From fbd68482939e652da87e29aec36dea4ea5ac0fe0 Mon Sep 17 00:00:00 2001 From: Tetsuo Handa Date: Sat, 10 Sep 2011 15:24:56 +0900 Subject: [PATCH] --- yaml --- r: 264534 b: refs/heads/master c: 1f067a682a9bd252107ac6f6946b7332fde42344 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/security/tomoyo/audit.c | 7 ++++++- trunk/security/tomoyo/common.c | 4 ++++ trunk/security/tomoyo/common.h | 12 ++++++++++++ trunk/security/tomoyo/condition.c | 15 +++++++++++++++ trunk/security/tomoyo/domain.c | 1 + 6 files changed, 39 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index 33380bdd800e..803337ba4846 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 059d84dbb3897d4ee494a9c842c5dda54316cb47 +refs/heads/master: 1f067a682a9bd252107ac6f6946b7332fde42344 diff --git a/trunk/security/tomoyo/audit.c b/trunk/security/tomoyo/audit.c index 5dbb1f7617c0..075c3a6d1649 100644 --- a/trunk/security/tomoyo/audit.c +++ b/trunk/security/tomoyo/audit.c @@ -313,6 +313,7 @@ static unsigned int tomoyo_log_count; */ static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns, const u8 profile, const u8 index, + const struct tomoyo_acl_info *matched_acl, const bool is_granted) { u8 mode; @@ -324,6 +325,9 @@ static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns, p = tomoyo_profile(ns, profile); if (tomoyo_log_count >= p->pref[TOMOYO_PREF_MAX_AUDIT_LOG]) return false; + if (is_granted && matched_acl && matched_acl->cond && + matched_acl->cond->grant_log != TOMOYO_GRANTLOG_AUTO) + return matched_acl->cond->grant_log == TOMOYO_GRANTLOG_YES; mode = p->config[index]; if (mode == TOMOYO_CONFIG_USE_DEFAULT) mode = p->config[category]; @@ -350,7 +354,8 @@ void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, char *buf; struct tomoyo_log *entry; bool quota_exceeded = false; - if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, r->granted)) + if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, + r->matched_acl, r->granted)) goto out; buf = tomoyo_init_log(r, len, fmt, args); if (!buf) diff --git a/trunk/security/tomoyo/common.c b/trunk/security/tomoyo/common.c index 85d915587a71..2704c384bf1e 100644 --- a/trunk/security/tomoyo/common.c +++ b/trunk/security/tomoyo/common.c @@ -1272,6 +1272,10 @@ static bool tomoyo_print_condition(struct tomoyo_io_buffer *head, head->r.cond_step++; /* fall through */ case 3: + if (cond->grant_log != TOMOYO_GRANTLOG_AUTO) + tomoyo_io_printf(head, " grant_log=%s", + tomoyo_yesno(cond->grant_log == + TOMOYO_GRANTLOG_YES)); tomoyo_set_lf(head); return true; } diff --git a/trunk/security/tomoyo/common.h b/trunk/security/tomoyo/common.h index d1c758e7f92b..435b3d869fc5 100644 --- a/trunk/security/tomoyo/common.h +++ b/trunk/security/tomoyo/common.h @@ -179,6 +179,16 @@ enum tomoyo_domain_info_flags_index { TOMOYO_MAX_DOMAIN_INFO_FLAGS }; +/* Index numbers for audit type. */ +enum tomoyo_grant_log { + /* Follow profile's configuration. */ + TOMOYO_GRANTLOG_AUTO, + /* Do not generate grant log. */ + TOMOYO_GRANTLOG_NO, + /* Generate grant_log. */ + TOMOYO_GRANTLOG_YES, +}; + /* Index numbers for group entries. */ enum tomoyo_group_id { TOMOYO_PATH_GROUP, @@ -471,6 +481,7 @@ struct tomoyo_request_info { int need_dev; } mount; } param; + struct tomoyo_acl_info *matched_acl; u8 param_type; bool granted; u8 retry; @@ -635,6 +646,7 @@ struct tomoyo_condition { u16 names_count; /* Number of "struct tomoyo_name_union names". */ u16 argc; /* Number of "struct tomoyo_argv". */ u16 envc; /* Number of "struct tomoyo_envp". */ + u8 grant_log; /* One of values in "enum tomoyo_grant_log". */ /* * struct tomoyo_condition_element condition[condc]; * struct tomoyo_number_union values[numbers_count]; diff --git a/trunk/security/tomoyo/condition.c b/trunk/security/tomoyo/condition.c index 8a05f71eaf67..3a05eb3e2a64 100644 --- a/trunk/security/tomoyo/condition.c +++ b/trunk/security/tomoyo/condition.c @@ -348,6 +348,7 @@ static inline bool tomoyo_same_condition(const struct tomoyo_condition *a, a->numbers_count == b->numbers_count && a->names_count == b->names_count && a->argc == b->argc && a->envc == b->envc && + a->grant_log == b->grant_log && !memcmp(a + 1, b + 1, a->size - sizeof(*a)); } @@ -486,6 +487,20 @@ struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param) goto out; dprintk(KERN_WARNING "%u: <%s>%s=<%s>\n", __LINE__, left_word, is_not ? "!" : "", right_word); + if (!strcmp(left_word, "grant_log")) { + if (entry) { + if (is_not || + entry->grant_log != TOMOYO_GRANTLOG_AUTO) + goto out; + else if (!strcmp(right_word, "yes")) + entry->grant_log = TOMOYO_GRANTLOG_YES; + else if (!strcmp(right_word, "no")) + entry->grant_log = TOMOYO_GRANTLOG_NO; + else + goto out; + } + continue; + } if (!strncmp(left_word, "exec.argv[", 10)) { if (!argv) { e.argc++; diff --git a/trunk/security/tomoyo/domain.c b/trunk/security/tomoyo/domain.c index 5931fb1c04d5..498fea732f48 100644 --- a/trunk/security/tomoyo/domain.c +++ b/trunk/security/tomoyo/domain.c @@ -157,6 +157,7 @@ void tomoyo_check_acl(struct tomoyo_request_info *r, continue; if (!tomoyo_condition(r, ptr->cond)) continue; + r->matched_acl = ptr; r->granted = true; return; }