19590837bSKentaro Takeda /* 29590837bSKentaro Takeda * security/tomoyo/common.h 39590837bSKentaro Takeda * 476bb0895STetsuo Handa * Header file for TOMOYO. 59590837bSKentaro Takeda * 676bb0895STetsuo Handa * Copyright (C) 2005-2010 NTT DATA CORPORATION 79590837bSKentaro Takeda */ 89590837bSKentaro Takeda 99590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 109590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda 129590837bSKentaro Takeda #include <linux/ctype.h> 139590837bSKentaro Takeda #include <linux/string.h> 149590837bSKentaro Takeda #include <linux/mm.h> 159590837bSKentaro Takeda #include <linux/file.h> 169590837bSKentaro Takeda #include <linux/kmod.h> 179590837bSKentaro Takeda #include <linux/fs.h> 189590837bSKentaro Takeda #include <linux/sched.h> 199590837bSKentaro Takeda #include <linux/namei.h> 209590837bSKentaro Takeda #include <linux/mount.h> 219590837bSKentaro Takeda #include <linux/list.h> 2276bb0895STetsuo Handa #include <linux/cred.h> 2317fcfbd9STetsuo Handa #include <linux/poll.h> 242066a361STetsuo Handa #include <linux/binfmts.h> 252066a361STetsuo Handa #include <linux/highmem.h> 26059d84dbSTetsuo Handa #include <linux/net.h> 27059d84dbSTetsuo Handa #include <linux/inet.h> 28059d84dbSTetsuo Handa #include <linux/in.h> 29059d84dbSTetsuo Handa #include <linux/in6.h> 30059d84dbSTetsuo Handa #include <linux/un.h> 31059d84dbSTetsuo Handa #include <net/sock.h> 32059d84dbSTetsuo Handa #include <net/af_unix.h> 33059d84dbSTetsuo Handa #include <net/ip.h> 34059d84dbSTetsuo Handa #include <net/ipv6.h> 35059d84dbSTetsuo Handa #include <net/udp.h> 369590837bSKentaro Takeda 3776bb0895STetsuo Handa /********** Constants definitions. **********/ 3876bb0895STetsuo Handa 3976bb0895STetsuo Handa /* 4076bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 4176bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 4276bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 4376bb0895STetsuo Handa */ 4476bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 4576bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 4676bb0895STetsuo Handa 47059d84dbSTetsuo Handa /* 48059d84dbSTetsuo Handa * TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET. 49059d84dbSTetsuo Handa * Therefore, we don't need SOCK_MAX. 50059d84dbSTetsuo Handa */ 51059d84dbSTetsuo Handa #define TOMOYO_SOCK_MAX 6 52059d84dbSTetsuo Handa 53c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 5476bb0895STetsuo Handa 5576bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 5676bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 5776bb0895STetsuo Handa 5832997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 5932997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 6032997144STetsuo Handa 612066a361STetsuo Handa /* Index numbers for "struct tomoyo_condition". */ 622066a361STetsuo Handa enum tomoyo_conditions_index { 632066a361STetsuo Handa TOMOYO_TASK_UID, /* current_uid() */ 642066a361STetsuo Handa TOMOYO_TASK_EUID, /* current_euid() */ 652066a361STetsuo Handa TOMOYO_TASK_SUID, /* current_suid() */ 662066a361STetsuo Handa TOMOYO_TASK_FSUID, /* current_fsuid() */ 672066a361STetsuo Handa TOMOYO_TASK_GID, /* current_gid() */ 682066a361STetsuo Handa TOMOYO_TASK_EGID, /* current_egid() */ 692066a361STetsuo Handa TOMOYO_TASK_SGID, /* current_sgid() */ 702066a361STetsuo Handa TOMOYO_TASK_FSGID, /* current_fsgid() */ 712066a361STetsuo Handa TOMOYO_TASK_PID, /* sys_getpid() */ 722066a361STetsuo Handa TOMOYO_TASK_PPID, /* sys_getppid() */ 735b636857STetsuo Handa TOMOYO_EXEC_ARGC, /* "struct linux_binprm *"->argc */ 745b636857STetsuo Handa TOMOYO_EXEC_ENVC, /* "struct linux_binprm *"->envc */ 758761afd4STetsuo Handa TOMOYO_TYPE_IS_SOCKET, /* S_IFSOCK */ 768761afd4STetsuo Handa TOMOYO_TYPE_IS_SYMLINK, /* S_IFLNK */ 778761afd4STetsuo Handa TOMOYO_TYPE_IS_FILE, /* S_IFREG */ 788761afd4STetsuo Handa TOMOYO_TYPE_IS_BLOCK_DEV, /* S_IFBLK */ 798761afd4STetsuo Handa TOMOYO_TYPE_IS_DIRECTORY, /* S_IFDIR */ 808761afd4STetsuo Handa TOMOYO_TYPE_IS_CHAR_DEV, /* S_IFCHR */ 818761afd4STetsuo Handa TOMOYO_TYPE_IS_FIFO, /* S_IFIFO */ 828761afd4STetsuo Handa TOMOYO_MODE_SETUID, /* S_ISUID */ 838761afd4STetsuo Handa TOMOYO_MODE_SETGID, /* S_ISGID */ 848761afd4STetsuo Handa TOMOYO_MODE_STICKY, /* S_ISVTX */ 858761afd4STetsuo Handa TOMOYO_MODE_OWNER_READ, /* S_IRUSR */ 868761afd4STetsuo Handa TOMOYO_MODE_OWNER_WRITE, /* S_IWUSR */ 878761afd4STetsuo Handa TOMOYO_MODE_OWNER_EXECUTE, /* S_IXUSR */ 888761afd4STetsuo Handa TOMOYO_MODE_GROUP_READ, /* S_IRGRP */ 898761afd4STetsuo Handa TOMOYO_MODE_GROUP_WRITE, /* S_IWGRP */ 908761afd4STetsuo Handa TOMOYO_MODE_GROUP_EXECUTE, /* S_IXGRP */ 918761afd4STetsuo Handa TOMOYO_MODE_OTHERS_READ, /* S_IROTH */ 928761afd4STetsuo Handa TOMOYO_MODE_OTHERS_WRITE, /* S_IWOTH */ 938761afd4STetsuo Handa TOMOYO_MODE_OTHERS_EXECUTE, /* S_IXOTH */ 942ca9bf45STetsuo Handa TOMOYO_EXEC_REALPATH, 952ca9bf45STetsuo Handa TOMOYO_SYMLINK_TARGET, 968761afd4STetsuo Handa TOMOYO_PATH1_UID, 978761afd4STetsuo Handa TOMOYO_PATH1_GID, 988761afd4STetsuo Handa TOMOYO_PATH1_INO, 998761afd4STetsuo Handa TOMOYO_PATH1_MAJOR, 1008761afd4STetsuo Handa TOMOYO_PATH1_MINOR, 1018761afd4STetsuo Handa TOMOYO_PATH1_PERM, 1028761afd4STetsuo Handa TOMOYO_PATH1_TYPE, 1038761afd4STetsuo Handa TOMOYO_PATH1_DEV_MAJOR, 1048761afd4STetsuo Handa TOMOYO_PATH1_DEV_MINOR, 1058761afd4STetsuo Handa TOMOYO_PATH2_UID, 1068761afd4STetsuo Handa TOMOYO_PATH2_GID, 1078761afd4STetsuo Handa TOMOYO_PATH2_INO, 1088761afd4STetsuo Handa TOMOYO_PATH2_MAJOR, 1098761afd4STetsuo Handa TOMOYO_PATH2_MINOR, 1108761afd4STetsuo Handa TOMOYO_PATH2_PERM, 1118761afd4STetsuo Handa TOMOYO_PATH2_TYPE, 1128761afd4STetsuo Handa TOMOYO_PATH2_DEV_MAJOR, 1138761afd4STetsuo Handa TOMOYO_PATH2_DEV_MINOR, 1148761afd4STetsuo Handa TOMOYO_PATH1_PARENT_UID, 1158761afd4STetsuo Handa TOMOYO_PATH1_PARENT_GID, 1168761afd4STetsuo Handa TOMOYO_PATH1_PARENT_INO, 1178761afd4STetsuo Handa TOMOYO_PATH1_PARENT_PERM, 1188761afd4STetsuo Handa TOMOYO_PATH2_PARENT_UID, 1198761afd4STetsuo Handa TOMOYO_PATH2_PARENT_GID, 1208761afd4STetsuo Handa TOMOYO_PATH2_PARENT_INO, 1218761afd4STetsuo Handa TOMOYO_PATH2_PARENT_PERM, 1222066a361STetsuo Handa TOMOYO_MAX_CONDITION_KEYWORD, 1232066a361STetsuo Handa TOMOYO_NUMBER_UNION, 1242ca9bf45STetsuo Handa TOMOYO_NAME_UNION, 1255b636857STetsuo Handa TOMOYO_ARGV_ENTRY, 1265b636857STetsuo Handa TOMOYO_ENVP_ENTRY, 1272066a361STetsuo Handa }; 1282066a361STetsuo Handa 1298761afd4STetsuo Handa 1308761afd4STetsuo Handa /* Index numbers for stat(). */ 1318761afd4STetsuo Handa enum tomoyo_path_stat_index { 1328761afd4STetsuo Handa /* Do not change this order. */ 1338761afd4STetsuo Handa TOMOYO_PATH1, 1348761afd4STetsuo Handa TOMOYO_PATH1_PARENT, 1358761afd4STetsuo Handa TOMOYO_PATH2, 1368761afd4STetsuo Handa TOMOYO_PATH2_PARENT, 1378761afd4STetsuo Handa TOMOYO_MAX_PATH_STAT 1388761afd4STetsuo Handa }; 1398761afd4STetsuo Handa 140b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 141cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 142cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 143cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 144cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 14557c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 146eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 147eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 148eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 149eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 150cb0abe6aSTetsuo Handa }; 151cb0abe6aSTetsuo Handa 152b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 153a230f9e7STetsuo Handa enum tomoyo_policy_id { 154a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 155059d84dbSTetsuo Handa TOMOYO_ID_ADDRESS_GROUP, 156a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 157a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 1585448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 159a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 160a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 1612066a361STetsuo Handa TOMOYO_ID_CONDITION, 162a230f9e7STetsuo Handa TOMOYO_ID_NAME, 163a230f9e7STetsuo Handa TOMOYO_ID_ACL, 164a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 165a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 166a230f9e7STetsuo Handa }; 167a230f9e7STetsuo Handa 1682c47ab93STetsuo Handa /* Index numbers for domain's attributes. */ 1692c47ab93STetsuo Handa enum tomoyo_domain_info_flags_index { 1702c47ab93STetsuo Handa /* Quota warnning flag. */ 1712c47ab93STetsuo Handa TOMOYO_DIF_QUOTA_WARNED, 1722c47ab93STetsuo Handa /* 1732c47ab93STetsuo Handa * This domain was unable to create a new domain at 1742c47ab93STetsuo Handa * tomoyo_find_next_domain() because the name of the domain to be 1752c47ab93STetsuo Handa * created was too long or it could not allocate memory. 1762c47ab93STetsuo Handa * More than one process continued execve() without domain transition. 1772c47ab93STetsuo Handa */ 1782c47ab93STetsuo Handa TOMOYO_DIF_TRANSITION_FAILED, 1792c47ab93STetsuo Handa TOMOYO_MAX_DOMAIN_INFO_FLAGS 1802c47ab93STetsuo Handa }; 1812c47ab93STetsuo Handa 1821f067a68STetsuo Handa /* Index numbers for audit type. */ 1831f067a68STetsuo Handa enum tomoyo_grant_log { 1841f067a68STetsuo Handa /* Follow profile's configuration. */ 1851f067a68STetsuo Handa TOMOYO_GRANTLOG_AUTO, 1861f067a68STetsuo Handa /* Do not generate grant log. */ 1871f067a68STetsuo Handa TOMOYO_GRANTLOG_NO, 1881f067a68STetsuo Handa /* Generate grant_log. */ 1891f067a68STetsuo Handa TOMOYO_GRANTLOG_YES, 1901f067a68STetsuo Handa }; 1911f067a68STetsuo Handa 192b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 193a230f9e7STetsuo Handa enum tomoyo_group_id { 194a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 195a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 196059d84dbSTetsuo Handa TOMOYO_ADDRESS_GROUP, 197a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 198a230f9e7STetsuo Handa }; 199a230f9e7STetsuo Handa 200b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 201b5bc60b4STetsuo Handa enum tomoyo_value_type { 202b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 203b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 204b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 205b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 206b5bc60b4STetsuo Handa }; 2074c3e9e2dSTetsuo Handa 208b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 2095448ec4fSTetsuo Handa enum tomoyo_transition_type { 2105448ec4fSTetsuo Handa /* Do not change this order, */ 211bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 212bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 2135448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 2145448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 2155448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 2165448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 2175448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 2185448ec4fSTetsuo Handa }; 2195448ec4fSTetsuo Handa 22076bb0895STetsuo Handa /* Index numbers for Access Controls. */ 221084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 2227ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 2237ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 224a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 22575093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 2262106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 227059d84dbSTetsuo Handa TOMOYO_TYPE_INET_ACL, 228059d84dbSTetsuo Handa TOMOYO_TYPE_UNIX_ACL, 229d58e0da8STetsuo Handa TOMOYO_TYPE_ENV_ACL, 230084da356STetsuo Handa }; 23176bb0895STetsuo Handa 232b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 233084da356STetsuo Handa enum tomoyo_path_acl_index { 2347ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 2357ef61233STetsuo Handa TOMOYO_TYPE_READ, 2367ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 2377c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 2387ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 2397c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 2407ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 2417ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 2427ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 2437ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 2447ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 2457ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 246084da356STetsuo Handa }; 24776bb0895STetsuo Handa 248b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 249eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 250eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 251eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 252eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 253eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 254eadd99ccSTetsuo Handa }; 255eadd99ccSTetsuo Handa 25675093152STetsuo Handa enum tomoyo_mkdev_acl_index { 257a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 258a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 25975093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 260a1f9bb6aSTetsuo Handa }; 261a1f9bb6aSTetsuo Handa 262059d84dbSTetsuo Handa /* Index numbers for socket operations. */ 263059d84dbSTetsuo Handa enum tomoyo_network_acl_index { 264059d84dbSTetsuo Handa TOMOYO_NETWORK_BIND, /* bind() operation. */ 265059d84dbSTetsuo Handa TOMOYO_NETWORK_LISTEN, /* listen() operation. */ 266059d84dbSTetsuo Handa TOMOYO_NETWORK_CONNECT, /* connect() operation. */ 267059d84dbSTetsuo Handa TOMOYO_NETWORK_SEND, /* send() operation. */ 268059d84dbSTetsuo Handa TOMOYO_MAX_NETWORK_OPERATION 269059d84dbSTetsuo Handa }; 270059d84dbSTetsuo Handa 271b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 272084da356STetsuo Handa enum tomoyo_path2_acl_index { 2737ef61233STetsuo Handa TOMOYO_TYPE_LINK, 2747ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 2757ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 2767ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 277084da356STetsuo Handa }; 27876bb0895STetsuo Handa 279b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 280a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 281a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 282a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 283a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 284a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 285a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 286a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 287a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 288a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 289a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 290a1f9bb6aSTetsuo Handa }; 291a1f9bb6aSTetsuo Handa 292b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 293084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 294084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 295084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 296084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 297b22b8b9fSTetsuo Handa TOMOYO_STAT, 298084da356STetsuo Handa TOMOYO_SELFDOMAIN, 299eadd99ccSTetsuo Handa TOMOYO_AUDIT, 300084da356STetsuo Handa TOMOYO_VERSION, 301084da356STetsuo Handa TOMOYO_PROFILE, 30217fcfbd9STetsuo Handa TOMOYO_QUERY, 303084da356STetsuo Handa TOMOYO_MANAGER 304084da356STetsuo Handa }; 30576bb0895STetsuo Handa 306b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 307b5bc60b4STetsuo Handa enum tomoyo_special_mount { 308b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 309b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 310b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 311b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 312b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 313b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 314b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 315b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 316b5bc60b4STetsuo Handa }; 317b5bc60b4STetsuo Handa 318b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 31957c2590fSTetsuo Handa enum tomoyo_mac_index { 32057c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 32157c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 32257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 32357c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 3247c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 32557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 32657c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 32757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 32857c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 32957c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 33057c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 33157c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 33257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 33357c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 33457c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 33557c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 33657c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 33757c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 33857c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 33957c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 34057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 34157c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 34257c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 343059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_BIND, 344059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN, 345059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT, 346059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_BIND, 347059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_SEND, 348059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_BIND, 349059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_SEND, 350059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND, 351059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN, 352059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT, 353059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND, 354059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND, 355059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND, 356059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN, 357059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT, 358d58e0da8STetsuo Handa TOMOYO_MAC_ENVIRON, 35957c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 36057c2590fSTetsuo Handa }; 36157c2590fSTetsuo Handa 362b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 36357c2590fSTetsuo Handa enum tomoyo_mac_category_index { 36457c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 365059d84dbSTetsuo Handa TOMOYO_MAC_CATEGORY_NETWORK, 366d58e0da8STetsuo Handa TOMOYO_MAC_CATEGORY_MISC, 36757c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 36857c2590fSTetsuo Handa }; 36957c2590fSTetsuo Handa 370b5bc60b4STetsuo Handa /* 371b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 372b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 373b5bc60b4STetsuo Handa * 374b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 375b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 376b5bc60b4STetsuo Handa */ 377b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 37817fcfbd9STetsuo Handa 379b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 380b22b8b9fSTetsuo Handa enum tomoyo_policy_stat_type { 381b22b8b9fSTetsuo Handa /* Do not change this order. */ 382b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_UPDATES, 383b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_LEARNING, /* == TOMOYO_CONFIG_LEARNING */ 384b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_PERMISSIVE, /* == TOMOYO_CONFIG_PERMISSIVE */ 385b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_ENFORCING, /* == TOMOYO_CONFIG_ENFORCING */ 386b22b8b9fSTetsuo Handa TOMOYO_MAX_POLICY_STAT 387b22b8b9fSTetsuo Handa }; 388b22b8b9fSTetsuo Handa 389d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 390d5ca1725STetsuo Handa enum tomoyo_pref_index { 391eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 392d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 393d5ca1725STetsuo Handa TOMOYO_MAX_PREF 394d5ca1725STetsuo Handa }; 395d5ca1725STetsuo Handa 39676bb0895STetsuo Handa /********** Structure definitions. **********/ 3979590837bSKentaro Takeda 398b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 39982e0f001STetsuo Handa struct tomoyo_acl_head { 40082e0f001STetsuo Handa struct list_head list; 40182e0f001STetsuo Handa bool is_deleted; 40282e0f001STetsuo Handa } __packed; 40382e0f001STetsuo Handa 4040df7e8b8STetsuo Handa /* Common header for shared entries. */ 4050df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 4060df7e8b8STetsuo Handa struct list_head list; 4070df7e8b8STetsuo Handa atomic_t users; 4080df7e8b8STetsuo Handa } __packed; 4090df7e8b8STetsuo Handa 410bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 411bd03a3e4STetsuo Handa 412b5bc60b4STetsuo Handa /* Structure for request info. */ 413cb0abe6aSTetsuo Handa struct tomoyo_request_info { 4148761afd4STetsuo Handa /* 4158761afd4STetsuo Handa * For holding parameters specific to operations which deal files. 4168761afd4STetsuo Handa * NULL if not dealing files. 4178761afd4STetsuo Handa */ 4188761afd4STetsuo Handa struct tomoyo_obj_info *obj; 4192ca9bf45STetsuo Handa /* 4202ca9bf45STetsuo Handa * For holding parameters specific to execve() request. 4212ca9bf45STetsuo Handa * NULL if not dealing do_execve(). 4222ca9bf45STetsuo Handa */ 4232ca9bf45STetsuo Handa struct tomoyo_execve *ee; 424cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 425cf6e9a64STetsuo Handa /* For holding parameters. */ 426cf6e9a64STetsuo Handa union { 427cf6e9a64STetsuo Handa struct { 428cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 429484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 430484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 431b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 432cf6e9a64STetsuo Handa u8 operation; 433cf6e9a64STetsuo Handa } path; 434cf6e9a64STetsuo Handa struct { 435cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 436cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 437b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 438cf6e9a64STetsuo Handa u8 operation; 439cf6e9a64STetsuo Handa } path2; 440cf6e9a64STetsuo Handa struct { 441cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 442cf6e9a64STetsuo Handa unsigned int mode; 443cf6e9a64STetsuo Handa unsigned int major; 444cf6e9a64STetsuo Handa unsigned int minor; 445b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 446cf6e9a64STetsuo Handa u8 operation; 447cf6e9a64STetsuo Handa } mkdev; 448cf6e9a64STetsuo Handa struct { 449cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 450cf6e9a64STetsuo Handa unsigned long number; 451b5bc60b4STetsuo Handa /* 452b5bc60b4STetsuo Handa * One of values in 453b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 454b5bc60b4STetsuo Handa */ 455cf6e9a64STetsuo Handa u8 operation; 456cf6e9a64STetsuo Handa } path_number; 457cf6e9a64STetsuo Handa struct { 458d58e0da8STetsuo Handa const struct tomoyo_path_info *name; 459d58e0da8STetsuo Handa } environ; 460d58e0da8STetsuo Handa struct { 461059d84dbSTetsuo Handa const __be32 *address; 462059d84dbSTetsuo Handa u16 port; 463059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 464059d84dbSTetsuo Handa u8 protocol; 465059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 466059d84dbSTetsuo Handa u8 operation; 467059d84dbSTetsuo Handa bool is_ipv6; 468059d84dbSTetsuo Handa } inet_network; 469059d84dbSTetsuo Handa struct { 470059d84dbSTetsuo Handa const struct tomoyo_path_info *address; 471059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 472059d84dbSTetsuo Handa u8 protocol; 473059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 474059d84dbSTetsuo Handa u8 operation; 475059d84dbSTetsuo Handa } unix_network; 476059d84dbSTetsuo Handa struct { 477cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 478cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 479cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 480cf6e9a64STetsuo Handa unsigned long flags; 481cf6e9a64STetsuo Handa int need_dev; 482cf6e9a64STetsuo Handa } mount; 483cf6e9a64STetsuo Handa } param; 4841f067a68STetsuo Handa struct tomoyo_acl_info *matched_acl; 485cf6e9a64STetsuo Handa u8 param_type; 486cf6e9a64STetsuo Handa bool granted; 48717fcfbd9STetsuo Handa u8 retry; 48817fcfbd9STetsuo Handa u8 profile; 489cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 49057c2590fSTetsuo Handa u8 type; 491cb0abe6aSTetsuo Handa }; 492cb0abe6aSTetsuo Handa 493b5bc60b4STetsuo Handa /* Structure for holding a token. */ 4949590837bSKentaro Takeda struct tomoyo_path_info { 4959590837bSKentaro Takeda const char *name; 4969590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 4979590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 4989590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 4999590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 5009590837bSKentaro Takeda }; 5019590837bSKentaro Takeda 502b5bc60b4STetsuo Handa /* Structure for holding string data. */ 503e2bf6907STetsuo Handa struct tomoyo_name { 5040df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 50576bb0895STetsuo Handa struct tomoyo_path_info entry; 50676bb0895STetsuo Handa }; 5079590837bSKentaro Takeda 508b5bc60b4STetsuo Handa /* Structure for holding a word. */ 5097762fbffSTetsuo Handa struct tomoyo_name_union { 510b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 5117762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 512a98aa4deSTetsuo Handa struct tomoyo_group *group; 5137762fbffSTetsuo Handa }; 5147762fbffSTetsuo Handa 515b5bc60b4STetsuo Handa /* Structure for holding a number. */ 5164c3e9e2dSTetsuo Handa struct tomoyo_number_union { 5174c3e9e2dSTetsuo Handa unsigned long values[2]; 518b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 519b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 5200df7e8b8STetsuo Handa u8 value_type[2]; 5214c3e9e2dSTetsuo Handa }; 5224c3e9e2dSTetsuo Handa 523059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 524059d84dbSTetsuo Handa struct tomoyo_ipaddr_union { 525059d84dbSTetsuo Handa struct in6_addr ip[2]; /* Big endian. */ 526059d84dbSTetsuo Handa struct tomoyo_group *group; /* Pointer to address group. */ 527059d84dbSTetsuo Handa bool is_ipv6; /* Valid only if @group == NULL. */ 528059d84dbSTetsuo Handa }; 529059d84dbSTetsuo Handa 530059d84dbSTetsuo Handa /* Structure for "path_group"/"number_group"/"address_group" directive. */ 531a98aa4deSTetsuo Handa struct tomoyo_group { 5320df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 533a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 534a98aa4deSTetsuo Handa struct list_head member_list; 535a98aa4deSTetsuo Handa }; 536a98aa4deSTetsuo Handa 5377762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 5387762fbffSTetsuo Handa struct tomoyo_path_group { 53982e0f001STetsuo Handa struct tomoyo_acl_head head; 5407762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 5417762fbffSTetsuo Handa }; 5427762fbffSTetsuo Handa 5434c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 544a98aa4deSTetsuo Handa struct tomoyo_number_group { 54582e0f001STetsuo Handa struct tomoyo_acl_head head; 5464c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 5474c3e9e2dSTetsuo Handa }; 5484c3e9e2dSTetsuo Handa 549059d84dbSTetsuo Handa /* Structure for "address_group" directive. */ 550059d84dbSTetsuo Handa struct tomoyo_address_group { 551059d84dbSTetsuo Handa struct tomoyo_acl_head head; 552059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 553059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 554059d84dbSTetsuo Handa }; 555059d84dbSTetsuo Handa 5568761afd4STetsuo Handa /* Subset of "struct stat". Used by conditional ACL and audit logs. */ 5578761afd4STetsuo Handa struct tomoyo_mini_stat { 5588761afd4STetsuo Handa uid_t uid; 5598761afd4STetsuo Handa gid_t gid; 5608761afd4STetsuo Handa ino_t ino; 5618761afd4STetsuo Handa mode_t mode; 5628761afd4STetsuo Handa dev_t dev; 5638761afd4STetsuo Handa dev_t rdev; 5648761afd4STetsuo Handa }; 5658761afd4STetsuo Handa 5665b636857STetsuo Handa /* Structure for dumping argv[] and envp[] of "struct linux_binprm". */ 5675b636857STetsuo Handa struct tomoyo_page_dump { 5685b636857STetsuo Handa struct page *page; /* Previously dumped page. */ 5695b636857STetsuo Handa char *data; /* Contents of "page". Size is PAGE_SIZE. */ 5705b636857STetsuo Handa }; 5715b636857STetsuo Handa 5728761afd4STetsuo Handa /* Structure for attribute checks in addition to pathname checks. */ 5738761afd4STetsuo Handa struct tomoyo_obj_info { 5748761afd4STetsuo Handa /* 5758761afd4STetsuo Handa * True if tomoyo_get_attributes() was already called, false otherwise. 5768761afd4STetsuo Handa */ 5778761afd4STetsuo Handa bool validate_done; 5788761afd4STetsuo Handa /* True if @stat[] is valid. */ 5798761afd4STetsuo Handa bool stat_valid[TOMOYO_MAX_PATH_STAT]; 5808761afd4STetsuo Handa /* First pathname. Initialized with { NULL, NULL } if no path. */ 5818761afd4STetsuo Handa struct path path1; 5828761afd4STetsuo Handa /* Second pathname. Initialized with { NULL, NULL } if no path. */ 5838761afd4STetsuo Handa struct path path2; 5848761afd4STetsuo Handa /* 5858761afd4STetsuo Handa * Information on @path1, @path1's parent directory, @path2, @path2's 5868761afd4STetsuo Handa * parent directory. 5878761afd4STetsuo Handa */ 5888761afd4STetsuo Handa struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT]; 5892ca9bf45STetsuo Handa /* 5902ca9bf45STetsuo Handa * Content of symbolic link to be created. NULL for operations other 5912ca9bf45STetsuo Handa * than symlink(). 5922ca9bf45STetsuo Handa */ 5932ca9bf45STetsuo Handa struct tomoyo_path_info *symlink_target; 5942ca9bf45STetsuo Handa }; 5952ca9bf45STetsuo Handa 5965b636857STetsuo Handa /* Structure for argv[]. */ 5975b636857STetsuo Handa struct tomoyo_argv { 5985b636857STetsuo Handa unsigned long index; 5995b636857STetsuo Handa const struct tomoyo_path_info *value; 6005b636857STetsuo Handa bool is_not; 6015b636857STetsuo Handa }; 6025b636857STetsuo Handa 6035b636857STetsuo Handa /* Structure for envp[]. */ 6045b636857STetsuo Handa struct tomoyo_envp { 6055b636857STetsuo Handa const struct tomoyo_path_info *name; 6065b636857STetsuo Handa const struct tomoyo_path_info *value; 6075b636857STetsuo Handa bool is_not; 6085b636857STetsuo Handa }; 6095b636857STetsuo Handa 6102ca9bf45STetsuo Handa /* Structure for execve() operation. */ 6112ca9bf45STetsuo Handa struct tomoyo_execve { 6122ca9bf45STetsuo Handa struct tomoyo_request_info r; 6132ca9bf45STetsuo Handa struct tomoyo_obj_info obj; 6142ca9bf45STetsuo Handa struct linux_binprm *bprm; 6155b636857STetsuo Handa /* For dumping argv[] and envp[]. */ 6165b636857STetsuo Handa struct tomoyo_page_dump dump; 6172ca9bf45STetsuo Handa /* For temporary use. */ 6182ca9bf45STetsuo Handa char *tmp; /* Size is TOMOYO_EXEC_TMPSIZE bytes */ 6198761afd4STetsuo Handa }; 6208761afd4STetsuo Handa 6212066a361STetsuo Handa /* Structure for entries which follows "struct tomoyo_condition". */ 6222066a361STetsuo Handa struct tomoyo_condition_element { 6235b636857STetsuo Handa /* 6245b636857STetsuo Handa * Left hand operand. A "struct tomoyo_argv" for TOMOYO_ARGV_ENTRY, a 6255b636857STetsuo Handa * "struct tomoyo_envp" for TOMOYO_ENVP_ENTRY is attached to the tail 6265b636857STetsuo Handa * of the array of this struct. 6275b636857STetsuo Handa */ 6282066a361STetsuo Handa u8 left; 6295b636857STetsuo Handa /* 6305b636857STetsuo Handa * Right hand operand. A "struct tomoyo_number_union" for 6315b636857STetsuo Handa * TOMOYO_NUMBER_UNION, a "struct tomoyo_name_union" for 6325b636857STetsuo Handa * TOMOYO_NAME_UNION is attached to the tail of the array of this 6335b636857STetsuo Handa * struct. 6345b636857STetsuo Handa */ 6352066a361STetsuo Handa u8 right; 6362066a361STetsuo Handa /* Equation operator. True if equals or overlaps, false otherwise. */ 6372066a361STetsuo Handa bool equals; 6382066a361STetsuo Handa }; 6392066a361STetsuo Handa 6402066a361STetsuo Handa /* Structure for optional arguments. */ 6412066a361STetsuo Handa struct tomoyo_condition { 6422066a361STetsuo Handa struct tomoyo_shared_acl_head head; 6432066a361STetsuo Handa u32 size; /* Memory size allocated for this entry. */ 6442066a361STetsuo Handa u16 condc; /* Number of conditions in this struct. */ 6452066a361STetsuo Handa u16 numbers_count; /* Number of "struct tomoyo_number_union values". */ 6462ca9bf45STetsuo Handa u16 names_count; /* Number of "struct tomoyo_name_union names". */ 6475b636857STetsuo Handa u16 argc; /* Number of "struct tomoyo_argv". */ 6485b636857STetsuo Handa u16 envc; /* Number of "struct tomoyo_envp". */ 6491f067a68STetsuo Handa u8 grant_log; /* One of values in "enum tomoyo_grant_log". */ 6502066a361STetsuo Handa /* 6512066a361STetsuo Handa * struct tomoyo_condition_element condition[condc]; 6522066a361STetsuo Handa * struct tomoyo_number_union values[numbers_count]; 6532ca9bf45STetsuo Handa * struct tomoyo_name_union names[names_count]; 6545b636857STetsuo Handa * struct tomoyo_argv argv[argc]; 6555b636857STetsuo Handa * struct tomoyo_envp envp[envc]; 6562066a361STetsuo Handa */ 6572066a361STetsuo Handa }; 6582066a361STetsuo Handa 659b5bc60b4STetsuo Handa /* Common header for individual entries. */ 6609590837bSKentaro Takeda struct tomoyo_acl_info { 6619590837bSKentaro Takeda struct list_head list; 6622066a361STetsuo Handa struct tomoyo_condition *cond; /* Maybe NULL. */ 663237ab459STetsuo Handa bool is_deleted; 664b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 6659590837bSKentaro Takeda } __packed; 6669590837bSKentaro Takeda 667b5bc60b4STetsuo Handa /* Structure for domain information. */ 6689590837bSKentaro Takeda struct tomoyo_domain_info { 6699590837bSKentaro Takeda struct list_head list; 6709590837bSKentaro Takeda struct list_head acl_info_list; 6719590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 6729590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 673bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 674bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 6759590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 67632997144STetsuo Handa u8 group; /* Group number to use. */ 677a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 6782c47ab93STetsuo Handa bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 679ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 6809590837bSKentaro Takeda }; 6819590837bSKentaro Takeda 6829590837bSKentaro Takeda /* 683b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 684b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 685b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 6869590837bSKentaro Takeda */ 6877ef61233STetsuo Handa struct tomoyo_path_acl { 6887ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 689b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 6907762fbffSTetsuo Handa struct tomoyo_name_union name; 6919590837bSKentaro Takeda }; 6929590837bSKentaro Takeda 693c3fa109aSTetsuo Handa /* 694b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 695b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 696a1f9bb6aSTetsuo Handa */ 697a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 698a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 699b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 700a1f9bb6aSTetsuo Handa u8 perm; 701a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 702a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 703a1f9bb6aSTetsuo Handa }; 704a1f9bb6aSTetsuo Handa 705b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 70675093152STetsuo Handa struct tomoyo_mkdev_acl { 70775093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 708b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 709a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 710a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 711a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 712a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 713a1f9bb6aSTetsuo Handa }; 714a1f9bb6aSTetsuo Handa 715a1f9bb6aSTetsuo Handa /* 716b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 717c3fa109aSTetsuo Handa */ 7187ef61233STetsuo Handa struct tomoyo_path2_acl { 7197ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 720b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 7217762fbffSTetsuo Handa struct tomoyo_name_union name1; 7227762fbffSTetsuo Handa struct tomoyo_name_union name2; 7239590837bSKentaro Takeda }; 7249590837bSKentaro Takeda 725b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 7262106ccd9STetsuo Handa struct tomoyo_mount_acl { 7272106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 7282106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 7292106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 7302106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 7312106ccd9STetsuo Handa struct tomoyo_number_union flags; 7322106ccd9STetsuo Handa }; 7332106ccd9STetsuo Handa 734d58e0da8STetsuo Handa /* Structure for "misc env" directive in domain policy. */ 735d58e0da8STetsuo Handa struct tomoyo_env_acl { 736d58e0da8STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_ENV_ACL */ 737d58e0da8STetsuo Handa const struct tomoyo_path_info *env; /* environment variable */ 738d58e0da8STetsuo Handa }; 739d58e0da8STetsuo Handa 740059d84dbSTetsuo Handa /* Structure for "network inet" directive. */ 741059d84dbSTetsuo Handa struct tomoyo_inet_acl { 742059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */ 743059d84dbSTetsuo Handa u8 protocol; 744059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 745059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 746059d84dbSTetsuo Handa struct tomoyo_number_union port; 747059d84dbSTetsuo Handa }; 748059d84dbSTetsuo Handa 749059d84dbSTetsuo Handa /* Structure for "network unix" directive. */ 750059d84dbSTetsuo Handa struct tomoyo_unix_acl { 751059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */ 752059d84dbSTetsuo Handa u8 protocol; 753059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 754059d84dbSTetsuo Handa struct tomoyo_name_union name; 755059d84dbSTetsuo Handa }; 756059d84dbSTetsuo Handa 757a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 758a238cf5bSTetsuo Handa struct tomoyo_acl_param { 759a238cf5bSTetsuo Handa char *data; 760a238cf5bSTetsuo Handa struct list_head *list; 761bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 762a238cf5bSTetsuo Handa bool is_delete; 763a238cf5bSTetsuo Handa }; 764a238cf5bSTetsuo Handa 7650d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 766f23571e8STetsuo Handa 7672106ccd9STetsuo Handa /* 768f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 769f23571e8STetsuo Handa * interfaces. 770c3fa109aSTetsuo Handa */ 7719590837bSKentaro Takeda struct tomoyo_io_buffer { 7728fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 7739590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 77417fcfbd9STetsuo Handa int (*poll) (struct file *file, poll_table *wait); 7759590837bSKentaro Takeda /* Exclusive lock for this structure. */ 7769590837bSKentaro Takeda struct mutex io_sem; 777f23571e8STetsuo Handa char __user *read_user_buf; 7782c47ab93STetsuo Handa size_t read_user_buf_avail; 779f23571e8STetsuo Handa struct { 780bd03a3e4STetsuo Handa struct list_head *ns; 781f23571e8STetsuo Handa struct list_head *domain; 782f23571e8STetsuo Handa struct list_head *group; 783f23571e8STetsuo Handa struct list_head *acl; 7842c47ab93STetsuo Handa size_t avail; 7852c47ab93STetsuo Handa unsigned int step; 7862c47ab93STetsuo Handa unsigned int query_index; 787f23571e8STetsuo Handa u16 index; 7882066a361STetsuo Handa u16 cond_index; 78932997144STetsuo Handa u8 acl_group_index; 7902066a361STetsuo Handa u8 cond_step; 791f23571e8STetsuo Handa u8 bit; 792f23571e8STetsuo Handa u8 w_pos; 793f23571e8STetsuo Handa bool eof; 794f23571e8STetsuo Handa bool print_this_domain_only; 795bd03a3e4STetsuo Handa bool print_transition_related_only; 7962066a361STetsuo Handa bool print_cond_part; 797f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 798f23571e8STetsuo Handa } r; 7990df7e8b8STetsuo Handa struct { 800bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 8019590837bSKentaro Takeda /* The position currently writing to. */ 8020df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 8030df7e8b8STetsuo Handa /* Bytes available for writing. */ 8042c47ab93STetsuo Handa size_t avail; 805bd03a3e4STetsuo Handa bool is_delete; 8060df7e8b8STetsuo Handa } w; 8079590837bSKentaro Takeda /* Buffer for reading. */ 8089590837bSKentaro Takeda char *read_buf; 8099590837bSKentaro Takeda /* Size of read buffer. */ 8102c47ab93STetsuo Handa size_t readbuf_size; 8119590837bSKentaro Takeda /* Buffer for writing. */ 8129590837bSKentaro Takeda char *write_buf; 8139590837bSKentaro Takeda /* Size of write buffer. */ 8142c47ab93STetsuo Handa size_t writebuf_size; 81517fcfbd9STetsuo Handa /* Type of this interface. */ 8162c47ab93STetsuo Handa enum tomoyo_securityfs_interface_index type; 8172e503bbbSTetsuo Handa /* Users counter protected by tomoyo_io_buffer_list_lock. */ 8182e503bbbSTetsuo Handa u8 users; 8192e503bbbSTetsuo Handa /* List for telling GC not to kfree() elements. */ 8202e503bbbSTetsuo Handa struct list_head list; 8219590837bSKentaro Takeda }; 8229590837bSKentaro Takeda 82376bb0895STetsuo Handa /* 824b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 825b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 82676bb0895STetsuo Handa */ 8275448ec4fSTetsuo Handa struct tomoyo_transition_control { 82882e0f001STetsuo Handa struct tomoyo_acl_head head; 8295448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 83076bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 83176bb0895STetsuo Handa bool is_last_name; 8325448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 8335448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 83476bb0895STetsuo Handa }; 83576bb0895STetsuo Handa 836b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 837e2bf6907STetsuo Handa struct tomoyo_aggregator { 83882e0f001STetsuo Handa struct tomoyo_acl_head head; 8391084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 8401084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 8411084307cSTetsuo Handa }; 8421084307cSTetsuo Handa 843b5bc60b4STetsuo Handa /* Structure for policy manager. */ 844e2bf6907STetsuo Handa struct tomoyo_manager { 84582e0f001STetsuo Handa struct tomoyo_acl_head head; 84682e0f001STetsuo Handa bool is_domain; /* True if manager is a domainname. */ 84776bb0895STetsuo Handa /* A path to program or a domainname. */ 84876bb0895STetsuo Handa const struct tomoyo_path_info *manager; 84976bb0895STetsuo Handa }; 85076bb0895STetsuo Handa 85157c2590fSTetsuo Handa struct tomoyo_preference { 85257c2590fSTetsuo Handa unsigned int learning_max_entry; 85357c2590fSTetsuo Handa bool enforcing_verbose; 85457c2590fSTetsuo Handa bool learning_verbose; 85557c2590fSTetsuo Handa bool permissive_verbose; 85657c2590fSTetsuo Handa }; 85757c2590fSTetsuo Handa 858b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 85957c2590fSTetsuo Handa struct tomoyo_profile { 86057c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 86157c2590fSTetsuo Handa struct tomoyo_preference *learning; 86257c2590fSTetsuo Handa struct tomoyo_preference *permissive; 86357c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 86457c2590fSTetsuo Handa struct tomoyo_preference preference; 86557c2590fSTetsuo Handa u8 default_config; 86657c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 867d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 86857c2590fSTetsuo Handa }; 86957c2590fSTetsuo Handa 870eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 871eadd99ccSTetsuo Handa struct tomoyo_time { 872eadd99ccSTetsuo Handa u16 year; 873eadd99ccSTetsuo Handa u8 month; 874eadd99ccSTetsuo Handa u8 day; 875eadd99ccSTetsuo Handa u8 hour; 876eadd99ccSTetsuo Handa u8 min; 877eadd99ccSTetsuo Handa u8 sec; 878eadd99ccSTetsuo Handa }; 879eadd99ccSTetsuo Handa 880bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 881bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 882bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 883bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 884bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 885bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 886bd03a3e4STetsuo Handa /* List of policy. */ 887bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 888bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 889bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 890bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 891bd03a3e4STetsuo Handa struct list_head namespace_list; 892bd03a3e4STetsuo Handa /* Profile version. Currently only 20100903 is defined. */ 893bd03a3e4STetsuo Handa unsigned int profile_version; 894bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 895bd03a3e4STetsuo Handa const char *name; 896bd03a3e4STetsuo Handa }; 897bd03a3e4STetsuo Handa 89876bb0895STetsuo Handa /********** Function prototypes. **********/ 89976bb0895STetsuo Handa 900059d84dbSTetsuo Handa bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address, 901059d84dbSTetsuo Handa const struct tomoyo_group *group); 9022106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 9032106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 9042066a361STetsuo Handa bool tomoyo_condition(struct tomoyo_request_info *r, 9052066a361STetsuo Handa const struct tomoyo_condition *cond); 90675093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 90775093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 90875093152STetsuo Handa bool tomoyo_correct_word(const char *string); 90975093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 9103ddf17f0STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 9115b636857STetsuo Handa bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, 9125b636857STetsuo Handa struct tomoyo_page_dump *dump); 9133ddf17f0STetsuo Handa bool tomoyo_memory_ok(void *ptr); 9144c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 9154c3e9e2dSTetsuo Handa const unsigned long max, 916a98aa4deSTetsuo Handa const struct tomoyo_group *group); 917059d84dbSTetsuo Handa bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param, 918059d84dbSTetsuo Handa struct tomoyo_ipaddr_union *ptr); 9193ddf17f0STetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 9203ddf17f0STetsuo Handa struct tomoyo_name_union *ptr); 921a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 922a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 9233ddf17f0STetsuo Handa bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 9243ddf17f0STetsuo Handa const struct tomoyo_path_info *pattern); 9253ddf17f0STetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 9263ddf17f0STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 9273ddf17f0STetsuo Handa char *tomoyo_encode(const char *str); 928059d84dbSTetsuo Handa char *tomoyo_encode2(const char *str, int str_len); 9293ddf17f0STetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 9303ddf17f0STetsuo Handa va_list args); 9313ddf17f0STetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 9323ddf17f0STetsuo Handa char *tomoyo_realpath_from_path(struct path *path); 9333ddf17f0STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 9343ddf17f0STetsuo Handa const char *tomoyo_get_exe(void); 9353ddf17f0STetsuo Handa const char *tomoyo_yesno(const unsigned int value); 9363ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_compare_name_union 9373ddf17f0STetsuo Handa (const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr); 9383ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 9393ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_path_matches_group 9403ddf17f0STetsuo Handa (const struct tomoyo_path_info *pathname, const struct tomoyo_group *group); 9413ddf17f0STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 9423ddf17f0STetsuo Handa struct path *path, const int flag); 9433ddf17f0STetsuo Handa int tomoyo_close_control(struct tomoyo_io_buffer *head); 944d58e0da8STetsuo Handa int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env); 9453ddf17f0STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 9463ddf17f0STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 9473ddf17f0STetsuo Handa const u8 index); 9482106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 94957c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 95057c2590fSTetsuo Handa const u8 index); 9513ddf17f0STetsuo Handa int tomoyo_mkdev_perm(const u8 operation, struct path *path, 9523ddf17f0STetsuo Handa const unsigned int mode, unsigned int dev); 953b5bc60b4STetsuo Handa int tomoyo_mount_permission(char *dev_name, struct path *path, 954b5bc60b4STetsuo Handa const char *type, unsigned long flags, 955b5bc60b4STetsuo Handa void *data_page); 9563ddf17f0STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 95797d6931eSTetsuo Handa int tomoyo_path2_perm(const u8 operation, struct path *path1, 95897d6931eSTetsuo Handa struct path *path2); 9593ddf17f0STetsuo Handa int tomoyo_path_number_perm(const u8 operation, struct path *path, 9603ddf17f0STetsuo Handa unsigned long number); 96197fb35e4STetsuo Handa int tomoyo_path_perm(const u8 operation, struct path *path, 96297fb35e4STetsuo Handa const char *target); 9633ddf17f0STetsuo Handa int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 9643ddf17f0STetsuo Handa const struct tomoyo_path_info *filename); 9653ddf17f0STetsuo Handa int tomoyo_poll_control(struct file *file, poll_table *wait); 9663ddf17f0STetsuo Handa int tomoyo_poll_log(struct file *file, poll_table *wait); 967059d84dbSTetsuo Handa int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr, 968059d84dbSTetsuo Handa int addr_len); 969059d84dbSTetsuo Handa int tomoyo_socket_connect_permission(struct socket *sock, 970059d84dbSTetsuo Handa struct sockaddr *addr, int addr_len); 971059d84dbSTetsuo Handa int tomoyo_socket_listen_permission(struct socket *sock); 972059d84dbSTetsuo Handa int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg, 973059d84dbSTetsuo Handa int size); 9743ddf17f0STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 9753ddf17f0STetsuo Handa __printf(2, 3); 976237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 977a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 9783ddf17f0STetsuo Handa bool (*check_duplicate) 9793ddf17f0STetsuo Handa (const struct tomoyo_acl_info *, 9803ddf17f0STetsuo Handa const struct tomoyo_acl_info *), 9813ddf17f0STetsuo Handa bool (*merge_duplicate) 9823ddf17f0STetsuo Handa (struct tomoyo_acl_info *, struct tomoyo_acl_info *, 983237ab459STetsuo Handa const bool)); 98436f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 985a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 9863ddf17f0STetsuo Handa bool (*check_duplicate) 9873ddf17f0STetsuo Handa (const struct tomoyo_acl_head *, 9883ddf17f0STetsuo Handa const struct tomoyo_acl_head *)); 9893ddf17f0STetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 9903ddf17f0STetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 9913ddf17f0STetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 992d58e0da8STetsuo Handa int tomoyo_write_misc(struct tomoyo_acl_param *param); 993059d84dbSTetsuo Handa int tomoyo_write_inet_network(struct tomoyo_acl_param *param); 9943ddf17f0STetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 9953ddf17f0STetsuo Handa const u8 type); 996059d84dbSTetsuo Handa int tomoyo_write_unix_network(struct tomoyo_acl_param *param); 9973ddf17f0STetsuo Handa ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 9983ddf17f0STetsuo Handa const int buffer_len); 9993ddf17f0STetsuo Handa ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 10003ddf17f0STetsuo Handa const char __user *buffer, const int buffer_len); 10012066a361STetsuo Handa struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param); 10023ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 10033ddf17f0STetsuo Handa const bool transit); 10043ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 10053ddf17f0STetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 10063ddf17f0STetsuo Handa const u8 idx); 10073ddf17f0STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 10083ddf17f0STetsuo Handa (const char *domainname); 10093ddf17f0STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 10103ddf17f0STetsuo Handa const u8 profile); 10113ddf17f0STetsuo Handa unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 10123ddf17f0STetsuo Handa const u8 index); 10132066a361STetsuo Handa u8 tomoyo_parse_ulong(unsigned long *result, char **str); 10143ddf17f0STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 10153ddf17f0STetsuo Handa void __init tomoyo_load_builtin_policy(void); 10163ddf17f0STetsuo Handa void __init tomoyo_mm_init(void); 101799a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 1018484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 101999a85259STetsuo Handa const struct tomoyo_acl_info *)); 10203ddf17f0STetsuo Handa void tomoyo_check_profile(void); 10213ddf17f0STetsuo Handa void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp); 10222066a361STetsuo Handa void tomoyo_del_condition(struct list_head *element); 10233ddf17f0STetsuo Handa void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 10248761afd4STetsuo Handa void tomoyo_get_attributes(struct tomoyo_obj_info *obj); 10253ddf17f0STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 10263ddf17f0STetsuo Handa void tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 10273ddf17f0STetsuo Handa __printf(2, 3); 10283ddf17f0STetsuo Handa void tomoyo_load_policy(const char *filename); 10293ddf17f0STetsuo Handa void tomoyo_memory_free(void *ptr); 10303ddf17f0STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 10313ddf17f0STetsuo Handa void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); 1032059d84dbSTetsuo Handa void tomoyo_print_ip(char *buf, const unsigned int size, 1033059d84dbSTetsuo Handa const struct tomoyo_ipaddr_union *ptr); 10343ddf17f0STetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 10353ddf17f0STetsuo Handa const unsigned long value, const u8 type); 10363ddf17f0STetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 10373ddf17f0STetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 1038eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 10393ddf17f0STetsuo Handa void tomoyo_update_stat(const u8 index); 10403ddf17f0STetsuo Handa void tomoyo_warn_oom(const char *function); 10413ddf17f0STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 10423ddf17f0STetsuo Handa __printf(2, 3); 10433ddf17f0STetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 1044eadd99ccSTetsuo Handa va_list args); 1045eadd99ccSTetsuo Handa 104676bb0895STetsuo Handa /********** External variable definitions. **********/ 104776bb0895STetsuo Handa 104876bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 10492066a361STetsuo Handa extern const char * const tomoyo_condition_keyword 10502066a361STetsuo Handa [TOMOYO_MAX_CONDITION_KEYWORD]; 10513ddf17f0STetsuo Handa extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 10523ddf17f0STetsuo Handa extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX 10533ddf17f0STetsuo Handa + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 10543ddf17f0STetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 10552c47ab93STetsuo Handa extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 1056059d84dbSTetsuo Handa extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX]; 1057059d84dbSTetsuo Handa extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION]; 10582c47ab93STetsuo Handa extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; 10593ddf17f0STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 10600d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 10610d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 10622066a361STetsuo Handa extern struct list_head tomoyo_condition_list; 10633ddf17f0STetsuo Handa extern struct list_head tomoyo_domain_list; 10643ddf17f0STetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 10653ddf17f0STetsuo Handa extern struct list_head tomoyo_namespace_list; 10663ddf17f0STetsuo Handa extern struct mutex tomoyo_policy_lock; 10673ddf17f0STetsuo Handa extern struct srcu_struct tomoyo_ss; 10683ddf17f0STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 10693ddf17f0STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 1070eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 1071eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 107217fcfbd9STetsuo Handa 107376bb0895STetsuo Handa /********** Inlined functions. **********/ 107476bb0895STetsuo Handa 1075b5bc60b4STetsuo Handa /** 1076b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 1077b5bc60b4STetsuo Handa * 1078b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 1079b5bc60b4STetsuo Handa */ 108076bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 108176bb0895STetsuo Handa { 108276bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 108376bb0895STetsuo Handa } 108476bb0895STetsuo Handa 1085b5bc60b4STetsuo Handa /** 1086b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 1087b5bc60b4STetsuo Handa * 1088b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 1089b5bc60b4STetsuo Handa * 1090b5bc60b4STetsuo Handa * Returns nothing. 1091b5bc60b4STetsuo Handa */ 109276bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 109376bb0895STetsuo Handa { 109476bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 109576bb0895STetsuo Handa } 109676bb0895STetsuo Handa 1097b5bc60b4STetsuo Handa /** 10982066a361STetsuo Handa * tomoyo_sys_getppid - Copy of getppid(). 10992066a361STetsuo Handa * 11002066a361STetsuo Handa * Returns parent process's PID. 11012066a361STetsuo Handa * 11022066a361STetsuo Handa * Alpha does not have getppid() defined. To be able to build this module on 11032066a361STetsuo Handa * Alpha, I have to copy getppid() from kernel/timer.c. 11042066a361STetsuo Handa */ 11052066a361STetsuo Handa static inline pid_t tomoyo_sys_getppid(void) 11062066a361STetsuo Handa { 11072066a361STetsuo Handa pid_t pid; 11082066a361STetsuo Handa rcu_read_lock(); 11092066a361STetsuo Handa pid = task_tgid_vnr(current->real_parent); 11102066a361STetsuo Handa rcu_read_unlock(); 11112066a361STetsuo Handa return pid; 11122066a361STetsuo Handa } 11132066a361STetsuo Handa 11142066a361STetsuo Handa /** 11152066a361STetsuo Handa * tomoyo_sys_getpid - Copy of getpid(). 11162066a361STetsuo Handa * 11172066a361STetsuo Handa * Returns current thread's PID. 11182066a361STetsuo Handa * 11192066a361STetsuo Handa * Alpha does not have getpid() defined. To be able to build this module on 11202066a361STetsuo Handa * Alpha, I have to copy getpid() from kernel/timer.c. 11212066a361STetsuo Handa */ 11222066a361STetsuo Handa static inline pid_t tomoyo_sys_getpid(void) 11232066a361STetsuo Handa { 11242066a361STetsuo Handa return task_tgid_vnr(current); 11252066a361STetsuo Handa } 11262066a361STetsuo Handa 11272066a361STetsuo Handa /** 1128b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 1129b5bc60b4STetsuo Handa * 1130b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 1131b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 1132b5bc60b4STetsuo Handa * 1133b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1134b5bc60b4STetsuo Handa */ 11359590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 11369590837bSKentaro Takeda const struct tomoyo_path_info *b) 11379590837bSKentaro Takeda { 11389590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 11399590837bSKentaro Takeda } 11409590837bSKentaro Takeda 11419590837bSKentaro Takeda /** 1142b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 1143b5bc60b4STetsuo Handa * 1144b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 1145b5bc60b4STetsuo Handa * 1146b5bc60b4STetsuo Handa * Returns nothing. 1147b5bc60b4STetsuo Handa */ 114876bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 114976bb0895STetsuo Handa { 115076bb0895STetsuo Handa if (name) { 1151e2bf6907STetsuo Handa struct tomoyo_name *ptr = 1152e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 11530df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 115476bb0895STetsuo Handa } 115576bb0895STetsuo Handa } 11569590837bSKentaro Takeda 1157b5bc60b4STetsuo Handa /** 11582066a361STetsuo Handa * tomoyo_put_condition - Drop reference on "struct tomoyo_condition". 11592066a361STetsuo Handa * 11602066a361STetsuo Handa * @cond: Pointer to "struct tomoyo_condition". Maybe NULL. 11612066a361STetsuo Handa * 11622066a361STetsuo Handa * Returns nothing. 11632066a361STetsuo Handa */ 11642066a361STetsuo Handa static inline void tomoyo_put_condition(struct tomoyo_condition *cond) 11652066a361STetsuo Handa { 11662066a361STetsuo Handa if (cond) 11672066a361STetsuo Handa atomic_dec(&cond->head.users); 11682066a361STetsuo Handa } 11692066a361STetsuo Handa 11702066a361STetsuo Handa /** 1171b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 1172b5bc60b4STetsuo Handa * 1173b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 1174b5bc60b4STetsuo Handa * 1175b5bc60b4STetsuo Handa * Returns nothing. 1176b5bc60b4STetsuo Handa */ 1177a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 11784c3e9e2dSTetsuo Handa { 11794c3e9e2dSTetsuo Handa if (group) 11800df7e8b8STetsuo Handa atomic_dec(&group->head.users); 11814c3e9e2dSTetsuo Handa } 11824c3e9e2dSTetsuo Handa 1183b5bc60b4STetsuo Handa /** 1184b5bc60b4STetsuo Handa * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 1185b5bc60b4STetsuo Handa * 1186b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_domain_info" for current thread. 1187b5bc60b4STetsuo Handa */ 118876bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 118976bb0895STetsuo Handa { 119076bb0895STetsuo Handa return current_cred()->security; 119176bb0895STetsuo Handa } 11929590837bSKentaro Takeda 1193b5bc60b4STetsuo Handa /** 1194b5bc60b4STetsuo Handa * tomoyo_real_domain - Get "struct tomoyo_domain_info" for specified thread. 1195b5bc60b4STetsuo Handa * 1196b5bc60b4STetsuo Handa * @task: Pointer to "struct task_struct". 1197b5bc60b4STetsuo Handa * 1198b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_security" for specified thread. 1199b5bc60b4STetsuo Handa */ 120076bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 120176bb0895STetsuo Handa *task) 120276bb0895STetsuo Handa { 120376bb0895STetsuo Handa return task_cred_xxx(task, security); 120476bb0895STetsuo Handa } 12059590837bSKentaro Takeda 1206b5bc60b4STetsuo Handa /** 1207b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 1208b5bc60b4STetsuo Handa * 1209b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 1210b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 1211b5bc60b4STetsuo Handa * 1212b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1213b5bc60b4STetsuo Handa */ 121475093152STetsuo Handa static inline bool tomoyo_same_name_union 1215b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 12167762fbffSTetsuo Handa { 12170df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 12187762fbffSTetsuo Handa } 12197762fbffSTetsuo Handa 1220b5bc60b4STetsuo Handa /** 1221b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 1222b5bc60b4STetsuo Handa * 1223b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 1224b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 1225b5bc60b4STetsuo Handa * 1226b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1227b5bc60b4STetsuo Handa */ 122875093152STetsuo Handa static inline bool tomoyo_same_number_union 1229b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 12304c3e9e2dSTetsuo Handa { 1231b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 12320df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 12330df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 12344c3e9e2dSTetsuo Handa } 12354c3e9e2dSTetsuo Handa 1236bd03a3e4STetsuo Handa /** 1237059d84dbSTetsuo Handa * tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry. 1238059d84dbSTetsuo Handa * 1239059d84dbSTetsuo Handa * @a: Pointer to "struct tomoyo_ipaddr_union". 1240059d84dbSTetsuo Handa * @b: Pointer to "struct tomoyo_ipaddr_union". 1241059d84dbSTetsuo Handa * 1242059d84dbSTetsuo Handa * Returns true if @a == @b, false otherwise. 1243059d84dbSTetsuo Handa */ 1244059d84dbSTetsuo Handa static inline bool tomoyo_same_ipaddr_union 1245059d84dbSTetsuo Handa (const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b) 1246059d84dbSTetsuo Handa { 1247059d84dbSTetsuo Handa return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group && 1248059d84dbSTetsuo Handa a->is_ipv6 == b->is_ipv6; 1249059d84dbSTetsuo Handa } 1250059d84dbSTetsuo Handa 1251059d84dbSTetsuo Handa /** 1252bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 1253bd03a3e4STetsuo Handa * 1254bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 1255bd03a3e4STetsuo Handa */ 1256bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 1257bd03a3e4STetsuo Handa { 1258bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 1259bd03a3e4STetsuo Handa } 1260bd03a3e4STetsuo Handa 1261eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 1262eadd99ccSTetsuo Handa 1263eadd99ccSTetsuo Handa /** 1264eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1265eadd99ccSTetsuo Handa * 1266eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1267eadd99ccSTetsuo Handa * 1268eadd99ccSTetsuo Handa * Returns @size. 1269eadd99ccSTetsuo Handa * 1270eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 1271eadd99ccSTetsuo Handa */ 1272eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1273eadd99ccSTetsuo Handa { 1274eadd99ccSTetsuo Handa return size; 1275eadd99ccSTetsuo Handa } 1276eadd99ccSTetsuo Handa 1277eadd99ccSTetsuo Handa #else 1278eadd99ccSTetsuo Handa 1279eadd99ccSTetsuo Handa /** 1280eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1281eadd99ccSTetsuo Handa * 1282eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1283eadd99ccSTetsuo Handa * 1284eadd99ccSTetsuo Handa * Returns rounded size. 1285eadd99ccSTetsuo Handa * 1286eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 1287eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 1288eadd99ccSTetsuo Handa */ 1289eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1290eadd99ccSTetsuo Handa { 1291eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 1292eadd99ccSTetsuo Handa size_t bsize = 32; 1293eadd99ccSTetsuo Handa #else 1294eadd99ccSTetsuo Handa size_t bsize = 64; 1295eadd99ccSTetsuo Handa #endif 1296eadd99ccSTetsuo Handa if (!size) 1297eadd99ccSTetsuo Handa return 0; 1298eadd99ccSTetsuo Handa while (size > bsize) 1299eadd99ccSTetsuo Handa bsize <<= 1; 1300eadd99ccSTetsuo Handa return bsize; 1301eadd99ccSTetsuo Handa } 1302eadd99ccSTetsuo Handa 1303eadd99ccSTetsuo Handa #endif 1304eadd99ccSTetsuo Handa 13059590837bSKentaro Takeda /** 13069590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 13079590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 13089590837bSKentaro Takeda * @head: the head for your list. 13099590837bSKentaro Takeda */ 1310475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 1311475e6fa3STetsuo Handa if (!pos) \ 1312475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 1313475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 1314fdb8ebb7STetsuo Handa 13159590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 1316