2 * security/tomoyo/common.c
4 * Common functions for TOMOYO.
6 * Copyright (C) 2005-2009 NTT DATA CORPORATION
8 * Version: 2.2.0 2009/04/01
12 #include <linux/uaccess.h>
13 #include <linux/security.h>
14 #include <linux/hardirq.h>
19 /* Has loading policy done? */
20 bool tomoyo_policy_loaded;
22 /* String table for functionality that takes 4 modes. */
23 static const char *tomoyo_mode_4[4] = {
24 "disabled", "learning", "permissive", "enforcing"
26 /* String table for functionality that takes 2 modes. */
27 static const char *tomoyo_mode_2[4] = {
28 "disabled", "enabled", "enabled", "enabled"
31 /* Table for profile. */
34 unsigned int current_value;
35 const unsigned int max_value;
36 } tomoyo_control_array[TOMOYO_MAX_CONTROL_INDEX] = {
37 [TOMOYO_MAC_FOR_FILE] = { "MAC_FOR_FILE", 0, 3 },
38 [TOMOYO_MAX_ACCEPT_ENTRY] = { "MAX_ACCEPT_ENTRY", 2048, INT_MAX },
39 [TOMOYO_VERBOSE] = { "TOMOYO_VERBOSE", 1, 1 },
42 /* Profile table. Memory is allocated as needed. */
43 static struct tomoyo_profile {
44 unsigned int value[TOMOYO_MAX_CONTROL_INDEX];
45 const struct tomoyo_path_info *comment;
46 } *tomoyo_profile_ptr[TOMOYO_MAX_PROFILES];
48 /* Permit policy management by non-root user? */
49 static bool tomoyo_manage_by_non_root;
51 /* Utility functions. */
53 /* Open operation for /sys/kernel/security/tomoyo/ interface. */
54 static int tomoyo_open_control(const u8 type, struct file *file);
55 /* Close /sys/kernel/security/tomoyo/ interface. */
56 static int tomoyo_close_control(struct file *file);
57 /* Read operation for /sys/kernel/security/tomoyo/ interface. */
58 static int tomoyo_read_control(struct file *file, char __user *buffer,
59 const int buffer_len);
60 /* Write operation for /sys/kernel/security/tomoyo/ interface. */
61 static int tomoyo_write_control(struct file *file, const char __user *buffer,
62 const int buffer_len);
65 * tomoyo_is_byte_range - Check whether the string isa \ooo style octal value.
67 * @str: Pointer to the string.
69 * Returns true if @str is a \ooo style octal value, false otherwise.
71 * TOMOYO uses \ooo style representation for 0x01 - 0x20 and 0x7F - 0xFF.
72 * This function verifies that \ooo is in valid range.
74 static inline bool tomoyo_is_byte_range(const char *str)
76 return *str >= '0' && *str++ <= '3' &&
77 *str >= '0' && *str++ <= '7' &&
78 *str >= '0' && *str <= '7';
82 * tomoyo_is_alphabet_char - Check whether the character is an alphabet.
84 * @c: The character to check.
86 * Returns true if @c is an alphabet character, false otherwise.
88 static inline bool tomoyo_is_alphabet_char(const char c)
90 return (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z');
94 * tomoyo_make_byte - Make byte value from three octal characters.
96 * @c1: The first character.
97 * @c2: The second character.
98 * @c3: The third character.
100 * Returns byte value.
102 static inline u8 tomoyo_make_byte(const u8 c1, const u8 c2, const u8 c3)
104 return ((c1 - '0') << 6) + ((c2 - '0') << 3) + (c3 - '0');
108 * tomoyo_str_starts - Check whether the given string starts with the given keyword.
110 * @src: Pointer to pointer to the string.
111 * @find: Pointer to the keyword.
113 * Returns true if @src starts with @find, false otherwise.
115 * The @src is updated to point the first character after the @find
116 * if @src starts with @find.
118 static bool tomoyo_str_starts(char **src, const char *find)
120 const int len = strlen(find);
123 if (strncmp(tmp, find, len))
131 * tomoyo_normalize_line - Format string.
133 * @buffer: The line to normalize.
135 * Leading and trailing whitespaces are removed.
136 * Multiple whitespaces are packed into single space.
140 static void tomoyo_normalize_line(unsigned char *buffer)
142 unsigned char *sp = buffer;
143 unsigned char *dp = buffer;
146 while (tomoyo_is_invalid(*sp))
152 while (tomoyo_is_valid(*sp))
154 while (tomoyo_is_invalid(*sp))
161 * tomoyo_is_correct_path - Validate a pathname.
162 * @filename: The pathname to check.
163 * @start_type: Should the pathname start with '/'?
164 * 1 = must / -1 = must not / 0 = don't care
165 * @pattern_type: Can the pathname contain a wildcard?
166 * 1 = must / -1 = must not / 0 = don't care
167 * @end_type: Should the pathname end with '/'?
168 * 1 = must / -1 = must not / 0 = don't care
169 * @function: The name of function calling me.
171 * Check whether the given filename follows the naming rules.
172 * Returns true if @filename follows the naming rules, false otherwise.
174 bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
175 const s8 pattern_type, const s8 end_type,
176 const char *function)
178 bool contains_pattern = false;
182 const char *original_filename = filename;
187 if (start_type == 1) { /* Must start with '/' */
190 } else if (start_type == -1) { /* Must not start with '/' */
195 c = *(filename + strlen(filename) - 1);
196 if (end_type == 1) { /* Must end with '/' */
199 } else if (end_type == -1) { /* Must not end with '/' */
203 while ((c = *filename++) != '\0') {
205 switch ((c = *filename++)) {
206 case '\\': /* "\\" */
218 if (pattern_type == -1)
219 break; /* Must not contain pattern */
220 contains_pattern = true;
222 case '0': /* "\ooo" */
227 if (d < '0' || d > '7')
230 if (e < '0' || e > '7')
232 c = tomoyo_make_byte(c, d, e);
233 if (tomoyo_is_invalid(c))
234 continue; /* pattern is not \000 */
237 } else if (tomoyo_is_invalid(c)) {
241 if (pattern_type == 1) { /* Must contain pattern */
242 if (!contains_pattern)
247 printk(KERN_DEBUG "%s: Invalid pathname '%s'\n", function,
253 * tomoyo_is_correct_domain - Check whether the given domainname follows the naming rules.
254 * @domainname: The domainname to check.
255 * @function: The name of function calling me.
257 * Returns true if @domainname follows the naming rules, false otherwise.
259 bool tomoyo_is_correct_domain(const unsigned char *domainname,
260 const char *function)
265 const char *org_domainname = domainname;
267 if (!domainname || strncmp(domainname, TOMOYO_ROOT_NAME,
268 TOMOYO_ROOT_NAME_LEN))
270 domainname += TOMOYO_ROOT_NAME_LEN;
274 if (*domainname++ != ' ')
276 if (*domainname++ != '/')
278 while ((c = *domainname) != '\0' && c != ' ') {
283 case '\\': /* "\\" */
285 case '0': /* "\ooo" */
290 if (d < '0' || d > '7')
293 if (e < '0' || e > '7')
295 c = tomoyo_make_byte(c, d, e);
296 if (tomoyo_is_invalid(c))
297 /* pattern is not \000 */
301 } else if (tomoyo_is_invalid(c)) {
305 } while (*domainname);
308 printk(KERN_DEBUG "%s: Invalid domainname '%s'\n", function,
314 * tomoyo_is_domain_def - Check whether the given token can be a domainname.
316 * @buffer: The token to check.
318 * Returns true if @buffer possibly be a domainname, false otherwise.
320 bool tomoyo_is_domain_def(const unsigned char *buffer)
322 return !strncmp(buffer, TOMOYO_ROOT_NAME, TOMOYO_ROOT_NAME_LEN);
326 * tomoyo_find_domain - Find a domain by the given name.
328 * @domainname: The domainname to find.
330 * Caller must call down_read(&tomoyo_domain_list_lock); or
331 * down_write(&tomoyo_domain_list_lock); .
333 * Returns pointer to "struct tomoyo_domain_info" if found, NULL otherwise.
335 struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname)
337 struct tomoyo_domain_info *domain;
338 struct tomoyo_path_info name;
340 name.name = domainname;
341 tomoyo_fill_path_info(&name);
342 list_for_each_entry(domain, &tomoyo_domain_list, list) {
343 if (!domain->is_deleted &&
344 !tomoyo_pathcmp(&name, domain->domainname))
351 * tomoyo_path_depth - Evaluate the number of '/' in a string.
353 * @pathname: The string to evaluate.
355 * Returns path depth of the string.
357 * I score 2 for each of the '/' in the @pathname
358 * and score 1 if the @pathname ends with '/'.
360 static int tomoyo_path_depth(const char *pathname)
365 const char *ep = pathname + strlen(pathname);
366 if (pathname < ep--) {
369 while (pathname <= ep)
378 * tomoyo_const_part_length - Evaluate the initial length without a pattern in a token.
380 * @filename: The string to evaluate.
382 * Returns the initial length without a pattern in @filename.
384 static int tomoyo_const_part_length(const char *filename)
391 while ((c = *filename++) != '\0') {
398 case '\\': /* "\\" */
401 case '0': /* "\ooo" */
406 if (c < '0' || c > '7')
409 if (c < '0' || c > '7')
420 * tomoyo_fill_path_info - Fill in "struct tomoyo_path_info" members.
422 * @ptr: Pointer to "struct tomoyo_path_info" to fill in.
424 * The caller sets "struct tomoyo_path_info"->name.
426 void tomoyo_fill_path_info(struct tomoyo_path_info *ptr)
428 const char *name = ptr->name;
429 const int len = strlen(name);
431 ptr->const_len = tomoyo_const_part_length(name);
432 ptr->is_dir = len && (name[len - 1] == '/');
433 ptr->is_patterned = (ptr->const_len < len);
434 ptr->hash = full_name_hash(name, len);
435 ptr->depth = tomoyo_path_depth(name);
439 * tomoyo_file_matches_to_pattern2 - Pattern matching without '/' character
442 * @filename: The start of string to check.
443 * @filename_end: The end of string to check.
444 * @pattern: The start of pattern to compare.
445 * @pattern_end: The end of pattern to compare.
447 * Returns true if @filename matches @pattern, false otherwise.
449 static bool tomoyo_file_matches_to_pattern2(const char *filename,
450 const char *filename_end,
452 const char *pattern_end)
454 while (filename < filename_end && pattern < pattern_end) {
456 if (*pattern != '\\') {
457 if (*filename++ != *pattern++)
469 } else if (c == '\\') {
470 if (filename[1] == '\\')
472 else if (tomoyo_is_byte_range(filename + 1))
481 if (*++filename != '\\')
493 if (!tomoyo_is_alphabet_char(c))
500 if (c == '\\' && tomoyo_is_byte_range(filename + 1)
501 && strncmp(filename + 1, pattern, 3) == 0) {
506 return false; /* Not matched. */
509 for (i = 0; i <= filename_end - filename; i++) {
510 if (tomoyo_file_matches_to_pattern2(
511 filename + i, filename_end,
512 pattern + 1, pattern_end))
515 if (c == '.' && *pattern == '@')
519 if (filename[i + 1] == '\\')
521 else if (tomoyo_is_byte_range(filename + i + 1))
524 break; /* Bad pattern. */
526 return false; /* Not matched. */
531 while (isdigit(filename[j]))
533 } else if (c == 'X') {
534 while (isxdigit(filename[j]))
536 } else if (c == 'A') {
537 while (tomoyo_is_alphabet_char(filename[j]))
540 for (i = 1; i <= j; i++) {
541 if (tomoyo_file_matches_to_pattern2(
542 filename + i, filename_end,
543 pattern + 1, pattern_end))
546 return false; /* Not matched or bad pattern. */
551 while (*pattern == '\\' &&
552 (*(pattern + 1) == '*' || *(pattern + 1) == '@'))
554 return filename == filename_end && pattern == pattern_end;
558 * tomoyo_file_matches_to_pattern - Pattern matching without without '/' character.
560 * @filename: The start of string to check.
561 * @filename_end: The end of string to check.
562 * @pattern: The start of pattern to compare.
563 * @pattern_end: The end of pattern to compare.
565 * Returns true if @filename matches @pattern, false otherwise.
567 static bool tomoyo_file_matches_to_pattern(const char *filename,
568 const char *filename_end,
570 const char *pattern_end)
572 const char *pattern_start = pattern;
576 while (pattern < pattern_end - 1) {
577 /* Split at "\-" pattern. */
578 if (*pattern++ != '\\' || *pattern++ != '-')
580 result = tomoyo_file_matches_to_pattern2(filename,
589 pattern_start = pattern;
591 result = tomoyo_file_matches_to_pattern2(filename, filename_end,
592 pattern_start, pattern_end);
593 return first ? result : !result;
597 * tomoyo_path_matches_pattern - Check whether the given filename matches the given pattern.
598 * @filename: The filename to check.
599 * @pattern: The pattern to compare.
601 * Returns true if matches, false otherwise.
603 * The following patterns are available.
605 * \ooo Octal representation of a byte.
606 * \* More than or equals to 0 character other than '/'.
607 * \@ More than or equals to 0 character other than '/' or '.'.
608 * \? 1 byte character other than '/'.
609 * \$ More than or equals to 1 decimal digit.
610 * \+ 1 decimal digit.
611 * \X More than or equals to 1 hexadecimal digit.
612 * \x 1 hexadecimal digit.
613 * \A More than or equals to 1 alphabet character.
614 * \a 1 alphabet character.
615 * \- Subtraction operator.
617 bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
618 const struct tomoyo_path_info *pattern)
621 if (!filename || !pattern)
624 const char *f = filename->name;
625 const char *p = pattern->name;
626 const int len = pattern->const_len;
628 /* If @pattern doesn't contain pattern, I can use strcmp(). */
629 if (!pattern->is_patterned)
630 return !tomoyo_pathcmp(filename, pattern);
631 /* Dont compare if the number of '/' differs. */
632 if (filename->depth != pattern->depth)
634 /* Compare the initial length without patterns. */
635 if (strncmp(f, p, len))
639 /* Main loop. Compare each directory component. */
641 const char *f_delimiter = strchr(f, '/');
642 const char *p_delimiter = strchr(p, '/');
644 f_delimiter = f + strlen(f);
646 p_delimiter = p + strlen(p);
647 if (!tomoyo_file_matches_to_pattern(f, f_delimiter,
657 /* Ignore trailing "\*" and "\@" in @pattern. */
659 (*(p + 1) == '*' || *(p + 1) == '@'))
665 * tomoyo_io_printf - Transactional printf() to "struct tomoyo_io_buffer" structure.
667 * @head: Pointer to "struct tomoyo_io_buffer".
668 * @fmt: The printf()'s format string, followed by parameters.
670 * Returns true if output was written, false otherwise.
672 * The snprintf() will truncate, but tomoyo_io_printf() won't.
674 bool tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...)
678 int pos = head->read_avail;
679 int size = head->readbuf_size - pos;
684 len = vsnprintf(head->read_buf + pos, size, fmt, args);
686 if (pos + len >= head->readbuf_size)
688 head->read_avail += len;
693 * tomoyo_get_exe - Get tomoyo_realpath() of current process.
695 * Returns the tomoyo_realpath() of current process on success, NULL otherwise.
697 * This function uses tomoyo_alloc(), so the caller must call tomoyo_free()
698 * if this function didn't return NULL.
700 static const char *tomoyo_get_exe(void)
702 struct mm_struct *mm = current->mm;
703 struct vm_area_struct *vma;
704 const char *cp = NULL;
708 down_read(&mm->mmap_sem);
709 for (vma = mm->mmap; vma; vma = vma->vm_next) {
710 if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file) {
711 cp = tomoyo_realpath_from_path(&vma->vm_file->f_path);
715 up_read(&mm->mmap_sem);
720 * tomoyo_get_msg - Get warning message.
722 * @is_enforce: Is it enforcing mode?
724 * Returns "ERROR" or "WARNING".
726 const char *tomoyo_get_msg(const bool is_enforce)
735 * tomoyo_check_flags - Check mode for specified functionality.
737 * @domain: Pointer to "struct tomoyo_domain_info".
738 * @index: The functionality to check mode.
740 * TOMOYO checks only process context.
741 * This code disables TOMOYO's enforcement in case the function is called from
744 unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain,
747 const u8 profile = domain->profile;
749 if (WARN_ON(in_interrupt()))
751 return tomoyo_policy_loaded && index < TOMOYO_MAX_CONTROL_INDEX
752 #if TOMOYO_MAX_PROFILES != 256
753 && profile < TOMOYO_MAX_PROFILES
755 && tomoyo_profile_ptr[profile] ?
756 tomoyo_profile_ptr[profile]->value[index] : 0;
760 * tomoyo_verbose_mode - Check whether TOMOYO is verbose mode.
762 * @domain: Pointer to "struct tomoyo_domain_info".
764 * Returns true if domain policy violation warning should be printed to
767 bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain)
769 return tomoyo_check_flags(domain, TOMOYO_VERBOSE) != 0;
773 * tomoyo_domain_quota_is_ok - Check for domain's quota.
775 * @domain: Pointer to "struct tomoyo_domain_info".
777 * Returns true if the domain is not exceeded quota, false otherwise.
779 bool tomoyo_domain_quota_is_ok(struct tomoyo_domain_info * const domain)
781 unsigned int count = 0;
782 struct tomoyo_acl_info *ptr;
786 down_read(&tomoyo_domain_acl_info_list_lock);
787 list_for_each_entry(ptr, &domain->acl_info_list, list) {
788 if (ptr->type & TOMOYO_ACL_DELETED)
790 switch (tomoyo_acl_type2(ptr)) {
791 struct tomoyo_single_path_acl_record *acl1;
792 struct tomoyo_double_path_acl_record *acl2;
794 case TOMOYO_TYPE_SINGLE_PATH_ACL:
795 acl1 = container_of(ptr,
796 struct tomoyo_single_path_acl_record,
799 if (perm & (1 << TOMOYO_TYPE_EXECUTE_ACL))
802 ((1 << TOMOYO_TYPE_READ_ACL) |
803 (1 << TOMOYO_TYPE_WRITE_ACL)))
805 if (perm & (1 << TOMOYO_TYPE_CREATE_ACL))
807 if (perm & (1 << TOMOYO_TYPE_UNLINK_ACL))
809 if (perm & (1 << TOMOYO_TYPE_MKDIR_ACL))
811 if (perm & (1 << TOMOYO_TYPE_RMDIR_ACL))
813 if (perm & (1 << TOMOYO_TYPE_MKFIFO_ACL))
815 if (perm & (1 << TOMOYO_TYPE_MKSOCK_ACL))
817 if (perm & (1 << TOMOYO_TYPE_MKBLOCK_ACL))
819 if (perm & (1 << TOMOYO_TYPE_MKCHAR_ACL))
821 if (perm & (1 << TOMOYO_TYPE_TRUNCATE_ACL))
823 if (perm & (1 << TOMOYO_TYPE_SYMLINK_ACL))
825 if (perm & (1 << TOMOYO_TYPE_REWRITE_ACL))
828 case TOMOYO_TYPE_DOUBLE_PATH_ACL:
829 acl2 = container_of(ptr,
830 struct tomoyo_double_path_acl_record,
833 if (perm & (1 << TOMOYO_TYPE_LINK_ACL))
835 if (perm & (1 << TOMOYO_TYPE_RENAME_ACL))
840 up_read(&tomoyo_domain_acl_info_list_lock);
841 if (count < tomoyo_check_flags(domain, TOMOYO_MAX_ACCEPT_ENTRY))
843 if (!domain->quota_warned) {
844 domain->quota_warned = true;
845 printk(KERN_WARNING "TOMOYO-WARNING: "
846 "Domain '%s' has so many ACLs to hold. "
847 "Stopped learning mode.\n", domain->domainname->name);
853 * tomoyo_find_or_assign_new_profile - Create a new profile.
855 * @profile: Profile number to create.
857 * Returns pointer to "struct tomoyo_profile" on success, NULL otherwise.
859 static struct tomoyo_profile *tomoyo_find_or_assign_new_profile(const unsigned
862 static DEFINE_MUTEX(lock);
863 struct tomoyo_profile *ptr = NULL;
866 if (profile >= TOMOYO_MAX_PROFILES)
869 ptr = tomoyo_profile_ptr[profile];
872 ptr = tomoyo_alloc_element(sizeof(*ptr));
875 for (i = 0; i < TOMOYO_MAX_CONTROL_INDEX; i++)
876 ptr->value[i] = tomoyo_control_array[i].current_value;
877 mb(); /* Avoid out-of-order execution. */
878 tomoyo_profile_ptr[profile] = ptr;
885 * tomoyo_write_profile - Write to profile table.
887 * @head: Pointer to "struct tomoyo_io_buffer".
889 * Returns 0 on success, negative value otherwise.
891 static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
893 char *data = head->write_buf;
897 struct tomoyo_profile *profile;
900 cp = strchr(data, '-');
903 if (strict_strtoul(data, 10, &num))
907 profile = tomoyo_find_or_assign_new_profile(num);
910 cp = strchr(data, '=');
914 if (!strcmp(data, "COMMENT")) {
915 profile->comment = tomoyo_save_name(cp + 1);
918 for (i = 0; i < TOMOYO_MAX_CONTROL_INDEX; i++) {
919 if (strcmp(data, tomoyo_control_array[i].keyword))
921 if (sscanf(cp + 1, "%u", &value) != 1) {
926 modes = tomoyo_mode_2;
929 modes = tomoyo_mode_4;
932 for (j = 0; j < 4; j++) {
933 if (strcmp(cp + 1, modes[j]))
940 } else if (value > tomoyo_control_array[i].max_value) {
941 value = tomoyo_control_array[i].max_value;
943 profile->value[i] = value;
950 * tomoyo_read_profile - Read from profile table.
952 * @head: Pointer to "struct tomoyo_io_buffer".
956 static int tomoyo_read_profile(struct tomoyo_io_buffer *head)
958 static const int total = TOMOYO_MAX_CONTROL_INDEX + 1;
963 for (step = head->read_step; step < TOMOYO_MAX_PROFILES * total;
965 const u8 index = step / total;
966 u8 type = step % total;
967 const struct tomoyo_profile *profile
968 = tomoyo_profile_ptr[index];
969 head->read_step = step;
972 if (!type) { /* Print profile' comment tag. */
973 if (!tomoyo_io_printf(head, "%u-COMMENT=%s\n",
974 index, profile->comment ?
975 profile->comment->name : ""))
980 if (type < TOMOYO_MAX_CONTROL_INDEX) {
981 const unsigned int value = profile->value[type];
982 const char **modes = NULL;
984 = tomoyo_control_array[type].keyword;
985 switch (tomoyo_control_array[type].max_value) {
987 modes = tomoyo_mode_4;
990 modes = tomoyo_mode_2;
994 if (!tomoyo_io_printf(head, "%u-%s=%s\n", index,
995 keyword, modes[value]))
998 if (!tomoyo_io_printf(head, "%u-%s=%u\n", index,
1004 if (step == TOMOYO_MAX_PROFILES * total)
1005 head->read_eof = true;
1009 /* Structure for policy manager. */
1010 struct tomoyo_policy_manager_entry {
1011 struct list_head list;
1012 /* A path to program or a domainname. */
1013 const struct tomoyo_path_info *manager;
1014 bool is_domain; /* True if manager is a domainname. */
1015 bool is_deleted; /* True if this entry is deleted. */
1018 /* The list for "struct tomoyo_policy_manager_entry". */
1019 static LIST_HEAD(tomoyo_policy_manager_list);
1020 static DECLARE_RWSEM(tomoyo_policy_manager_list_lock);
1023 * tomoyo_update_manager_entry - Add a manager entry.
1025 * @manager: The path to manager or the domainnamme.
1026 * @is_delete: True if it is a delete request.
1028 * Returns 0 on success, negative value otherwise.
1030 static int tomoyo_update_manager_entry(const char *manager,
1031 const bool is_delete)
1033 struct tomoyo_policy_manager_entry *new_entry;
1034 struct tomoyo_policy_manager_entry *ptr;
1035 const struct tomoyo_path_info *saved_manager;
1036 int error = -ENOMEM;
1037 bool is_domain = false;
1039 if (tomoyo_is_domain_def(manager)) {
1040 if (!tomoyo_is_correct_domain(manager, __func__))
1044 if (!tomoyo_is_correct_path(manager, 1, -1, -1, __func__))
1047 saved_manager = tomoyo_save_name(manager);
1050 down_write(&tomoyo_policy_manager_list_lock);
1051 list_for_each_entry(ptr, &tomoyo_policy_manager_list, list) {
1052 if (ptr->manager != saved_manager)
1054 ptr->is_deleted = is_delete;
1062 new_entry = tomoyo_alloc_element(sizeof(*new_entry));
1065 new_entry->manager = saved_manager;
1066 new_entry->is_domain = is_domain;
1067 list_add_tail(&new_entry->list, &tomoyo_policy_manager_list);
1070 up_write(&tomoyo_policy_manager_list_lock);
1075 * tomoyo_write_manager_policy - Write manager policy.
1077 * @head: Pointer to "struct tomoyo_io_buffer".
1079 * Returns 0 on success, negative value otherwise.
1081 static int tomoyo_write_manager_policy(struct tomoyo_io_buffer *head)
1083 char *data = head->write_buf;
1084 bool is_delete = tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE);
1086 if (!strcmp(data, "manage_by_non_root")) {
1087 tomoyo_manage_by_non_root = !is_delete;
1090 return tomoyo_update_manager_entry(data, is_delete);
1094 * tomoyo_read_manager_policy - Read manager policy.
1096 * @head: Pointer to "struct tomoyo_io_buffer".
1100 static int tomoyo_read_manager_policy(struct tomoyo_io_buffer *head)
1102 struct list_head *pos;
1107 down_read(&tomoyo_policy_manager_list_lock);
1108 list_for_each_cookie(pos, head->read_var2,
1109 &tomoyo_policy_manager_list) {
1110 struct tomoyo_policy_manager_entry *ptr;
1111 ptr = list_entry(pos, struct tomoyo_policy_manager_entry,
1113 if (ptr->is_deleted)
1115 done = tomoyo_io_printf(head, "%s\n", ptr->manager->name);
1119 up_read(&tomoyo_policy_manager_list_lock);
1120 head->read_eof = done;
1125 * tomoyo_is_policy_manager - Check whether the current process is a policy manager.
1127 * Returns true if the current process is permitted to modify policy
1128 * via /sys/kernel/security/tomoyo/ interface.
1130 static bool tomoyo_is_policy_manager(void)
1132 struct tomoyo_policy_manager_entry *ptr;
1134 const struct task_struct *task = current;
1135 const struct tomoyo_path_info *domainname = tomoyo_domain()->domainname;
1138 if (!tomoyo_policy_loaded)
1140 if (!tomoyo_manage_by_non_root && (task->cred->uid || task->cred->euid))
1142 down_read(&tomoyo_policy_manager_list_lock);
1143 list_for_each_entry(ptr, &tomoyo_policy_manager_list, list) {
1144 if (!ptr->is_deleted && ptr->is_domain
1145 && !tomoyo_pathcmp(domainname, ptr->manager)) {
1150 up_read(&tomoyo_policy_manager_list_lock);
1153 exe = tomoyo_get_exe();
1156 down_read(&tomoyo_policy_manager_list_lock);
1157 list_for_each_entry(ptr, &tomoyo_policy_manager_list, list) {
1158 if (!ptr->is_deleted && !ptr->is_domain
1159 && !strcmp(exe, ptr->manager->name)) {
1164 up_read(&tomoyo_policy_manager_list_lock);
1165 if (!found) { /* Reduce error messages. */
1166 static pid_t last_pid;
1167 const pid_t pid = current->pid;
1168 if (last_pid != pid) {
1169 printk(KERN_WARNING "%s ( %s ) is not permitted to "
1170 "update policies.\n", domainname->name, exe);
1179 * tomoyo_is_select_one - Parse select command.
1181 * @head: Pointer to "struct tomoyo_io_buffer".
1182 * @data: String to parse.
1184 * Returns true on success, false otherwise.
1186 static bool tomoyo_is_select_one(struct tomoyo_io_buffer *head,
1190 struct tomoyo_domain_info *domain = NULL;
1192 if (sscanf(data, "pid=%u", &pid) == 1) {
1193 struct task_struct *p;
1194 read_lock(&tasklist_lock);
1195 p = find_task_by_vpid(pid);
1197 domain = tomoyo_real_domain(p);
1198 read_unlock(&tasklist_lock);
1199 } else if (!strncmp(data, "domain=", 7)) {
1200 if (tomoyo_is_domain_def(data + 7)) {
1201 down_read(&tomoyo_domain_list_lock);
1202 domain = tomoyo_find_domain(data + 7);
1203 up_read(&tomoyo_domain_list_lock);
1207 head->write_var1 = domain;
1208 /* Accessing read_buf is safe because head->io_sem is held. */
1209 if (!head->read_buf)
1210 return true; /* Do nothing if open(O_WRONLY). */
1211 head->read_avail = 0;
1212 tomoyo_io_printf(head, "# select %s\n", data);
1213 head->read_single_domain = true;
1214 head->read_eof = !domain;
1216 struct tomoyo_domain_info *d;
1217 head->read_var1 = NULL;
1218 down_read(&tomoyo_domain_list_lock);
1219 list_for_each_entry(d, &tomoyo_domain_list, list) {
1222 head->read_var1 = &d->list;
1224 up_read(&tomoyo_domain_list_lock);
1225 head->read_var2 = NULL;
1227 head->read_step = 0;
1228 if (domain->is_deleted)
1229 tomoyo_io_printf(head, "# This is a deleted domain.\n");
1235 * tomoyo_write_domain_policy - Write domain policy.
1237 * @head: Pointer to "struct tomoyo_io_buffer".
1239 * Returns 0 on success, negative value otherwise.
1241 static int tomoyo_write_domain_policy(struct tomoyo_io_buffer *head)
1243 char *data = head->write_buf;
1244 struct tomoyo_domain_info *domain = head->write_var1;
1245 bool is_delete = false;
1246 bool is_select = false;
1247 unsigned int profile;
1249 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE))
1251 else if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_SELECT))
1253 if (is_select && tomoyo_is_select_one(head, data))
1255 /* Don't allow updating policies by non manager programs. */
1256 if (!tomoyo_is_policy_manager())
1258 if (tomoyo_is_domain_def(data)) {
1261 tomoyo_delete_domain(data);
1262 else if (is_select) {
1263 down_read(&tomoyo_domain_list_lock);
1264 domain = tomoyo_find_domain(data);
1265 up_read(&tomoyo_domain_list_lock);
1267 domain = tomoyo_find_or_assign_new_domain(data, 0);
1268 head->write_var1 = domain;
1274 if (sscanf(data, TOMOYO_KEYWORD_USE_PROFILE "%u", &profile) == 1
1275 && profile < TOMOYO_MAX_PROFILES) {
1276 if (tomoyo_profile_ptr[profile] || !tomoyo_policy_loaded)
1277 domain->profile = (u8) profile;
1280 if (!strcmp(data, TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ)) {
1281 tomoyo_set_domain_flag(domain, is_delete,
1282 TOMOYO_DOMAIN_FLAGS_IGNORE_GLOBAL_ALLOW_READ);
1285 return tomoyo_write_file_policy(data, domain, is_delete);
1289 * tomoyo_print_single_path_acl - Print a single path ACL entry.
1291 * @head: Pointer to "struct tomoyo_io_buffer".
1292 * @ptr: Pointer to "struct tomoyo_single_path_acl_record".
1294 * Returns true on success, false otherwise.
1296 static bool tomoyo_print_single_path_acl(struct tomoyo_io_buffer *head,
1297 struct tomoyo_single_path_acl_record *
1302 const char *atmark = "";
1303 const char *filename;
1304 const u16 perm = ptr->perm;
1306 filename = ptr->filename->name;
1307 for (bit = head->read_bit; bit < TOMOYO_MAX_SINGLE_PATH_OPERATION;
1310 if (!(perm & (1 << bit)))
1312 /* Print "read/write" instead of "read" and "write". */
1313 if ((bit == TOMOYO_TYPE_READ_ACL ||
1314 bit == TOMOYO_TYPE_WRITE_ACL)
1315 && (perm & (1 << TOMOYO_TYPE_READ_WRITE_ACL)))
1317 msg = tomoyo_sp2keyword(bit);
1318 pos = head->read_avail;
1319 if (!tomoyo_io_printf(head, "allow_%s %s%s\n", msg,
1326 head->read_bit = bit;
1327 head->read_avail = pos;
1332 * tomoyo_print_double_path_acl - Print a double path ACL entry.
1334 * @head: Pointer to "struct tomoyo_io_buffer".
1335 * @ptr: Pointer to "struct tomoyo_double_path_acl_record".
1337 * Returns true on success, false otherwise.
1339 static bool tomoyo_print_double_path_acl(struct tomoyo_io_buffer *head,
1340 struct tomoyo_double_path_acl_record *
1344 const char *atmark1 = "";
1345 const char *atmark2 = "";
1346 const char *filename1;
1347 const char *filename2;
1348 const u8 perm = ptr->perm;
1351 filename1 = ptr->filename1->name;
1352 filename2 = ptr->filename2->name;
1353 for (bit = head->read_bit; bit < TOMOYO_MAX_DOUBLE_PATH_OPERATION;
1356 if (!(perm & (1 << bit)))
1358 msg = tomoyo_dp2keyword(bit);
1359 pos = head->read_avail;
1360 if (!tomoyo_io_printf(head, "allow_%s %s%s %s%s\n", msg,
1361 atmark1, filename1, atmark2, filename2))
1367 head->read_bit = bit;
1368 head->read_avail = pos;
1373 * tomoyo_print_entry - Print an ACL entry.
1375 * @head: Pointer to "struct tomoyo_io_buffer".
1376 * @ptr: Pointer to an ACL entry.
1378 * Returns true on success, false otherwise.
1380 static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1381 struct tomoyo_acl_info *ptr)
1383 const u8 acl_type = tomoyo_acl_type2(ptr);
1385 if (acl_type & TOMOYO_ACL_DELETED)
1387 if (acl_type == TOMOYO_TYPE_SINGLE_PATH_ACL) {
1388 struct tomoyo_single_path_acl_record *acl
1390 struct tomoyo_single_path_acl_record,
1392 return tomoyo_print_single_path_acl(head, acl);
1394 if (acl_type == TOMOYO_TYPE_DOUBLE_PATH_ACL) {
1395 struct tomoyo_double_path_acl_record *acl
1397 struct tomoyo_double_path_acl_record,
1399 return tomoyo_print_double_path_acl(head, acl);
1401 BUG(); /* This must not happen. */
1406 * tomoyo_read_domain_policy - Read domain policy.
1408 * @head: Pointer to "struct tomoyo_io_buffer".
1412 static int tomoyo_read_domain_policy(struct tomoyo_io_buffer *head)
1414 struct list_head *dpos;
1415 struct list_head *apos;
1420 if (head->read_step == 0)
1421 head->read_step = 1;
1422 down_read(&tomoyo_domain_list_lock);
1423 list_for_each_cookie(dpos, head->read_var1, &tomoyo_domain_list) {
1424 struct tomoyo_domain_info *domain;
1425 const char *quota_exceeded = "";
1426 const char *transition_failed = "";
1427 const char *ignore_global_allow_read = "";
1428 domain = list_entry(dpos, struct tomoyo_domain_info, list);
1429 if (head->read_step != 1)
1431 if (domain->is_deleted && !head->read_single_domain)
1433 /* Print domainname and flags. */
1434 if (domain->quota_warned)
1435 quota_exceeded = "quota_exceeded\n";
1436 if (domain->flags & TOMOYO_DOMAIN_FLAGS_TRANSITION_FAILED)
1437 transition_failed = "transition_failed\n";
1439 TOMOYO_DOMAIN_FLAGS_IGNORE_GLOBAL_ALLOW_READ)
1440 ignore_global_allow_read
1441 = TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "\n";
1442 done = tomoyo_io_printf(head, "%s\n" TOMOYO_KEYWORD_USE_PROFILE
1444 domain->domainname->name,
1445 domain->profile, quota_exceeded,
1447 ignore_global_allow_read);
1450 head->read_step = 2;
1452 if (head->read_step == 3)
1454 /* Print ACL entries in the domain. */
1455 down_read(&tomoyo_domain_acl_info_list_lock);
1456 list_for_each_cookie(apos, head->read_var2,
1457 &domain->acl_info_list) {
1458 struct tomoyo_acl_info *ptr
1459 = list_entry(apos, struct tomoyo_acl_info,
1461 done = tomoyo_print_entry(head, ptr);
1465 up_read(&tomoyo_domain_acl_info_list_lock);
1468 head->read_step = 3;
1470 done = tomoyo_io_printf(head, "\n");
1473 head->read_step = 1;
1474 if (head->read_single_domain)
1477 up_read(&tomoyo_domain_list_lock);
1478 head->read_eof = done;
1483 * tomoyo_write_domain_profile - Assign profile for specified domain.
1485 * @head: Pointer to "struct tomoyo_io_buffer".
1487 * Returns 0 on success, -EINVAL otherwise.
1489 * This is equivalent to doing
1491 * ( echo "select " $domainname; echo "use_profile " $profile ) |
1492 * /usr/lib/ccs/loadpolicy -d
1494 static int tomoyo_write_domain_profile(struct tomoyo_io_buffer *head)
1496 char *data = head->write_buf;
1497 char *cp = strchr(data, ' ');
1498 struct tomoyo_domain_info *domain;
1499 unsigned long profile;
1504 down_read(&tomoyo_domain_list_lock);
1505 domain = tomoyo_find_domain(cp + 1);
1506 up_read(&tomoyo_domain_list_lock);
1507 if (strict_strtoul(data, 10, &profile))
1509 if (domain && profile < TOMOYO_MAX_PROFILES
1510 && (tomoyo_profile_ptr[profile] || !tomoyo_policy_loaded))
1511 domain->profile = (u8) profile;
1516 * tomoyo_read_domain_profile - Read only domainname and profile.
1518 * @head: Pointer to "struct tomoyo_io_buffer".
1520 * Returns list of profile number and domainname pairs.
1522 * This is equivalent to doing
1524 * grep -A 1 '^<kernel>' /sys/kernel/security/tomoyo/domain_policy |
1525 * awk ' { if ( domainname == "" ) { if ( $1 == "<kernel>" )
1526 * domainname = $0; } else if ( $1 == "use_profile" ) {
1527 * print $2 " " domainname; domainname = ""; } } ; '
1529 static int tomoyo_read_domain_profile(struct tomoyo_io_buffer *head)
1531 struct list_head *pos;
1536 down_read(&tomoyo_domain_list_lock);
1537 list_for_each_cookie(pos, head->read_var1, &tomoyo_domain_list) {
1538 struct tomoyo_domain_info *domain;
1539 domain = list_entry(pos, struct tomoyo_domain_info, list);
1540 if (domain->is_deleted)
1542 done = tomoyo_io_printf(head, "%u %s\n", domain->profile,
1543 domain->domainname->name);
1547 up_read(&tomoyo_domain_list_lock);
1548 head->read_eof = done;
1553 * tomoyo_write_pid: Specify PID to obtain domainname.
1555 * @head: Pointer to "struct tomoyo_io_buffer".
1559 static int tomoyo_write_pid(struct tomoyo_io_buffer *head)
1562 /* No error check. */
1563 strict_strtoul(head->write_buf, 10, &pid);
1564 head->read_step = (int) pid;
1565 head->read_eof = false;
1570 * tomoyo_read_pid - Get domainname of the specified PID.
1572 * @head: Pointer to "struct tomoyo_io_buffer".
1574 * Returns the domainname which the specified PID is in on success,
1575 * empty string otherwise.
1576 * The PID is specified by tomoyo_write_pid() so that the user can obtain
1577 * using read()/write() interface rather than sysctl() interface.
1579 static int tomoyo_read_pid(struct tomoyo_io_buffer *head)
1581 if (head->read_avail == 0 && !head->read_eof) {
1582 const int pid = head->read_step;
1583 struct task_struct *p;
1584 struct tomoyo_domain_info *domain = NULL;
1585 read_lock(&tasklist_lock);
1586 p = find_task_by_vpid(pid);
1588 domain = tomoyo_real_domain(p);
1589 read_unlock(&tasklist_lock);
1591 tomoyo_io_printf(head, "%d %u %s", pid, domain->profile,
1592 domain->domainname->name);
1593 head->read_eof = true;
1599 * tomoyo_write_exception_policy - Write exception policy.
1601 * @head: Pointer to "struct tomoyo_io_buffer".
1603 * Returns 0 on success, negative value otherwise.
1605 static int tomoyo_write_exception_policy(struct tomoyo_io_buffer *head)
1607 char *data = head->write_buf;
1608 bool is_delete = tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE);
1610 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_KEEP_DOMAIN))
1611 return tomoyo_write_domain_keeper_policy(data, false,
1613 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NO_KEEP_DOMAIN))
1614 return tomoyo_write_domain_keeper_policy(data, true, is_delete);
1615 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_INITIALIZE_DOMAIN))
1616 return tomoyo_write_domain_initializer_policy(data, false,
1618 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NO_INITIALIZE_DOMAIN))
1619 return tomoyo_write_domain_initializer_policy(data, true,
1621 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALIAS))
1622 return tomoyo_write_alias_policy(data, is_delete);
1623 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALLOW_READ))
1624 return tomoyo_write_globally_readable_policy(data, is_delete);
1625 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_FILE_PATTERN))
1626 return tomoyo_write_pattern_policy(data, is_delete);
1627 if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_DENY_REWRITE))
1628 return tomoyo_write_no_rewrite_policy(data, is_delete);
1633 * tomoyo_read_exception_policy - Read exception policy.
1635 * @head: Pointer to "struct tomoyo_io_buffer".
1637 * Returns 0 on success, -EINVAL otherwise.
1639 static int tomoyo_read_exception_policy(struct tomoyo_io_buffer *head)
1641 if (!head->read_eof) {
1642 switch (head->read_step) {
1644 head->read_var2 = NULL;
1645 head->read_step = 1;
1647 if (!tomoyo_read_domain_keeper_policy(head))
1649 head->read_var2 = NULL;
1650 head->read_step = 2;
1652 if (!tomoyo_read_globally_readable_policy(head))
1654 head->read_var2 = NULL;
1655 head->read_step = 3;
1657 head->read_var2 = NULL;
1658 head->read_step = 4;
1660 if (!tomoyo_read_domain_initializer_policy(head))
1662 head->read_var2 = NULL;
1663 head->read_step = 5;
1665 if (!tomoyo_read_alias_policy(head))
1667 head->read_var2 = NULL;
1668 head->read_step = 6;
1670 head->read_var2 = NULL;
1671 head->read_step = 7;
1673 if (!tomoyo_read_file_pattern(head))
1675 head->read_var2 = NULL;
1676 head->read_step = 8;
1678 if (!tomoyo_read_no_rewrite_policy(head))
1680 head->read_var2 = NULL;
1681 head->read_step = 9;
1683 head->read_eof = true;
1692 /* path to policy loader */
1693 static const char *tomoyo_loader = "/sbin/tomoyo-init";
1696 * tomoyo_policy_loader_exists - Check whether /sbin/tomoyo-init exists.
1698 * Returns true if /sbin/tomoyo-init exists, false otherwise.
1700 static bool tomoyo_policy_loader_exists(void)
1703 * Don't activate MAC if the policy loader doesn't exist.
1704 * If the initrd includes /sbin/init but real-root-dev has not
1705 * mounted on / yet, activating MAC will block the system since
1706 * policies are not loaded yet.
1707 * Thus, let do_execve() call this function everytime.
1711 if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
1712 printk(KERN_INFO "Not activating Mandatory Access Control now "
1713 "since %s doesn't exist.\n", tomoyo_loader);
1721 * tomoyo_load_policy - Run external policy loader to load policy.
1723 * @filename: The program about to start.
1725 * This function checks whether @filename is /sbin/init , and if so
1726 * invoke /sbin/tomoyo-init and wait for the termination of /sbin/tomoyo-init
1727 * and then continues invocation of /sbin/init.
1728 * /sbin/tomoyo-init reads policy files in /etc/tomoyo/ directory and
1729 * writes to /sys/kernel/security/tomoyo/ interfaces.
1733 void tomoyo_load_policy(const char *filename)
1738 if (tomoyo_policy_loaded)
1741 * Check filename is /sbin/init or /sbin/tomoyo-start.
1742 * /sbin/tomoyo-start is a dummy filename in case where /sbin/init can't
1744 * You can create /sbin/tomoyo-start by
1745 * "ln -s /bin/true /sbin/tomoyo-start".
1747 if (strcmp(filename, "/sbin/init") &&
1748 strcmp(filename, "/sbin/tomoyo-start"))
1750 if (!tomoyo_policy_loader_exists())
1753 printk(KERN_INFO "Calling %s to load policy. Please wait.\n",
1755 argv[0] = (char *) tomoyo_loader;
1758 envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
1760 call_usermodehelper(argv[0], argv, envp, 1);
1762 printk(KERN_INFO "TOMOYO: 2.2.0 2009/04/01\n");
1763 printk(KERN_INFO "Mandatory Access Control activated.\n");
1764 tomoyo_policy_loaded = true;
1765 { /* Check all profiles currently assigned to domains are defined. */
1766 struct tomoyo_domain_info *domain;
1767 down_read(&tomoyo_domain_list_lock);
1768 list_for_each_entry(domain, &tomoyo_domain_list, list) {
1769 const u8 profile = domain->profile;
1770 if (tomoyo_profile_ptr[profile])
1772 panic("Profile %u (used by '%s') not defined.\n",
1773 profile, domain->domainname->name);
1775 up_read(&tomoyo_domain_list_lock);
1780 * tomoyo_read_version: Get version.
1782 * @head: Pointer to "struct tomoyo_io_buffer".
1784 * Returns version information.
1786 static int tomoyo_read_version(struct tomoyo_io_buffer *head)
1788 if (!head->read_eof) {
1789 tomoyo_io_printf(head, "2.2.0");
1790 head->read_eof = true;
1796 * tomoyo_read_self_domain - Get the current process's domainname.
1798 * @head: Pointer to "struct tomoyo_io_buffer".
1800 * Returns the current process's domainname.
1802 static int tomoyo_read_self_domain(struct tomoyo_io_buffer *head)
1804 if (!head->read_eof) {
1806 * tomoyo_domain()->domainname != NULL
1807 * because every process belongs to a domain and
1808 * the domain's name cannot be NULL.
1810 tomoyo_io_printf(head, "%s", tomoyo_domain()->domainname->name);
1811 head->read_eof = true;
1817 * tomoyo_open_control - open() for /sys/kernel/security/tomoyo/ interface.
1819 * @type: Type of interface.
1820 * @file: Pointer to "struct file".
1822 * Associates policy handler and returns 0 on success, -ENOMEM otherwise.
1824 static int tomoyo_open_control(const u8 type, struct file *file)
1826 struct tomoyo_io_buffer *head = tomoyo_alloc(sizeof(*head));
1830 mutex_init(&head->io_sem);
1832 case TOMOYO_DOMAINPOLICY:
1833 /* /sys/kernel/security/tomoyo/domain_policy */
1834 head->write = tomoyo_write_domain_policy;
1835 head->read = tomoyo_read_domain_policy;
1837 case TOMOYO_EXCEPTIONPOLICY:
1838 /* /sys/kernel/security/tomoyo/exception_policy */
1839 head->write = tomoyo_write_exception_policy;
1840 head->read = tomoyo_read_exception_policy;
1842 case TOMOYO_SELFDOMAIN:
1843 /* /sys/kernel/security/tomoyo/self_domain */
1844 head->read = tomoyo_read_self_domain;
1846 case TOMOYO_DOMAIN_STATUS:
1847 /* /sys/kernel/security/tomoyo/.domain_status */
1848 head->write = tomoyo_write_domain_profile;
1849 head->read = tomoyo_read_domain_profile;
1851 case TOMOYO_PROCESS_STATUS:
1852 /* /sys/kernel/security/tomoyo/.process_status */
1853 head->write = tomoyo_write_pid;
1854 head->read = tomoyo_read_pid;
1856 case TOMOYO_VERSION:
1857 /* /sys/kernel/security/tomoyo/version */
1858 head->read = tomoyo_read_version;
1859 head->readbuf_size = 128;
1861 case TOMOYO_MEMINFO:
1862 /* /sys/kernel/security/tomoyo/meminfo */
1863 head->write = tomoyo_write_memory_quota;
1864 head->read = tomoyo_read_memory_counter;
1865 head->readbuf_size = 512;
1867 case TOMOYO_PROFILE:
1868 /* /sys/kernel/security/tomoyo/profile */
1869 head->write = tomoyo_write_profile;
1870 head->read = tomoyo_read_profile;
1872 case TOMOYO_MANAGER:
1873 /* /sys/kernel/security/tomoyo/manager */
1874 head->write = tomoyo_write_manager_policy;
1875 head->read = tomoyo_read_manager_policy;
1878 if (!(file->f_mode & FMODE_READ)) {
1880 * No need to allocate read_buf since it is not opened
1885 if (!head->readbuf_size)
1886 head->readbuf_size = 4096 * 2;
1887 head->read_buf = tomoyo_alloc(head->readbuf_size);
1888 if (!head->read_buf) {
1893 if (!(file->f_mode & FMODE_WRITE)) {
1895 * No need to allocate write_buf since it is not opened
1899 } else if (head->write) {
1900 head->writebuf_size = 4096 * 2;
1901 head->write_buf = tomoyo_alloc(head->writebuf_size);
1902 if (!head->write_buf) {
1903 tomoyo_free(head->read_buf);
1908 file->private_data = head;
1910 * Call the handler now if the file is
1911 * /sys/kernel/security/tomoyo/self_domain
1912 * so that the user can use
1913 * cat < /sys/kernel/security/tomoyo/self_domain"
1914 * to know the current process's domainname.
1916 if (type == TOMOYO_SELFDOMAIN)
1917 tomoyo_read_control(file, NULL, 0);
1922 * tomoyo_read_control - read() for /sys/kernel/security/tomoyo/ interface.
1924 * @file: Pointer to "struct file".
1925 * @buffer: Poiner to buffer to write to.
1926 * @buffer_len: Size of @buffer.
1928 * Returns bytes read on success, negative value otherwise.
1930 static int tomoyo_read_control(struct file *file, char __user *buffer,
1931 const int buffer_len)
1934 struct tomoyo_io_buffer *head = file->private_data;
1939 if (mutex_lock_interruptible(&head->io_sem))
1941 /* Call the policy handler. */
1942 len = head->read(head);
1945 /* Write to buffer. */
1946 len = head->read_avail;
1947 if (len > buffer_len)
1951 /* head->read_buf changes by some functions. */
1952 cp = head->read_buf;
1953 if (copy_to_user(buffer, cp, len)) {
1957 head->read_avail -= len;
1958 memmove(cp, cp + len, head->read_avail);
1960 mutex_unlock(&head->io_sem);
1965 * tomoyo_write_control - write() for /sys/kernel/security/tomoyo/ interface.
1967 * @file: Pointer to "struct file".
1968 * @buffer: Pointer to buffer to read from.
1969 * @buffer_len: Size of @buffer.
1971 * Returns @buffer_len on success, negative value otherwise.
1973 static int tomoyo_write_control(struct file *file, const char __user *buffer,
1974 const int buffer_len)
1976 struct tomoyo_io_buffer *head = file->private_data;
1977 int error = buffer_len;
1978 int avail_len = buffer_len;
1979 char *cp0 = head->write_buf;
1983 if (!access_ok(VERIFY_READ, buffer, buffer_len))
1985 /* Don't allow updating policies by non manager programs. */
1986 if (head->write != tomoyo_write_pid &&
1987 head->write != tomoyo_write_domain_policy &&
1988 !tomoyo_is_policy_manager())
1990 if (mutex_lock_interruptible(&head->io_sem))
1992 /* Read a line and dispatch it to the policy handler. */
1993 while (avail_len > 0) {
1995 if (head->write_avail >= head->writebuf_size - 1) {
1998 } else if (get_user(c, buffer)) {
2004 cp0[head->write_avail++] = c;
2007 cp0[head->write_avail - 1] = '\0';
2008 head->write_avail = 0;
2009 tomoyo_normalize_line(cp0);
2012 mutex_unlock(&head->io_sem);
2017 * tomoyo_close_control - close() for /sys/kernel/security/tomoyo/ interface.
2019 * @file: Pointer to "struct file".
2021 * Releases memory and returns 0.
2023 static int tomoyo_close_control(struct file *file)
2025 struct tomoyo_io_buffer *head = file->private_data;
2027 /* Release memory used for policy I/O. */
2028 tomoyo_free(head->read_buf);
2029 head->read_buf = NULL;
2030 tomoyo_free(head->write_buf);
2031 head->write_buf = NULL;
2034 file->private_data = NULL;
2039 * tomoyo_alloc_acl_element - Allocate permanent memory for ACL entry.
2041 * @acl_type: Type of ACL entry.
2043 * Returns pointer to the ACL entry on success, NULL otherwise.
2045 void *tomoyo_alloc_acl_element(const u8 acl_type)
2048 struct tomoyo_acl_info *ptr;
2051 case TOMOYO_TYPE_SINGLE_PATH_ACL:
2052 len = sizeof(struct tomoyo_single_path_acl_record);
2054 case TOMOYO_TYPE_DOUBLE_PATH_ACL:
2055 len = sizeof(struct tomoyo_double_path_acl_record);
2060 ptr = tomoyo_alloc_element(len);
2063 ptr->type = acl_type;
2068 * tomoyo_open - open() for /sys/kernel/security/tomoyo/ interface.
2070 * @inode: Pointer to "struct inode".
2071 * @file: Pointer to "struct file".
2073 * Returns 0 on success, negative value otherwise.
2075 static int tomoyo_open(struct inode *inode, struct file *file)
2077 const int key = ((u8 *) file->f_path.dentry->d_inode->i_private)
2079 return tomoyo_open_control(key, file);
2083 * tomoyo_release - close() for /sys/kernel/security/tomoyo/ interface.
2085 * @inode: Pointer to "struct inode".
2086 * @file: Pointer to "struct file".
2088 * Returns 0 on success, negative value otherwise.
2090 static int tomoyo_release(struct inode *inode, struct file *file)
2092 return tomoyo_close_control(file);
2096 * tomoyo_read - read() for /sys/kernel/security/tomoyo/ interface.
2098 * @file: Pointer to "struct file".
2099 * @buf: Pointer to buffer.
2100 * @count: Size of @buf.
2103 * Returns bytes read on success, negative value otherwise.
2105 static ssize_t tomoyo_read(struct file *file, char __user *buf, size_t count,
2108 return tomoyo_read_control(file, buf, count);
2112 * tomoyo_write - write() for /sys/kernel/security/tomoyo/ interface.
2114 * @file: Pointer to "struct file".
2115 * @buf: Pointer to buffer.
2116 * @count: Size of @buf.
2119 * Returns @count on success, negative value otherwise.
2121 static ssize_t tomoyo_write(struct file *file, const char __user *buf,
2122 size_t count, loff_t *ppos)
2124 return tomoyo_write_control(file, buf, count);
2127 /* Operations for /sys/kernel/security/tomoyo/ interface. */
2128 static const struct file_operations tomoyo_operations = {
2129 .open = tomoyo_open,
2130 .release = tomoyo_release,
2131 .read = tomoyo_read,
2132 .write = tomoyo_write,
2136 * tomoyo_create_entry - Create interface files under /sys/kernel/security/tomoyo/ directory.
2138 * @name: The name of the interface file.
2139 * @mode: The permission of the interface file.
2140 * @parent: The parent directory.
2141 * @key: Type of interface.
2145 static void __init tomoyo_create_entry(const char *name, const mode_t mode,
2146 struct dentry *parent, const u8 key)
2148 securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key,
2149 &tomoyo_operations);
2153 * tomoyo_initerface_init - Initialize /sys/kernel/security/tomoyo/ interface.
2157 static int __init tomoyo_initerface_init(void)
2159 struct dentry *tomoyo_dir;
2161 /* Don't create securityfs entries unless registered. */
2162 if (current_cred()->security != &tomoyo_kernel_domain)
2165 tomoyo_dir = securityfs_create_dir("tomoyo", NULL);
2166 tomoyo_create_entry("domain_policy", 0600, tomoyo_dir,
2167 TOMOYO_DOMAINPOLICY);
2168 tomoyo_create_entry("exception_policy", 0600, tomoyo_dir,
2169 TOMOYO_EXCEPTIONPOLICY);
2170 tomoyo_create_entry("self_domain", 0400, tomoyo_dir,
2172 tomoyo_create_entry(".domain_status", 0600, tomoyo_dir,
2173 TOMOYO_DOMAIN_STATUS);
2174 tomoyo_create_entry(".process_status", 0600, tomoyo_dir,
2175 TOMOYO_PROCESS_STATUS);
2176 tomoyo_create_entry("meminfo", 0600, tomoyo_dir,
2178 tomoyo_create_entry("profile", 0600, tomoyo_dir,
2180 tomoyo_create_entry("manager", 0600, tomoyo_dir,
2182 tomoyo_create_entry("version", 0400, tomoyo_dir,
2187 fs_initcall(tomoyo_initerface_init);