4 * Implementation of the Domain-Based Mandatory Access Control.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
11 #include <linux/kthread.h>
12 #include <linux/slab.h>
15 TOMOYO_ID_DOMAIN_INITIALIZER,
16 TOMOYO_ID_DOMAIN_KEEPER,
18 TOMOYO_ID_GLOBALLY_READABLE,
27 struct tomoyo_gc_entry {
28 struct list_head list;
32 static LIST_HEAD(tomoyo_gc_queue);
33 static DEFINE_MUTEX(tomoyo_gc_mutex);
35 /* Caller holds tomoyo_policy_lock mutex. */
36 static bool tomoyo_add_to_gc(const int type, void *element)
38 struct tomoyo_gc_entry *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
42 entry->element = element;
43 list_add(&entry->list, &tomoyo_gc_queue);
47 static void tomoyo_del_allow_read
48 (struct tomoyo_globally_readable_file_entry *ptr)
50 tomoyo_put_name(ptr->filename);
53 static void tomoyo_del_file_pattern(struct tomoyo_pattern_entry *ptr)
55 tomoyo_put_name(ptr->pattern);
58 static void tomoyo_del_no_rewrite(struct tomoyo_no_rewrite_entry *ptr)
60 tomoyo_put_name(ptr->pattern);
63 static void tomoyo_del_domain_initializer
64 (struct tomoyo_domain_initializer_entry *ptr)
66 tomoyo_put_name(ptr->domainname);
67 tomoyo_put_name(ptr->program);
70 static void tomoyo_del_domain_keeper(struct tomoyo_domain_keeper_entry *ptr)
72 tomoyo_put_name(ptr->domainname);
73 tomoyo_put_name(ptr->program);
76 static void tomoyo_del_alias(struct tomoyo_alias_entry *ptr)
78 tomoyo_put_name(ptr->original_name);
79 tomoyo_put_name(ptr->aliased_name);
82 static void tomoyo_del_manager(struct tomoyo_policy_manager_entry *ptr)
84 tomoyo_put_name(ptr->manager);
87 static void tomoyo_del_acl(struct tomoyo_acl_info *acl)
90 case TOMOYO_TYPE_PATH_ACL:
92 struct tomoyo_path_acl *entry
93 = container_of(acl, typeof(*entry), head);
94 tomoyo_put_name(entry->filename);
97 case TOMOYO_TYPE_PATH2_ACL:
99 struct tomoyo_path2_acl *entry
100 = container_of(acl, typeof(*entry), head);
101 tomoyo_put_name(entry->filename1);
102 tomoyo_put_name(entry->filename2);
106 printk(KERN_WARNING "Unknown type\n");
111 static bool tomoyo_del_domain(struct tomoyo_domain_info *domain)
113 struct tomoyo_acl_info *acl;
114 struct tomoyo_acl_info *tmp;
116 * Since we don't protect whole execve() operation using SRCU,
117 * we need to recheck domain->users at this point.
119 * (1) Reader starts SRCU section upon execve().
120 * (2) Reader traverses tomoyo_domain_list and finds this domain.
121 * (3) Writer marks this domain as deleted.
122 * (4) Garbage collector removes this domain from tomoyo_domain_list
123 * because this domain is marked as deleted and used by nobody.
124 * (5) Reader saves reference to this domain into
125 * "struct linux_binprm"->cred->security .
126 * (6) Reader finishes SRCU section, although execve() operation has
128 * (7) Garbage collector waits for SRCU synchronization.
129 * (8) Garbage collector kfree() this domain because this domain is
131 * (9) Reader finishes execve() operation and restores this domain from
132 * "struct linux_binprm"->cred->security.
134 * By updating domain->users at (5), we can solve this race problem
135 * by rechecking domain->users at (8).
137 if (atomic_read(&domain->users))
139 list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
141 tomoyo_memory_free(acl);
143 tomoyo_put_name(domain->domainname);
148 static void tomoyo_del_name(const struct tomoyo_name_entry *ptr)
152 static void tomoyo_collect_entry(void)
154 if (mutex_lock_interruptible(&tomoyo_policy_lock))
157 struct tomoyo_globally_readable_file_entry *ptr;
158 list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list,
160 if (!ptr->is_deleted)
162 if (tomoyo_add_to_gc(TOMOYO_ID_GLOBALLY_READABLE, ptr))
163 list_del_rcu(&ptr->list);
169 struct tomoyo_pattern_entry *ptr;
170 list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, list) {
171 if (!ptr->is_deleted)
173 if (tomoyo_add_to_gc(TOMOYO_ID_PATTERN, ptr))
174 list_del_rcu(&ptr->list);
180 struct tomoyo_no_rewrite_entry *ptr;
181 list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, list) {
182 if (!ptr->is_deleted)
184 if (tomoyo_add_to_gc(TOMOYO_ID_NO_REWRITE, ptr))
185 list_del_rcu(&ptr->list);
191 struct tomoyo_domain_initializer_entry *ptr;
192 list_for_each_entry_rcu(ptr, &tomoyo_domain_initializer_list,
194 if (!ptr->is_deleted)
196 if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_INITIALIZER, ptr))
197 list_del_rcu(&ptr->list);
203 struct tomoyo_domain_keeper_entry *ptr;
204 list_for_each_entry_rcu(ptr, &tomoyo_domain_keeper_list, list) {
205 if (!ptr->is_deleted)
207 if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN_KEEPER, ptr))
208 list_del_rcu(&ptr->list);
214 struct tomoyo_alias_entry *ptr;
215 list_for_each_entry_rcu(ptr, &tomoyo_alias_list, list) {
216 if (!ptr->is_deleted)
218 if (tomoyo_add_to_gc(TOMOYO_ID_ALIAS, ptr))
219 list_del_rcu(&ptr->list);
225 struct tomoyo_policy_manager_entry *ptr;
226 list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list,
228 if (!ptr->is_deleted)
230 if (tomoyo_add_to_gc(TOMOYO_ID_MANAGER, ptr))
231 list_del_rcu(&ptr->list);
237 struct tomoyo_domain_info *domain;
238 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
239 struct tomoyo_acl_info *acl;
240 list_for_each_entry_rcu(acl, &domain->acl_info_list,
243 case TOMOYO_TYPE_PATH_ACL:
244 if (container_of(acl,
245 struct tomoyo_path_acl,
248 struct tomoyo_path_acl,
252 case TOMOYO_TYPE_PATH2_ACL:
253 if (container_of(acl,
254 struct tomoyo_path2_acl,
261 if (tomoyo_add_to_gc(TOMOYO_ID_ACL, acl))
262 list_del_rcu(&acl->list);
266 if (!domain->is_deleted || atomic_read(&domain->users))
269 * Nobody is referring this domain. But somebody may
270 * refer this domain after successful execve().
271 * We recheck domain->users after SRCU synchronization.
273 if (tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, domain))
274 list_del_rcu(&domain->list);
281 for (i = 0; i < TOMOYO_MAX_HASH; i++) {
282 struct tomoyo_name_entry *ptr;
283 list_for_each_entry_rcu(ptr, &tomoyo_name_list[i],
285 if (atomic_read(&ptr->users))
287 if (tomoyo_add_to_gc(TOMOYO_ID_NAME, ptr))
288 list_del_rcu(&ptr->list);
296 mutex_unlock(&tomoyo_policy_lock);
299 static void tomoyo_kfree_entry(void)
301 struct tomoyo_gc_entry *p;
302 struct tomoyo_gc_entry *tmp;
304 list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
306 case TOMOYO_ID_DOMAIN_INITIALIZER:
307 tomoyo_del_domain_initializer(p->element);
309 case TOMOYO_ID_DOMAIN_KEEPER:
310 tomoyo_del_domain_keeper(p->element);
312 case TOMOYO_ID_ALIAS:
313 tomoyo_del_alias(p->element);
315 case TOMOYO_ID_GLOBALLY_READABLE:
316 tomoyo_del_allow_read(p->element);
318 case TOMOYO_ID_PATTERN:
319 tomoyo_del_file_pattern(p->element);
321 case TOMOYO_ID_NO_REWRITE:
322 tomoyo_del_no_rewrite(p->element);
324 case TOMOYO_ID_MANAGER:
325 tomoyo_del_manager(p->element);
328 tomoyo_del_name(p->element);
331 tomoyo_del_acl(p->element);
333 case TOMOYO_ID_DOMAIN:
334 if (!tomoyo_del_domain(p->element))
338 printk(KERN_WARNING "Unknown type\n");
341 tomoyo_memory_free(p->element);
347 static int tomoyo_gc_thread(void *unused)
349 daemonize("GC for TOMOYO");
350 if (mutex_trylock(&tomoyo_gc_mutex)) {
352 for (i = 0; i < 10; i++) {
353 tomoyo_collect_entry();
354 if (list_empty(&tomoyo_gc_queue))
356 synchronize_srcu(&tomoyo_ss);
357 tomoyo_kfree_entry();
359 mutex_unlock(&tomoyo_gc_mutex);
364 void tomoyo_run_gc(void)
366 struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
369 wake_up_process(task);