SAFE public projects git trees. - safe/jmp/linux-2.6/blob - security/tomoyo/domain.c

   1 /*
   2  * security/tomoyo/domain.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   7  *
   8  * Version: 2.2.0   2009/04/01
   9  *
  10  */
  11
  12 #include "common.h"
  13 #include "tomoyo.h"
  14 #include "realpath.h"
  15 #include <linux/binfmts.h>
  16
  17 /* Variables definitions.*/
  18
  19 /* The initial domain. */
  20 struct tomoyo_domain_info tomoyo_kernel_domain;
  21
  22 /* The list for "struct tomoyo_domain_info". */
  23 LIST_HEAD(tomoyo_domain_list);
  24 DECLARE_RWSEM(tomoyo_domain_list_lock);
  25
  26 /* Structure for "initialize_domain" and "no_initialize_domain" keyword. */
  27 struct tomoyo_domain_initializer_entry {
  28         struct list_head list;
  29         const struct tomoyo_path_info *domainname;    /* This may be NULL */
  30         const struct tomoyo_path_info *program;
  31         bool is_deleted;
  32         bool is_not;       /* True if this entry is "no_initialize_domain".  */
  33         /* True if the domainname is tomoyo_get_last_name(). */
  34         bool is_last_name;
  35 };
  36
  37 /* Structure for "keep_domain" and "no_keep_domain" keyword. */
  38 struct tomoyo_domain_keeper_entry {
  39         struct list_head list;
  40         const struct tomoyo_path_info *domainname;
  41         const struct tomoyo_path_info *program;       /* This may be NULL */
  42         bool is_deleted;
  43         bool is_not;       /* True if this entry is "no_keep_domain".        */
  44         /* True if the domainname is tomoyo_get_last_name(). */
  45         bool is_last_name;
  46 };
  47
  48 /* Structure for "alias" keyword. */
  49 struct tomoyo_alias_entry {
  50         struct list_head list;
  51         const struct tomoyo_path_info *original_name;
  52         const struct tomoyo_path_info *aliased_name;
  53         bool is_deleted;
  54 };
  55
  56 /**
  57  * tomoyo_set_domain_flag - Set or clear domain's attribute flags.
  58  *
  59  * @domain:    Pointer to "struct tomoyo_domain_info".
  60  * @is_delete: True if it is a delete request.
  61  * @flags:     Flags to set or clear.
  62  *
  63  * Returns nothing.
  64  */
  65 void tomoyo_set_domain_flag(struct tomoyo_domain_info *domain,
  66                             const bool is_delete, const u8 flags)
  67 {
  68         /* We need to serialize because this is bitfield operation. */
  69         static DEFINE_SPINLOCK(lock);
  70         spin_lock(&lock);
  71         if (!is_delete)
  72                 domain->flags |= flags;
  73         else
  74                 domain->flags &= ~flags;
  75         spin_unlock(&lock);
  76 }
  77
  78 /**
  79  * tomoyo_get_last_name - Get last component of a domainname.
  80  *
  81  * @domain: Pointer to "struct tomoyo_domain_info".
  82  *
  83  * Returns the last component of the domainname.
  84  */
  85 const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain)
  86 {
  87         const char *cp0 = domain->domainname->name;
  88         const char *cp1 = strrchr(cp0, ' ');
  89
  90         if (cp1)
  91                 return cp1 + 1;
  92         return cp0;
  93 }
  94
  95 /* The list for "struct tomoyo_domain_initializer_entry". */
  96 static LIST_HEAD(tomoyo_domain_initializer_list);
  97 static DECLARE_RWSEM(tomoyo_domain_initializer_list_lock);
  98
  99 /**
 100  * tomoyo_update_domain_initializer_entry - Update "struct tomoyo_domain_initializer_entry" list.
 101  *
 102  * @domainname: The name of domain. May be NULL.
 103  * @program:    The name of program.
 104  * @is_not:     True if it is "no_initialize_domain" entry.
 105  * @is_delete:  True if it is a delete request.
 106  *
 107  * Returns 0 on success, negative value otherwise.
 108  */
 109 static int tomoyo_update_domain_initializer_entry(const char *domainname,
 110                                                   const char *program,
 111                                                   const bool is_not,
 112                                                   const bool is_delete)
 113 {
 114         struct tomoyo_domain_initializer_entry *new_entry;
 115         struct tomoyo_domain_initializer_entry *ptr;
 116         const struct tomoyo_path_info *saved_program;
 117         const struct tomoyo_path_info *saved_domainname = NULL;
 118         int error = -ENOMEM;
 119         bool is_last_name = false;
 120
 121         if (!tomoyo_is_correct_path(program, 1, -1, -1, __func__))
 122                 return -EINVAL; /* No patterns allowed. */
 123         if (domainname) {
 124                 if (!tomoyo_is_domain_def(domainname) &&
 125                     tomoyo_is_correct_path(domainname, 1, -1, -1, __func__))
 126                         is_last_name = true;
 127                 else if (!tomoyo_is_correct_domain(domainname, __func__))
 128                         return -EINVAL;
 129                 saved_domainname = tomoyo_save_name(domainname);
 130                 if (!saved_domainname)
 131                         return -ENOMEM;
 132         }
 133         saved_program = tomoyo_save_name(program);
 134         if (!saved_program)
 135                 return -ENOMEM;
 136         down_write(&tomoyo_domain_initializer_list_lock);
 137         list_for_each_entry(ptr, &tomoyo_domain_initializer_list, list) {
 138                 if (ptr->is_not != is_not ||
 139                     ptr->domainname != saved_domainname ||
 140                     ptr->program != saved_program)
 141                         continue;
 142                 ptr->is_deleted = is_delete;
 143                 error = 0;
 144                 goto out;
 145         }
 146         if (is_delete) {
 147                 error = -ENOENT;
 148                 goto out;
 149         }
 150         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 151         if (!new_entry)
 152                 goto out;
 153         new_entry->domainname = saved_domainname;
 154         new_entry->program = saved_program;
 155         new_entry->is_not = is_not;
 156         new_entry->is_last_name = is_last_name;
 157         list_add_tail(&new_entry->list, &tomoyo_domain_initializer_list);
 158         error = 0;
 159  out:
 160         up_write(&tomoyo_domain_initializer_list_lock);
 161         return error;
 162 }
 163
 164 /**
 165  * tomoyo_read_domain_initializer_policy - Read "struct tomoyo_domain_initializer_entry" list.
 166  *
 167  * @head: Pointer to "struct tomoyo_io_buffer".
 168  *
 169  * Returns true on success, false otherwise.
 170  */
 171 bool tomoyo_read_domain_initializer_policy(struct tomoyo_io_buffer *head)
 172 {
 173         struct list_head *pos;
 174         bool done = true;
 175
 176         down_read(&tomoyo_domain_initializer_list_lock);
 177         list_for_each_cookie(pos, head->read_var2,
 178                              &tomoyo_domain_initializer_list) {
 179                 const char *no;
 180                 const char *from = "";
 181                 const char *domain = "";
 182                 struct tomoyo_domain_initializer_entry *ptr;
 183                 ptr = list_entry(pos, struct tomoyo_domain_initializer_entry,
 184                                   list);
 185                 if (ptr->is_deleted)
 186                         continue;
 187                 no = ptr->is_not ? "no_" : "";
 188                 if (ptr->domainname) {
 189                         from = " from ";
 190                         domain = ptr->domainname->name;
 191                 }
 192                 if (!tomoyo_io_printf(head,
 193                                       "%s" TOMOYO_KEYWORD_INITIALIZE_DOMAIN
 194                                       "%s%s%s\n", no, ptr->program->name, from,
 195                                       domain)) {
 196                         done = false;
 197                         break;
 198                 }
 199         }
 200         up_read(&tomoyo_domain_initializer_list_lock);
 201         return done;
 202 }
 203
 204 /**
 205  * tomoyo_write_domain_initializer_policy - Write "struct tomoyo_domain_initializer_entry" list.
 206  *
 207  * @data:      String to parse.
 208  * @is_not:    True if it is "no_initialize_domain" entry.
 209  * @is_delete: True if it is a delete request.
 210  *
 211  * Returns 0 on success, negative value otherwise.
 212  */
 213 int tomoyo_write_domain_initializer_policy(char *data, const bool is_not,
 214                                            const bool is_delete)
 215 {
 216         char *cp = strstr(data, " from ");
 217
 218         if (cp) {
 219                 *cp = '\0';
 220                 return tomoyo_update_domain_initializer_entry(cp + 6, data,
 221                                                               is_not,
 222                                                               is_delete);
 223         }
 224         return tomoyo_update_domain_initializer_entry(NULL, data, is_not,
 225                                                       is_delete);
 226 }
 227
 228 /**
 229  * tomoyo_is_domain_initializer - Check whether the given program causes domainname reinitialization.
 230  *
 231  * @domainname: The name of domain.
 232  * @program:    The name of program.
 233  * @last_name:  The last component of @domainname.
 234  *
 235  * Returns true if executing @program reinitializes domain transition,
 236  * false otherwise.
 237  */
 238 static bool tomoyo_is_domain_initializer(const struct tomoyo_path_info *
 239                                          domainname,
 240                                          const struct tomoyo_path_info *program,
 241                                          const struct tomoyo_path_info *
 242                                          last_name)
 243 {
 244         struct tomoyo_domain_initializer_entry *ptr;
 245         bool flag = false;
 246
 247         down_read(&tomoyo_domain_initializer_list_lock);
 248         list_for_each_entry(ptr,  &tomoyo_domain_initializer_list, list) {
 249                 if (ptr->is_deleted)
 250                         continue;
 251                 if (ptr->domainname) {
 252                         if (!ptr->is_last_name) {
 253                                 if (ptr->domainname != domainname)
 254                                         continue;
 255                         } else {
 256                                 if (tomoyo_pathcmp(ptr->domainname, last_name))
 257                                         continue;
 258                         }
 259                 }
 260                 if (tomoyo_pathcmp(ptr->program, program))
 261                         continue;
 262                 if (ptr->is_not) {
 263                         flag = false;
 264                         break;
 265                 }
 266                 flag = true;
 267         }
 268         up_read(&tomoyo_domain_initializer_list_lock);
 269         return flag;
 270 }
 271
 272 /* The list for "struct tomoyo_domain_keeper_entry". */
 273 static LIST_HEAD(tomoyo_domain_keeper_list);
 274 static DECLARE_RWSEM(tomoyo_domain_keeper_list_lock);
 275
 276 /**
 277  * tomoyo_update_domain_keeper_entry - Update "struct tomoyo_domain_keeper_entry" list.
 278  *
 279  * @domainname: The name of domain.
 280  * @program:    The name of program. May be NULL.
 281  * @is_not:     True if it is "no_keep_domain" entry.
 282  * @is_delete:  True if it is a delete request.
 283  *
 284  * Returns 0 on success, negative value otherwise.
 285  */
 286 static int tomoyo_update_domain_keeper_entry(const char *domainname,
 287                                              const char *program,
 288                                              const bool is_not,
 289                                              const bool is_delete)
 290 {
 291         struct tomoyo_domain_keeper_entry *new_entry;
 292         struct tomoyo_domain_keeper_entry *ptr;
 293         const struct tomoyo_path_info *saved_domainname;
 294         const struct tomoyo_path_info *saved_program = NULL;
 295         int error = -ENOMEM;
 296         bool is_last_name = false;
 297
 298         if (!tomoyo_is_domain_def(domainname) &&
 299             tomoyo_is_correct_path(domainname, 1, -1, -1, __func__))
 300                 is_last_name = true;
 301         else if (!tomoyo_is_correct_domain(domainname, __func__))
 302                 return -EINVAL;
 303         if (program) {
 304                 if (!tomoyo_is_correct_path(program, 1, -1, -1, __func__))
 305                         return -EINVAL;
 306                 saved_program = tomoyo_save_name(program);
 307                 if (!saved_program)
 308                         return -ENOMEM;
 309         }
 310         saved_domainname = tomoyo_save_name(domainname);
 311         if (!saved_domainname)
 312                 return -ENOMEM;
 313         down_write(&tomoyo_domain_keeper_list_lock);
 314         list_for_each_entry(ptr, &tomoyo_domain_keeper_list, list) {
 315                 if (ptr->is_not != is_not ||
 316                     ptr->domainname != saved_domainname ||
 317                     ptr->program != saved_program)
 318                         continue;
 319                 ptr->is_deleted = is_delete;
 320                 error = 0;
 321                 goto out;
 322         }
 323         if (is_delete) {
 324                 error = -ENOENT;
 325                 goto out;
 326         }
 327         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 328         if (!new_entry)
 329                 goto out;
 330         new_entry->domainname = saved_domainname;
 331         new_entry->program = saved_program;
 332         new_entry->is_not = is_not;
 333         new_entry->is_last_name = is_last_name;
 334         list_add_tail(&new_entry->list, &tomoyo_domain_keeper_list);
 335         error = 0;
 336  out:
 337         up_write(&tomoyo_domain_keeper_list_lock);
 338         return error;
 339 }
 340
 341 /**
 342  * tomoyo_write_domain_keeper_policy - Write "struct tomoyo_domain_keeper_entry" list.
 343  *
 344  * @data:      String to parse.
 345  * @is_not:    True if it is "no_keep_domain" entry.
 346  * @is_delete: True if it is a delete request.
 347  *
 348  */
 349 int tomoyo_write_domain_keeper_policy(char *data, const bool is_not,
 350                                       const bool is_delete)
 351 {
 352         char *cp = strstr(data, " from ");
 353
 354         if (cp) {
 355                 *cp = '\0';
 356                 return tomoyo_update_domain_keeper_entry(cp + 6, data, is_not,
 357                                                          is_delete);
 358         }
 359         return tomoyo_update_domain_keeper_entry(data, NULL, is_not, is_delete);
 360 }
 361
 362 /**
 363  * tomoyo_read_domain_keeper_policy - Read "struct tomoyo_domain_keeper_entry" list.
 364  *
 365  * @head: Pointer to "struct tomoyo_io_buffer".
 366  *
 367  * Returns true on success, false otherwise.
 368  */
 369 bool tomoyo_read_domain_keeper_policy(struct tomoyo_io_buffer *head)
 370 {
 371         struct list_head *pos;
 372         bool done = true;
 373
 374         down_read(&tomoyo_domain_keeper_list_lock);
 375         list_for_each_cookie(pos, head->read_var2,
 376                              &tomoyo_domain_keeper_list) {
 377                 struct tomoyo_domain_keeper_entry *ptr;
 378                 const char *no;
 379                 const char *from = "";
 380                 const char *program = "";
 381
 382                 ptr = list_entry(pos, struct tomoyo_domain_keeper_entry, list);
 383                 if (ptr->is_deleted)
 384                         continue;
 385                 no = ptr->is_not ? "no_" : "";
 386                 if (ptr->program) {
 387                         from = " from ";
 388                         program = ptr->program->name;
 389                 }
 390                 if (!tomoyo_io_printf(head,
 391                                       "%s" TOMOYO_KEYWORD_KEEP_DOMAIN
 392                                       "%s%s%s\n", no, program, from,
 393                                       ptr->domainname->name)) {
 394                         done = false;
 395                         break;
 396                 }
 397         }
 398         up_read(&tomoyo_domain_keeper_list_lock);
 399         return done;
 400 }
 401
 402 /**
 403  * tomoyo_is_domain_keeper - Check whether the given program causes domain transition suppression.
 404  *
 405  * @domainname: The name of domain.
 406  * @program:    The name of program.
 407  * @last_name:  The last component of @domainname.
 408  *
 409  * Returns true if executing @program supresses domain transition,
 410  * false otherwise.
 411  */
 412 static bool tomoyo_is_domain_keeper(const struct tomoyo_path_info *domainname,
 413                                     const struct tomoyo_path_info *program,
 414                                     const struct tomoyo_path_info *last_name)
 415 {
 416         struct tomoyo_domain_keeper_entry *ptr;
 417         bool flag = false;
 418
 419         down_read(&tomoyo_domain_keeper_list_lock);
 420         list_for_each_entry(ptr, &tomoyo_domain_keeper_list, list) {
 421                 if (ptr->is_deleted)
 422                         continue;
 423                 if (!ptr->is_last_name) {
 424                         if (ptr->domainname != domainname)
 425                                 continue;
 426                 } else {
 427                         if (tomoyo_pathcmp(ptr->domainname, last_name))
 428                                 continue;
 429                 }
 430                 if (ptr->program && tomoyo_pathcmp(ptr->program, program))
 431                         continue;
 432                 if (ptr->is_not) {
 433                         flag = false;
 434                         break;
 435                 }
 436                 flag = true;
 437         }
 438         up_read(&tomoyo_domain_keeper_list_lock);
 439         return flag;
 440 }
 441
 442 /* The list for "struct tomoyo_alias_entry". */
 443 static LIST_HEAD(tomoyo_alias_list);
 444 static DECLARE_RWSEM(tomoyo_alias_list_lock);
 445
 446 /**
 447  * tomoyo_update_alias_entry - Update "struct tomoyo_alias_entry" list.
 448  *
 449  * @original_name: The original program's real name.
 450  * @aliased_name:  The symbolic program's symbolic link's name.
 451  * @is_delete:     True if it is a delete request.
 452  *
 453  * Returns 0 on success, negative value otherwise.
 454  */
 455 static int tomoyo_update_alias_entry(const char *original_name,
 456                                      const char *aliased_name,
 457                                      const bool is_delete)
 458 {
 459         struct tomoyo_alias_entry *new_entry;
 460         struct tomoyo_alias_entry *ptr;
 461         const struct tomoyo_path_info *saved_original_name;
 462         const struct tomoyo_path_info *saved_aliased_name;
 463         int error = -ENOMEM;
 464
 465         if (!tomoyo_is_correct_path(original_name, 1, -1, -1, __func__) ||
 466             !tomoyo_is_correct_path(aliased_name, 1, -1, -1, __func__))
 467                 return -EINVAL; /* No patterns allowed. */
 468         saved_original_name = tomoyo_save_name(original_name);
 469         saved_aliased_name = tomoyo_save_name(aliased_name);
 470         if (!saved_original_name || !saved_aliased_name)
 471                 return -ENOMEM;
 472         down_write(&tomoyo_alias_list_lock);
 473         list_for_each_entry(ptr, &tomoyo_alias_list, list) {
 474                 if (ptr->original_name != saved_original_name ||
 475                     ptr->aliased_name != saved_aliased_name)
 476                         continue;
 477                 ptr->is_deleted = is_delete;
 478                 error = 0;
 479                 goto out;
 480         }
 481         if (is_delete) {
 482                 error = -ENOENT;
 483                 goto out;
 484         }
 485         new_entry = tomoyo_alloc_element(sizeof(*new_entry));
 486         if (!new_entry)
 487                 goto out;
 488         new_entry->original_name = saved_original_name;
 489         new_entry->aliased_name = saved_aliased_name;
 490         list_add_tail(&new_entry->list, &tomoyo_alias_list);
 491         error = 0;
 492  out:
 493         up_write(&tomoyo_alias_list_lock);
 494         return error;
 495 }
 496
 497 /**
 498  * tomoyo_read_alias_policy - Read "struct tomoyo_alias_entry" list.
 499  *
 500  * @head: Pointer to "struct tomoyo_io_buffer".
 501  *
 502  * Returns true on success, false otherwise.
 503  */
 504 bool tomoyo_read_alias_policy(struct tomoyo_io_buffer *head)
 505 {
 506         struct list_head *pos;
 507         bool done = true;
 508
 509         down_read(&tomoyo_alias_list_lock);
 510         list_for_each_cookie(pos, head->read_var2, &tomoyo_alias_list) {
 511                 struct tomoyo_alias_entry *ptr;
 512
 513                 ptr = list_entry(pos, struct tomoyo_alias_entry, list);
 514                 if (ptr->is_deleted)
 515                         continue;
 516                 if (!tomoyo_io_printf(head, TOMOYO_KEYWORD_ALIAS "%s %s\n",
 517                                       ptr->original_name->name,
 518                                       ptr->aliased_name->name)) {
 519                         done = false;
 520                         break;
 521                 }
 522         }
 523         up_read(&tomoyo_alias_list_lock);
 524         return done;
 525 }
 526
 527 /**
 528  * tomoyo_write_alias_policy - Write "struct tomoyo_alias_entry" list.
 529  *
 530  * @data:      String to parse.
 531  * @is_delete: True if it is a delete request.
 532  *
 533  * Returns 0 on success, negative value otherwise.
 534  */
 535 int tomoyo_write_alias_policy(char *data, const bool is_delete)
 536 {
 537         char *cp = strchr(data, ' ');
 538
 539         if (!cp)
 540                 return -EINVAL;
 541         *cp++ = '\0';
 542         return tomoyo_update_alias_entry(data, cp, is_delete);
 543 }
 544
 545 /* Domain create/delete handler. */
 546
 547 /**
 548  * tomoyo_delete_domain - Delete a domain.
 549  *
 550  * @domainname: The name of domain.
 551  *
 552  * Returns 0.
 553  */
 554 int tomoyo_delete_domain(char *domainname)
 555 {
 556         struct tomoyo_domain_info *domain;
 557         struct tomoyo_path_info name;
 558
 559         name.name = domainname;
 560         tomoyo_fill_path_info(&name);
 561         down_write(&tomoyo_domain_list_lock);
 562         /* Is there an active domain? */
 563         list_for_each_entry(domain, &tomoyo_domain_list, list) {
 564                 /* Never delete tomoyo_kernel_domain */
 565                 if (domain == &tomoyo_kernel_domain)
 566                         continue;
 567                 if (domain->is_deleted ||
 568                     tomoyo_pathcmp(domain->domainname, &name))
 569                         continue;
 570                 domain->is_deleted = true;
 571                 break;
 572         }
 573         up_write(&tomoyo_domain_list_lock);
 574         return 0;
 575 }
 576
 577 /**
 578  * tomoyo_find_or_assign_new_domain - Create a domain.
 579  *
 580  * @domainname: The name of domain.
 581  * @profile:    Profile number to assign if the domain was newly created.
 582  *
 583  * Returns pointer to "struct tomoyo_domain_info" on success, NULL otherwise.
 584  */
 585 struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char *
 586                                                             domainname,
 587                                                             const u8 profile)
 588 {
 589         struct tomoyo_domain_info *domain = NULL;
 590         const struct tomoyo_path_info *saved_domainname;
 591
 592         down_write(&tomoyo_domain_list_lock);
 593         domain = tomoyo_find_domain(domainname);
 594         if (domain)
 595                 goto out;
 596         if (!tomoyo_is_correct_domain(domainname, __func__))
 597                 goto out;
 598         saved_domainname = tomoyo_save_name(domainname);
 599         if (!saved_domainname)
 600                 goto out;
 601         /* Can I reuse memory of deleted domain? */
 602         list_for_each_entry(domain, &tomoyo_domain_list, list) {
 603                 struct task_struct *p;
 604                 struct tomoyo_acl_info *ptr;
 605                 bool flag;
 606                 if (!domain->is_deleted ||
 607                     domain->domainname != saved_domainname)
 608                         continue;
 609                 flag = false;
 610                 read_lock(&tasklist_lock);
 611                 for_each_process(p) {
 612                         if (tomoyo_real_domain(p) != domain)
 613                                 continue;
 614                         flag = true;
 615                         break;
 616                 }
 617                 read_unlock(&tasklist_lock);
 618                 if (flag)
 619                         continue;
 620                 list_for_each_entry(ptr, &domain->acl_info_list, list) {
 621                         ptr->type |= TOMOYO_ACL_DELETED;
 622                 }
 623                 tomoyo_set_domain_flag(domain, true, domain->flags);
 624                 domain->profile = profile;
 625                 domain->quota_warned = false;
 626                 mb(); /* Avoid out-of-order execution. */
 627                 domain->is_deleted = false;
 628                 goto out;
 629         }
 630         /* No memory reusable. Create using new memory. */
 631         domain = tomoyo_alloc_element(sizeof(*domain));
 632         if (domain) {
 633                 INIT_LIST_HEAD(&domain->acl_info_list);
 634                 domain->domainname = saved_domainname;
 635                 domain->profile = profile;
 636                 list_add_tail(&domain->list, &tomoyo_domain_list);
 637         }
 638  out:
 639         up_write(&tomoyo_domain_list_lock);
 640         return domain;
 641 }
 642
 643 /**
 644  * tomoyo_find_next_domain - Find a domain.
 645  *
 646  * @bprm:           Pointer to "struct linux_binprm".
 647  * @next_domain:    Pointer to pointer to "struct tomoyo_domain_info".
 648  *
 649  * Returns 0 on success, negative value otherwise.
 650  */
 651 int tomoyo_find_next_domain(struct linux_binprm *bprm,
 652                             struct tomoyo_domain_info **next_domain)
 653 {
 654         /*
 655          * This function assumes that the size of buffer returned by
 656          * tomoyo_realpath() = TOMOYO_MAX_PATHNAME_LEN.
 657          */
 658         struct tomoyo_page_buffer *tmp = tomoyo_alloc(sizeof(*tmp));
 659         struct tomoyo_domain_info *old_domain = tomoyo_domain();
 660         struct tomoyo_domain_info *domain = NULL;
 661         const char *old_domain_name = old_domain->domainname->name;
 662         const char *original_name = bprm->filename;
 663         char *new_domain_name = NULL;
 664         char *real_program_name = NULL;
 665         char *symlink_program_name = NULL;
 666         const u8 mode = tomoyo_check_flags(old_domain, TOMOYO_MAC_FOR_FILE);
 667         const bool is_enforce = (mode == 3);
 668         int retval = -ENOMEM;
 669         struct tomoyo_path_info r; /* real name */
 670         struct tomoyo_path_info s; /* symlink name */
 671         struct tomoyo_path_info l; /* last name */
 672         static bool initialized;
 673
 674         if (!tmp)
 675                 goto out;
 676
 677         if (!initialized) {
 678                 /*
 679                  * Built-in initializers. This is needed because policies are
 680                  * not loaded until starting /sbin/init.
 681                  */
 682                 tomoyo_update_domain_initializer_entry(NULL, "/sbin/hotplug",
 683                                                        false, false);
 684                 tomoyo_update_domain_initializer_entry(NULL, "/sbin/modprobe",
 685                                                        false, false);
 686                 initialized = true;
 687         }
 688
 689         /* Get tomoyo_realpath of program. */
 690         retval = -ENOENT;
 691         /* I hope tomoyo_realpath() won't fail with -ENOMEM. */
 692         real_program_name = tomoyo_realpath(original_name);
 693         if (!real_program_name)
 694                 goto out;
 695         /* Get tomoyo_realpath of symbolic link. */
 696         symlink_program_name = tomoyo_realpath_nofollow(original_name);
 697         if (!symlink_program_name)
 698                 goto out;
 699
 700         r.name = real_program_name;
 701         tomoyo_fill_path_info(&r);
 702         s.name = symlink_program_name;
 703         tomoyo_fill_path_info(&s);
 704         l.name = tomoyo_get_last_name(old_domain);
 705         tomoyo_fill_path_info(&l);
 706
 707         /* Check 'alias' directive. */
 708         if (tomoyo_pathcmp(&r, &s)) {
 709                 struct tomoyo_alias_entry *ptr;
 710                 /* Is this program allowed to be called via symbolic links? */
 711                 down_read(&tomoyo_alias_list_lock);
 712                 list_for_each_entry(ptr, &tomoyo_alias_list, list) {
 713                         if (ptr->is_deleted ||
 714                             tomoyo_pathcmp(&r, ptr->original_name) ||
 715                             tomoyo_pathcmp(&s, ptr->aliased_name))
 716                                 continue;
 717                         memset(real_program_name, 0, TOMOYO_MAX_PATHNAME_LEN);
 718                         strncpy(real_program_name, ptr->aliased_name->name,
 719                                 TOMOYO_MAX_PATHNAME_LEN - 1);
 720                         tomoyo_fill_path_info(&r);
 721                         break;
 722                 }
 723                 up_read(&tomoyo_alias_list_lock);
 724         }
 725
 726         /* Check execute permission. */
 727         retval = tomoyo_check_exec_perm(old_domain, &r, tmp);
 728         if (retval < 0)
 729                 goto out;
 730
 731         new_domain_name = tmp->buffer;
 732         if (tomoyo_is_domain_initializer(old_domain->domainname, &r, &l)) {
 733                 /* Transit to the child of tomoyo_kernel_domain domain. */
 734                 snprintf(new_domain_name, TOMOYO_MAX_PATHNAME_LEN + 1,
 735                          TOMOYO_ROOT_NAME " " "%s", real_program_name);
 736         } else if (old_domain == &tomoyo_kernel_domain &&
 737                    !tomoyo_policy_loaded) {
 738                 /*
 739                  * Needn't to transit from kernel domain before starting
 740                  * /sbin/init. But transit from kernel domain if executing
 741                  * initializers because they might start before /sbin/init.
 742                  */
 743                 domain = old_domain;
 744         } else if (tomoyo_is_domain_keeper(old_domain->domainname, &r, &l)) {
 745                 /* Keep current domain. */
 746                 domain = old_domain;
 747         } else {
 748                 /* Normal domain transition. */
 749                 snprintf(new_domain_name, TOMOYO_MAX_PATHNAME_LEN + 1,
 750                          "%s %s", old_domain_name, real_program_name);
 751         }
 752         if (domain || strlen(new_domain_name) >= TOMOYO_MAX_PATHNAME_LEN)
 753                 goto done;
 754         down_read(&tomoyo_domain_list_lock);
 755         domain = tomoyo_find_domain(new_domain_name);
 756         up_read(&tomoyo_domain_list_lock);
 757         if (domain)
 758                 goto done;
 759         if (is_enforce)
 760                 goto done;
 761         domain = tomoyo_find_or_assign_new_domain(new_domain_name,
 762                                                   old_domain->profile);
 763  done:
 764         if (domain)
 765                 goto out;
 766         printk(KERN_WARNING "TOMOYO-ERROR: Domain '%s' not defined.\n",
 767                new_domain_name);
 768         if (is_enforce)
 769                 retval = -EPERM;
 770         else
 771                 tomoyo_set_domain_flag(old_domain, false,
 772                                        TOMOYO_DOMAIN_FLAGS_TRANSITION_FAILED);
 773  out:
 774         tomoyo_free(real_program_name);
 775         tomoyo_free(symlink_program_name);
 776         *next_domain = domain ? domain : old_domain;
 777         tomoyo_free(tmp);
 778         return retval;
 779 }