct tomoyo_path_info *name)
if (name) {
struct tomoyo_name *ptr =
container_of(name, typeof(*ptr), entry);
atomic_dec(&ptr->users);
atomic_dec(&ptr->head.users);
}
}

Expand All @@ -721,7 +698,7 @@ static inline void tomoyo_put_name(const struct tomoyo_path_info *name)
static inline void tomoyo_put_group(struct tomoyo_group *group)
{
if (group)
atomic_dec(&group->users);
atomic_dec(&group->head.users);
}

/**
Expand All @@ -747,12 +724,6 @@ static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct
return task_cred_xxx(task, security);
}

static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *p1,
const struct tomoyo_acl_info *p2)
{
return p1->type == p2->type;
}

/**
* tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry.
*
Expand All @@ -764,8 +735,7 @@ static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *p1,
static inline bool tomoyo_same_name_union
(const struct tomoyo_name_union *a, const struct tomoyo_name_union *b)
{
return a->filename == b->filename && a->group == b->group &&
a->is_group == b->is_group;
return a->filename == b->filename && a->group == b->group;
}

/**
Expand All @@ -780,8 +750,8 @@ static inline bool tomoyo_same_number_union
(const struct tomoyo_number_union *a, const struct tomoyo_number_union *b)
{
return a->values[0] == b->values[0] && a->values[1] == b->values[1] &&
a->group == b->group && a->min_type == b->min_type &&
a->max_type == b->max_type && a->is_group == b->is_group;
a->group == b->group && a->value_type[0] == b->value_type[0] &&
a->value_type[1] == b->value_type[1];
}

/**
Expand Down
17 changes: 16 additions & 1 deletion trunk/security/tomoyo/domain.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,20 @@ int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
return error;
}

/**
* tomoyo_same_acl_head - Check for duplicated "struct tomoyo_acl_info" entry.
*
* @a: Pointer to "struct tomoyo_acl_info".
* @b: Pointer to "struct tomoyo_acl_info".
*
* Returns true if @a == @b, false otherwise.
*/
static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
const struct tomoyo_acl_info *b)
{
return a->type == b->type;
}

/**
* tomoyo_update_domain - Update an entry for domain policy.
*
Expand Down Expand Up @@ -88,7 +102,8 @@ int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
if (mutex_lock_interruptible(&tomoyo_policy_lock))
return error;
list_for_each_entry_rcu(entry, &domain->acl_info_list, list) {
if (!check_duplicate(entry, new_entry))
if (!tomoyo_same_acl_head(entry, new_entry) ||
!check_duplicate(entry, new_entry))
continue;
if (merge_duplicate)
entry->is_deleted = merge_duplicate(entry, new_entry,
Expand Down
Loading

0 comments on commit 0e84f44

Please sign in to comment.