SAFE public projects git trees. - safe/jmp/linux-2.6/blob - security/tomoyo/file.c

   1 /*
   2  * security/tomoyo/file.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   7  *
   8  * Version: 2.2.0   2009/04/01
   9  *
  10  */
  11
  12 #include "common.h"
  13 #include "tomoyo.h"
  14 #include "realpath.h"
  15
  16 /*
  17  * tomoyo_globally_readable_file_entry is a structure which is used for holding
  18  * "allow_read" entries.
  19  * It has following fields.
  20  *
  21  *  (1) "list" which is linked to tomoyo_globally_readable_list .
  22  *  (2) "filename" is a pathname which is allowed to open(O_RDONLY).
  23  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
  24  *      otherwise.
  25  */
  26 struct tomoyo_globally_readable_file_entry {
  27         struct list_head list;
  28         const struct tomoyo_path_info *filename;
  29         bool is_deleted;
  30 };
  31
  32 /*
  33  * tomoyo_pattern_entry is a structure which is used for holding
  34  * "tomoyo_pattern_list" entries.
  35  * It has following fields.
  36  *
  37  *  (1) "list" which is linked to tomoyo_pattern_list .
  38  *  (2) "pattern" is a pathname pattern which is used for converting pathnames
  39  *      to pathname patterns during learning mode.
  40  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
  41  *      otherwise.
  42  */
  43 struct tomoyo_pattern_entry {
  44         struct list_head list;
  45         const struct tomoyo_path_info *pattern;
  46         bool is_deleted;
  47 };
  48
  49 /*
  50  * tomoyo_no_rewrite_entry is a structure which is used for holding
  51  * "deny_rewrite" entries.
  52  * It has following fields.
  53  *
  54  *  (1) "list" which is linked to tomoyo_no_rewrite_list .
  55  *  (2) "pattern" is a pathname which is by default not permitted to modify
  56  *      already existing content.
  57  *  (3) "is_deleted" is a bool which is true if marked as deleted, false
  58  *      otherwise.
  59  */
  60 struct tomoyo_no_rewrite_entry {
  61         struct list_head list;
  62         const struct tomoyo_path_info *pattern;
  63         bool is_deleted;
  64 };
  65
  66 /* Keyword array for single path operations. */
  67 static const char *tomoyo_sp_keyword[TOMOYO_MAX_SINGLE_PATH_OPERATION] = {
  68         [TOMOYO_TYPE_READ_WRITE_ACL] = "read/write",
  69         [TOMOYO_TYPE_EXECUTE_ACL]    = "execute",
  70         [TOMOYO_TYPE_READ_ACL]       = "read",
  71         [TOMOYO_TYPE_WRITE_ACL]      = "write",
  72         [TOMOYO_TYPE_CREATE_ACL]     = "create",
  73         [TOMOYO_TYPE_UNLINK_ACL]     = "unlink",
  74         [TOMOYO_TYPE_MKDIR_ACL]      = "mkdir",
  75         [TOMOYO_TYPE_RMDIR_ACL]      = "rmdir",
  76         [TOMOYO_TYPE_MKFIFO_ACL]     = "mkfifo",
  77         [TOMOYO_TYPE_MKSOCK_ACL]     = "mksock",
  78         [TOMOYO_TYPE_MKBLOCK_ACL]    = "mkblock",
  79         [TOMOYO_TYPE_MKCHAR_ACL]     = "mkchar",
  80         [TOMOYO_TYPE_TRUNCATE_ACL]   = "truncate",
  81         [TOMOYO_TYPE_SYMLINK_ACL]    = "symlink",
  82         [TOMOYO_TYPE_REWRITE_ACL]    = "rewrite",
  83         [TOMOYO_TYPE_IOCTL_ACL]      = "ioctl",
  84         [TOMOYO_TYPE_CHMOD_ACL]      = "chmod",
  85         [TOMOYO_TYPE_CHOWN_ACL]      = "chown",
  86         [TOMOYO_TYPE_CHGRP_ACL]      = "chgrp",
  87         [TOMOYO_TYPE_CHROOT_ACL]     = "chroot",
  88         [TOMOYO_TYPE_MOUNT_ACL]      = "mount",
  89         [TOMOYO_TYPE_UMOUNT_ACL]     = "unmount",
  90 };
  91
  92 /* Keyword array for double path operations. */
  93 static const char *tomoyo_dp_keyword[TOMOYO_MAX_DOUBLE_PATH_OPERATION] = {
  94         [TOMOYO_TYPE_LINK_ACL]    = "link",
  95         [TOMOYO_TYPE_RENAME_ACL]  = "rename",
  96         [TOMOYO_TYPE_PIVOT_ROOT_ACL] = "pivot_root",
  97 };
  98
  99 /**
 100  * tomoyo_sp2keyword - Get the name of single path operation.
 101  *
 102  * @operation: Type of operation.
 103  *
 104  * Returns the name of single path operation.
 105  */
 106 const char *tomoyo_sp2keyword(const u8 operation)
 107 {
 108         return (operation < TOMOYO_MAX_SINGLE_PATH_OPERATION)
 109                 ? tomoyo_sp_keyword[operation] : NULL;
 110 }
 111
 112 /**
 113  * tomoyo_dp2keyword - Get the name of double path operation.
 114  *
 115  * @operation: Type of operation.
 116  *
 117  * Returns the name of double path operation.
 118  */
 119 const char *tomoyo_dp2keyword(const u8 operation)
 120 {
 121         return (operation < TOMOYO_MAX_DOUBLE_PATH_OPERATION)
 122                 ? tomoyo_dp_keyword[operation] : NULL;
 123 }
 124
 125 /**
 126  * tomoyo_strendswith - Check whether the token ends with the given token.
 127  *
 128  * @name: The token to check.
 129  * @tail: The token to find.
 130  *
 131  * Returns true if @name ends with @tail, false otherwise.
 132  */
 133 static bool tomoyo_strendswith(const char *name, const char *tail)
 134 {
 135         int len;
 136
 137         if (!name || !tail)
 138                 return false;
 139         len = strlen(name) - strlen(tail);
 140         return len >= 0 && !strcmp(name + len, tail);
 141 }
 142
 143 /**
 144  * tomoyo_get_path - Get realpath.
 145  *
 146  * @path: Pointer to "struct path".
 147  *
 148  * Returns pointer to "struct tomoyo_path_info" on success, NULL otherwise.
 149  */
 150 static struct tomoyo_path_info *tomoyo_get_path(struct path *path)
 151 {
 152         int error;
 153         struct tomoyo_path_info_with_data *buf = kzalloc(sizeof(*buf),
 154                                                          GFP_KERNEL);
 155
 156         if (!buf)
 157                 return NULL;
 158         /* Reserve one byte for appending "/". */
 159         error = tomoyo_realpath_from_path2(path, buf->body,
 160                                            sizeof(buf->body) - 2);
 161         if (!error) {
 162                 buf->head.name = buf->body;
 163                 tomoyo_fill_path_info(&buf->head);
 164                 return &buf->head;
 165         }
 166         kfree(buf);
 167         return NULL;
 168 }
 169
 170 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
 171                                          const char *filename2,
 172                                          struct tomoyo_domain_info *
 173                                          const domain, const bool is_delete);
 174 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
 175                                          struct tomoyo_domain_info *
 176                                          const domain, const bool is_delete);
 177
 178 /*
 179  * tomoyo_globally_readable_list is used for holding list of pathnames which
 180  * are by default allowed to be open()ed for reading by any process.
 181  *
 182  * An entry is added by
 183  *
 184  * # echo 'allow_read /lib/libc-2.5.so' > \
 185  *                               /sys/kernel/security/tomoyo/exception_policy
 186  *
 187  * and is deleted by
 188  *
 189  * # echo 'delete allow_read /lib/libc-2.5.so' > \
 190  *                               /sys/kernel/security/tomoyo/exception_policy
 191  *
 192  * and all entries are retrieved by
 193  *
 194  * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
 195  *
 196  * In the example above, any process is allowed to
 197  * open("/lib/libc-2.5.so", O_RDONLY).
 198  * One exception is, if the domain which current process belongs to is marked
 199  * as "ignore_global_allow_read", current process can't do so unless explicitly
 200  * given "allow_read /lib/libc-2.5.so" to the domain which current process
 201  * belongs to.
 202  */
 203 static LIST_HEAD(tomoyo_globally_readable_list);
 204
 205 /**
 206  * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
 207  *
 208  * @filename:  Filename unconditionally permitted to open() for reading.
 209  * @is_delete: True if it is a delete request.
 210  *
 211  * Returns 0 on success, negative value otherwise.
 212  *
 213  * Caller holds tomoyo_read_lock().
 214  */
 215 static int tomoyo_update_globally_readable_entry(const char *filename,
 216                                                  const bool is_delete)
 217 {
 218         struct tomoyo_globally_readable_file_entry *new_entry;
 219         struct tomoyo_globally_readable_file_entry *ptr;
 220         const struct tomoyo_path_info *saved_filename;
 221         int error = -ENOMEM;
 222
 223         if (!tomoyo_is_correct_path(filename, 1, 0, -1, __func__))
 224                 return -EINVAL;
 225         saved_filename = tomoyo_save_name(filename);
 226         if (!saved_filename)
 227                 return -ENOMEM;
 228         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
 229         mutex_lock(&tomoyo_policy_lock);
 230         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
 231                 if (ptr->filename != saved_filename)
 232                         continue;
 233                 ptr->is_deleted = is_delete;
 234                 error = 0;
 235                 goto out;
 236         }
 237         if (is_delete) {
 238                 error = -ENOENT;
 239                 goto out;
 240         }
 241         if (!tomoyo_memory_ok(new_entry))
 242                 goto out;
 243         new_entry->filename = saved_filename;
 244         list_add_tail_rcu(&new_entry->list, &tomoyo_globally_readable_list);
 245         new_entry = NULL;
 246         error = 0;
 247  out:
 248         mutex_unlock(&tomoyo_policy_lock);
 249         kfree(new_entry);
 250         return error;
 251 }
 252
 253 /**
 254  * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
 255  *
 256  * @filename: The filename to check.
 257  *
 258  * Returns true if any domain can open @filename for reading, false otherwise.
 259  *
 260  * Caller holds tomoyo_read_lock().
 261  */
 262 static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
 263                                              filename)
 264 {
 265         struct tomoyo_globally_readable_file_entry *ptr;
 266         bool found = false;
 267
 268         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list, list) {
 269                 if (!ptr->is_deleted &&
 270                     tomoyo_path_matches_pattern(filename, ptr->filename)) {
 271                         found = true;
 272                         break;
 273                 }
 274         }
 275         return found;
 276 }
 277
 278 /**
 279  * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
 280  *
 281  * @data:      String to parse.
 282  * @is_delete: True if it is a delete request.
 283  *
 284  * Returns 0 on success, negative value otherwise.
 285  *
 286  * Caller holds tomoyo_read_lock().
 287  */
 288 int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
 289 {
 290         return tomoyo_update_globally_readable_entry(data, is_delete);
 291 }
 292
 293 /**
 294  * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
 295  *
 296  * @head: Pointer to "struct tomoyo_io_buffer".
 297  *
 298  * Returns true on success, false otherwise.
 299  *
 300  * Caller holds tomoyo_read_lock().
 301  */
 302 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
 303 {
 304         struct list_head *pos;
 305         bool done = true;
 306
 307         list_for_each_cookie(pos, head->read_var2,
 308                              &tomoyo_globally_readable_list) {
 309                 struct tomoyo_globally_readable_file_entry *ptr;
 310                 ptr = list_entry(pos,
 311                                  struct tomoyo_globally_readable_file_entry,
 312                                  list);
 313                 if (ptr->is_deleted)
 314                         continue;
 315                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
 316                                         ptr->filename->name);
 317                 if (!done)
 318                         break;
 319         }
 320         return done;
 321 }
 322
 323 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
 324  * converting pathnames to pathname patterns during learning mode.
 325  *
 326  * An entry is added by
 327  *
 328  * # echo 'file_pattern /proc/\$/mounts' > \
 329  *                             /sys/kernel/security/tomoyo/exception_policy
 330  *
 331  * and is deleted by
 332  *
 333  * # echo 'delete file_pattern /proc/\$/mounts' > \
 334  *                             /sys/kernel/security/tomoyo/exception_policy
 335  *
 336  * and all entries are retrieved by
 337  *
 338  * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
 339  *
 340  * In the example above, if a process which belongs to a domain which is in
 341  * learning mode requested open("/proc/1/mounts", O_RDONLY),
 342  * "allow_read /proc/\$/mounts" is automatically added to the domain which that
 343  * process belongs to.
 344  *
 345  * It is not a desirable behavior that we have to use /proc/\$/ instead of
 346  * /proc/self/ when current process needs to access only current process's
 347  * information. As of now, LSM version of TOMOYO is using __d_path() for
 348  * calculating pathname. Non LSM version of TOMOYO is using its own function
 349  * which pretends as if /proc/self/ is not a symlink; so that we can forbid
 350  * current process from accessing other process's information.
 351  */
 352 static LIST_HEAD(tomoyo_pattern_list);
 353
 354 /**
 355  * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
 356  *
 357  * @pattern:   Pathname pattern.
 358  * @is_delete: True if it is a delete request.
 359  *
 360  * Returns 0 on success, negative value otherwise.
 361  *
 362  * Caller holds tomoyo_read_lock().
 363  */
 364 static int tomoyo_update_file_pattern_entry(const char *pattern,
 365                                             const bool is_delete)
 366 {
 367         struct tomoyo_pattern_entry *new_entry;
 368         struct tomoyo_pattern_entry *ptr;
 369         const struct tomoyo_path_info *saved_pattern;
 370         int error = -ENOMEM;
 371
 372         if (!tomoyo_is_correct_path(pattern, 0, 1, 0, __func__))
 373                 return -EINVAL;
 374         saved_pattern = tomoyo_save_name(pattern);
 375         if (!saved_pattern)
 376                 return -ENOMEM;
 377         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
 378         mutex_lock(&tomoyo_policy_lock);
 379         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
 380                 if (saved_pattern != ptr->pattern)
 381                         continue;
 382                 ptr->is_deleted = is_delete;
 383                 error = 0;
 384                 goto out;
 385         }
 386         if (is_delete) {
 387                 error = -ENOENT;
 388                 goto out;
 389         }
 390         if (!tomoyo_memory_ok(new_entry))
 391                 goto out;
 392         new_entry->pattern = saved_pattern;
 393         list_add_tail_rcu(&new_entry->list, &tomoyo_pattern_list);
 394         new_entry = NULL;
 395         error = 0;
 396  out:
 397         mutex_unlock(&tomoyo_policy_lock);
 398         kfree(new_entry);
 399         return error;
 400 }
 401
 402 /**
 403  * tomoyo_get_file_pattern - Get patterned pathname.
 404  *
 405  * @filename: The filename to find patterned pathname.
 406  *
 407  * Returns pointer to pathname pattern if matched, @filename otherwise.
 408  *
 409  * Caller holds tomoyo_read_lock().
 410  */
 411 static const struct tomoyo_path_info *
 412 tomoyo_get_file_pattern(const struct tomoyo_path_info *filename)
 413 {
 414         struct tomoyo_pattern_entry *ptr;
 415         const struct tomoyo_path_info *pattern = NULL;
 416
 417         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
 418                 if (ptr->is_deleted)
 419                         continue;
 420                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 421                         continue;
 422                 pattern = ptr->pattern;
 423                 if (tomoyo_strendswith(pattern->name, "/\\*")) {
 424                         /* Do nothing. Try to find the better match. */
 425                 } else {
 426                         /* This would be the better match. Use this. */
 427                         break;
 428                 }
 429         }
 430         if (pattern)
 431                 filename = pattern;
 432         return filename;
 433 }
 434
 435 /**
 436  * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
 437  *
 438  * @data:      String to parse.
 439  * @is_delete: True if it is a delete request.
 440  *
 441  * Returns 0 on success, negative value otherwise.
 442  *
 443  * Caller holds tomoyo_read_lock().
 444  */
 445 int tomoyo_write_pattern_policy(char *data, const bool is_delete)
 446 {
 447         return tomoyo_update_file_pattern_entry(data, is_delete);
 448 }
 449
 450 /**
 451  * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
 452  *
 453  * @head: Pointer to "struct tomoyo_io_buffer".
 454  *
 455  * Returns true on success, false otherwise.
 456  *
 457  * Caller holds tomoyo_read_lock().
 458  */
 459 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
 460 {
 461         struct list_head *pos;
 462         bool done = true;
 463
 464         list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
 465                 struct tomoyo_pattern_entry *ptr;
 466                 ptr = list_entry(pos, struct tomoyo_pattern_entry, list);
 467                 if (ptr->is_deleted)
 468                         continue;
 469                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
 470                                         "%s\n", ptr->pattern->name);
 471                 if (!done)
 472                         break;
 473         }
 474         return done;
 475 }
 476
 477 /*
 478  * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
 479  * default forbidden to modify already written content of a file.
 480  *
 481  * An entry is added by
 482  *
 483  * # echo 'deny_rewrite /var/log/messages' > \
 484  *                              /sys/kernel/security/tomoyo/exception_policy
 485  *
 486  * and is deleted by
 487  *
 488  * # echo 'delete deny_rewrite /var/log/messages' > \
 489  *                              /sys/kernel/security/tomoyo/exception_policy
 490  *
 491  * and all entries are retrieved by
 492  *
 493  * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
 494  *
 495  * In the example above, if a process requested to rewrite /var/log/messages ,
 496  * the process can't rewrite unless the domain which that process belongs to
 497  * has "allow_rewrite /var/log/messages" entry.
 498  *
 499  * It is not a desirable behavior that we have to add "\040(deleted)" suffix
 500  * when we want to allow rewriting already unlink()ed file. As of now,
 501  * LSM version of TOMOYO is using __d_path() for calculating pathname.
 502  * Non LSM version of TOMOYO is using its own function which doesn't append
 503  * " (deleted)" suffix if the file is already unlink()ed; so that we don't
 504  * need to worry whether the file is already unlink()ed or not.
 505  */
 506 static LIST_HEAD(tomoyo_no_rewrite_list);
 507
 508 /**
 509  * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
 510  *
 511  * @pattern:   Pathname pattern that are not rewritable by default.
 512  * @is_delete: True if it is a delete request.
 513  *
 514  * Returns 0 on success, negative value otherwise.
 515  *
 516  * Caller holds tomoyo_read_lock().
 517  */
 518 static int tomoyo_update_no_rewrite_entry(const char *pattern,
 519                                           const bool is_delete)
 520 {
 521         struct tomoyo_no_rewrite_entry *new_entry, *ptr;
 522         const struct tomoyo_path_info *saved_pattern;
 523         int error = -ENOMEM;
 524
 525         if (!tomoyo_is_correct_path(pattern, 0, 0, 0, __func__))
 526                 return -EINVAL;
 527         saved_pattern = tomoyo_save_name(pattern);
 528         if (!saved_pattern)
 529                 return -ENOMEM;
 530         new_entry = kmalloc(sizeof(*new_entry), GFP_KERNEL);
 531         mutex_lock(&tomoyo_policy_lock);
 532         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
 533                 if (ptr->pattern != saved_pattern)
 534                         continue;
 535                 ptr->is_deleted = is_delete;
 536                 error = 0;
 537                 goto out;
 538         }
 539         if (is_delete) {
 540                 error = -ENOENT;
 541                 goto out;
 542         }
 543         if (!tomoyo_memory_ok(new_entry))
 544                 goto out;
 545         new_entry->pattern = saved_pattern;
 546         list_add_tail_rcu(&new_entry->list, &tomoyo_no_rewrite_list);
 547         new_entry = NULL;
 548         error = 0;
 549  out:
 550         mutex_unlock(&tomoyo_policy_lock);
 551         kfree(new_entry);
 552         return error;
 553 }
 554
 555 /**
 556  * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
 557  *
 558  * @filename: Filename to check.
 559  *
 560  * Returns true if @filename is specified by "deny_rewrite" directive,
 561  * false otherwise.
 562  *
 563  * Caller holds tomoyo_read_lock().
 564  */
 565 static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
 566 {
 567         struct tomoyo_no_rewrite_entry *ptr;
 568         bool found = false;
 569
 570         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
 571                 if (ptr->is_deleted)
 572                         continue;
 573                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 574                         continue;
 575                 found = true;
 576                 break;
 577         }
 578         return found;
 579 }
 580
 581 /**
 582  * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
 583  *
 584  * @data:      String to parse.
 585  * @is_delete: True if it is a delete request.
 586  *
 587  * Returns 0 on success, negative value otherwise.
 588  *
 589  * Caller holds tomoyo_read_lock().
 590  */
 591 int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
 592 {
 593         return tomoyo_update_no_rewrite_entry(data, is_delete);
 594 }
 595
 596 /**
 597  * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
 598  *
 599  * @head: Pointer to "struct tomoyo_io_buffer".
 600  *
 601  * Returns true on success, false otherwise.
 602  *
 603  * Caller holds tomoyo_read_lock().
 604  */
 605 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
 606 {
 607         struct list_head *pos;
 608         bool done = true;
 609
 610         list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
 611                 struct tomoyo_no_rewrite_entry *ptr;
 612                 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry, list);
 613                 if (ptr->is_deleted)
 614                         continue;
 615                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
 616                                         "%s\n", ptr->pattern->name);
 617                 if (!done)
 618                         break;
 619         }
 620         return done;
 621 }
 622
 623 /**
 624  * tomoyo_update_file_acl - Update file's read/write/execute ACL.
 625  *
 626  * @filename:  Filename.
 627  * @perm:      Permission (between 1 to 7).
 628  * @domain:    Pointer to "struct tomoyo_domain_info".
 629  * @is_delete: True if it is a delete request.
 630  *
 631  * Returns 0 on success, negative value otherwise.
 632  *
 633  * This is legacy support interface for older policy syntax.
 634  * Current policy syntax uses "allow_read/write" instead of "6",
 635  * "allow_read" instead of "4", "allow_write" instead of "2",
 636  * "allow_execute" instead of "1".
 637  *
 638  * Caller holds tomoyo_read_lock().
 639  */
 640 static int tomoyo_update_file_acl(const char *filename, u8 perm,
 641                                   struct tomoyo_domain_info * const domain,
 642                                   const bool is_delete)
 643 {
 644         if (perm > 7 || !perm) {
 645                 printk(KERN_DEBUG "%s: Invalid permission '%d %s'\n",
 646                        __func__, perm, filename);
 647                 return -EINVAL;
 648         }
 649         if (filename[0] != '@' && tomoyo_strendswith(filename, "/"))
 650                 /*
 651                  * Only 'allow_mkdir' and 'allow_rmdir' are valid for
 652                  * directory permissions.
 653                  */
 654                 return 0;
 655         if (perm & 4)
 656                 tomoyo_update_single_path_acl(TOMOYO_TYPE_READ_ACL, filename,
 657                                               domain, is_delete);
 658         if (perm & 2)
 659                 tomoyo_update_single_path_acl(TOMOYO_TYPE_WRITE_ACL, filename,
 660                                               domain, is_delete);
 661         if (perm & 1)
 662                 tomoyo_update_single_path_acl(TOMOYO_TYPE_EXECUTE_ACL,
 663                                               filename, domain, is_delete);
 664         return 0;
 665 }
 666
 667 /**
 668  * tomoyo_check_single_path_acl2 - Check permission for single path operation.
 669  *
 670  * @domain:          Pointer to "struct tomoyo_domain_info".
 671  * @filename:        Filename to check.
 672  * @perm:            Permission.
 673  * @may_use_pattern: True if patterned ACL is permitted.
 674  *
 675  * Returns 0 on success, -EPERM otherwise.
 676  *
 677  * Caller holds tomoyo_read_lock().
 678  */
 679 static int tomoyo_check_single_path_acl2(const struct tomoyo_domain_info *
 680                                          domain,
 681                                          const struct tomoyo_path_info *
 682                                          filename,
 683                                          const u32 perm,
 684                                          const bool may_use_pattern)
 685 {
 686         struct tomoyo_acl_info *ptr;
 687         int error = -EPERM;
 688
 689         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 690                 struct tomoyo_single_path_acl_record *acl;
 691                 if (ptr->type != TOMOYO_TYPE_SINGLE_PATH_ACL)
 692                         continue;
 693                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
 694                                    head);
 695                 if (perm <= 0xFFFF) {
 696                         if (!(acl->perm & perm))
 697                                 continue;
 698                 } else {
 699                         if (!(acl->perm_high & (perm >> 16)))
 700                                 continue;
 701                 }
 702                 if (may_use_pattern || !acl->filename->is_patterned) {
 703                         if (!tomoyo_path_matches_pattern(filename,
 704                                                          acl->filename))
 705                                 continue;
 706                 } else {
 707                         continue;
 708                 }
 709                 error = 0;
 710                 break;
 711         }
 712         return error;
 713 }
 714
 715 /**
 716  * tomoyo_check_file_acl - Check permission for opening files.
 717  *
 718  * @domain:    Pointer to "struct tomoyo_domain_info".
 719  * @filename:  Filename to check.
 720  * @operation: Mode ("read" or "write" or "read/write" or "execute").
 721  *
 722  * Returns 0 on success, -EPERM otherwise.
 723  *
 724  * Caller holds tomoyo_read_lock().
 725  */
 726 static int tomoyo_check_file_acl(const struct tomoyo_domain_info *domain,
 727                                  const struct tomoyo_path_info *filename,
 728                                  const u8 operation)
 729 {
 730         u32 perm = 0;
 731
 732         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
 733                 return 0;
 734         if (operation == 6)
 735                 perm = 1 << TOMOYO_TYPE_READ_WRITE_ACL;
 736         else if (operation == 4)
 737                 perm = 1 << TOMOYO_TYPE_READ_ACL;
 738         else if (operation == 2)
 739                 perm = 1 << TOMOYO_TYPE_WRITE_ACL;
 740         else if (operation == 1)
 741                 perm = 1 << TOMOYO_TYPE_EXECUTE_ACL;
 742         else
 743                 BUG();
 744         return tomoyo_check_single_path_acl2(domain, filename, perm,
 745                                              operation != 1);
 746 }
 747
 748 /**
 749  * tomoyo_check_file_perm2 - Check permission for opening files.
 750  *
 751  * @domain:    Pointer to "struct tomoyo_domain_info".
 752  * @filename:  Filename to check.
 753  * @perm:      Mode ("read" or "write" or "read/write" or "execute").
 754  * @operation: Operation name passed used for verbose mode.
 755  * @mode:      Access control mode.
 756  *
 757  * Returns 0 on success, negative value otherwise.
 758  *
 759  * Caller holds tomoyo_read_lock().
 760  */
 761 static int tomoyo_check_file_perm2(struct tomoyo_domain_info * const domain,
 762                                    const struct tomoyo_path_info *filename,
 763                                    const u8 perm, const char *operation,
 764                                    const u8 mode)
 765 {
 766         const bool is_enforce = (mode == 3);
 767         const char *msg = "<unknown>";
 768         int error = 0;
 769
 770         if (!filename)
 771                 return 0;
 772         error = tomoyo_check_file_acl(domain, filename, perm);
 773         if (error && perm == 4 && !domain->ignore_global_allow_read
 774             && tomoyo_is_globally_readable_file(filename))
 775                 error = 0;
 776         if (perm == 6)
 777                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_WRITE_ACL);
 778         else if (perm == 4)
 779                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_READ_ACL);
 780         else if (perm == 2)
 781                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_WRITE_ACL);
 782         else if (perm == 1)
 783                 msg = tomoyo_sp2keyword(TOMOYO_TYPE_EXECUTE_ACL);
 784         else
 785                 BUG();
 786         if (!error)
 787                 return 0;
 788         if (tomoyo_verbose_mode(domain))
 789                 printk(KERN_WARNING "TOMOYO-%s: Access '%s(%s) %s' denied "
 790                        "for %s\n", tomoyo_get_msg(is_enforce), msg, operation,
 791                        filename->name, tomoyo_get_last_name(domain));
 792         if (is_enforce)
 793                 return error;
 794         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
 795                 /* Don't use patterns for execute permission. */
 796                 const struct tomoyo_path_info *patterned_file = (perm != 1) ?
 797                         tomoyo_get_file_pattern(filename) : filename;
 798                 tomoyo_update_file_acl(patterned_file->name, perm,
 799                                        domain, false);
 800         }
 801         return 0;
 802 }
 803
 804 /**
 805  * tomoyo_write_file_policy - Update file related list.
 806  *
 807  * @data:      String to parse.
 808  * @domain:    Pointer to "struct tomoyo_domain_info".
 809  * @is_delete: True if it is a delete request.
 810  *
 811  * Returns 0 on success, negative value otherwise.
 812  *
 813  * Caller holds tomoyo_read_lock().
 814  */
 815 int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
 816                              const bool is_delete)
 817 {
 818         char *filename = strchr(data, ' ');
 819         char *filename2;
 820         unsigned int perm;
 821         u8 type;
 822
 823         if (!filename)
 824                 return -EINVAL;
 825         *filename++ = '\0';
 826         if (sscanf(data, "%u", &perm) == 1)
 827                 return tomoyo_update_file_acl(filename, (u8) perm, domain,
 828                                               is_delete);
 829         if (strncmp(data, "allow_", 6))
 830                 goto out;
 831         data += 6;
 832         for (type = 0; type < TOMOYO_MAX_SINGLE_PATH_OPERATION; type++) {
 833                 if (strcmp(data, tomoyo_sp_keyword[type]))
 834                         continue;
 835                 return tomoyo_update_single_path_acl(type, filename,
 836                                                      domain, is_delete);
 837         }
 838         filename2 = strchr(filename, ' ');
 839         if (!filename2)
 840                 goto out;
 841         *filename2++ = '\0';
 842         for (type = 0; type < TOMOYO_MAX_DOUBLE_PATH_OPERATION; type++) {
 843                 if (strcmp(data, tomoyo_dp_keyword[type]))
 844                         continue;
 845                 return tomoyo_update_double_path_acl(type, filename, filename2,
 846                                                      domain, is_delete);
 847         }
 848  out:
 849         return -EINVAL;
 850 }
 851
 852 /**
 853  * tomoyo_update_single_path_acl - Update "struct tomoyo_single_path_acl_record" list.
 854  *
 855  * @type:      Type of operation.
 856  * @filename:  Filename.
 857  * @domain:    Pointer to "struct tomoyo_domain_info".
 858  * @is_delete: True if it is a delete request.
 859  *
 860  * Returns 0 on success, negative value otherwise.
 861  *
 862  * Caller holds tomoyo_read_lock().
 863  */
 864 static int tomoyo_update_single_path_acl(const u8 type, const char *filename,
 865                                          struct tomoyo_domain_info *
 866                                          const domain, const bool is_delete)
 867 {
 868         static const u32 rw_mask =
 869                 (1 << TOMOYO_TYPE_READ_ACL) | (1 << TOMOYO_TYPE_WRITE_ACL);
 870         const struct tomoyo_path_info *saved_filename;
 871         struct tomoyo_acl_info *ptr;
 872         struct tomoyo_single_path_acl_record *acl;
 873         int error = -ENOMEM;
 874         const u32 perm = 1 << type;
 875
 876         if (!domain)
 877                 return -EINVAL;
 878         if (!tomoyo_is_correct_path(filename, 0, 0, 0, __func__))
 879                 return -EINVAL;
 880         saved_filename = tomoyo_save_name(filename);
 881         if (!saved_filename)
 882                 return -ENOMEM;
 883         mutex_lock(&tomoyo_policy_lock);
 884         if (is_delete)
 885                 goto delete;
 886         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 887                 if (ptr->type != TOMOYO_TYPE_SINGLE_PATH_ACL)
 888                         continue;
 889                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
 890                                    head);
 891                 if (acl->filename != saved_filename)
 892                         continue;
 893                 if (perm <= 0xFFFF)
 894                         acl->perm |= perm;
 895                 else
 896                         acl->perm_high |= (perm >> 16);
 897                 if ((acl->perm & rw_mask) == rw_mask)
 898                         acl->perm |= 1 << TOMOYO_TYPE_READ_WRITE_ACL;
 899                 else if (acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL))
 900                         acl->perm |= rw_mask;
 901                 error = 0;
 902                 goto out;
 903         }
 904         /* Not found. Append it to the tail. */
 905         acl = kmalloc(sizeof(*acl), GFP_KERNEL);
 906         if (!tomoyo_memory_ok(acl)) {
 907                 kfree(acl);
 908                 acl = NULL;
 909                 goto out;
 910         }
 911         acl->head.type = TOMOYO_TYPE_SINGLE_PATH_ACL;
 912         if (perm <= 0xFFFF)
 913                 acl->perm = perm;
 914         else
 915                 acl->perm_high = (perm >> 16);
 916         if (perm == (1 << TOMOYO_TYPE_READ_WRITE_ACL))
 917                 acl->perm |= rw_mask;
 918         acl->filename = saved_filename;
 919         list_add_tail_rcu(&acl->head.list, &domain->acl_info_list);
 920         error = 0;
 921         goto out;
 922  delete:
 923         error = -ENOENT;
 924         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 925                 if (ptr->type != TOMOYO_TYPE_SINGLE_PATH_ACL)
 926                         continue;
 927                 acl = container_of(ptr, struct tomoyo_single_path_acl_record,
 928                                    head);
 929                 if (acl->filename != saved_filename)
 930                         continue;
 931                 if (perm <= 0xFFFF)
 932                         acl->perm &= ~perm;
 933                 else
 934                         acl->perm_high &= ~(perm >> 16);
 935                 if ((acl->perm & rw_mask) != rw_mask)
 936                         acl->perm &= ~(1 << TOMOYO_TYPE_READ_WRITE_ACL);
 937                 else if (!(acl->perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL)))
 938                         acl->perm &= ~rw_mask;
 939                 error = 0;
 940                 break;
 941         }
 942  out:
 943         mutex_unlock(&tomoyo_policy_lock);
 944         return error;
 945 }
 946
 947 /**
 948  * tomoyo_update_double_path_acl - Update "struct tomoyo_double_path_acl_record" list.
 949  *
 950  * @type:      Type of operation.
 951  * @filename1: First filename.
 952  * @filename2: Second filename.
 953  * @domain:    Pointer to "struct tomoyo_domain_info".
 954  * @is_delete: True if it is a delete request.
 955  *
 956  * Returns 0 on success, negative value otherwise.
 957  *
 958  * Caller holds tomoyo_read_lock().
 959  */
 960 static int tomoyo_update_double_path_acl(const u8 type, const char *filename1,
 961                                          const char *filename2,
 962                                          struct tomoyo_domain_info *
 963                                          const domain, const bool is_delete)
 964 {
 965         const struct tomoyo_path_info *saved_filename1;
 966         const struct tomoyo_path_info *saved_filename2;
 967         struct tomoyo_acl_info *ptr;
 968         struct tomoyo_double_path_acl_record *acl;
 969         int error = -ENOMEM;
 970         const u8 perm = 1 << type;
 971
 972         if (!domain)
 973                 return -EINVAL;
 974         if (!tomoyo_is_correct_path(filename1, 0, 0, 0, __func__) ||
 975             !tomoyo_is_correct_path(filename2, 0, 0, 0, __func__))
 976                 return -EINVAL;
 977         saved_filename1 = tomoyo_save_name(filename1);
 978         saved_filename2 = tomoyo_save_name(filename2);
 979         if (!saved_filename1 || !saved_filename2)
 980                 return -ENOMEM;
 981         mutex_lock(&tomoyo_policy_lock);
 982         if (is_delete)
 983                 goto delete;
 984         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 985                 if (ptr->type != TOMOYO_TYPE_DOUBLE_PATH_ACL)
 986                         continue;
 987                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
 988                                    head);
 989                 if (acl->filename1 != saved_filename1 ||
 990                     acl->filename2 != saved_filename2)
 991                         continue;
 992                 acl->perm |= perm;
 993                 error = 0;
 994                 goto out;
 995         }
 996         /* Not found. Append it to the tail. */
 997         acl = kmalloc(sizeof(*acl), GFP_KERNEL);
 998         if (!tomoyo_memory_ok(acl)) {
 999                 kfree(acl);
1000                 acl = NULL;
1001                 goto out;
1002         }
1003         acl->head.type = TOMOYO_TYPE_DOUBLE_PATH_ACL;
1004         acl->perm = perm;
1005         acl->filename1 = saved_filename1;
1006         acl->filename2 = saved_filename2;
1007         list_add_tail_rcu(&acl->head.list, &domain->acl_info_list);
1008         error = 0;
1009         goto out;
1010  delete:
1011         error = -ENOENT;
1012         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1013                 if (ptr->type != TOMOYO_TYPE_DOUBLE_PATH_ACL)
1014                         continue;
1015                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
1016                                    head);
1017                 if (acl->filename1 != saved_filename1 ||
1018                     acl->filename2 != saved_filename2)
1019                         continue;
1020                 acl->perm &= ~perm;
1021                 error = 0;
1022                 break;
1023         }
1024  out:
1025         mutex_unlock(&tomoyo_policy_lock);
1026         return error;
1027 }
1028
1029 /**
1030  * tomoyo_check_single_path_acl - Check permission for single path operation.
1031  *
1032  * @domain:   Pointer to "struct tomoyo_domain_info".
1033  * @type:     Type of operation.
1034  * @filename: Filename to check.
1035  *
1036  * Returns 0 on success, negative value otherwise.
1037  *
1038  * Caller holds tomoyo_read_lock().
1039  */
1040 static int tomoyo_check_single_path_acl(struct tomoyo_domain_info *domain,
1041                                         const u8 type,
1042                                         const struct tomoyo_path_info *filename)
1043 {
1044         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1045                 return 0;
1046         return tomoyo_check_single_path_acl2(domain, filename, 1 << type, 1);
1047 }
1048
1049 /**
1050  * tomoyo_check_double_path_acl - Check permission for double path operation.
1051  *
1052  * @domain:    Pointer to "struct tomoyo_domain_info".
1053  * @type:      Type of operation.
1054  * @filename1: First filename to check.
1055  * @filename2: Second filename to check.
1056  *
1057  * Returns 0 on success, -EPERM otherwise.
1058  *
1059  * Caller holds tomoyo_read_lock().
1060  */
1061 static int tomoyo_check_double_path_acl(const struct tomoyo_domain_info *domain,
1062                                         const u8 type,
1063                                         const struct tomoyo_path_info *
1064                                         filename1,
1065                                         const struct tomoyo_path_info *
1066                                         filename2)
1067 {
1068         struct tomoyo_acl_info *ptr;
1069         const u8 perm = 1 << type;
1070         int error = -EPERM;
1071
1072         if (!tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE))
1073                 return 0;
1074         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1075                 struct tomoyo_double_path_acl_record *acl;
1076                 if (ptr->type != TOMOYO_TYPE_DOUBLE_PATH_ACL)
1077                         continue;
1078                 acl = container_of(ptr, struct tomoyo_double_path_acl_record,
1079                                    head);
1080                 if (!(acl->perm & perm))
1081                         continue;
1082                 if (!tomoyo_path_matches_pattern(filename1, acl->filename1))
1083                         continue;
1084                 if (!tomoyo_path_matches_pattern(filename2, acl->filename2))
1085                         continue;
1086                 error = 0;
1087                 break;
1088         }
1089         return error;
1090 }
1091
1092 /**
1093  * tomoyo_check_single_path_permission2 - Check permission for single path operation.
1094  *
1095  * @domain:    Pointer to "struct tomoyo_domain_info".
1096  * @operation: Type of operation.
1097  * @filename:  Filename to check.
1098  * @mode:      Access control mode.
1099  *
1100  * Returns 0 on success, negative value otherwise.
1101  *
1102  * Caller holds tomoyo_read_lock().
1103  */
1104 static int tomoyo_check_single_path_permission2(struct tomoyo_domain_info *
1105                                                 const domain, u8 operation,
1106                                                 const struct tomoyo_path_info *
1107                                                 filename, const u8 mode)
1108 {
1109         const char *msg;
1110         int error;
1111         const bool is_enforce = (mode == 3);
1112
1113         if (!mode)
1114                 return 0;
1115  next:
1116         error = tomoyo_check_single_path_acl(domain, operation, filename);
1117         msg = tomoyo_sp2keyword(operation);
1118         if (!error)
1119                 goto ok;
1120         if (tomoyo_verbose_mode(domain))
1121                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s' denied for %s\n",
1122                        tomoyo_get_msg(is_enforce), msg, filename->name,
1123                        tomoyo_get_last_name(domain));
1124         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1125                 const char *name = tomoyo_get_file_pattern(filename)->name;
1126                 tomoyo_update_single_path_acl(operation, name, domain, false);
1127         }
1128         if (!is_enforce)
1129                 error = 0;
1130  ok:
1131         /*
1132          * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1133          * we need to check "allow_rewrite" permission if the filename is
1134          * specified by "deny_rewrite" keyword.
1135          */
1136         if (!error && operation == TOMOYO_TYPE_TRUNCATE_ACL &&
1137             tomoyo_is_no_rewrite_file(filename)) {
1138                 operation = TOMOYO_TYPE_REWRITE_ACL;
1139                 goto next;
1140         }
1141         return error;
1142 }
1143
1144 /**
1145  * tomoyo_check_exec_perm - Check permission for "execute".
1146  *
1147  * @domain:   Pointer to "struct tomoyo_domain_info".
1148  * @filename: Check permission for "execute".
1149  *
1150  * Returns 0 on success, negativevalue otherwise.
1151  *
1152  * Caller holds tomoyo_read_lock().
1153  */
1154 int tomoyo_check_exec_perm(struct tomoyo_domain_info *domain,
1155                            const struct tomoyo_path_info *filename)
1156 {
1157         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1158
1159         if (!mode)
1160                 return 0;
1161         return tomoyo_check_file_perm2(domain, filename, 1, "do_execve", mode);
1162 }
1163
1164 /**
1165  * tomoyo_check_open_permission - Check permission for "read" and "write".
1166  *
1167  * @domain: Pointer to "struct tomoyo_domain_info".
1168  * @path:   Pointer to "struct path".
1169  * @flag:   Flags for open().
1170  *
1171  * Returns 0 on success, negative value otherwise.
1172  */
1173 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1174                                  struct path *path, const int flag)
1175 {
1176         const u8 acc_mode = ACC_MODE(flag);
1177         int error = -ENOMEM;
1178         struct tomoyo_path_info *buf;
1179         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1180         const bool is_enforce = (mode == 3);
1181         int idx;
1182
1183         if (!mode || !path->mnt)
1184                 return 0;
1185         if (acc_mode == 0)
1186                 return 0;
1187         if (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode))
1188                 /*
1189                  * I don't check directories here because mkdir() and rmdir()
1190                  * don't call me.
1191                  */
1192                 return 0;
1193         idx = tomoyo_read_lock();
1194         buf = tomoyo_get_path(path);
1195         if (!buf)
1196                 goto out;
1197         error = 0;
1198         /*
1199          * If the filename is specified by "deny_rewrite" keyword,
1200          * we need to check "allow_rewrite" permission when the filename is not
1201          * opened for append mode or the filename is truncated at open time.
1202          */
1203         if ((acc_mode & MAY_WRITE) &&
1204             ((flag & O_TRUNC) || !(flag & O_APPEND)) &&
1205             (tomoyo_is_no_rewrite_file(buf))) {
1206                 error = tomoyo_check_single_path_permission2(domain,
1207                                                      TOMOYO_TYPE_REWRITE_ACL,
1208                                                              buf, mode);
1209         }
1210         if (!error)
1211                 error = tomoyo_check_file_perm2(domain, buf, acc_mode, "open",
1212                                                 mode);
1213         if (!error && (flag & O_TRUNC))
1214                 error = tomoyo_check_single_path_permission2(domain,
1215                                                      TOMOYO_TYPE_TRUNCATE_ACL,
1216                                                              buf, mode);
1217  out:
1218         kfree(buf);
1219         tomoyo_read_unlock(idx);
1220         if (!is_enforce)
1221                 error = 0;
1222         return error;
1223 }
1224
1225 /**
1226  * tomoyo_check_1path_perm - Check permission for "create", "unlink", "mkdir", "rmdir", "mkfifo", "mksock", "mkblock", "mkchar", "truncate", "symlink", "ioctl", "chmod", "chown", "chgrp", "chroot", "mount" and "unmount".
1227  *
1228  * @domain:    Pointer to "struct tomoyo_domain_info".
1229  * @operation: Type of operation.
1230  * @path:      Pointer to "struct path".
1231  *
1232  * Returns 0 on success, negative value otherwise.
1233  */
1234 int tomoyo_check_1path_perm(struct tomoyo_domain_info *domain,
1235                             const u8 operation, struct path *path)
1236 {
1237         int error = -ENOMEM;
1238         struct tomoyo_path_info *buf;
1239         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1240         const bool is_enforce = (mode == 3);
1241         int idx;
1242
1243         if (!mode || !path->mnt)
1244                 return 0;
1245         idx = tomoyo_read_lock();
1246         buf = tomoyo_get_path(path);
1247         if (!buf)
1248                 goto out;
1249         switch (operation) {
1250         case TOMOYO_TYPE_MKDIR_ACL:
1251         case TOMOYO_TYPE_RMDIR_ACL:
1252         case TOMOYO_TYPE_CHROOT_ACL:
1253                 if (!buf->is_dir) {
1254                         /*
1255                          * tomoyo_get_path() reserves space for appending "/."
1256                          */
1257                         strcat((char *) buf->name, "/");
1258                         tomoyo_fill_path_info(buf);
1259                 }
1260         }
1261         error = tomoyo_check_single_path_permission2(domain, operation, buf,
1262                                                      mode);
1263  out:
1264         kfree(buf);
1265         tomoyo_read_unlock(idx);
1266         if (!is_enforce)
1267                 error = 0;
1268         return error;
1269 }
1270
1271 /**
1272  * tomoyo_check_rewrite_permission - Check permission for "rewrite".
1273  *
1274  * @domain: Pointer to "struct tomoyo_domain_info".
1275  * @filp: Pointer to "struct file".
1276  *
1277  * Returns 0 on success, negative value otherwise.
1278  */
1279 int tomoyo_check_rewrite_permission(struct tomoyo_domain_info *domain,
1280                                     struct file *filp)
1281 {
1282         int error = -ENOMEM;
1283         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1284         const bool is_enforce = (mode == 3);
1285         struct tomoyo_path_info *buf;
1286         int idx;
1287
1288         if (!mode || !filp->f_path.mnt)
1289                 return 0;
1290
1291         idx = tomoyo_read_lock();
1292         buf = tomoyo_get_path(&filp->f_path);
1293         if (!buf)
1294                 goto out;
1295         if (!tomoyo_is_no_rewrite_file(buf)) {
1296                 error = 0;
1297                 goto out;
1298         }
1299         error = tomoyo_check_single_path_permission2(domain,
1300                                                      TOMOYO_TYPE_REWRITE_ACL,
1301                                                      buf, mode);
1302  out:
1303         kfree(buf);
1304         tomoyo_read_unlock(idx);
1305         if (!is_enforce)
1306                 error = 0;
1307         return error;
1308 }
1309
1310 /**
1311  * tomoyo_check_2path_perm - Check permission for "rename", "link" and "pivot_root".
1312  *
1313  * @domain:    Pointer to "struct tomoyo_domain_info".
1314  * @operation: Type of operation.
1315  * @path1:      Pointer to "struct path".
1316  * @path2:      Pointer to "struct path".
1317  *
1318  * Returns 0 on success, negative value otherwise.
1319  */
1320 int tomoyo_check_2path_perm(struct tomoyo_domain_info * const domain,
1321                             const u8 operation, struct path *path1,
1322                             struct path *path2)
1323 {
1324         int error = -ENOMEM;
1325         struct tomoyo_path_info *buf1, *buf2;
1326         const u8 mode = tomoyo_check_flags(domain, TOMOYO_MAC_FOR_FILE);
1327         const bool is_enforce = (mode == 3);
1328         const char *msg;
1329         int idx;
1330
1331         if (!mode || !path1->mnt || !path2->mnt)
1332                 return 0;
1333         idx = tomoyo_read_lock();
1334         buf1 = tomoyo_get_path(path1);
1335         buf2 = tomoyo_get_path(path2);
1336         if (!buf1 || !buf2)
1337                 goto out;
1338         {
1339                 struct dentry *dentry = path1->dentry;
1340                 if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode)) {
1341                         /*
1342                          * tomoyo_get_path() reserves space for appending "/."
1343                          */
1344                         if (!buf1->is_dir) {
1345                                 strcat((char *) buf1->name, "/");
1346                                 tomoyo_fill_path_info(buf1);
1347                         }
1348                         if (!buf2->is_dir) {
1349                                 strcat((char *) buf2->name, "/");
1350                                 tomoyo_fill_path_info(buf2);
1351                         }
1352                 }
1353         }
1354         error = tomoyo_check_double_path_acl(domain, operation, buf1, buf2);
1355         msg = tomoyo_dp2keyword(operation);
1356         if (!error)
1357                 goto out;
1358         if (tomoyo_verbose_mode(domain))
1359                 printk(KERN_WARNING "TOMOYO-%s: Access '%s %s %s' "
1360                        "denied for %s\n", tomoyo_get_msg(is_enforce),
1361                        msg, buf1->name, buf2->name,
1362                        tomoyo_get_last_name(domain));
1363         if (mode == 1 && tomoyo_domain_quota_is_ok(domain)) {
1364                 const char *name1 = tomoyo_get_file_pattern(buf1)->name;
1365                 const char *name2 = tomoyo_get_file_pattern(buf2)->name;
1366                 tomoyo_update_double_path_acl(operation, name1, name2, domain,
1367                                               false);
1368         }
1369  out:
1370         kfree(buf1);
1371         kfree(buf2);
1372         tomoyo_read_unlock(idx);
1373         if (!is_enforce)
1374                 error = 0;
1375         return error;
1376 }