19590837bSKentaro Takeda /* 29590837bSKentaro Takeda * security/tomoyo/common.h 39590837bSKentaro Takeda * 476bb0895STetsuo Handa * Header file for TOMOYO. 59590837bSKentaro Takeda * 676bb0895STetsuo Handa * Copyright (C) 2005-2010 NTT DATA CORPORATION 79590837bSKentaro Takeda */ 89590837bSKentaro Takeda 99590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 109590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda 129590837bSKentaro Takeda #include <linux/ctype.h> 139590837bSKentaro Takeda #include <linux/string.h> 149590837bSKentaro Takeda #include <linux/mm.h> 159590837bSKentaro Takeda #include <linux/file.h> 169590837bSKentaro Takeda #include <linux/kmod.h> 179590837bSKentaro Takeda #include <linux/fs.h> 189590837bSKentaro Takeda #include <linux/sched.h> 199590837bSKentaro Takeda #include <linux/namei.h> 209590837bSKentaro Takeda #include <linux/mount.h> 219590837bSKentaro Takeda #include <linux/list.h> 2276bb0895STetsuo Handa #include <linux/cred.h> 2317fcfbd9STetsuo Handa #include <linux/poll.h> 2476bb0895STetsuo Handa struct linux_binprm; 259590837bSKentaro Takeda 2676bb0895STetsuo Handa /********** Constants definitions. **********/ 2776bb0895STetsuo Handa 2876bb0895STetsuo Handa /* 2976bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 3076bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 3176bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 3276bb0895STetsuo Handa */ 3376bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 3476bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 3576bb0895STetsuo Handa 36c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 3776bb0895STetsuo Handa 3876bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 3976bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 4076bb0895STetsuo Handa 41cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 42cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 43cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 44cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 4557c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 4657c2590fSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255 47cb0abe6aSTetsuo Handa }; 48cb0abe6aSTetsuo Handa 49a230f9e7STetsuo Handa enum tomoyo_policy_id { 50a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 51a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 52a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 535448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 54a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 55a230f9e7STetsuo Handa TOMOYO_ID_GLOBALLY_READABLE, 56a230f9e7STetsuo Handa TOMOYO_ID_PATTERN, 57a230f9e7STetsuo Handa TOMOYO_ID_NO_REWRITE, 58a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 59a230f9e7STetsuo Handa TOMOYO_ID_NAME, 60a230f9e7STetsuo Handa TOMOYO_ID_ACL, 61a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 62a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 63a230f9e7STetsuo Handa }; 64a230f9e7STetsuo Handa 65a230f9e7STetsuo Handa enum tomoyo_group_id { 66a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 67a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 68a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 69a230f9e7STetsuo Handa }; 70a230f9e7STetsuo Handa 7176bb0895STetsuo Handa /* Keywords for ACLs. */ 721084307cSTetsuo Handa #define TOMOYO_KEYWORD_AGGREGATOR "aggregator " 732106ccd9STetsuo Handa #define TOMOYO_KEYWORD_ALLOW_MOUNT "allow_mount " 7476bb0895STetsuo Handa #define TOMOYO_KEYWORD_ALLOW_READ "allow_read " 7576bb0895STetsuo Handa #define TOMOYO_KEYWORD_DELETE "delete " 7676bb0895STetsuo Handa #define TOMOYO_KEYWORD_DENY_REWRITE "deny_rewrite " 7776bb0895STetsuo Handa #define TOMOYO_KEYWORD_FILE_PATTERN "file_pattern " 7876bb0895STetsuo Handa #define TOMOYO_KEYWORD_INITIALIZE_DOMAIN "initialize_domain " 7976bb0895STetsuo Handa #define TOMOYO_KEYWORD_KEEP_DOMAIN "keep_domain " 8076bb0895STetsuo Handa #define TOMOYO_KEYWORD_NO_INITIALIZE_DOMAIN "no_initialize_domain " 8176bb0895STetsuo Handa #define TOMOYO_KEYWORD_NO_KEEP_DOMAIN "no_keep_domain " 827762fbffSTetsuo Handa #define TOMOYO_KEYWORD_PATH_GROUP "path_group " 834c3e9e2dSTetsuo Handa #define TOMOYO_KEYWORD_NUMBER_GROUP "number_group " 8476bb0895STetsuo Handa #define TOMOYO_KEYWORD_SELECT "select " 8576bb0895STetsuo Handa #define TOMOYO_KEYWORD_USE_PROFILE "use_profile " 8676bb0895STetsuo Handa #define TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "ignore_global_allow_read" 879b244373STetsuo Handa #define TOMOYO_KEYWORD_QUOTA_EXCEEDED "quota_exceeded" 889b244373STetsuo Handa #define TOMOYO_KEYWORD_TRANSITION_FAILED "transition_failed" 8976bb0895STetsuo Handa /* A domain definition starts with <kernel>. */ 9076bb0895STetsuo Handa #define TOMOYO_ROOT_NAME "<kernel>" 9176bb0895STetsuo Handa #define TOMOYO_ROOT_NAME_LEN (sizeof(TOMOYO_ROOT_NAME) - 1) 9276bb0895STetsuo Handa 934c3e9e2dSTetsuo Handa /* Value type definition. */ 944c3e9e2dSTetsuo Handa #define TOMOYO_VALUE_TYPE_INVALID 0 954c3e9e2dSTetsuo Handa #define TOMOYO_VALUE_TYPE_DECIMAL 1 964c3e9e2dSTetsuo Handa #define TOMOYO_VALUE_TYPE_OCTAL 2 974c3e9e2dSTetsuo Handa #define TOMOYO_VALUE_TYPE_HEXADECIMAL 3 984c3e9e2dSTetsuo Handa 995448ec4fSTetsuo Handa enum tomoyo_transition_type { 1005448ec4fSTetsuo Handa /* Do not change this order, */ 1015448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 1025448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 1035448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 1045448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 1055448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 1065448ec4fSTetsuo Handa }; 1075448ec4fSTetsuo Handa 10876bb0895STetsuo Handa /* Index numbers for Access Controls. */ 109084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 1107ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 1117ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 112a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 11375093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 1142106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 115084da356STetsuo Handa }; 11676bb0895STetsuo Handa 11776bb0895STetsuo Handa /* Index numbers for File Controls. */ 11876bb0895STetsuo Handa 11976bb0895STetsuo Handa /* 120a1f9bb6aSTetsuo Handa * TOMOYO_TYPE_READ_WRITE is special. TOMOYO_TYPE_READ_WRITE is automatically 121a1f9bb6aSTetsuo Handa * set if both TOMOYO_TYPE_READ and TOMOYO_TYPE_WRITE are set. 122a1f9bb6aSTetsuo Handa * Both TOMOYO_TYPE_READ and TOMOYO_TYPE_WRITE are automatically set if 123a1f9bb6aSTetsuo Handa * TOMOYO_TYPE_READ_WRITE is set. 124a1f9bb6aSTetsuo Handa * TOMOYO_TYPE_READ_WRITE is automatically cleared if either TOMOYO_TYPE_READ 125a1f9bb6aSTetsuo Handa * or TOMOYO_TYPE_WRITE is cleared. 126a1f9bb6aSTetsuo Handa * Both TOMOYO_TYPE_READ and TOMOYO_TYPE_WRITE are automatically cleared if 127a1f9bb6aSTetsuo Handa * TOMOYO_TYPE_READ_WRITE is cleared. 12876bb0895STetsuo Handa */ 12976bb0895STetsuo Handa 130084da356STetsuo Handa enum tomoyo_path_acl_index { 1317ef61233STetsuo Handa TOMOYO_TYPE_READ_WRITE, 1327ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 1337ef61233STetsuo Handa TOMOYO_TYPE_READ, 1347ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 1357ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 1367ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 1377ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 1387ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 1397ef61233STetsuo Handa TOMOYO_TYPE_REWRITE, 1407ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 1417ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 1427ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 143084da356STetsuo Handa }; 14476bb0895STetsuo Handa 145237ab459STetsuo Handa #define TOMOYO_RW_MASK ((1 << TOMOYO_TYPE_READ) | (1 << TOMOYO_TYPE_WRITE)) 146237ab459STetsuo Handa 14775093152STetsuo Handa enum tomoyo_mkdev_acl_index { 148a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 149a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 15075093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 151a1f9bb6aSTetsuo Handa }; 152a1f9bb6aSTetsuo Handa 153084da356STetsuo Handa enum tomoyo_path2_acl_index { 1547ef61233STetsuo Handa TOMOYO_TYPE_LINK, 1557ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 1567ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 1577ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 158084da356STetsuo Handa }; 15976bb0895STetsuo Handa 160a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 161a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 162a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 163a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 164a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 165a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 166a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 167a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 168a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 169a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 170a1f9bb6aSTetsuo Handa }; 171a1f9bb6aSTetsuo Handa 172084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 173084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 174084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 175084da356STetsuo Handa TOMOYO_DOMAIN_STATUS, 176084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 177084da356STetsuo Handa TOMOYO_MEMINFO, 178084da356STetsuo Handa TOMOYO_SELFDOMAIN, 179084da356STetsuo Handa TOMOYO_VERSION, 180084da356STetsuo Handa TOMOYO_PROFILE, 18117fcfbd9STetsuo Handa TOMOYO_QUERY, 182084da356STetsuo Handa TOMOYO_MANAGER 183084da356STetsuo Handa }; 18476bb0895STetsuo Handa 18557c2590fSTetsuo Handa enum tomoyo_mac_index { 18657c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 18757c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 18857c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 18957c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 19057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 19157c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 19257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 19357c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 19457c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 19557c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 19657c2590fSTetsuo Handa TOMOYO_MAC_FILE_REWRITE, 19757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 19857c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 19957c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 20057c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 20157c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 20257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 20357c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 20457c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 20557c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 20657c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 20757c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 20857c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 20957c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 21057c2590fSTetsuo Handa }; 21157c2590fSTetsuo Handa 21257c2590fSTetsuo Handa enum tomoyo_mac_category_index { 21357c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 21457c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 21557c2590fSTetsuo Handa }; 21657c2590fSTetsuo Handa 21717fcfbd9STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 /* Retry this request. */ 21817fcfbd9STetsuo Handa 21976bb0895STetsuo Handa /********** Structure definitions. **********/ 2209590837bSKentaro Takeda 221c3fa109aSTetsuo Handa /* 22282e0f001STetsuo Handa * tomoyo_acl_head is a structure which is used for holding elements not in 22382e0f001STetsuo Handa * domain policy. 22482e0f001STetsuo Handa * It has following fields. 22582e0f001STetsuo Handa * 22682e0f001STetsuo Handa * (1) "list" which is linked to tomoyo_policy_list[] . 22782e0f001STetsuo Handa * (2) "is_deleted" is a bool which is true if marked as deleted, false 22882e0f001STetsuo Handa * otherwise. 22982e0f001STetsuo Handa */ 23082e0f001STetsuo Handa struct tomoyo_acl_head { 23182e0f001STetsuo Handa struct list_head list; 23282e0f001STetsuo Handa bool is_deleted; 23382e0f001STetsuo Handa } __packed; 23482e0f001STetsuo Handa 23582e0f001STetsuo Handa /* 236cb0abe6aSTetsuo Handa * tomoyo_request_info is a structure which is used for holding 237cb0abe6aSTetsuo Handa * 238cb0abe6aSTetsuo Handa * (1) Domain information of current process. 23917fcfbd9STetsuo Handa * (2) How many retries are made for this request. 24017fcfbd9STetsuo Handa * (3) Profile number used for this request. 24117fcfbd9STetsuo Handa * (4) Access control mode of the profile. 242cb0abe6aSTetsuo Handa */ 243cb0abe6aSTetsuo Handa struct tomoyo_request_info { 244cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 245cf6e9a64STetsuo Handa /* For holding parameters. */ 246cf6e9a64STetsuo Handa union { 247cf6e9a64STetsuo Handa struct { 248cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 249cf6e9a64STetsuo Handa u8 operation; 250cf6e9a64STetsuo Handa } path; 251cf6e9a64STetsuo Handa struct { 252cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 253cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 254cf6e9a64STetsuo Handa u8 operation; 255cf6e9a64STetsuo Handa } path2; 256cf6e9a64STetsuo Handa struct { 257cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 258cf6e9a64STetsuo Handa unsigned int mode; 259cf6e9a64STetsuo Handa unsigned int major; 260cf6e9a64STetsuo Handa unsigned int minor; 261cf6e9a64STetsuo Handa u8 operation; 262cf6e9a64STetsuo Handa } mkdev; 263cf6e9a64STetsuo Handa struct { 264cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 265cf6e9a64STetsuo Handa unsigned long number; 266cf6e9a64STetsuo Handa u8 operation; 267cf6e9a64STetsuo Handa } path_number; 268cf6e9a64STetsuo Handa struct { 269cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 270cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 271cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 272cf6e9a64STetsuo Handa unsigned long flags; 273cf6e9a64STetsuo Handa int need_dev; 274cf6e9a64STetsuo Handa } mount; 275cf6e9a64STetsuo Handa } param; 276cf6e9a64STetsuo Handa u8 param_type; 277cf6e9a64STetsuo Handa bool granted; 27817fcfbd9STetsuo Handa u8 retry; 27917fcfbd9STetsuo Handa u8 profile; 280cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 28157c2590fSTetsuo Handa u8 type; 282cb0abe6aSTetsuo Handa }; 283cb0abe6aSTetsuo Handa 284cb0abe6aSTetsuo Handa /* 285c3fa109aSTetsuo Handa * tomoyo_path_info is a structure which is used for holding a string data 286c3fa109aSTetsuo Handa * used by TOMOYO. 287c3fa109aSTetsuo Handa * This structure has several fields for supporting pattern matching. 288c3fa109aSTetsuo Handa * 289c3fa109aSTetsuo Handa * (1) "name" is the '\0' terminated string data. 290c3fa109aSTetsuo Handa * (2) "hash" is full_name_hash(name, strlen(name)). 291c3fa109aSTetsuo Handa * This allows tomoyo_pathcmp() to compare by hash before actually compare 292c3fa109aSTetsuo Handa * using strcmp(). 293c3fa109aSTetsuo Handa * (3) "const_len" is the length of the initial segment of "name" which 294c3fa109aSTetsuo Handa * consists entirely of non wildcard characters. In other words, the length 295c3fa109aSTetsuo Handa * which we can compare two strings using strncmp(). 296c3fa109aSTetsuo Handa * (4) "is_dir" is a bool which is true if "name" ends with "/", 297c3fa109aSTetsuo Handa * false otherwise. 298c3fa109aSTetsuo Handa * TOMOYO distinguishes directory and non-directory. A directory ends with 299c3fa109aSTetsuo Handa * "/" and non-directory does not end with "/". 300c3fa109aSTetsuo Handa * (5) "is_patterned" is a bool which is true if "name" contains wildcard 301c3fa109aSTetsuo Handa * characters, false otherwise. This allows TOMOYO to use "hash" and 302c3fa109aSTetsuo Handa * strcmp() for string comparison if "is_patterned" is false. 303c3fa109aSTetsuo Handa */ 3049590837bSKentaro Takeda struct tomoyo_path_info { 3059590837bSKentaro Takeda const char *name; 3069590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 3079590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 3089590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 3099590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 3109590837bSKentaro Takeda }; 3119590837bSKentaro Takeda 3129590837bSKentaro Takeda /* 31376bb0895STetsuo Handa * tomoyo_name_entry is a structure which is used for linking 31476bb0895STetsuo Handa * "struct tomoyo_path_info" into tomoyo_name_list . 3159590837bSKentaro Takeda */ 31676bb0895STetsuo Handa struct tomoyo_name_entry { 31776bb0895STetsuo Handa struct list_head list; 31876bb0895STetsuo Handa atomic_t users; 31976bb0895STetsuo Handa struct tomoyo_path_info entry; 32076bb0895STetsuo Handa }; 3219590837bSKentaro Takeda 3227762fbffSTetsuo Handa struct tomoyo_name_union { 3237762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 324a98aa4deSTetsuo Handa struct tomoyo_group *group; 3257762fbffSTetsuo Handa u8 is_group; 3267762fbffSTetsuo Handa }; 3277762fbffSTetsuo Handa 3284c3e9e2dSTetsuo Handa struct tomoyo_number_union { 3294c3e9e2dSTetsuo Handa unsigned long values[2]; 330a98aa4deSTetsuo Handa struct tomoyo_group *group; 3314c3e9e2dSTetsuo Handa u8 min_type; 3324c3e9e2dSTetsuo Handa u8 max_type; 3334c3e9e2dSTetsuo Handa u8 is_group; 3344c3e9e2dSTetsuo Handa }; 3354c3e9e2dSTetsuo Handa 336a98aa4deSTetsuo Handa /* Structure for "path_group"/"number_group" directive. */ 337a98aa4deSTetsuo Handa struct tomoyo_group { 338a98aa4deSTetsuo Handa struct list_head list; 339a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 340a98aa4deSTetsuo Handa struct list_head member_list; 341a98aa4deSTetsuo Handa atomic_t users; 342a98aa4deSTetsuo Handa }; 343a98aa4deSTetsuo Handa 3447762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 3457762fbffSTetsuo Handa struct tomoyo_path_group { 34682e0f001STetsuo Handa struct tomoyo_acl_head head; 3477762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 3487762fbffSTetsuo Handa }; 3497762fbffSTetsuo Handa 3504c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 351a98aa4deSTetsuo Handa struct tomoyo_number_group { 35282e0f001STetsuo Handa struct tomoyo_acl_head head; 3534c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 3544c3e9e2dSTetsuo Handa }; 3554c3e9e2dSTetsuo Handa 3569590837bSKentaro Takeda /* 357c3fa109aSTetsuo Handa * tomoyo_acl_info is a structure which is used for holding 358c3fa109aSTetsuo Handa * 359c3fa109aSTetsuo Handa * (1) "list" which is linked to the ->acl_info_list of 360c3fa109aSTetsuo Handa * "struct tomoyo_domain_info" 361237ab459STetsuo Handa * (2) "is_deleted" is a bool which is true if this domain is marked as 362237ab459STetsuo Handa * "deleted", false otherwise. 363237ab459STetsuo Handa * (3) "type" which tells type of the entry. 3649590837bSKentaro Takeda * 3659590837bSKentaro Takeda * Packing "struct tomoyo_acl_info" allows 366237ab459STetsuo Handa * "struct tomoyo_path_acl" to embed "u16" and "struct tomoyo_path2_acl" 36775093152STetsuo Handa * "struct tomoyo_path_number_acl" "struct tomoyo_mkdev_acl" to embed 368237ab459STetsuo Handa * "u8" without enlarging their structure size. 3699590837bSKentaro Takeda */ 3709590837bSKentaro Takeda struct tomoyo_acl_info { 3719590837bSKentaro Takeda struct list_head list; 372237ab459STetsuo Handa bool is_deleted; 373237ab459STetsuo Handa u8 type; /* = one of values in "enum tomoyo_acl_entry_type_index". */ 3749590837bSKentaro Takeda } __packed; 3759590837bSKentaro Takeda 376c3fa109aSTetsuo Handa /* 377c3fa109aSTetsuo Handa * tomoyo_domain_info is a structure which is used for holding permissions 378c3fa109aSTetsuo Handa * (e.g. "allow_read /lib/libc-2.5.so") given to each domain. 379c3fa109aSTetsuo Handa * It has following fields. 380c3fa109aSTetsuo Handa * 381c3fa109aSTetsuo Handa * (1) "list" which is linked to tomoyo_domain_list . 382c3fa109aSTetsuo Handa * (2) "acl_info_list" which is linked to "struct tomoyo_acl_info". 383c3fa109aSTetsuo Handa * (3) "domainname" which holds the name of the domain. 384c3fa109aSTetsuo Handa * (4) "profile" which remembers profile number assigned to this domain. 385c3fa109aSTetsuo Handa * (5) "is_deleted" is a bool which is true if this domain is marked as 386c3fa109aSTetsuo Handa * "deleted", false otherwise. 387c3fa109aSTetsuo Handa * (6) "quota_warned" is a bool which is used for suppressing warning message 388c3fa109aSTetsuo Handa * when learning mode learned too much entries. 389ea13ddbaSTetsuo Handa * (7) "ignore_global_allow_read" is a bool which is true if this domain 390ea13ddbaSTetsuo Handa * should ignore "allow_read" directive in exception policy. 391ea13ddbaSTetsuo Handa * (8) "transition_failed" is a bool which is set to true when this domain was 392ea13ddbaSTetsuo Handa * unable to create a new domain at tomoyo_find_next_domain() because the 393ea13ddbaSTetsuo Handa * name of the domain to be created was too long or it could not allocate 394ea13ddbaSTetsuo Handa * memory. If set to true, more than one process continued execve() 395ea13ddbaSTetsuo Handa * without domain transition. 396ec8e6a4eSTetsuo Handa * (9) "users" is an atomic_t that holds how many "struct cred"->security 397ec8e6a4eSTetsuo Handa * are referring this "struct tomoyo_domain_info". If is_deleted == true 398ec8e6a4eSTetsuo Handa * and users == 0, this struct will be kfree()d upon next garbage 399ec8e6a4eSTetsuo Handa * collection. 400c3fa109aSTetsuo Handa * 401c3fa109aSTetsuo Handa * A domain's lifecycle is an analogy of files on / directory. 402c3fa109aSTetsuo Handa * Multiple domains with the same domainname cannot be created (as with 403c3fa109aSTetsuo Handa * creating files with the same filename fails with -EEXIST). 404c3fa109aSTetsuo Handa * If a process reached a domain, that process can reside in that domain after 405c3fa109aSTetsuo Handa * that domain is marked as "deleted" (as with a process can access an already 406c3fa109aSTetsuo Handa * open()ed file after that file was unlink()ed). 407c3fa109aSTetsuo Handa */ 4089590837bSKentaro Takeda struct tomoyo_domain_info { 4099590837bSKentaro Takeda struct list_head list; 4109590837bSKentaro Takeda struct list_head acl_info_list; 4119590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 4129590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 4139590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 414a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 4159590837bSKentaro Takeda bool quota_warned; /* Quota warnning flag. */ 416ea13ddbaSTetsuo Handa bool ignore_global_allow_read; /* Ignore "allow_read" flag. */ 417ea13ddbaSTetsuo Handa bool transition_failed; /* Domain transition failed flag. */ 418ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 4199590837bSKentaro Takeda }; 4209590837bSKentaro Takeda 4219590837bSKentaro Takeda /* 4227ef61233STetsuo Handa * tomoyo_path_acl is a structure which is used for holding an 423c3fa109aSTetsuo Handa * entry with one pathname operation (e.g. open(), mkdir()). 424c3fa109aSTetsuo Handa * It has following fields. 425c3fa109aSTetsuo Handa * 426c3fa109aSTetsuo Handa * (1) "head" which is a "struct tomoyo_acl_info". 427c3fa109aSTetsuo Handa * (2) "perm" which is a bitmask of permitted operations. 4287762fbffSTetsuo Handa * (3) "name" is the pathname. 429c3fa109aSTetsuo Handa * 430c3fa109aSTetsuo Handa * Directives held by this structure are "allow_read/write", "allow_execute", 431a1f9bb6aSTetsuo Handa * "allow_read", "allow_write", "allow_unlink", "allow_rmdir", 4322106ccd9STetsuo Handa * "allow_truncate", "allow_symlink", "allow_rewrite", "allow_chroot" and 4332106ccd9STetsuo Handa * "allow_unmount". 4349590837bSKentaro Takeda */ 4357ef61233STetsuo Handa struct tomoyo_path_acl { 4367ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 4379590837bSKentaro Takeda u16 perm; 4387762fbffSTetsuo Handa struct tomoyo_name_union name; 4399590837bSKentaro Takeda }; 4409590837bSKentaro Takeda 441c3fa109aSTetsuo Handa /* 442a1f9bb6aSTetsuo Handa * tomoyo_path_number_acl is a structure which is used for holding an 443a1f9bb6aSTetsuo Handa * entry with one pathname and one number operation. 444a1f9bb6aSTetsuo Handa * It has following fields. 445a1f9bb6aSTetsuo Handa * 446a1f9bb6aSTetsuo Handa * (1) "head" which is a "struct tomoyo_acl_info". 447a1f9bb6aSTetsuo Handa * (2) "perm" which is a bitmask of permitted operations. 448a1f9bb6aSTetsuo Handa * (3) "name" is the pathname. 449a1f9bb6aSTetsuo Handa * (4) "number" is the numeric value. 450a1f9bb6aSTetsuo Handa * 451a1f9bb6aSTetsuo Handa * Directives held by this structure are "allow_create", "allow_mkdir", 452a1f9bb6aSTetsuo Handa * "allow_ioctl", "allow_mkfifo", "allow_mksock", "allow_chmod", "allow_chown" 453a1f9bb6aSTetsuo Handa * and "allow_chgrp". 454a1f9bb6aSTetsuo Handa * 455a1f9bb6aSTetsuo Handa */ 456a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 457a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 458a1f9bb6aSTetsuo Handa u8 perm; 459a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 460a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 461a1f9bb6aSTetsuo Handa }; 462a1f9bb6aSTetsuo Handa 463a1f9bb6aSTetsuo Handa /* 46475093152STetsuo Handa * tomoyo_mkdev_acl is a structure which is used for holding an 465a1f9bb6aSTetsuo Handa * entry with one pathname and three numbers operation. 466a1f9bb6aSTetsuo Handa * It has following fields. 467a1f9bb6aSTetsuo Handa * 468a1f9bb6aSTetsuo Handa * (1) "head" which is a "struct tomoyo_acl_info". 469a1f9bb6aSTetsuo Handa * (2) "perm" which is a bitmask of permitted operations. 470a1f9bb6aSTetsuo Handa * (3) "mode" is the create mode. 471a1f9bb6aSTetsuo Handa * (4) "major" is the major number of device node. 472a1f9bb6aSTetsuo Handa * (5) "minor" is the minor number of device node. 473a1f9bb6aSTetsuo Handa * 474a1f9bb6aSTetsuo Handa * Directives held by this structure are "allow_mkchar", "allow_mkblock". 475a1f9bb6aSTetsuo Handa * 476a1f9bb6aSTetsuo Handa */ 47775093152STetsuo Handa struct tomoyo_mkdev_acl { 47875093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 479a1f9bb6aSTetsuo Handa u8 perm; 480a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 481a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 482a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 483a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 484a1f9bb6aSTetsuo Handa }; 485a1f9bb6aSTetsuo Handa 486a1f9bb6aSTetsuo Handa /* 4877ef61233STetsuo Handa * tomoyo_path2_acl is a structure which is used for holding an 488937bf613STetsuo Handa * entry with two pathnames operation (i.e. link(), rename() and pivot_root()). 489c3fa109aSTetsuo Handa * It has following fields. 490c3fa109aSTetsuo Handa * 491c3fa109aSTetsuo Handa * (1) "head" which is a "struct tomoyo_acl_info". 492c3fa109aSTetsuo Handa * (2) "perm" which is a bitmask of permitted operations. 4937762fbffSTetsuo Handa * (3) "name1" is the source/old pathname. 4947762fbffSTetsuo Handa * (4) "name2" is the destination/new pathname. 495c3fa109aSTetsuo Handa * 496937bf613STetsuo Handa * Directives held by this structure are "allow_rename", "allow_link" and 497937bf613STetsuo Handa * "allow_pivot_root". 498c3fa109aSTetsuo Handa */ 4997ef61233STetsuo Handa struct tomoyo_path2_acl { 5007ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 5019590837bSKentaro Takeda u8 perm; 5027762fbffSTetsuo Handa struct tomoyo_name_union name1; 5037762fbffSTetsuo Handa struct tomoyo_name_union name2; 5049590837bSKentaro Takeda }; 5059590837bSKentaro Takeda 506c3fa109aSTetsuo Handa /* 5072106ccd9STetsuo Handa * tomoyo_mount_acl is a structure which is used for holding an 5082106ccd9STetsuo Handa * entry for mount operation. 5092106ccd9STetsuo Handa * It has following fields. 5102106ccd9STetsuo Handa * 5112106ccd9STetsuo Handa * (1) "head" which is a "struct tomoyo_acl_info". 512237ab459STetsuo Handa * (2) "dev_name" is the device name. 513237ab459STetsuo Handa * (3) "dir_name" is the mount point. 514237ab459STetsuo Handa * (4) "fs_type" is the filesystem type. 5152106ccd9STetsuo Handa * (5) "flags" is the mount flags. 5162106ccd9STetsuo Handa * 517237ab459STetsuo Handa * Directive held by this structure is "allow_mount". 5182106ccd9STetsuo Handa */ 5192106ccd9STetsuo Handa struct tomoyo_mount_acl { 5202106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 5212106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 5222106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 5232106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 5242106ccd9STetsuo Handa struct tomoyo_number_union flags; 5252106ccd9STetsuo Handa }; 5262106ccd9STetsuo Handa 5272106ccd9STetsuo Handa /* 528c3fa109aSTetsuo Handa * tomoyo_io_buffer is a structure which is used for reading and modifying 529c3fa109aSTetsuo Handa * configuration via /sys/kernel/security/tomoyo/ interface. 530c3fa109aSTetsuo Handa * It has many fields. ->read_var1 , ->read_var2 , ->write_var1 are used as 531c3fa109aSTetsuo Handa * cursors. 532c3fa109aSTetsuo Handa * 533c3fa109aSTetsuo Handa * Since the content of /sys/kernel/security/tomoyo/domain_policy is a list of 534c3fa109aSTetsuo Handa * "struct tomoyo_domain_info" entries and each "struct tomoyo_domain_info" 535c3fa109aSTetsuo Handa * entry has a list of "struct tomoyo_acl_info", we need two cursors when 536c3fa109aSTetsuo Handa * reading (one is for traversing tomoyo_domain_list and the other is for 537c3fa109aSTetsuo Handa * traversing "struct tomoyo_acl_info"->acl_info_list ). 538c3fa109aSTetsuo Handa * 539c3fa109aSTetsuo Handa * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 540c3fa109aSTetsuo Handa * "select ", TOMOYO seeks the cursor ->read_var1 and ->write_var1 to the 541c3fa109aSTetsuo Handa * domain with the domainname specified by the rest of that line (NULL is set 542c3fa109aSTetsuo Handa * if seek failed). 543c3fa109aSTetsuo Handa * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 544c3fa109aSTetsuo Handa * "delete ", TOMOYO deletes an entry or a domain specified by the rest of that 545c3fa109aSTetsuo Handa * line (->write_var1 is set to NULL if a domain was deleted). 546c3fa109aSTetsuo Handa * If a line written to /sys/kernel/security/tomoyo/domain_policy starts with 547c3fa109aSTetsuo Handa * neither "select " nor "delete ", an entry or a domain specified by that line 548c3fa109aSTetsuo Handa * is appended. 549c3fa109aSTetsuo Handa */ 5509590837bSKentaro Takeda struct tomoyo_io_buffer { 5518fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 5529590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 55317fcfbd9STetsuo Handa int (*poll) (struct file *file, poll_table *wait); 5549590837bSKentaro Takeda /* Exclusive lock for this structure. */ 5559590837bSKentaro Takeda struct mutex io_sem; 556fdb8ebb7STetsuo Handa /* Index returned by tomoyo_read_lock(). */ 557fdb8ebb7STetsuo Handa int reader_idx; 5589590837bSKentaro Takeda /* The position currently reading from. */ 5599590837bSKentaro Takeda struct list_head *read_var1; 5609590837bSKentaro Takeda /* Extra variables for reading. */ 5619590837bSKentaro Takeda struct list_head *read_var2; 5629590837bSKentaro Takeda /* The position currently writing to. */ 5639590837bSKentaro Takeda struct tomoyo_domain_info *write_var1; 5649590837bSKentaro Takeda /* The step for reading. */ 5659590837bSKentaro Takeda int read_step; 5669590837bSKentaro Takeda /* Buffer for reading. */ 5679590837bSKentaro Takeda char *read_buf; 5689590837bSKentaro Takeda /* EOF flag for reading. */ 5699590837bSKentaro Takeda bool read_eof; 5709590837bSKentaro Takeda /* Read domain ACL of specified PID? */ 5719590837bSKentaro Takeda bool read_single_domain; 5729590837bSKentaro Takeda /* Extra variable for reading. */ 5739590837bSKentaro Takeda u8 read_bit; 5749590837bSKentaro Takeda /* Bytes available for reading. */ 5759590837bSKentaro Takeda int read_avail; 5769590837bSKentaro Takeda /* Size of read buffer. */ 5779590837bSKentaro Takeda int readbuf_size; 5789590837bSKentaro Takeda /* Buffer for writing. */ 5799590837bSKentaro Takeda char *write_buf; 5809590837bSKentaro Takeda /* Bytes available for writing. */ 5819590837bSKentaro Takeda int write_avail; 5829590837bSKentaro Takeda /* Size of write buffer. */ 5839590837bSKentaro Takeda int writebuf_size; 58417fcfbd9STetsuo Handa /* Type of this interface. */ 58517fcfbd9STetsuo Handa u8 type; 5869590837bSKentaro Takeda }; 5879590837bSKentaro Takeda 58876bb0895STetsuo Handa /* 58976bb0895STetsuo Handa * tomoyo_globally_readable_file_entry is a structure which is used for holding 59076bb0895STetsuo Handa * "allow_read" entries. 59176bb0895STetsuo Handa * It has following fields. 59276bb0895STetsuo Handa * 59382e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 59476bb0895STetsuo Handa * (2) "filename" is a pathname which is allowed to open(O_RDONLY). 59576bb0895STetsuo Handa */ 59676bb0895STetsuo Handa struct tomoyo_globally_readable_file_entry { 59782e0f001STetsuo Handa struct tomoyo_acl_head head; 59876bb0895STetsuo Handa const struct tomoyo_path_info *filename; 59976bb0895STetsuo Handa }; 60076bb0895STetsuo Handa 60176bb0895STetsuo Handa /* 60276bb0895STetsuo Handa * tomoyo_pattern_entry is a structure which is used for holding 603a230f9e7STetsuo Handa * "file_pattern" entries. 60476bb0895STetsuo Handa * It has following fields. 60576bb0895STetsuo Handa * 60682e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 60776bb0895STetsuo Handa * (2) "pattern" is a pathname pattern which is used for converting pathnames 60876bb0895STetsuo Handa * to pathname patterns during learning mode. 60976bb0895STetsuo Handa */ 61076bb0895STetsuo Handa struct tomoyo_pattern_entry { 61182e0f001STetsuo Handa struct tomoyo_acl_head head; 61276bb0895STetsuo Handa const struct tomoyo_path_info *pattern; 61376bb0895STetsuo Handa }; 61476bb0895STetsuo Handa 61576bb0895STetsuo Handa /* 61676bb0895STetsuo Handa * tomoyo_no_rewrite_entry is a structure which is used for holding 61776bb0895STetsuo Handa * "deny_rewrite" entries. 61876bb0895STetsuo Handa * It has following fields. 61976bb0895STetsuo Handa * 62082e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 62176bb0895STetsuo Handa * (2) "pattern" is a pathname which is by default not permitted to modify 62276bb0895STetsuo Handa * already existing content. 62376bb0895STetsuo Handa */ 62476bb0895STetsuo Handa struct tomoyo_no_rewrite_entry { 62582e0f001STetsuo Handa struct tomoyo_acl_head head; 62676bb0895STetsuo Handa const struct tomoyo_path_info *pattern; 62776bb0895STetsuo Handa }; 62876bb0895STetsuo Handa 62976bb0895STetsuo Handa /* 6305448ec4fSTetsuo Handa * tomoyo_transition_control is a structure which is used for holding 6315448ec4fSTetsuo Handa * "initialize_domain"/"no_initialize_domain"/"keep_domain"/"no_keep_domain" 6325448ec4fSTetsuo Handa * entries. 63376bb0895STetsuo Handa * It has following fields. 63476bb0895STetsuo Handa * 63582e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 6365448ec4fSTetsuo Handa * (2) "type" is type of this entry. 63782e0f001STetsuo Handa * (3) "is_last_name" is a bool which is true if "domainname" is "the last 63876bb0895STetsuo Handa * component of a domainname", false otherwise. 63982e0f001STetsuo Handa * (4) "domainname" which is "a domainname" or "the last component of a 64082e0f001STetsuo Handa * domainname". 64182e0f001STetsuo Handa * (5) "program" which is a program's pathname. 64276bb0895STetsuo Handa */ 6435448ec4fSTetsuo Handa struct tomoyo_transition_control { 64482e0f001STetsuo Handa struct tomoyo_acl_head head; 6455448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 64676bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 64776bb0895STetsuo Handa bool is_last_name; 6485448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 6495448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 65076bb0895STetsuo Handa }; 65176bb0895STetsuo Handa 65276bb0895STetsuo Handa /* 6531084307cSTetsuo Handa * tomoyo_aggregator_entry is a structure which is used for holding 6541084307cSTetsuo Handa * "aggregator" entries. 6551084307cSTetsuo Handa * It has following fields. 6561084307cSTetsuo Handa * 65782e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 6581084307cSTetsuo Handa * (2) "original_name" which is originally requested name. 6591084307cSTetsuo Handa * (3) "aggregated_name" which is name to rewrite. 6601084307cSTetsuo Handa */ 6611084307cSTetsuo Handa struct tomoyo_aggregator_entry { 66282e0f001STetsuo Handa struct tomoyo_acl_head head; 6631084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 6641084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 6651084307cSTetsuo Handa }; 6661084307cSTetsuo Handa 6671084307cSTetsuo Handa /* 66876bb0895STetsuo Handa * tomoyo_policy_manager_entry is a structure which is used for holding list of 66976bb0895STetsuo Handa * domainnames or programs which are permitted to modify configuration via 67076bb0895STetsuo Handa * /sys/kernel/security/tomoyo/ interface. 67176bb0895STetsuo Handa * It has following fields. 67276bb0895STetsuo Handa * 67382e0f001STetsuo Handa * (1) "head" is "struct tomoyo_acl_head". 67482e0f001STetsuo Handa * (2) "is_domain" is a bool which is true if "manager" is a domainname, false 67576bb0895STetsuo Handa * otherwise. 67682e0f001STetsuo Handa * (3) "manager" is a domainname or a program's pathname. 67776bb0895STetsuo Handa */ 67876bb0895STetsuo Handa struct tomoyo_policy_manager_entry { 67982e0f001STetsuo Handa struct tomoyo_acl_head head; 68082e0f001STetsuo Handa bool is_domain; /* True if manager is a domainname. */ 68176bb0895STetsuo Handa /* A path to program or a domainname. */ 68276bb0895STetsuo Handa const struct tomoyo_path_info *manager; 68376bb0895STetsuo Handa }; 68476bb0895STetsuo Handa 68557c2590fSTetsuo Handa struct tomoyo_preference { 68657c2590fSTetsuo Handa unsigned int learning_max_entry; 68757c2590fSTetsuo Handa bool enforcing_verbose; 68857c2590fSTetsuo Handa bool learning_verbose; 68957c2590fSTetsuo Handa bool permissive_verbose; 69057c2590fSTetsuo Handa }; 69157c2590fSTetsuo Handa 69257c2590fSTetsuo Handa struct tomoyo_profile { 69357c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 69457c2590fSTetsuo Handa struct tomoyo_preference *learning; 69557c2590fSTetsuo Handa struct tomoyo_preference *permissive; 69657c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 69757c2590fSTetsuo Handa struct tomoyo_preference preference; 69857c2590fSTetsuo Handa u8 default_config; 69957c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 70057c2590fSTetsuo Handa }; 70157c2590fSTetsuo Handa 70276bb0895STetsuo Handa /********** Function prototypes. **********/ 70376bb0895STetsuo Handa 70417fcfbd9STetsuo Handa extern asmlinkage long sys_getpid(void); 70517fcfbd9STetsuo Handa extern asmlinkage long sys_getppid(void); 70617fcfbd9STetsuo Handa 707c3ef1500STetsuo Handa /* Check whether the given string starts with the given keyword. */ 708c3ef1500STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 709c3ef1500STetsuo Handa /* Get tomoyo_realpath() of current process. */ 710c3ef1500STetsuo Handa const char *tomoyo_get_exe(void); 711c3ef1500STetsuo Handa /* Format string. */ 712c3ef1500STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 713c3ef1500STetsuo Handa /* Print warning or error message on console. */ 714c3ef1500STetsuo Handa void tomoyo_warn_log(struct tomoyo_request_info *r, const char *fmt, ...) 715c3ef1500STetsuo Handa __attribute__ ((format(printf, 2, 3))); 716c3ef1500STetsuo Handa /* Check all profiles currently assigned to domains are defined. */ 717c3ef1500STetsuo Handa void tomoyo_check_profile(void); 718c3ef1500STetsuo Handa /* Open operation for /sys/kernel/security/tomoyo/ interface. */ 719c3ef1500STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 720c3ef1500STetsuo Handa /* Close /sys/kernel/security/tomoyo/ interface. */ 721c3ef1500STetsuo Handa int tomoyo_close_control(struct file *file); 722c3ef1500STetsuo Handa /* Read operation for /sys/kernel/security/tomoyo/ interface. */ 723c3ef1500STetsuo Handa int tomoyo_read_control(struct file *file, char __user *buffer, 724c3ef1500STetsuo Handa const int buffer_len); 725c3ef1500STetsuo Handa /* Write operation for /sys/kernel/security/tomoyo/ interface. */ 726c3ef1500STetsuo Handa int tomoyo_write_control(struct file *file, const char __user *buffer, 727c3ef1500STetsuo Handa const int buffer_len); 728c3ef1500STetsuo Handa /* Check whether the domain has too many ACL entries to hold. */ 729c3ef1500STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 730c3ef1500STetsuo Handa /* Print out of memory warning message. */ 731c3ef1500STetsuo Handa void tomoyo_warn_oom(const char *function); 7327762fbffSTetsuo Handa /* Check whether the given name matches the given name_union. */ 7337762fbffSTetsuo Handa bool tomoyo_compare_name_union(const struct tomoyo_path_info *name, 7347762fbffSTetsuo Handa const struct tomoyo_name_union *ptr); 7352106ccd9STetsuo Handa /* Check whether the given number matches the given number_union. */ 7362106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 7372106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 73857c2590fSTetsuo Handa int tomoyo_get_mode(const u8 profile, const u8 index); 7399590837bSKentaro Takeda /* Transactional sprintf() for policy dump. */ 7409590837bSKentaro Takeda bool tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 7419590837bSKentaro Takeda __attribute__ ((format(printf, 2, 3))); 7429590837bSKentaro Takeda /* Check whether the domainname is correct. */ 74375093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 7449590837bSKentaro Takeda /* Check whether the token is correct. */ 74575093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 74675093152STetsuo Handa bool tomoyo_correct_word(const char *string); 7479590837bSKentaro Takeda /* Check whether the token can be a domainname. */ 74875093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 7497762fbffSTetsuo Handa bool tomoyo_parse_name_union(const char *filename, 7507762fbffSTetsuo Handa struct tomoyo_name_union *ptr); 7517762fbffSTetsuo Handa /* Check whether the given filename matches the given path_group. */ 7527762fbffSTetsuo Handa bool tomoyo_path_matches_group(const struct tomoyo_path_info *pathname, 753a98aa4deSTetsuo Handa const struct tomoyo_group *group); 7544c3e9e2dSTetsuo Handa /* Check whether the given value matches the given number_group. */ 7554c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 7564c3e9e2dSTetsuo Handa const unsigned long max, 757a98aa4deSTetsuo Handa const struct tomoyo_group *group); 7589590837bSKentaro Takeda /* Check whether the given filename matches the given pattern. */ 7599590837bSKentaro Takeda bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 7609590837bSKentaro Takeda const struct tomoyo_path_info *pattern); 7614c3e9e2dSTetsuo Handa 7624c3e9e2dSTetsuo Handa bool tomoyo_print_number_union(struct tomoyo_io_buffer *head, 7634c3e9e2dSTetsuo Handa const struct tomoyo_number_union *ptr); 7644c3e9e2dSTetsuo Handa bool tomoyo_parse_number_union(char *data, struct tomoyo_number_union *num); 7657762fbffSTetsuo Handa /* Tokenize a line. */ 7667762fbffSTetsuo Handa bool tomoyo_tokenize(char *buffer, char *w[], size_t size); 7679590837bSKentaro Takeda /* Write domain policy violation warning message to console? */ 7689590837bSKentaro Takeda bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain); 7699590837bSKentaro Takeda /* Get the last component of the given domainname. */ 7709590837bSKentaro Takeda const char *tomoyo_get_last_name(const struct tomoyo_domain_info *domain); 7712106ccd9STetsuo Handa /* Fill "struct tomoyo_request_info". */ 7722106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 77357c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 77457c2590fSTetsuo Handa const u8 index); 7752106ccd9STetsuo Handa /* Check permission for mount operation. */ 7762106ccd9STetsuo Handa int tomoyo_mount_permission(char *dev_name, struct path *path, char *type, 7772106ccd9STetsuo Handa unsigned long flags, void *data_page); 7781084307cSTetsuo Handa /* Create "aggregator" entry in exception policy. */ 7791084307cSTetsuo Handa int tomoyo_write_aggregator_policy(char *data, const bool is_delete); 7805448ec4fSTetsuo Handa int tomoyo_write_transition_control(char *data, const bool is_delete, 7815448ec4fSTetsuo Handa const u8 type); 7829590837bSKentaro Takeda /* 7839590837bSKentaro Takeda * Create "allow_read/write", "allow_execute", "allow_read", "allow_write", 7849590837bSKentaro Takeda * "allow_create", "allow_unlink", "allow_mkdir", "allow_rmdir", 7859590837bSKentaro Takeda * "allow_mkfifo", "allow_mksock", "allow_mkblock", "allow_mkchar", 7869590837bSKentaro Takeda * "allow_truncate", "allow_symlink", "allow_rewrite", "allow_rename" and 7879590837bSKentaro Takeda * "allow_link" entry in domain policy. 7889590837bSKentaro Takeda */ 7899590837bSKentaro Takeda int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain, 7909590837bSKentaro Takeda const bool is_delete); 7919590837bSKentaro Takeda /* Create "allow_read" entry in exception policy. */ 7929590837bSKentaro Takeda int tomoyo_write_globally_readable_policy(char *data, const bool is_delete); 7932106ccd9STetsuo Handa /* Create "allow_mount" entry in domain policy. */ 7942106ccd9STetsuo Handa int tomoyo_write_mount_policy(char *data, struct tomoyo_domain_info *domain, 7952106ccd9STetsuo Handa const bool is_delete); 7969590837bSKentaro Takeda /* Create "deny_rewrite" entry in exception policy. */ 7979590837bSKentaro Takeda int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete); 7989590837bSKentaro Takeda /* Create "file_pattern" entry in exception policy. */ 7999590837bSKentaro Takeda int tomoyo_write_pattern_policy(char *data, const bool is_delete); 8007c2ea22eSTetsuo Handa /* Create "path_group"/"number_group" entry in exception policy. */ 8017c2ea22eSTetsuo Handa int tomoyo_write_group(char *data, const bool is_delete, const u8 type); 80217fcfbd9STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 80317fcfbd9STetsuo Handa __attribute__ ((format(printf, 2, 3))); 8049590837bSKentaro Takeda /* Find a domain by the given name. */ 8059590837bSKentaro Takeda struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 8069590837bSKentaro Takeda /* Find or create a domain by the given name. */ 8079590837bSKentaro Takeda struct tomoyo_domain_info *tomoyo_find_or_assign_new_domain(const char * 8089590837bSKentaro Takeda domainname, 8099590837bSKentaro Takeda const u8 profile); 81057c2590fSTetsuo Handa struct tomoyo_profile *tomoyo_profile(const u8 profile); 8117c2ea22eSTetsuo Handa /* 8127c2ea22eSTetsuo Handa * Allocate memory for "struct tomoyo_path_group"/"struct tomoyo_number_group". 8137c2ea22eSTetsuo Handa */ 8147c2ea22eSTetsuo Handa struct tomoyo_group *tomoyo_get_group(const char *group_name, const u8 type); 8157762fbffSTetsuo Handa 8169590837bSKentaro Takeda /* Check mode for specified functionality. */ 8179590837bSKentaro Takeda unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 8189590837bSKentaro Takeda const u8 index); 8199590837bSKentaro Takeda /* Fill in "struct tomoyo_path_info" members. */ 8209590837bSKentaro Takeda void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 8219590837bSKentaro Takeda /* Run policy loader when /sbin/init starts. */ 8229590837bSKentaro Takeda void tomoyo_load_policy(const char *filename); 8239590837bSKentaro Takeda 8244c3e9e2dSTetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 8254c3e9e2dSTetsuo Handa 82676bb0895STetsuo Handa /* Convert binary string to ascii string. */ 827c8c57e84STetsuo Handa char *tomoyo_encode(const char *str); 82876bb0895STetsuo Handa 82976bb0895STetsuo Handa /* 8300617c7ffSTetsuo Handa * Returns realpath(3) of the given pathname except that 8310617c7ffSTetsuo Handa * ignores chroot'ed root and does not follow the final symlink. 83276bb0895STetsuo Handa */ 83376bb0895STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 8340617c7ffSTetsuo Handa /* 8350617c7ffSTetsuo Handa * Returns realpath(3) of the given pathname except that 8360617c7ffSTetsuo Handa * ignores chroot'ed root and the pathname is already solved. 8370617c7ffSTetsuo Handa */ 83876bb0895STetsuo Handa char *tomoyo_realpath_from_path(struct path *path); 83917fcfbd9STetsuo Handa /* Get patterned pathname. */ 84017fcfbd9STetsuo Handa const char *tomoyo_file_pattern(const struct tomoyo_path_info *filename); 84176bb0895STetsuo Handa 84276bb0895STetsuo Handa /* Check memory quota. */ 84376bb0895STetsuo Handa bool tomoyo_memory_ok(void *ptr); 8449e4b50e9STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 84576bb0895STetsuo Handa 84676bb0895STetsuo Handa /* 84776bb0895STetsuo Handa * Keep the given name on the RAM. 84876bb0895STetsuo Handa * The RAM is shared, so NEVER try to modify or kfree() the returned name. 84976bb0895STetsuo Handa */ 85076bb0895STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 85176bb0895STetsuo Handa 85276bb0895STetsuo Handa /* Check for memory usage. */ 8538fbe71f0STetsuo Handa void tomoyo_read_memory_counter(struct tomoyo_io_buffer *head); 85476bb0895STetsuo Handa 85576bb0895STetsuo Handa /* Set memory quota. */ 85676bb0895STetsuo Handa int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head); 85776bb0895STetsuo Handa 858c3ef1500STetsuo Handa /* Initialize mm related code. */ 859c3ef1500STetsuo Handa void __init tomoyo_mm_init(void); 86005336deeSTetsuo Handa int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 86176bb0895STetsuo Handa const struct tomoyo_path_info *filename); 86276bb0895STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 86376bb0895STetsuo Handa struct path *path, const int flag); 864a1f9bb6aSTetsuo Handa int tomoyo_path_number_perm(const u8 operation, struct path *path, 865a1f9bb6aSTetsuo Handa unsigned long number); 86675093152STetsuo Handa int tomoyo_mkdev_perm(const u8 operation, struct path *path, 867a1f9bb6aSTetsuo Handa const unsigned int mode, unsigned int dev); 86897d6931eSTetsuo Handa int tomoyo_path_perm(const u8 operation, struct path *path); 86997d6931eSTetsuo Handa int tomoyo_path2_perm(const u8 operation, struct path *path1, 87097d6931eSTetsuo Handa struct path *path2); 87176bb0895STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 87276bb0895STetsuo Handa 873a1f9bb6aSTetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 874a1f9bb6aSTetsuo Handa const unsigned long value, const u8 type); 875a1f9bb6aSTetsuo Handa 8767762fbffSTetsuo Handa /* Drop refcount on tomoyo_name_union. */ 8777762fbffSTetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 8787762fbffSTetsuo Handa 879847b173eSTetsuo Handa /* Run garbage collector. */ 880847b173eSTetsuo Handa void tomoyo_run_gc(void); 881847b173eSTetsuo Handa 882847b173eSTetsuo Handa void tomoyo_memory_free(void *ptr); 883847b173eSTetsuo Handa 884237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 885237ab459STetsuo Handa bool is_delete, struct tomoyo_domain_info *domain, 886237ab459STetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_info 887237ab459STetsuo Handa *, 888237ab459STetsuo Handa const struct tomoyo_acl_info 889237ab459STetsuo Handa *), 890237ab459STetsuo Handa bool (*merge_duplicate) (struct tomoyo_acl_info *, 891237ab459STetsuo Handa struct tomoyo_acl_info *, 892237ab459STetsuo Handa const bool)); 89336f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 89436f5e1ffSTetsuo Handa bool is_delete, struct list_head *list, 89536f5e1ffSTetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_head 89636f5e1ffSTetsuo Handa *, 89736f5e1ffSTetsuo Handa const struct tomoyo_acl_head 89836f5e1ffSTetsuo Handa *)); 89999a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 90099a85259STetsuo Handa bool (*check_entry) (const struct tomoyo_request_info *, 90199a85259STetsuo Handa const struct tomoyo_acl_info *)); 9025448ec4fSTetsuo Handa const char *tomoyo_last_word(const char *name); 903237ab459STetsuo Handa 90476bb0895STetsuo Handa /********** External variable definitions. **********/ 90576bb0895STetsuo Handa 90676bb0895STetsuo Handa /* Lock for GC. */ 90776bb0895STetsuo Handa extern struct srcu_struct tomoyo_ss; 90876bb0895STetsuo Handa 90976bb0895STetsuo Handa /* The list for "struct tomoyo_domain_info". */ 91076bb0895STetsuo Handa extern struct list_head tomoyo_domain_list; 91176bb0895STetsuo Handa 912a230f9e7STetsuo Handa extern struct list_head tomoyo_policy_list[TOMOYO_MAX_POLICY]; 913a230f9e7STetsuo Handa extern struct list_head tomoyo_group_list[TOMOYO_MAX_GROUP]; 914847b173eSTetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 915847b173eSTetsuo Handa 91676bb0895STetsuo Handa /* Lock for protecting policy. */ 91776bb0895STetsuo Handa extern struct mutex tomoyo_policy_lock; 91876bb0895STetsuo Handa 91976bb0895STetsuo Handa /* Has /sbin/init started? */ 92076bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 92176bb0895STetsuo Handa 92276bb0895STetsuo Handa /* The kernel's domain. */ 92376bb0895STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 92476bb0895STetsuo Handa 92571c28236STetsuo Handa extern const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 92671c28236STetsuo Handa extern const char *tomoyo_mkdev_keyword[TOMOYO_MAX_MKDEV_OPERATION]; 92771c28236STetsuo Handa extern const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION]; 92871c28236STetsuo Handa extern const char *tomoyo_path_number_keyword[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 92971c28236STetsuo Handa 93017fcfbd9STetsuo Handa extern unsigned int tomoyo_quota_for_query; 93117fcfbd9STetsuo Handa extern unsigned int tomoyo_query_memory_size; 93217fcfbd9STetsuo Handa 93376bb0895STetsuo Handa /********** Inlined functions. **********/ 93476bb0895STetsuo Handa 93576bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 93676bb0895STetsuo Handa { 93776bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 93876bb0895STetsuo Handa } 93976bb0895STetsuo Handa 94076bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 94176bb0895STetsuo Handa { 94276bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 94376bb0895STetsuo Handa } 94476bb0895STetsuo Handa 9459590837bSKentaro Takeda /* strcmp() for "struct tomoyo_path_info" structure. */ 9469590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 9479590837bSKentaro Takeda const struct tomoyo_path_info *b) 9489590837bSKentaro Takeda { 9499590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 9509590837bSKentaro Takeda } 9519590837bSKentaro Takeda 9529590837bSKentaro Takeda /** 95375093152STetsuo Handa * tomoyo_valid - Check whether the character is a valid char. 9549590837bSKentaro Takeda * 9559590837bSKentaro Takeda * @c: The character to check. 9569590837bSKentaro Takeda * 9579590837bSKentaro Takeda * Returns true if @c is a valid character, false otherwise. 9589590837bSKentaro Takeda */ 95975093152STetsuo Handa static inline bool tomoyo_valid(const unsigned char c) 9609590837bSKentaro Takeda { 9619590837bSKentaro Takeda return c > ' ' && c < 127; 9629590837bSKentaro Takeda } 9639590837bSKentaro Takeda 9649590837bSKentaro Takeda /** 96575093152STetsuo Handa * tomoyo_invalid - Check whether the character is an invalid char. 9669590837bSKentaro Takeda * 9679590837bSKentaro Takeda * @c: The character to check. 9689590837bSKentaro Takeda * 9699590837bSKentaro Takeda * Returns true if @c is an invalid character, false otherwise. 9709590837bSKentaro Takeda */ 97175093152STetsuo Handa static inline bool tomoyo_invalid(const unsigned char c) 9729590837bSKentaro Takeda { 9739590837bSKentaro Takeda return c && (c <= ' ' || c >= 127); 9749590837bSKentaro Takeda } 9759590837bSKentaro Takeda 97676bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 97776bb0895STetsuo Handa { 97876bb0895STetsuo Handa if (name) { 97976bb0895STetsuo Handa struct tomoyo_name_entry *ptr = 98076bb0895STetsuo Handa container_of(name, struct tomoyo_name_entry, entry); 98176bb0895STetsuo Handa atomic_dec(&ptr->users); 98276bb0895STetsuo Handa } 98376bb0895STetsuo Handa } 9849590837bSKentaro Takeda 985a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 9864c3e9e2dSTetsuo Handa { 9874c3e9e2dSTetsuo Handa if (group) 9884c3e9e2dSTetsuo Handa atomic_dec(&group->users); 9894c3e9e2dSTetsuo Handa } 9904c3e9e2dSTetsuo Handa 99176bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 99276bb0895STetsuo Handa { 99376bb0895STetsuo Handa return current_cred()->security; 99476bb0895STetsuo Handa } 9959590837bSKentaro Takeda 99676bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 99776bb0895STetsuo Handa *task) 99876bb0895STetsuo Handa { 99976bb0895STetsuo Handa return task_cred_xxx(task, security); 100076bb0895STetsuo Handa } 10019590837bSKentaro Takeda 100275093152STetsuo Handa static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *p1, 10037762fbffSTetsuo Handa const struct tomoyo_acl_info *p2) 10047762fbffSTetsuo Handa { 10057762fbffSTetsuo Handa return p1->type == p2->type; 10067762fbffSTetsuo Handa } 10077762fbffSTetsuo Handa 100875093152STetsuo Handa static inline bool tomoyo_same_name_union 10097762fbffSTetsuo Handa (const struct tomoyo_name_union *p1, const struct tomoyo_name_union *p2) 10107762fbffSTetsuo Handa { 10117762fbffSTetsuo Handa return p1->filename == p2->filename && p1->group == p2->group && 10127762fbffSTetsuo Handa p1->is_group == p2->is_group; 10137762fbffSTetsuo Handa } 10147762fbffSTetsuo Handa 101575093152STetsuo Handa static inline bool tomoyo_same_number_union 10164c3e9e2dSTetsuo Handa (const struct tomoyo_number_union *p1, const struct tomoyo_number_union *p2) 10174c3e9e2dSTetsuo Handa { 10184c3e9e2dSTetsuo Handa return p1->values[0] == p2->values[0] && p1->values[1] == p2->values[1] 10194c3e9e2dSTetsuo Handa && p1->group == p2->group && p1->min_type == p2->min_type && 10204c3e9e2dSTetsuo Handa p1->max_type == p2->max_type && p1->is_group == p2->is_group; 10214c3e9e2dSTetsuo Handa } 10224c3e9e2dSTetsuo Handa 10239590837bSKentaro Takeda /** 10249590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 10259590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 10269590837bSKentaro Takeda * @head: the head for your list. 10279590837bSKentaro Takeda */ 1028475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 1029475e6fa3STetsuo Handa if (!pos) \ 1030475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 1031475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 1032fdb8ebb7STetsuo Handa 10339590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 1034