1
2
3
4
5
6
7
8
9
10#ifndef _SECURITY_TOMOYO_COMMON_H
11#define _SECURITY_TOMOYO_COMMON_H
12
13#include <linux/ctype.h>
14#include <linux/string.h>
15#include <linux/mm.h>
16#include <linux/file.h>
17#include <linux/kmod.h>
18#include <linux/fs.h>
19#include <linux/sched.h>
20#include <linux/namei.h>
21#include <linux/mount.h>
22#include <linux/list.h>
23#include <linux/cred.h>
24#include <linux/poll.h>
25#include <linux/binfmts.h>
26#include <linux/highmem.h>
27#include <linux/net.h>
28#include <linux/inet.h>
29#include <linux/in.h>
30#include <linux/in6.h>
31#include <linux/un.h>
32#include <net/sock.h>
33#include <net/af_unix.h>
34#include <net/ip.h>
35#include <net/ipv6.h>
36#include <net/udp.h>
37
38
39
40
41
42
43
44
45#define TOMOYO_HASH_BITS 8
46#define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS)
47
48
49
50
51
52#define TOMOYO_SOCK_MAX 6
53
54#define TOMOYO_EXEC_TMPSIZE 4096
55
56
57#define TOMOYO_GC_IN_PROGRESS -1
58
59
60#define TOMOYO_MAX_PROFILES 256
61
62
63#define TOMOYO_MAX_ACL_GROUPS 256
64
65
66enum tomoyo_conditions_index {
67 TOMOYO_TASK_UID,
68 TOMOYO_TASK_EUID,
69 TOMOYO_TASK_SUID,
70 TOMOYO_TASK_FSUID,
71 TOMOYO_TASK_GID,
72 TOMOYO_TASK_EGID,
73 TOMOYO_TASK_SGID,
74 TOMOYO_TASK_FSGID,
75 TOMOYO_TASK_PID,
76 TOMOYO_TASK_PPID,
77 TOMOYO_EXEC_ARGC,
78 TOMOYO_EXEC_ENVC,
79 TOMOYO_TYPE_IS_SOCKET,
80 TOMOYO_TYPE_IS_SYMLINK,
81 TOMOYO_TYPE_IS_FILE,
82 TOMOYO_TYPE_IS_BLOCK_DEV,
83 TOMOYO_TYPE_IS_DIRECTORY,
84 TOMOYO_TYPE_IS_CHAR_DEV,
85 TOMOYO_TYPE_IS_FIFO,
86 TOMOYO_MODE_SETUID,
87 TOMOYO_MODE_SETGID,
88 TOMOYO_MODE_STICKY,
89 TOMOYO_MODE_OWNER_READ,
90 TOMOYO_MODE_OWNER_WRITE,
91 TOMOYO_MODE_OWNER_EXECUTE,
92 TOMOYO_MODE_GROUP_READ,
93 TOMOYO_MODE_GROUP_WRITE,
94 TOMOYO_MODE_GROUP_EXECUTE,
95 TOMOYO_MODE_OTHERS_READ,
96 TOMOYO_MODE_OTHERS_WRITE,
97 TOMOYO_MODE_OTHERS_EXECUTE,
98 TOMOYO_EXEC_REALPATH,
99 TOMOYO_SYMLINK_TARGET,
100 TOMOYO_PATH1_UID,
101 TOMOYO_PATH1_GID,
102 TOMOYO_PATH1_INO,
103 TOMOYO_PATH1_MAJOR,
104 TOMOYO_PATH1_MINOR,
105 TOMOYO_PATH1_PERM,
106 TOMOYO_PATH1_TYPE,
107 TOMOYO_PATH1_DEV_MAJOR,
108 TOMOYO_PATH1_DEV_MINOR,
109 TOMOYO_PATH2_UID,
110 TOMOYO_PATH2_GID,
111 TOMOYO_PATH2_INO,
112 TOMOYO_PATH2_MAJOR,
113 TOMOYO_PATH2_MINOR,
114 TOMOYO_PATH2_PERM,
115 TOMOYO_PATH2_TYPE,
116 TOMOYO_PATH2_DEV_MAJOR,
117 TOMOYO_PATH2_DEV_MINOR,
118 TOMOYO_PATH1_PARENT_UID,
119 TOMOYO_PATH1_PARENT_GID,
120 TOMOYO_PATH1_PARENT_INO,
121 TOMOYO_PATH1_PARENT_PERM,
122 TOMOYO_PATH2_PARENT_UID,
123 TOMOYO_PATH2_PARENT_GID,
124 TOMOYO_PATH2_PARENT_INO,
125 TOMOYO_PATH2_PARENT_PERM,
126 TOMOYO_MAX_CONDITION_KEYWORD,
127 TOMOYO_NUMBER_UNION,
128 TOMOYO_NAME_UNION,
129 TOMOYO_ARGV_ENTRY,
130 TOMOYO_ENVP_ENTRY,
131};
132
133
134
135enum tomoyo_path_stat_index {
136
137 TOMOYO_PATH1,
138 TOMOYO_PATH1_PARENT,
139 TOMOYO_PATH2,
140 TOMOYO_PATH2_PARENT,
141 TOMOYO_MAX_PATH_STAT
142};
143
144
145enum tomoyo_mode_index {
146 TOMOYO_CONFIG_DISABLED,
147 TOMOYO_CONFIG_LEARNING,
148 TOMOYO_CONFIG_PERMISSIVE,
149 TOMOYO_CONFIG_ENFORCING,
150 TOMOYO_CONFIG_MAX_MODE,
151 TOMOYO_CONFIG_WANT_REJECT_LOG = 64,
152 TOMOYO_CONFIG_WANT_GRANT_LOG = 128,
153 TOMOYO_CONFIG_USE_DEFAULT = 255,
154};
155
156
157enum tomoyo_policy_id {
158 TOMOYO_ID_GROUP,
159 TOMOYO_ID_ADDRESS_GROUP,
160 TOMOYO_ID_PATH_GROUP,
161 TOMOYO_ID_NUMBER_GROUP,
162 TOMOYO_ID_TRANSITION_CONTROL,
163 TOMOYO_ID_AGGREGATOR,
164 TOMOYO_ID_MANAGER,
165 TOMOYO_ID_CONDITION,
166 TOMOYO_ID_NAME,
167 TOMOYO_ID_ACL,
168 TOMOYO_ID_DOMAIN,
169 TOMOYO_MAX_POLICY
170};
171
172
173enum tomoyo_domain_info_flags_index {
174
175 TOMOYO_DIF_QUOTA_WARNED,
176
177
178
179
180
181
182 TOMOYO_DIF_TRANSITION_FAILED,
183 TOMOYO_MAX_DOMAIN_INFO_FLAGS
184};
185
186
187enum tomoyo_grant_log {
188
189 TOMOYO_GRANTLOG_AUTO,
190
191 TOMOYO_GRANTLOG_NO,
192
193 TOMOYO_GRANTLOG_YES,
194};
195
196
197enum tomoyo_group_id {
198 TOMOYO_PATH_GROUP,
199 TOMOYO_NUMBER_GROUP,
200 TOMOYO_ADDRESS_GROUP,
201 TOMOYO_MAX_GROUP
202};
203
204
205enum tomoyo_value_type {
206 TOMOYO_VALUE_TYPE_INVALID,
207 TOMOYO_VALUE_TYPE_DECIMAL,
208 TOMOYO_VALUE_TYPE_OCTAL,
209 TOMOYO_VALUE_TYPE_HEXADECIMAL,
210};
211
212
213enum tomoyo_transition_type {
214
215 TOMOYO_TRANSITION_CONTROL_NO_RESET,
216 TOMOYO_TRANSITION_CONTROL_RESET,
217 TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE,
218 TOMOYO_TRANSITION_CONTROL_INITIALIZE,
219 TOMOYO_TRANSITION_CONTROL_NO_KEEP,
220 TOMOYO_TRANSITION_CONTROL_KEEP,
221 TOMOYO_MAX_TRANSITION_TYPE
222};
223
224
225enum tomoyo_acl_entry_type_index {
226 TOMOYO_TYPE_PATH_ACL,
227 TOMOYO_TYPE_PATH2_ACL,
228 TOMOYO_TYPE_PATH_NUMBER_ACL,
229 TOMOYO_TYPE_MKDEV_ACL,
230 TOMOYO_TYPE_MOUNT_ACL,
231 TOMOYO_TYPE_INET_ACL,
232 TOMOYO_TYPE_UNIX_ACL,
233 TOMOYO_TYPE_ENV_ACL,
234 TOMOYO_TYPE_MANUAL_TASK_ACL,
235};
236
237
238enum tomoyo_path_acl_index {
239 TOMOYO_TYPE_EXECUTE,
240 TOMOYO_TYPE_READ,
241 TOMOYO_TYPE_WRITE,
242 TOMOYO_TYPE_APPEND,
243 TOMOYO_TYPE_UNLINK,
244 TOMOYO_TYPE_GETATTR,
245 TOMOYO_TYPE_RMDIR,
246 TOMOYO_TYPE_TRUNCATE,
247 TOMOYO_TYPE_SYMLINK,
248 TOMOYO_TYPE_CHROOT,
249 TOMOYO_TYPE_UMOUNT,
250 TOMOYO_MAX_PATH_OPERATION
251};
252
253
254enum tomoyo_memory_stat_type {
255 TOMOYO_MEMORY_POLICY,
256 TOMOYO_MEMORY_AUDIT,
257 TOMOYO_MEMORY_QUERY,
258 TOMOYO_MAX_MEMORY_STAT
259};
260
261enum tomoyo_mkdev_acl_index {
262 TOMOYO_TYPE_MKBLOCK,
263 TOMOYO_TYPE_MKCHAR,
264 TOMOYO_MAX_MKDEV_OPERATION
265};
266
267
268enum tomoyo_network_acl_index {
269 TOMOYO_NETWORK_BIND,
270 TOMOYO_NETWORK_LISTEN,
271 TOMOYO_NETWORK_CONNECT,
272 TOMOYO_NETWORK_SEND,
273 TOMOYO_MAX_NETWORK_OPERATION
274};
275
276
277enum tomoyo_path2_acl_index {
278 TOMOYO_TYPE_LINK,
279 TOMOYO_TYPE_RENAME,
280 TOMOYO_TYPE_PIVOT_ROOT,
281 TOMOYO_MAX_PATH2_OPERATION
282};
283
284
285enum tomoyo_path_number_acl_index {
286 TOMOYO_TYPE_CREATE,
287 TOMOYO_TYPE_MKDIR,
288 TOMOYO_TYPE_MKFIFO,
289 TOMOYO_TYPE_MKSOCK,
290 TOMOYO_TYPE_IOCTL,
291 TOMOYO_TYPE_CHMOD,
292 TOMOYO_TYPE_CHOWN,
293 TOMOYO_TYPE_CHGRP,
294 TOMOYO_MAX_PATH_NUMBER_OPERATION
295};
296
297
298enum tomoyo_securityfs_interface_index {
299 TOMOYO_DOMAINPOLICY,
300 TOMOYO_EXCEPTIONPOLICY,
301 TOMOYO_PROCESS_STATUS,
302 TOMOYO_STAT,
303 TOMOYO_AUDIT,
304 TOMOYO_VERSION,
305 TOMOYO_PROFILE,
306 TOMOYO_QUERY,
307 TOMOYO_MANAGER
308};
309
310
311enum tomoyo_special_mount {
312 TOMOYO_MOUNT_BIND,
313 TOMOYO_MOUNT_MOVE,
314 TOMOYO_MOUNT_REMOUNT,
315 TOMOYO_MOUNT_MAKE_UNBINDABLE,
316 TOMOYO_MOUNT_MAKE_PRIVATE,
317 TOMOYO_MOUNT_MAKE_SLAVE,
318 TOMOYO_MOUNT_MAKE_SHARED,
319 TOMOYO_MAX_SPECIAL_MOUNT
320};
321
322
323enum tomoyo_mac_index {
324 TOMOYO_MAC_FILE_EXECUTE,
325 TOMOYO_MAC_FILE_OPEN,
326 TOMOYO_MAC_FILE_CREATE,
327 TOMOYO_MAC_FILE_UNLINK,
328 TOMOYO_MAC_FILE_GETATTR,
329 TOMOYO_MAC_FILE_MKDIR,
330 TOMOYO_MAC_FILE_RMDIR,
331 TOMOYO_MAC_FILE_MKFIFO,
332 TOMOYO_MAC_FILE_MKSOCK,
333 TOMOYO_MAC_FILE_TRUNCATE,
334 TOMOYO_MAC_FILE_SYMLINK,
335 TOMOYO_MAC_FILE_MKBLOCK,
336 TOMOYO_MAC_FILE_MKCHAR,
337 TOMOYO_MAC_FILE_LINK,
338 TOMOYO_MAC_FILE_RENAME,
339 TOMOYO_MAC_FILE_CHMOD,
340 TOMOYO_MAC_FILE_CHOWN,
341 TOMOYO_MAC_FILE_CHGRP,
342 TOMOYO_MAC_FILE_IOCTL,
343 TOMOYO_MAC_FILE_CHROOT,
344 TOMOYO_MAC_FILE_MOUNT,
345 TOMOYO_MAC_FILE_UMOUNT,
346 TOMOYO_MAC_FILE_PIVOT_ROOT,
347 TOMOYO_MAC_NETWORK_INET_STREAM_BIND,
348 TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN,
349 TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT,
350 TOMOYO_MAC_NETWORK_INET_DGRAM_BIND,
351 TOMOYO_MAC_NETWORK_INET_DGRAM_SEND,
352 TOMOYO_MAC_NETWORK_INET_RAW_BIND,
353 TOMOYO_MAC_NETWORK_INET_RAW_SEND,
354 TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND,
355 TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN,
356 TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT,
357 TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND,
358 TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND,
359 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND,
360 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN,
361 TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT,
362 TOMOYO_MAC_ENVIRON,
363 TOMOYO_MAX_MAC_INDEX
364};
365
366
367enum tomoyo_mac_category_index {
368 TOMOYO_MAC_CATEGORY_FILE,
369 TOMOYO_MAC_CATEGORY_NETWORK,
370 TOMOYO_MAC_CATEGORY_MISC,
371 TOMOYO_MAX_MAC_CATEGORY_INDEX
372};
373
374
375
376
377
378
379
380
381#define TOMOYO_RETRY_REQUEST 1
382
383
384enum tomoyo_policy_stat_type {
385
386 TOMOYO_STAT_POLICY_UPDATES,
387 TOMOYO_STAT_POLICY_LEARNING,
388 TOMOYO_STAT_POLICY_PERMISSIVE,
389 TOMOYO_STAT_POLICY_ENFORCING,
390 TOMOYO_MAX_POLICY_STAT
391};
392
393
394enum tomoyo_pref_index {
395 TOMOYO_PREF_MAX_AUDIT_LOG,
396 TOMOYO_PREF_MAX_LEARNING_ENTRY,
397 TOMOYO_MAX_PREF
398};
399
400
401
402
403struct tomoyo_acl_head {
404 struct list_head list;
405 s8 is_deleted;
406} __packed;
407
408
409struct tomoyo_shared_acl_head {
410 struct list_head list;
411 atomic_t users;
412} __packed;
413
414struct tomoyo_policy_namespace;
415
416
417struct tomoyo_request_info {
418
419
420
421
422 struct tomoyo_obj_info *obj;
423
424
425
426
427 struct tomoyo_execve *ee;
428 struct tomoyo_domain_info *domain;
429
430 union {
431 struct {
432 const struct tomoyo_path_info *filename;
433
434 const struct tomoyo_path_info *matched_path;
435
436 u8 operation;
437 } path;
438 struct {
439 const struct tomoyo_path_info *filename1;
440 const struct tomoyo_path_info *filename2;
441
442 u8 operation;
443 } path2;
444 struct {
445 const struct tomoyo_path_info *filename;
446 unsigned int mode;
447 unsigned int major;
448 unsigned int minor;
449
450 u8 operation;
451 } mkdev;
452 struct {
453 const struct tomoyo_path_info *filename;
454 unsigned long number;
455
456
457
458
459 u8 operation;
460 } path_number;
461 struct {
462 const struct tomoyo_path_info *name;
463 } environ;
464 struct {
465 const __be32 *address;
466 u16 port;
467
468 u8 protocol;
469
470 u8 operation;
471 bool is_ipv6;
472 } inet_network;
473 struct {
474 const struct tomoyo_path_info *address;
475
476 u8 protocol;
477
478 u8 operation;
479 } unix_network;
480 struct {
481 const struct tomoyo_path_info *type;
482 const struct tomoyo_path_info *dir;
483 const struct tomoyo_path_info *dev;
484 unsigned long flags;
485 int need_dev;
486 } mount;
487 struct {
488 const struct tomoyo_path_info *domainname;
489 } task;
490 } param;
491 struct tomoyo_acl_info *matched_acl;
492 u8 param_type;
493 bool granted;
494 u8 retry;
495 u8 profile;
496 u8 mode;
497 u8 type;
498};
499
500
501struct tomoyo_path_info {
502 const char *name;
503 u32 hash;
504 u16 const_len;
505 bool is_dir;
506 bool is_patterned;
507};
508
509
510struct tomoyo_name {
511 struct tomoyo_shared_acl_head head;
512 struct tomoyo_path_info entry;
513};
514
515
516struct tomoyo_name_union {
517
518 const struct tomoyo_path_info *filename;
519 struct tomoyo_group *group;
520};
521
522
523struct tomoyo_number_union {
524 unsigned long values[2];
525 struct tomoyo_group *group;
526
527 u8 value_type[2];
528};
529
530
531struct tomoyo_ipaddr_union {
532 struct in6_addr ip[2];
533 struct tomoyo_group *group;
534 bool is_ipv6;
535};
536
537
538struct tomoyo_group {
539 struct tomoyo_shared_acl_head head;
540 const struct tomoyo_path_info *group_name;
541 struct list_head member_list;
542};
543
544
545struct tomoyo_path_group {
546 struct tomoyo_acl_head head;
547 const struct tomoyo_path_info *member_name;
548};
549
550
551struct tomoyo_number_group {
552 struct tomoyo_acl_head head;
553 struct tomoyo_number_union number;
554};
555
556
557struct tomoyo_address_group {
558 struct tomoyo_acl_head head;
559
560 struct tomoyo_ipaddr_union address;
561};
562
563
564struct tomoyo_mini_stat {
565 kuid_t uid;
566 kgid_t gid;
567 ino_t ino;
568 umode_t mode;
569 dev_t dev;
570 dev_t rdev;
571};
572
573
574struct tomoyo_page_dump {
575 struct page *page;
576 char *data;
577};
578
579
580struct tomoyo_obj_info {
581
582
583
584 bool validate_done;
585
586 bool stat_valid[TOMOYO_MAX_PATH_STAT];
587
588 struct path path1;
589
590 struct path path2;
591
592
593
594
595 struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT];
596
597
598
599
600 struct tomoyo_path_info *symlink_target;
601};
602
603
604struct tomoyo_argv {
605 unsigned long index;
606 const struct tomoyo_path_info *value;
607 bool is_not;
608};
609
610
611struct tomoyo_envp {
612 const struct tomoyo_path_info *name;
613 const struct tomoyo_path_info *value;
614 bool is_not;
615};
616
617
618struct tomoyo_execve {
619 struct tomoyo_request_info r;
620 struct tomoyo_obj_info obj;
621 struct linux_binprm *bprm;
622 const struct tomoyo_path_info *transition;
623
624 struct tomoyo_page_dump dump;
625
626 char *tmp;
627};
628
629
630struct tomoyo_condition_element {
631
632
633
634
635
636 u8 left;
637
638
639
640
641
642
643 u8 right;
644
645 bool equals;
646};
647
648
649struct tomoyo_condition {
650 struct tomoyo_shared_acl_head head;
651 u32 size;
652 u16 condc;
653 u16 numbers_count;
654 u16 names_count;
655 u16 argc;
656 u16 envc;
657 u8 grant_log;
658 const struct tomoyo_path_info *transit;
659
660
661
662
663
664
665
666};
667
668
669struct tomoyo_acl_info {
670 struct list_head list;
671 struct tomoyo_condition *cond;
672 s8 is_deleted;
673 u8 type;
674} __packed;
675
676
677struct tomoyo_domain_info {
678 struct list_head list;
679 struct list_head acl_info_list;
680
681 const struct tomoyo_path_info *domainname;
682
683 struct tomoyo_policy_namespace *ns;
684 u8 profile;
685 u8 group;
686 bool is_deleted;
687 bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS];
688 atomic_t users;
689};
690
691
692
693
694struct tomoyo_task_acl {
695 struct tomoyo_acl_info head;
696
697 const struct tomoyo_path_info *domainname;
698};
699
700
701
702
703
704
705struct tomoyo_path_acl {
706 struct tomoyo_acl_info head;
707 u16 perm;
708 struct tomoyo_name_union name;
709};
710
711
712
713
714
715struct tomoyo_path_number_acl {
716 struct tomoyo_acl_info head;
717
718 u8 perm;
719 struct tomoyo_name_union name;
720 struct tomoyo_number_union number;
721};
722
723
724struct tomoyo_mkdev_acl {
725 struct tomoyo_acl_info head;
726 u8 perm;
727 struct tomoyo_name_union name;
728 struct tomoyo_number_union mode;
729 struct tomoyo_number_union major;
730 struct tomoyo_number_union minor;
731};
732
733
734
735
736struct tomoyo_path2_acl {
737 struct tomoyo_acl_info head;
738 u8 perm;
739 struct tomoyo_name_union name1;
740 struct tomoyo_name_union name2;
741};
742
743
744struct tomoyo_mount_acl {
745 struct tomoyo_acl_info head;
746 struct tomoyo_name_union dev_name;
747 struct tomoyo_name_union dir_name;
748 struct tomoyo_name_union fs_type;
749 struct tomoyo_number_union flags;
750};
751
752
753struct tomoyo_env_acl {
754 struct tomoyo_acl_info head;
755 const struct tomoyo_path_info *env;
756};
757
758
759struct tomoyo_inet_acl {
760 struct tomoyo_acl_info head;
761 u8 protocol;
762 u8 perm;
763 struct tomoyo_ipaddr_union address;
764 struct tomoyo_number_union port;
765};
766
767
768struct tomoyo_unix_acl {
769 struct tomoyo_acl_info head;
770 u8 protocol;
771 u8 perm;
772 struct tomoyo_name_union name;
773};
774
775
776struct tomoyo_acl_param {
777 char *data;
778 struct list_head *list;
779 struct tomoyo_policy_namespace *ns;
780 bool is_delete;
781};
782
783#define TOMOYO_MAX_IO_READ_QUEUE 64
784
785
786
787
788
789struct tomoyo_io_buffer {
790 void (*read) (struct tomoyo_io_buffer *);
791 int (*write) (struct tomoyo_io_buffer *);
792 __poll_t (*poll) (struct file *file, poll_table *wait);
793
794 struct mutex io_sem;
795 char __user *read_user_buf;
796 size_t read_user_buf_avail;
797 struct {
798 struct list_head *ns;
799 struct list_head *domain;
800 struct list_head *group;
801 struct list_head *acl;
802 size_t avail;
803 unsigned int step;
804 unsigned int query_index;
805 u16 index;
806 u16 cond_index;
807 u8 acl_group_index;
808 u8 cond_step;
809 u8 bit;
810 u8 w_pos;
811 bool eof;
812 bool print_this_domain_only;
813 bool print_transition_related_only;
814 bool print_cond_part;
815 const char *w[TOMOYO_MAX_IO_READ_QUEUE];
816 } r;
817 struct {
818 struct tomoyo_policy_namespace *ns;
819
820 struct tomoyo_domain_info *domain;
821
822 size_t avail;
823 bool is_delete;
824 } w;
825
826 char *read_buf;
827
828 size_t readbuf_size;
829
830 char *write_buf;
831
832 size_t writebuf_size;
833
834 enum tomoyo_securityfs_interface_index type;
835
836 u8 users;
837
838 struct list_head list;
839};
840
841
842
843
844
845struct tomoyo_transition_control {
846 struct tomoyo_acl_head head;
847 u8 type;
848
849 bool is_last_name;
850 const struct tomoyo_path_info *domainname;
851 const struct tomoyo_path_info *program;
852};
853
854
855struct tomoyo_aggregator {
856 struct tomoyo_acl_head head;
857 const struct tomoyo_path_info *original_name;
858 const struct tomoyo_path_info *aggregated_name;
859};
860
861
862struct tomoyo_manager {
863 struct tomoyo_acl_head head;
864
865 const struct tomoyo_path_info *manager;
866};
867
868struct tomoyo_preference {
869 unsigned int learning_max_entry;
870 bool enforcing_verbose;
871 bool learning_verbose;
872 bool permissive_verbose;
873};
874
875
876struct tomoyo_profile {
877 const struct tomoyo_path_info *comment;
878 struct tomoyo_preference *learning;
879 struct tomoyo_preference *permissive;
880 struct tomoyo_preference *enforcing;
881 struct tomoyo_preference preference;
882 u8 default_config;
883 u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX];
884 unsigned int pref[TOMOYO_MAX_PREF];
885};
886
887
888struct tomoyo_time {
889 u16 year;
890 u8 month;
891 u8 day;
892 u8 hour;
893 u8 min;
894 u8 sec;
895};
896
897
898struct tomoyo_policy_namespace {
899
900 struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES];
901
902 struct list_head group_list[TOMOYO_MAX_GROUP];
903
904 struct list_head policy_list[TOMOYO_MAX_POLICY];
905
906 struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS];
907
908 struct list_head namespace_list;
909
910 unsigned int profile_version;
911
912 const char *name;
913};
914
915
916
917bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
918 const struct tomoyo_group *group);
919bool tomoyo_compare_number_union(const unsigned long value,
920 const struct tomoyo_number_union *ptr);
921bool tomoyo_condition(struct tomoyo_request_info *r,
922 const struct tomoyo_condition *cond);
923bool tomoyo_correct_domain(const unsigned char *domainname);
924bool tomoyo_correct_path(const char *filename);
925bool tomoyo_correct_word(const char *string);
926bool tomoyo_domain_def(const unsigned char *buffer);
927bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r);
928bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos,
929 struct tomoyo_page_dump *dump);
930bool tomoyo_memory_ok(void *ptr);
931bool tomoyo_number_matches_group(const unsigned long min,
932 const unsigned long max,
933 const struct tomoyo_group *group);
934bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param,
935 struct tomoyo_ipaddr_union *ptr);
936bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
937 struct tomoyo_name_union *ptr);
938bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
939 struct tomoyo_number_union *ptr);
940bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
941 const struct tomoyo_path_info *pattern);
942bool tomoyo_permstr(const char *string, const char *keyword);
943bool tomoyo_str_starts(char **src, const char *find);
944char *tomoyo_encode(const char *str);
945char *tomoyo_encode2(const char *str, int str_len);
946char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
947 va_list args);
948char *tomoyo_read_token(struct tomoyo_acl_param *param);
949char *tomoyo_realpath_from_path(const struct path *path);
950char *tomoyo_realpath_nofollow(const char *pathname);
951const char *tomoyo_get_exe(void);
952const char *tomoyo_yesno(const unsigned int value);
953const struct tomoyo_path_info *tomoyo_compare_name_union
954(const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr);
955const struct tomoyo_path_info *tomoyo_get_domainname
956(struct tomoyo_acl_param *param);
957const struct tomoyo_path_info *tomoyo_get_name(const char *name);
958const struct tomoyo_path_info *tomoyo_path_matches_group
959(const struct tomoyo_path_info *pathname, const struct tomoyo_group *group);
960int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
961 const struct path *path, const int flag);
962void tomoyo_close_control(struct tomoyo_io_buffer *head);
963int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env);
964int tomoyo_execute_permission(struct tomoyo_request_info *r,
965 const struct tomoyo_path_info *filename);
966int tomoyo_find_next_domain(struct linux_binprm *bprm);
967int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile,
968 const u8 index);
969int tomoyo_init_request_info(struct tomoyo_request_info *r,
970 struct tomoyo_domain_info *domain,
971 const u8 index);
972int tomoyo_mkdev_perm(const u8 operation, const struct path *path,
973 const unsigned int mode, unsigned int dev);
974int tomoyo_mount_permission(const char *dev_name, const struct path *path,
975 const char *type, unsigned long flags,
976 void *data_page);
977int tomoyo_open_control(const u8 type, struct file *file);
978int tomoyo_path2_perm(const u8 operation, const struct path *path1,
979 const struct path *path2);
980int tomoyo_path_number_perm(const u8 operation, const struct path *path,
981 unsigned long number);
982int tomoyo_path_perm(const u8 operation, const struct path *path,
983 const char *target);
984__poll_t tomoyo_poll_control(struct file *file, poll_table *wait);
985__poll_t tomoyo_poll_log(struct file *file, poll_table *wait);
986int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr,
987 int addr_len);
988int tomoyo_socket_connect_permission(struct socket *sock,
989 struct sockaddr *addr, int addr_len);
990int tomoyo_socket_listen_permission(struct socket *sock);
991int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg,
992 int size);
993int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
994 __printf(2, 3);
995int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
996 struct tomoyo_acl_param *param,
997 bool (*check_duplicate)
998 (const struct tomoyo_acl_info *,
999 const struct tomoyo_acl_info *),
1000 bool (*merge_duplicate)
1001 (struct tomoyo_acl_info *, struct tomoyo_acl_info *,
1002 const bool));
1003int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
1004 struct tomoyo_acl_param *param,
1005 bool (*check_duplicate)
1006 (const struct tomoyo_acl_head *,
1007 const struct tomoyo_acl_head *));
1008int tomoyo_write_aggregator(struct tomoyo_acl_param *param);
1009int tomoyo_write_file(struct tomoyo_acl_param *param);
1010int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type);
1011int tomoyo_write_misc(struct tomoyo_acl_param *param);
1012int tomoyo_write_inet_network(struct tomoyo_acl_param *param);
1013int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
1014 const u8 type);
1015int tomoyo_write_unix_network(struct tomoyo_acl_param *param);
1016ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
1017 const int buffer_len);
1018ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
1019 const char __user *buffer, const int buffer_len);
1020struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param);
1021struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
1022 const bool transit);
1023struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname);
1024struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param,
1025 const u8 idx);
1026struct tomoyo_policy_namespace *tomoyo_assign_namespace
1027(const char *domainname);
1028struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns,
1029 const u8 profile);
1030unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain,
1031 const u8 index);
1032u8 tomoyo_parse_ulong(unsigned long *result, char **str);
1033void *tomoyo_commit_ok(void *data, const unsigned int size);
1034void __init tomoyo_load_builtin_policy(void);
1035void __init tomoyo_mm_init(void);
1036void tomoyo_check_acl(struct tomoyo_request_info *r,
1037 bool (*check_entry) (struct tomoyo_request_info *,
1038 const struct tomoyo_acl_info *));
1039void tomoyo_check_profile(void);
1040void tomoyo_convert_time(time64_t time, struct tomoyo_time *stamp);
1041void tomoyo_del_condition(struct list_head *element);
1042void tomoyo_fill_path_info(struct tomoyo_path_info *ptr);
1043void tomoyo_get_attributes(struct tomoyo_obj_info *obj);
1044void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns);
1045void tomoyo_load_policy(const char *filename);
1046void tomoyo_normalize_line(unsigned char *buffer);
1047void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register);
1048void tomoyo_print_ip(char *buf, const unsigned int size,
1049 const struct tomoyo_ipaddr_union *ptr);
1050void tomoyo_print_ulong(char *buffer, const int buffer_len,
1051 const unsigned long value, const u8 type);
1052void tomoyo_put_name_union(struct tomoyo_name_union *ptr);
1053void tomoyo_put_number_union(struct tomoyo_number_union *ptr);
1054void tomoyo_read_log(struct tomoyo_io_buffer *head);
1055void tomoyo_update_stat(const u8 index);
1056void tomoyo_warn_oom(const char *function);
1057void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
1058 __printf(2, 3);
1059void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt,
1060 va_list args);
1061
1062
1063
1064extern bool tomoyo_policy_loaded;
1065extern const char * const tomoyo_condition_keyword
1066[TOMOYO_MAX_CONDITION_KEYWORD];
1067extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS];
1068extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX
1069 + TOMOYO_MAX_MAC_CATEGORY_INDEX];
1070extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE];
1071extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION];
1072extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX];
1073extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION];
1074extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX];
1075extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION];
1076extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION];
1077extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION];
1078extern struct list_head tomoyo_condition_list;
1079extern struct list_head tomoyo_domain_list;
1080extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH];
1081extern struct list_head tomoyo_namespace_list;
1082extern struct mutex tomoyo_policy_lock;
1083extern struct srcu_struct tomoyo_ss;
1084extern struct tomoyo_domain_info tomoyo_kernel_domain;
1085extern struct tomoyo_policy_namespace tomoyo_kernel_namespace;
1086extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT];
1087extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT];
1088
1089
1090
1091
1092
1093
1094
1095
1096static inline int tomoyo_read_lock(void)
1097{
1098 return srcu_read_lock(&tomoyo_ss);
1099}
1100
1101
1102
1103
1104
1105
1106
1107
1108static inline void tomoyo_read_unlock(int idx)
1109{
1110 srcu_read_unlock(&tomoyo_ss, idx);
1111}
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121static inline pid_t tomoyo_sys_getppid(void)
1122{
1123 pid_t pid;
1124 rcu_read_lock();
1125 pid = task_tgid_vnr(rcu_dereference(current->real_parent));
1126 rcu_read_unlock();
1127 return pid;
1128}
1129
1130
1131
1132
1133
1134
1135
1136
1137
1138static inline pid_t tomoyo_sys_getpid(void)
1139{
1140 return task_tgid_vnr(current);
1141}
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a,
1152 const struct tomoyo_path_info *b)
1153{
1154 return a->hash != b->hash || strcmp(a->name, b->name);
1155}
1156
1157
1158
1159
1160
1161
1162
1163
1164static inline void tomoyo_put_name(const struct tomoyo_path_info *name)
1165{
1166 if (name) {
1167 struct tomoyo_name *ptr =
1168 container_of(name, typeof(*ptr), entry);
1169 atomic_dec(&ptr->head.users);
1170 }
1171}
1172
1173
1174
1175
1176
1177
1178
1179
1180static inline void tomoyo_put_condition(struct tomoyo_condition *cond)
1181{
1182 if (cond)
1183 atomic_dec(&cond->head.users);
1184}
1185
1186
1187
1188
1189
1190
1191
1192
1193static inline void tomoyo_put_group(struct tomoyo_group *group)
1194{
1195 if (group)
1196 atomic_dec(&group->head.users);
1197}
1198
1199
1200
1201
1202
1203
1204static inline struct tomoyo_domain_info *tomoyo_domain(void)
1205{
1206 return current_cred()->security;
1207}
1208
1209
1210
1211
1212
1213
1214
1215
1216static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct
1217 *task)
1218{
1219 return task_cred_xxx(task, security);
1220}
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230static inline bool tomoyo_same_name_union
1231(const struct tomoyo_name_union *a, const struct tomoyo_name_union *b)
1232{
1233 return a->filename == b->filename && a->group == b->group;
1234}
1235
1236
1237
1238
1239
1240
1241
1242
1243
1244static inline bool tomoyo_same_number_union
1245(const struct tomoyo_number_union *a, const struct tomoyo_number_union *b)
1246{
1247 return a->values[0] == b->values[0] && a->values[1] == b->values[1] &&
1248 a->group == b->group && a->value_type[0] == b->value_type[0] &&
1249 a->value_type[1] == b->value_type[1];
1250}
1251
1252
1253
1254
1255
1256
1257
1258
1259
1260static inline bool tomoyo_same_ipaddr_union
1261(const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b)
1262{
1263 return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group &&
1264 a->is_ipv6 == b->is_ipv6;
1265}
1266
1267
1268
1269
1270
1271
1272static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void)
1273{
1274 return tomoyo_domain()->ns;
1275}
1276
1277#if defined(CONFIG_SLOB)
1278
1279
1280
1281
1282
1283
1284
1285
1286
1287
1288static inline int tomoyo_round2(size_t size)
1289{
1290 return size;
1291}
1292
1293#else
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303
1304
1305static inline int tomoyo_round2(size_t size)
1306{
1307#if PAGE_SIZE == 4096
1308 size_t bsize = 32;
1309#else
1310 size_t bsize = 64;
1311#endif
1312 if (!size)
1313 return 0;
1314 while (size > bsize)
1315 bsize <<= 1;
1316 return bsize;
1317}
1318
1319#endif
1320
1321
1322
1323
1324
1325
1326#define list_for_each_cookie(pos, head) \
1327 if (!pos) \
1328 pos = srcu_dereference((head)->next, &tomoyo_ss); \
1329 for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss))
1330
1331#endif
1332