1
2
3
4
5
6
7
8
9#ifndef _SECURITY_TOMOYO_COMMON_H
10#define _SECURITY_TOMOYO_COMMON_H
11
12#include <linux/ctype.h>
13#include <linux/string.h>
14#include <linux/mm.h>
15#include <linux/file.h>
16#include <linux/kmod.h>
17#include <linux/fs.h>
18#include <linux/sched.h>
19#include <linux/namei.h>
20#include <linux/mount.h>
21#include <linux/list.h>
22#include <linux/cred.h>
23#include <linux/poll.h>
24#include <linux/binfmts.h>
25#include <linux/highmem.h>
26#include <linux/net.h>
27#include <linux/inet.h>
28#include <linux/in.h>
29#include <linux/in6.h>
30#include <linux/un.h>
31#include <net/sock.h>
32#include <net/af_unix.h>
33#include <net/ip.h>
34#include <net/ipv6.h>
35#include <net/udp.h>
36
37
38
39
40
41
42
43
44#define TOMOYO_HASH_BITS 8
45#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
46
47
48
49
50
51#define TOMOYO_SOCK_MAX 6
52
53#define TOMOYO_EXEC_TMPSIZE 4096
54
55
56#define TOMOYO_GC_IN_PROGRESS -1
57
58
59#define TOMOYO_MAX_PROFILES 256
60
61
62#define TOMOYO_MAX_ACL_GROUPS 256
63
64
65enum tomoyo_conditions_index {
66 TOMOYO_TASK_UID,
67 TOMOYO_TASK_EUID,
68 TOMOYO_TASK_SUID,
69 TOMOYO_TASK_FSUID,
70 TOMOYO_TASK_GID,
71 TOMOYO_TASK_EGID,
72 TOMOYO_TASK_SGID,
73 TOMOYO_TASK_FSGID,
74 TOMOYO_TASK_PID,
75 TOMOYO_TASK_PPID,
76 TOMOYO_EXEC_ARGC,
77 TOMOYO_EXEC_ENVC,
78 TOMOYO_TYPE_IS_SOCKET,
79 TOMOYO_TYPE_IS_SYMLINK,
80 TOMOYO_TYPE_IS_FILE,
81 TOMOYO_TYPE_IS_BLOCK_DEV,
82 TOMOYO_TYPE_IS_DIRECTORY,
83 TOMOYO_TYPE_IS_CHAR_DEV,
84 TOMOYO_TYPE_IS_FIFO,
85 TOMOYO_MODE_SETUID,
86 TOMOYO_MODE_SETGID,
87 TOMOYO_MODE_STICKY,
88 TOMOYO_MODE_OWNER_READ,
89 TOMOYO_MODE_OWNER_WRITE,
90 TOMOYO_MODE_OWNER_EXECUTE,
91 TOMOYO_MODE_GROUP_READ,
92 TOMOYO_MODE_GROUP_WRITE,
93 TOMOYO_MODE_GROUP_EXECUTE,
94 TOMOYO_MODE_OTHERS_READ,
95 TOMOYO_MODE_OTHERS_WRITE,
96 TOMOYO_MODE_OTHERS_EXECUTE,
97 TOMOYO_EXEC_REALPATH,
98 TOMOYO_SYMLINK_TARGET,
99 TOMOYO_PATH1_UID,
100 TOMOYO_PATH1_GID,
101 TOMOYO_PATH1_INO,
102 TOMOYO_PATH1_MAJOR,
103 TOMOYO_PATH1_MINOR,
104 TOMOYO_PATH1_PERM,
105 TOMOYO_PATH1_TYPE,
106 TOMOYO_PATH1_DEV_MAJOR,
107 TOMOYO_PATH1_DEV_MINOR,
108 TOMOYO_PATH2_UID,
109 TOMOYO_PATH2_GID,
110 TOMOYO_PATH2_INO,
111 TOMOYO_PATH2_MAJOR,
112 TOMOYO_PATH2_MINOR,
113 TOMOYO_PATH2_PERM,
114 TOMOYO_PATH2_TYPE,
115 TOMOYO_PATH2_DEV_MAJOR,
116 TOMOYO_PATH2_DEV_MINOR,
117 TOMOYO_PATH1_PARENT_UID,
118 TOMOYO_PATH1_PARENT_GID,
119 TOMOYO_PATH1_PARENT_INO,
120 TOMOYO_PATH1_PARENT_PERM,
121 TOMOYO_PATH2_PARENT_UID,
122 TOMOYO_PATH2_PARENT_GID,
123 TOMOYO_PATH2_PARENT_INO,
124 TOMOYO_PATH2_PARENT_PERM,
125 TOMOYO_MAX_CONDITION_KEYWORD,
126 TOMOYO_NUMBER_UNION,
127 TOMOYO_NAME_UNION,
128 TOMOYO_ARGV_ENTRY,
129 TOMOYO_ENVP_ENTRY,
130};
131
132
133
134enum tomoyo_path_stat_index {
135
136 TOMOYO_PATH1,
137 TOMOYO_PATH1_PARENT,
138 TOMOYO_PATH2,
139 TOMOYO_PATH2_PARENT,
140 TOMOYO_MAX_PATH_STAT
141};
142
143
144enum tomoyo_mode_index {
145 TOMOYO_CONFIG_DISABLED,
146 TOMOYO_CONFIG_LEARNING,
147 TOMOYO_CONFIG_PERMISSIVE,
148 TOMOYO_CONFIG_ENFORCING,
149 TOMOYO_CONFIG_MAX_MODE,
150 TOMOYO_CONFIG_WANT_REJECT_LOG = 64,
151 TOMOYO_CONFIG_WANT_GRANT_LOG = 128,
152 TOMOYO_CONFIG_USE_DEFAULT = 255,
153};
154
155
156enum tomoyo_policy_id {
157 TOMOYO_ID_GROUP,
158 TOMOYO_ID_ADDRESS_GROUP,
159 TOMOYO_ID_PATH_GROUP,
160 TOMOYO_ID_NUMBER_GROUP,
161 TOMOYO_ID_TRANSITION_CONTROL,
162 TOMOYO_ID_AGGREGATOR,
163 TOMOYO_ID_MANAGER,
164 TOMOYO_ID_CONDITION,
165 TOMOYO_ID_NAME,
166 TOMOYO_ID_ACL,
167 TOMOYO_ID_DOMAIN,
168 TOMOYO_MAX_POLICY
169};
170
171
172enum tomoyo_domain_info_flags_index {
173
174 TOMOYO_DIF_QUOTA_WARNED,
175
176
177
178
179
180
181 TOMOYO_DIF_TRANSITION_FAILED,
182 TOMOYO_MAX_DOMAIN_INFO_FLAGS
183};
184
185
186enum tomoyo_grant_log {
187
188 TOMOYO_GRANTLOG_AUTO,
189
190 TOMOYO_GRANTLOG_NO,
191
192 TOMOYO_GRANTLOG_YES,
193};
194
195
196enum tomoyo_group_id {
197 TOMOYO_PATH_GROUP,
198 TOMOYO_NUMBER_GROUP,
199 TOMOYO_ADDRESS_GROUP,
200 TOMOYO_MAX_GROUP
201};
202
203
204enum tomoyo_value_type {
205 TOMOYO_VALUE_TYPE_INVALID,
206 TOMOYO_VALUE_TYPE_DECIMAL,
207 TOMOYO_VALUE_TYPE_OCTAL,
208 TOMOYO_VALUE_TYPE_HEXADECIMAL,
209};
210
211
212enum tomoyo_transition_type {
213
214 TOMOYO_TRANSITION_CONTROL_NO_RESET,
215 TOMOYO_TRANSITION_CONTROL_RESET,
216 TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE,
217 TOMOYO_TRANSITION_CONTROL_INITIALIZE,
218 TOMOYO_TRANSITION_CONTROL_NO_KEEP,
219 TOMOYO_TRANSITION_CONTROL_KEEP,
220 TOMOYO_MAX_TRANSITION_TYPE
221};
222
223
224enum tomoyo_acl_entry_type_index {
225 TOMOYO_TYPE_PATH_ACL,
226 TOMOYO_TYPE_PATH2_ACL,
227 TOMOYO_TYPE_PATH_NUMBER_ACL,
228 TOMOYO_TYPE_MKDEV_ACL,
229 TOMOYO_TYPE_MOUNT_ACL,
230 TOMOYO_TYPE_INET_ACL,
231 TOMOYO_TYPE_UNIX_ACL,
232 TOMOYO_TYPE_ENV_ACL,
233 TOMOYO_TYPE_MANUAL_TASK_ACL,
234};
235
236
237enum tomoyo_path_acl_index {
238 TOMOYO_TYPE_EXECUTE,
239 TOMOYO_TYPE_READ,
240 TOMOYO_TYPE_WRITE,
241 TOMOYO_TYPE_APPEND,
242 TOMOYO_TYPE_UNLINK,
243 TOMOYO_TYPE_GETATTR,
244 TOMOYO_TYPE_RMDIR,
245 TOMOYO_TYPE_TRUNCATE,
246 TOMOYO_TYPE_SYMLINK,
247 TOMOYO_TYPE_CHROOT,
248 TOMOYO_TYPE_UMOUNT,
249 TOMOYO_MAX_PATH_OPERATION
250};
251
252
253enum tomoyo_memory_stat_type {
254 TOMOYO_MEMORY_POLICY,
255 TOMOYO_MEMORY_AUDIT,
256 TOMOYO_MEMORY_QUERY,
257 TOMOYO_MAX_MEMORY_STAT
258};
259
260enum tomoyo_mkdev_acl_index {
261 TOMOYO_TYPE_MKBLOCK,
262 TOMOYO_TYPE_MKCHAR,
263 TOMOYO_MAX_MKDEV_OPERATION
264};
265
266
267enum tomoyo_network_acl_index {
268 TOMOYO_NETWORK_BIND,
269 TOMOYO_NETWORK_LISTEN,
270 TOMOYO_NETWORK_CONNECT,
271 TOMOYO_NETWORK_SEND,
272 TOMOYO_MAX_NETWORK_OPERATION
273};
274
275
276enum tomoyo_path2_acl_index {
277 TOMOYO_TYPE_LINK,
278 TOMOYO_TYPE_RENAME,
279 TOMOYO_TYPE_PIVOT_ROOT,
280 TOMOYO_MAX_PATH2_OPERATION
281};
282
283
284enum tomoyo_path_number_acl_index {
285 TOMOYO_TYPE_CREATE,
286 TOMOYO_TYPE_MKDIR,
287 TOMOYO_TYPE_MKFIFO,
288 TOMOYO_TYPE_MKSOCK,
289 TOMOYO_TYPE_IOCTL,
290 TOMOYO_TYPE_CHMOD,
291 TOMOYO_TYPE_CHOWN,
292 TOMOYO_TYPE_CHGRP,
293 TOMOYO_MAX_PATH_NUMBER_OPERATION
294};
295
296
297enum tomoyo_securityfs_interface_index {
298 TOMOYO_DOMAINPOLICY,
299 TOMOYO_EXCEPTIONPOLICY,
300 TOMOYO_PROCESS_STATUS,
301 TOMOYO_STAT,
302 TOMOYO_AUDIT,
303 TOMOYO_VERSION,
304 TOMOYO_PROFILE,
305 TOMOYO_QUERY,
306 TOMOYO_MANAGER
307};
308
309
310enum tomoyo_special_mount {
311 TOMOYO_MOUNT_BIND,
312 TOMOYO_MOUNT_MOVE,
313 TOMOYO_MOUNT_REMOUNT,
314 TOMOYO_MOUNT_MAKE_UNBINDABLE,
315 TOMOYO_MOUNT_MAKE_PRIVATE,
316 TOMOYO_MOUNT_MAKE_SLAVE,
317 TOMOYO_MOUNT_MAKE_SHARED,
318 TOMOYO_MAX_SPECIAL_MOUNT
319};
320
321
322enum tomoyo_mac_index {
323 TOMOYO_MAC_FILE_EXECUTE,
324 TOMOYO_MAC_FILE_OPEN,
325 TOMOYO_MAC_FILE_CREATE,
326 TOMOYO_MAC_FILE_UNLINK,
327 TOMOYO_MAC_FILE_GETATTR,
328 TOMOYO_MAC_FILE_MKDIR,
329 TOMOYO_MAC_FILE_RMDIR,
330 TOMOYO_MAC_FILE_MKFIFO,
331 TOMOYO_MAC_FILE_MKSOCK,
332 TOMOYO_MAC_FILE_TRUNCATE,
333 TOMOYO_MAC_FILE_SYMLINK,
334 TOMOYO_MAC_FILE_MKBLOCK,
335 TOMOYO_MAC_FILE_MKCHAR,
336 TOMOYO_MAC_FILE_LINK,
337 TOMOYO_MAC_FILE_RENAME,
338 TOMOYO_MAC_FILE_CHMOD,
339 TOMOYO_MAC_FILE_CHOWN,
340 TOMOYO_MAC_FILE_CHGRP,
341 TOMOYO_MAC_FILE_IOCTL,
342 TOMOYO_MAC_FILE_CHROOT,
343 TOMOYO_MAC_FILE_MOUNT,
344 TOMOYO_MAC_FILE_UMOUNT,
345 TOMOYO_MAC_FILE_PIVOT_ROOT,
346 TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
347 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
348 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
349 TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
350 TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
351 TOMOYO_MAC_NETWORK_INET_RAW_BIND,
352 TOMOYO_MAC_NETWORK_INET_RAW_SEND,
353 TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
354 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
355 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
356 TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
357 TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
358 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
359 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
360 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
361 TOMOYO_MAC_ENVIRON,
362 TOMOYO_MAX_MAC_INDEX
363};
364
365
366enum tomoyo_mac_category_index {
367 TOMOYO_MAC_CATEGORY_FILE,
368 TOMOYO_MAC_CATEGORY_NETWORK,
369 TOMOYO_MAC_CATEGORY_MISC,
370 TOMOYO_MAX_MAC_CATEGORY_INDEX
371};
372
373
374
375
376
377
378
379
380#define TOMOYO_RETRY_REQUEST 1
381
382
383enum tomoyo_policy_stat_type {
384
385 TOMOYO_STAT_POLICY_UPDATES,
386 TOMOYO_STAT_POLICY_LEARNING,
387 TOMOYO_STAT_POLICY_PERMISSIVE,
388 TOMOYO_STAT_POLICY_ENFORCING,
389 TOMOYO_MAX_POLICY_STAT
390};
391
392
393enum tomoyo_pref_index {
394 TOMOYO_PREF_MAX_AUDIT_LOG,
395 TOMOYO_PREF_MAX_LEARNING_ENTRY,
396 TOMOYO_MAX_PREF
397};
398
399
400
401
402struct tomoyo_acl_head {
403 struct list_head list;
404 s8 is_deleted;
405} __packed;
406
407
408struct tomoyo_shared_acl_head {
409 struct list_head list;
410 atomic_t users;
411} __packed;
412
413struct tomoyo_policy_namespace;
414
415
416struct tomoyo_request_info {
417
418
419
420
421 struct tomoyo_obj_info *obj;
422
423
424
425
426 struct tomoyo_execve *ee;
427 struct tomoyo_domain_info *domain;
428
429 union {
430 struct {
431 const struct tomoyo_path_info *filename;
432
433 const struct tomoyo_path_info *matched_path;
434
435 u8 operation;
436 } path;
437 struct {
438 const struct tomoyo_path_info *filename1;
439 const struct tomoyo_path_info *filename2;
440
441 u8 operation;
442 } path2;
443 struct {
444 const struct tomoyo_path_info *filename;
445 unsigned int mode;
446 unsigned int major;
447 unsigned int minor;
448
449 u8 operation;
450 } mkdev;
451 struct {
452 const struct tomoyo_path_info *filename;
453 unsigned long number;
454
455
456
457
458 u8 operation;
459 } path_number;
460 struct {
461 const struct tomoyo_path_info *name;
462 } environ;
463 struct {
464 const __be32 *address;
465 u16 port;
466
467 u8 protocol;
468
469 u8 operation;
470 bool is_ipv6;
471 } inet_network;
472 struct {
473 const struct tomoyo_path_info *address;
474
475 u8 protocol;
476
477 u8 operation;
478 } unix_network;
479 struct {
480 const struct tomoyo_path_info *type;
481 const struct tomoyo_path_info *dir;
482 const struct tomoyo_path_info *dev;
483 unsigned long flags;
484 int need_dev;
485 } mount;
486 struct {
487 const struct tomoyo_path_info *domainname;
488 } task;
489 } param;
490 struct tomoyo_acl_info *matched_acl;
491 u8 param_type;
492 bool granted;
493 u8 retry;
494 u8 profile;
495 u8 mode;
496 u8 type;
497};
498
499
500struct tomoyo_path_info {
501 const char *name;
502 u32 hash;
503 u16 const_len;
504 bool is_dir;
505 bool is_patterned;
506};
507
508
509struct tomoyo_name {
510 struct tomoyo_shared_acl_head head;
511 struct tomoyo_path_info entry;
512};
513
514
515struct tomoyo_name_union {
516
517 const struct tomoyo_path_info *filename;
518 struct tomoyo_group *group;
519};
520
521
522struct tomoyo_number_union {
523 unsigned long values[2];
524 struct tomoyo_group *group;
525
526 u8 value_type[2];
527};
528
529
530struct tomoyo_ipaddr_union {
531 struct in6_addr ip[2];
532 struct tomoyo_group *group;
533 bool is_ipv6;
534};
535
536
537struct tomoyo_group {
538 struct tomoyo_shared_acl_head head;
539 const struct tomoyo_path_info *group_name;
540 struct list_head member_list;
541};
542
543
544struct tomoyo_path_group {
545 struct tomoyo_acl_head head;
546 const struct tomoyo_path_info *member_name;
547};
548
549
550struct tomoyo_number_group {
551 struct tomoyo_acl_head head;
552 struct tomoyo_number_union number;
553};
554
555
556struct tomoyo_address_group {
557 struct tomoyo_acl_head head;
558
559 struct tomoyo_ipaddr_union address;
560};
561
562
563struct tomoyo_mini_stat {
564 kuid_t uid;
565 kgid_t gid;
566 ino_t ino;
567 umode_t mode;
568 dev_t dev;
569 dev_t rdev;
570};
571
572
573struct tomoyo_page_dump {
574 struct page *page;
575 char *data;
576};
577
578
579struct tomoyo_obj_info {
580
581
582
583 bool validate_done;
584
585 bool stat_valid[TOMOYO_MAX_PATH_STAT];
586
587 struct path path1;
588
589 struct path path2;
590
591
592
593
594 struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT];
595
596
597
598
599 struct tomoyo_path_info *symlink_target;
600};
601
602
603struct tomoyo_argv {
604 unsigned long index;
605 const struct tomoyo_path_info *value;
606 bool is_not;
607};
608
609
610struct tomoyo_envp {
611 const struct tomoyo_path_info *name;
612 const struct tomoyo_path_info *value;
613 bool is_not;
614};
615
616
617struct tomoyo_execve {
618 struct tomoyo_request_info r;
619 struct tomoyo_obj_info obj;
620 struct linux_binprm *bprm;
621 const struct tomoyo_path_info *transition;
622
623 struct tomoyo_page_dump dump;
624
625 char *tmp;
626};
627
628
629struct tomoyo_condition_element {
630
631
632
633
634
635 u8 left;
636
637
638
639
640
641
642 u8 right;
643
644 bool equals;
645};
646
647
648struct tomoyo_condition {
649 struct tomoyo_shared_acl_head head;
650 u32 size;
651 u16 condc;
652 u16 numbers_count;
653 u16 names_count;
654 u16 argc;
655 u16 envc;
656 u8 grant_log;
657 const struct tomoyo_path_info *transit;
658
659
660
661
662
663
664
665};
666
667
668struct tomoyo_acl_info {
669 struct list_head list;
670 struct tomoyo_condition *cond;
671 s8 is_deleted;
672 u8 type;
673} __packed;
674
675
676struct tomoyo_domain_info {
677 struct list_head list;
678 struct list_head acl_info_list;
679
680 const struct tomoyo_path_info *domainname;
681
682 struct tomoyo_policy_namespace *ns;
683 u8 profile;
684 u8 group;
685 bool is_deleted;
686 bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS];
687 atomic_t users;
688};
689
690
691
692
693struct tomoyo_task_acl {
694 struct tomoyo_acl_info head;
695
696 const struct tomoyo_path_info *domainname;
697};
698
699
700
701
702
703
704struct tomoyo_path_acl {
705 struct tomoyo_acl_info head;
706 u16 perm;
707 struct tomoyo_name_union name;
708};
709
710
711
712
713
714struct tomoyo_path_number_acl {
715 struct tomoyo_acl_info head;
716
717 u8 perm;
718 struct tomoyo_name_union name;
719 struct tomoyo_number_union number;
720};
721
722
723struct tomoyo_mkdev_acl {
724 struct tomoyo_acl_info head;
725 u8 perm;
726 struct tomoyo_name_union name;
727 struct tomoyo_number_union mode;
728 struct tomoyo_number_union major;
729 struct tomoyo_number_union minor;
730};
731
732
733
734
735struct tomoyo_path2_acl {
736 struct tomoyo_acl_info head;
737 u8 perm;
738 struct tomoyo_name_union name1;
739 struct tomoyo_name_union name2;
740};
741
742
743struct tomoyo_mount_acl {
744 struct tomoyo_acl_info head;
745 struct tomoyo_name_union dev_name;
746 struct tomoyo_name_union dir_name;
747 struct tomoyo_name_union fs_type;
748 struct tomoyo_number_union flags;
749};
750
751
752struct tomoyo_env_acl {
753 struct tomoyo_acl_info head;
754 const struct tomoyo_path_info *env;
755};
756
757
758struct tomoyo_inet_acl {
759 struct tomoyo_acl_info head;
760 u8 protocol;
761 u8 perm;
762 struct tomoyo_ipaddr_union address;
763 struct tomoyo_number_union port;
764};
765
766
767struct tomoyo_unix_acl {
768 struct tomoyo_acl_info head;
769 u8 protocol;
770 u8 perm;
771 struct tomoyo_name_union name;
772};
773
774
775struct tomoyo_acl_param {
776 char *data;
777 struct list_head *list;
778 struct tomoyo_policy_namespace *ns;
779 bool is_delete;
780};
781
782#define TOMOYO_MAX_IO_READ_QUEUE 64
783
784
785
786
787
788struct tomoyo_io_buffer {
789 void (*read) (struct tomoyo_io_buffer *);
790 int (*write) (struct tomoyo_io_buffer *);
791 unsigned int (*poll) (struct file *file, poll_table *wait);
792
793 struct mutex io_sem;
794 char __user *read_user_buf;
795 size_t read_user_buf_avail;
796 struct {
797 struct list_head *ns;
798 struct list_head *domain;
799 struct list_head *group;
800 struct list_head *acl;
801 size_t avail;
802 unsigned int step;
803 unsigned int query_index;
804 u16 index;
805 u16 cond_index;
806 u8 acl_group_index;
807 u8 cond_step;
808 u8 bit;
809 u8 w_pos;
810 bool eof;
811 bool print_this_domain_only;
812 bool print_transition_related_only;
813 bool print_cond_part;
814 const char *w[TOMOYO_MAX_IO_READ_QUEUE];
815 } r;
816 struct {
817 struct tomoyo_policy_namespace *ns;
818
819 struct tomoyo_domain_info *domain;
820
821 size_t avail;
822 bool is_delete;
823 } w;
824
825 char *read_buf;
826
827 size_t readbuf_size;
828
829 char *write_buf;
830
831 size_t writebuf_size;
832
833 enum tomoyo_securityfs_interface_index type;
834
835 u8 users;
836
837 struct list_head list;
838};
839
840
841
842
843
844struct tomoyo_transition_control {
845 struct tomoyo_acl_head head;
846 u8 type;
847
848 bool is_last_name;
849 const struct tomoyo_path_info *domainname;
850 const struct tomoyo_path_info *program;
851};
852
853
854struct tomoyo_aggregator {
855 struct tomoyo_acl_head head;
856 const struct tomoyo_path_info *original_name;
857 const struct tomoyo_path_info *aggregated_name;
858};
859
860
861struct tomoyo_manager {
862 struct tomoyo_acl_head head;
863
864 const struct tomoyo_path_info *manager;
865};
866
867struct tomoyo_preference {
868 unsigned int learning_max_entry;
869 bool enforcing_verbose;
870 bool learning_verbose;
871 bool permissive_verbose;
872};
873
874
875struct tomoyo_profile {
876 const struct tomoyo_path_info *comment;
877 struct tomoyo_preference *learning;
878 struct tomoyo_preference *permissive;
879 struct tomoyo_preference *enforcing;
880 struct tomoyo_preference preference;
881 u8 default_config;
882 u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX];
883 unsigned int pref[TOMOYO_MAX_PREF];
884};
885
886
887struct tomoyo_time {
888 u16 year;
889 u8 month;
890 u8 day;
891 u8 hour;
892 u8 min;
893 u8 sec;
894};
895
896
897struct tomoyo_policy_namespace {
898
899 struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES];
900
901 struct list_head group_list[TOMOYO_MAX_GROUP];
902
903 struct list_head policy_list[TOMOYO_MAX_POLICY];
904
905 struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS];
906
907 struct list_head namespace_list;
908
909 unsigned int profile_version;
910
911 const char *name;
912};
913
914
915
916bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
917 const struct tomoyo_group *group);
918bool tomoyo_compare_number_union(const unsigned long value,
919 const struct tomoyo_number_union *ptr);
920bool tomoyo_condition(struct tomoyo_request_info *r,
921 const struct tomoyo_condition *cond);
922bool tomoyo_correct_domain(const unsigned char *domainname);
923bool tomoyo_correct_path(const char *filename);
924bool tomoyo_correct_word(const char *string);
925bool tomoyo_domain_def(const unsigned char *buffer);
926bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r);
927bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
928 struct tomoyo_page_dump *dump);
929bool tomoyo_memory_ok(void *ptr);
930bool tomoyo_number_matches_group(const unsigned long min,
931 const unsigned long max,
932 const struct tomoyo_group *group);
933bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
934 struct tomoyo_ipaddr_union *ptr);
935bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
936 struct tomoyo_name_union *ptr);
937bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
938 struct tomoyo_number_union *ptr);
939bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
940 const struct tomoyo_path_info *pattern);
941bool tomoyo_permstr(const char *string, const char *keyword);
942bool tomoyo_str_starts(char **src, const char *find);
943char *tomoyo_encode(const char *str);
944char *tomoyo_encode2(const char *str, int str_len);
945char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
946 va_list args);
947char *tomoyo_read_token(struct tomoyo_acl_param *param);
948char *tomoyo_realpath_from_path(struct path *path);
949char *tomoyo_realpath_nofollow(const char *pathname);
950const char *tomoyo_get_exe(void);
951const char *tomoyo_yesno(const unsigned int value);
952const struct tomoyo_path_info *tomoyo_compare_name_union
953(const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr);
954const struct tomoyo_path_info *tomoyo_get_domainname
955(struct tomoyo_acl_param *param);
956const struct tomoyo_path_info *tomoyo_get_name(const char *name);
957const struct tomoyo_path_info *tomoyo_path_matches_group
958(const struct tomoyo_path_info *pathname, const struct tomoyo_group *group);
959int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
960 struct path *path, const int flag);
961void tomoyo_close_control(struct tomoyo_io_buffer *head);
962int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env);
963int tomoyo_execute_permission(struct tomoyo_request_info *r,
964 const struct tomoyo_path_info *filename);
965int tomoyo_find_next_domain(struct linux_binprm *bprm);
966int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile,
967 const u8 index);
968int tomoyo_init_request_info(struct tomoyo_request_info *r,
969 struct tomoyo_domain_info *domain,
970 const u8 index);
971int tomoyo_mkdev_perm(const u8 operation, struct path *path,
972 const unsigned int mode, unsigned int dev);
973int tomoyo_mount_permission(const char *dev_name, struct path *path,
974 const char *type, unsigned long flags,
975 void *data_page);
976int tomoyo_open_control(const u8 type, struct file *file);
977int tomoyo_path2_perm(const u8 operation, struct path *path1,
978 struct path *path2);
979int tomoyo_path_number_perm(const u8 operation, struct path *path,
980 unsigned long number);
981int tomoyo_path_perm(const u8 operation, struct path *path,
982 const char *target);
983unsigned int tomoyo_poll_control(struct file *file, poll_table *wait);
984unsigned int tomoyo_poll_log(struct file *file, poll_table *wait);
985int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
986 int addr_len);
987int tomoyo_socket_connect_permission(struct socket *sock,
988 struct sockaddr *addr, int addr_len);
989int tomoyo_socket_listen_permission(struct socket *sock);
990int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
991 int size);
992int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
993 __printf(2, 3);
994int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
995 struct tomoyo_acl_param *param,
996 bool (*check_duplicate)
997 (const struct tomoyo_acl_info *,
998 const struct tomoyo_acl_info *),
999 bool (*merge_duplicate)
1000 (struct tomoyo_acl_info *, struct tomoyo_acl_info *,
1001 const bool));
1002int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
1003 struct tomoyo_acl_param *param,
1004 bool (*check_duplicate)
1005 (const struct tomoyo_acl_head *,
1006 const struct tomoyo_acl_head *));
1007int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
1008int tomoyo_write_file(struct tomoyo_acl_param *param);
1009int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
1010int tomoyo_write_misc(struct tomoyo_acl_param *param);
1011int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
1012int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
1013 const u8 type);
1014int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
1015ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
1016 const int buffer_len);
1017ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
1018 const char __user *buffer, const int buffer_len);
1019struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param);
1020struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
1021 const bool transit);
1022struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname);
1023struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param,
1024 const u8 idx);
1025struct tomoyo_policy_namespace *tomoyo_assign_namespace
1026(const char *domainname);
1027struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns,
1028 const u8 profile);
1029unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain,
1030 const u8 index);
1031u8 tomoyo_parse_ulong(unsigned long *result, char **str);
1032void *tomoyo_commit_ok(void *data, const unsigned int size);
1033void __init tomoyo_load_builtin_policy(void);
1034void __init tomoyo_mm_init(void);
1035void tomoyo_check_acl(struct tomoyo_request_info *r,
1036 bool (*check_entry) (struct tomoyo_request_info *,
1037 const struct tomoyo_acl_info *));
1038void tomoyo_check_profile(void);
1039void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp);
1040void tomoyo_del_condition(struct list_head *element);
1041void tomoyo_fill_path_info(struct tomoyo_path_info *ptr);
1042void tomoyo_get_attributes(struct tomoyo_obj_info *obj);
1043void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns);
1044void tomoyo_load_policy(const char *filename);
1045void tomoyo_normalize_line(unsigned char *buffer);
1046void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
1047void tomoyo_print_ip(char *buf, const unsigned int size,
1048 const struct tomoyo_ipaddr_union *ptr);
1049void tomoyo_print_ulong(char *buffer, const int buffer_len,
1050 const unsigned long value, const u8 type);
1051void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
1052void tomoyo_put_number_union(struct tomoyo_number_union *ptr);
1053void tomoyo_read_log(struct tomoyo_io_buffer *head);
1054void tomoyo_update_stat(const u8 index);
1055void tomoyo_warn_oom(const char *function);
1056void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
1057 __printf(2, 3);
1058void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt,
1059 va_list args);
1060
1061
1062
1063extern bool tomoyo_policy_loaded;
1064extern const char * const tomoyo_condition_keyword
1065[TOMOYO_MAX_CONDITION_KEYWORD];
1066extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS];
1067extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
1068 + TOMOYO_MAX_MAC_CATEGORY_INDEX];
1069extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
1070extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
1071extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
1072extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
1073extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
1074extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
1075extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
1076extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION];
1077extern struct list_head tomoyo_condition_list;
1078extern struct list_head tomoyo_domain_list;
1079extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH];
1080extern struct list_head tomoyo_namespace_list;
1081extern struct mutex tomoyo_policy_lock;
1082extern struct srcu_struct tomoyo_ss;
1083extern struct tomoyo_domain_info tomoyo_kernel_domain;
1084extern struct tomoyo_policy_namespace tomoyo_kernel_namespace;
1085extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT];
1086extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT];
1087
1088
1089
1090
1091
1092
1093
1094
1095static inline int tomoyo_read_lock(void)
1096{
1097 return srcu_read_lock(&tomoyo_ss);
1098}
1099
1100
1101
1102
1103
1104
1105
1106
1107static inline void tomoyo_read_unlock(int idx)
1108{
1109 srcu_read_unlock(&tomoyo_ss, idx);
1110}
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120static inline pid_t tomoyo_sys_getppid(void)
1121{
1122 pid_t pid;
1123 rcu_read_lock();
1124 pid = task_tgid_vnr(rcu_dereference(current->real_parent));
1125 rcu_read_unlock();
1126 return pid;
1127}
1128
1129
1130
1131
1132
1133
1134
1135
1136
1137static inline pid_t tomoyo_sys_getpid(void)
1138{
1139 return task_tgid_vnr(current);
1140}
1141
1142
1143
1144
1145
1146
1147
1148
1149
1150static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a,
1151 const struct tomoyo_path_info *b)
1152{
1153 return a->hash != b->hash || strcmp(a->name, b->name);
1154}
1155
1156
1157
1158
1159
1160
1161
1162
1163static inline void tomoyo_put_name(const struct tomoyo_path_info *name)
1164{
1165 if (name) {
1166 struct tomoyo_name *ptr =
1167 container_of(name, typeof(*ptr), entry);
1168 atomic_dec(&ptr->head.users);
1169 }
1170}
1171
1172
1173
1174
1175
1176
1177
1178
1179static inline void tomoyo_put_condition(struct tomoyo_condition *cond)
1180{
1181 if (cond)
1182 atomic_dec(&cond->head.users);
1183}
1184
1185
1186
1187
1188
1189
1190
1191
1192static inline void tomoyo_put_group(struct tomoyo_group *group)
1193{
1194 if (group)
1195 atomic_dec(&group->head.users);
1196}
1197
1198
1199
1200
1201
1202
1203static inline struct tomoyo_domain_info *tomoyo_domain(void)
1204{
1205 return current_cred()->security;
1206}
1207
1208
1209
1210
1211
1212
1213
1214
1215static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct
1216 *task)
1217{
1218 return task_cred_xxx(task, security);
1219}
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229static inline bool tomoyo_same_name_union
1230(const struct tomoyo_name_union *a, const struct tomoyo_name_union *b)
1231{
1232 return a->filename == b->filename && a->group == b->group;
1233}
1234
1235
1236
1237
1238
1239
1240
1241
1242
1243static inline bool tomoyo_same_number_union
1244(const struct tomoyo_number_union *a, const struct tomoyo_number_union *b)
1245{
1246 return a->values[0] == b->values[0] && a->values[1] == b->values[1] &&
1247 a->group == b->group && a->value_type[0] == b->value_type[0] &&
1248 a->value_type[1] == b->value_type[1];
1249}
1250
1251
1252
1253
1254
1255
1256
1257
1258
1259static inline bool tomoyo_same_ipaddr_union
1260(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
1261{
1262 return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
1263 a->is_ipv6 == b->is_ipv6;
1264}
1265
1266
1267
1268
1269
1270
1271static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void)
1272{
1273 return tomoyo_domain()->ns;
1274}
1275
1276#if defined(CONFIG_SLOB)
1277
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287static inline int tomoyo_round2(size_t size)
1288{
1289 return size;
1290}
1291
1292#else
1293
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304static inline int tomoyo_round2(size_t size)
1305{
1306#if PAGE_SIZE == 4096
1307 size_t bsize = 32;
1308#else
1309 size_t bsize = 64;
1310#endif
1311 if (!size)
1312 return 0;
1313 while (size > bsize)
1314 bsize <<= 1;
1315 return bsize;
1316}
1317
1318#endif
1319
1320
1321
1322
1323
1324
1325#define list_for_each_cookie(pos, head) \
1326 if (!pos) \
1327 pos = srcu_dereference((head)->next, &tomoyo_ss); \
1328 for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss))
1329
1330#endif
1331