1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */ 29590837bSKentaro Takeda /* 39590837bSKentaro Takeda * security/tomoyo/common.h 49590837bSKentaro Takeda * 576bb0895STetsuo Handa * Header file for TOMOYO. 69590837bSKentaro Takeda * 7843d183cSTetsuo Handa * Copyright (C) 2005-2011 NTT DATA CORPORATION 89590837bSKentaro Takeda */ 99590837bSKentaro Takeda 109590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 129590837bSKentaro Takeda 139590837bSKentaro Takeda #include <linux/ctype.h> 149590837bSKentaro Takeda #include <linux/string.h> 159590837bSKentaro Takeda #include <linux/mm.h> 169590837bSKentaro Takeda #include <linux/file.h> 179590837bSKentaro Takeda #include <linux/kmod.h> 189590837bSKentaro Takeda #include <linux/fs.h> 199590837bSKentaro Takeda #include <linux/sched.h> 209590837bSKentaro Takeda #include <linux/namei.h> 219590837bSKentaro Takeda #include <linux/mount.h> 229590837bSKentaro Takeda #include <linux/list.h> 2376bb0895STetsuo Handa #include <linux/cred.h> 2417fcfbd9STetsuo Handa #include <linux/poll.h> 252066a361STetsuo Handa #include <linux/binfmts.h> 262066a361STetsuo Handa #include <linux/highmem.h> 27059d84dbSTetsuo Handa #include <linux/net.h> 28059d84dbSTetsuo Handa #include <linux/inet.h> 29059d84dbSTetsuo Handa #include <linux/in.h> 30059d84dbSTetsuo Handa #include <linux/in6.h> 31059d84dbSTetsuo Handa #include <linux/un.h> 3243fc4609SCasey Schaufler #include <linux/lsm_hooks.h> 33059d84dbSTetsuo Handa #include <net/sock.h> 34059d84dbSTetsuo Handa #include <net/af_unix.h> 35059d84dbSTetsuo Handa #include <net/ip.h> 36059d84dbSTetsuo Handa #include <net/ipv6.h> 37059d84dbSTetsuo Handa #include <net/udp.h> 389590837bSKentaro Takeda 3976bb0895STetsuo Handa /********** Constants definitions. **********/ 4076bb0895STetsuo Handa 4176bb0895STetsuo Handa /* 4276bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 4376bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 4476bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 4576bb0895STetsuo Handa */ 4676bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 4776bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 4876bb0895STetsuo Handa 49059d84dbSTetsuo Handa /* 50059d84dbSTetsuo Handa * TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET. 51059d84dbSTetsuo Handa * Therefore, we don't need SOCK_MAX. 52059d84dbSTetsuo Handa */ 53059d84dbSTetsuo Handa #define TOMOYO_SOCK_MAX 6 54059d84dbSTetsuo Handa 55c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 5676bb0895STetsuo Handa 57f9732ea1STetsuo Handa /* Garbage collector is trying to kfree() this element. */ 58f9732ea1STetsuo Handa #define TOMOYO_GC_IN_PROGRESS -1 59f9732ea1STetsuo Handa 6076bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 6176bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 6276bb0895STetsuo Handa 6332997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 6432997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 6532997144STetsuo Handa 662066a361STetsuo Handa /* Index numbers for "struct tomoyo_condition". */ 672066a361STetsuo Handa enum tomoyo_conditions_index { 682066a361STetsuo Handa TOMOYO_TASK_UID, /* current_uid() */ 692066a361STetsuo Handa TOMOYO_TASK_EUID, /* current_euid() */ 702066a361STetsuo Handa TOMOYO_TASK_SUID, /* current_suid() */ 712066a361STetsuo Handa TOMOYO_TASK_FSUID, /* current_fsuid() */ 722066a361STetsuo Handa TOMOYO_TASK_GID, /* current_gid() */ 732066a361STetsuo Handa TOMOYO_TASK_EGID, /* current_egid() */ 742066a361STetsuo Handa TOMOYO_TASK_SGID, /* current_sgid() */ 752066a361STetsuo Handa TOMOYO_TASK_FSGID, /* current_fsgid() */ 762066a361STetsuo Handa TOMOYO_TASK_PID, /* sys_getpid() */ 772066a361STetsuo Handa TOMOYO_TASK_PPID, /* sys_getppid() */ 785b636857STetsuo Handa TOMOYO_EXEC_ARGC, /* "struct linux_binprm *"->argc */ 795b636857STetsuo Handa TOMOYO_EXEC_ENVC, /* "struct linux_binprm *"->envc */ 808761afd4STetsuo Handa TOMOYO_TYPE_IS_SOCKET, /* S_IFSOCK */ 818761afd4STetsuo Handa TOMOYO_TYPE_IS_SYMLINK, /* S_IFLNK */ 828761afd4STetsuo Handa TOMOYO_TYPE_IS_FILE, /* S_IFREG */ 838761afd4STetsuo Handa TOMOYO_TYPE_IS_BLOCK_DEV, /* S_IFBLK */ 848761afd4STetsuo Handa TOMOYO_TYPE_IS_DIRECTORY, /* S_IFDIR */ 858761afd4STetsuo Handa TOMOYO_TYPE_IS_CHAR_DEV, /* S_IFCHR */ 868761afd4STetsuo Handa TOMOYO_TYPE_IS_FIFO, /* S_IFIFO */ 878761afd4STetsuo Handa TOMOYO_MODE_SETUID, /* S_ISUID */ 888761afd4STetsuo Handa TOMOYO_MODE_SETGID, /* S_ISGID */ 898761afd4STetsuo Handa TOMOYO_MODE_STICKY, /* S_ISVTX */ 908761afd4STetsuo Handa TOMOYO_MODE_OWNER_READ, /* S_IRUSR */ 918761afd4STetsuo Handa TOMOYO_MODE_OWNER_WRITE, /* S_IWUSR */ 928761afd4STetsuo Handa TOMOYO_MODE_OWNER_EXECUTE, /* S_IXUSR */ 938761afd4STetsuo Handa TOMOYO_MODE_GROUP_READ, /* S_IRGRP */ 948761afd4STetsuo Handa TOMOYO_MODE_GROUP_WRITE, /* S_IWGRP */ 958761afd4STetsuo Handa TOMOYO_MODE_GROUP_EXECUTE, /* S_IXGRP */ 968761afd4STetsuo Handa TOMOYO_MODE_OTHERS_READ, /* S_IROTH */ 978761afd4STetsuo Handa TOMOYO_MODE_OTHERS_WRITE, /* S_IWOTH */ 988761afd4STetsuo Handa TOMOYO_MODE_OTHERS_EXECUTE, /* S_IXOTH */ 992ca9bf45STetsuo Handa TOMOYO_EXEC_REALPATH, 1002ca9bf45STetsuo Handa TOMOYO_SYMLINK_TARGET, 1018761afd4STetsuo Handa TOMOYO_PATH1_UID, 1028761afd4STetsuo Handa TOMOYO_PATH1_GID, 1038761afd4STetsuo Handa TOMOYO_PATH1_INO, 1048761afd4STetsuo Handa TOMOYO_PATH1_MAJOR, 1058761afd4STetsuo Handa TOMOYO_PATH1_MINOR, 1068761afd4STetsuo Handa TOMOYO_PATH1_PERM, 1078761afd4STetsuo Handa TOMOYO_PATH1_TYPE, 1088761afd4STetsuo Handa TOMOYO_PATH1_DEV_MAJOR, 1098761afd4STetsuo Handa TOMOYO_PATH1_DEV_MINOR, 1108761afd4STetsuo Handa TOMOYO_PATH2_UID, 1118761afd4STetsuo Handa TOMOYO_PATH2_GID, 1128761afd4STetsuo Handa TOMOYO_PATH2_INO, 1138761afd4STetsuo Handa TOMOYO_PATH2_MAJOR, 1148761afd4STetsuo Handa TOMOYO_PATH2_MINOR, 1158761afd4STetsuo Handa TOMOYO_PATH2_PERM, 1168761afd4STetsuo Handa TOMOYO_PATH2_TYPE, 1178761afd4STetsuo Handa TOMOYO_PATH2_DEV_MAJOR, 1188761afd4STetsuo Handa TOMOYO_PATH2_DEV_MINOR, 1198761afd4STetsuo Handa TOMOYO_PATH1_PARENT_UID, 1208761afd4STetsuo Handa TOMOYO_PATH1_PARENT_GID, 1218761afd4STetsuo Handa TOMOYO_PATH1_PARENT_INO, 1228761afd4STetsuo Handa TOMOYO_PATH1_PARENT_PERM, 1238761afd4STetsuo Handa TOMOYO_PATH2_PARENT_UID, 1248761afd4STetsuo Handa TOMOYO_PATH2_PARENT_GID, 1258761afd4STetsuo Handa TOMOYO_PATH2_PARENT_INO, 1268761afd4STetsuo Handa TOMOYO_PATH2_PARENT_PERM, 1272066a361STetsuo Handa TOMOYO_MAX_CONDITION_KEYWORD, 1282066a361STetsuo Handa TOMOYO_NUMBER_UNION, 1292ca9bf45STetsuo Handa TOMOYO_NAME_UNION, 1305b636857STetsuo Handa TOMOYO_ARGV_ENTRY, 1315b636857STetsuo Handa TOMOYO_ENVP_ENTRY, 1322066a361STetsuo Handa }; 1332066a361STetsuo Handa 1348761afd4STetsuo Handa 1358761afd4STetsuo Handa /* Index numbers for stat(). */ 1368761afd4STetsuo Handa enum tomoyo_path_stat_index { 1378761afd4STetsuo Handa /* Do not change this order. */ 1388761afd4STetsuo Handa TOMOYO_PATH1, 1398761afd4STetsuo Handa TOMOYO_PATH1_PARENT, 1408761afd4STetsuo Handa TOMOYO_PATH2, 1418761afd4STetsuo Handa TOMOYO_PATH2_PARENT, 1428761afd4STetsuo Handa TOMOYO_MAX_PATH_STAT 1438761afd4STetsuo Handa }; 1448761afd4STetsuo Handa 145b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 146cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 147cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 148cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 149cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 15057c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 151eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 152eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 153eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 154eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 155cb0abe6aSTetsuo Handa }; 156cb0abe6aSTetsuo Handa 157b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 158a230f9e7STetsuo Handa enum tomoyo_policy_id { 159a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 160059d84dbSTetsuo Handa TOMOYO_ID_ADDRESS_GROUP, 161a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 162a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 1635448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 164a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 165a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 1662066a361STetsuo Handa TOMOYO_ID_CONDITION, 167a230f9e7STetsuo Handa TOMOYO_ID_NAME, 168a230f9e7STetsuo Handa TOMOYO_ID_ACL, 169a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 170a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 171a230f9e7STetsuo Handa }; 172a230f9e7STetsuo Handa 1732c47ab93STetsuo Handa /* Index numbers for domain's attributes. */ 1742c47ab93STetsuo Handa enum tomoyo_domain_info_flags_index { 1752c47ab93STetsuo Handa /* Quota warnning flag. */ 1762c47ab93STetsuo Handa TOMOYO_DIF_QUOTA_WARNED, 1772c47ab93STetsuo Handa /* 1782c47ab93STetsuo Handa * This domain was unable to create a new domain at 1792c47ab93STetsuo Handa * tomoyo_find_next_domain() because the name of the domain to be 1802c47ab93STetsuo Handa * created was too long or it could not allocate memory. 1812c47ab93STetsuo Handa * More than one process continued execve() without domain transition. 1822c47ab93STetsuo Handa */ 1832c47ab93STetsuo Handa TOMOYO_DIF_TRANSITION_FAILED, 1842c47ab93STetsuo Handa TOMOYO_MAX_DOMAIN_INFO_FLAGS 1852c47ab93STetsuo Handa }; 1862c47ab93STetsuo Handa 1871f067a68STetsuo Handa /* Index numbers for audit type. */ 1881f067a68STetsuo Handa enum tomoyo_grant_log { 1891f067a68STetsuo Handa /* Follow profile's configuration. */ 1901f067a68STetsuo Handa TOMOYO_GRANTLOG_AUTO, 1911f067a68STetsuo Handa /* Do not generate grant log. */ 1921f067a68STetsuo Handa TOMOYO_GRANTLOG_NO, 1931f067a68STetsuo Handa /* Generate grant_log. */ 1941f067a68STetsuo Handa TOMOYO_GRANTLOG_YES, 1951f067a68STetsuo Handa }; 1961f067a68STetsuo Handa 197b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 198a230f9e7STetsuo Handa enum tomoyo_group_id { 199a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 200a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 201059d84dbSTetsuo Handa TOMOYO_ADDRESS_GROUP, 202a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 203a230f9e7STetsuo Handa }; 204a230f9e7STetsuo Handa 205b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 206b5bc60b4STetsuo Handa enum tomoyo_value_type { 207b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 208b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 209b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 210b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 211b5bc60b4STetsuo Handa }; 2124c3e9e2dSTetsuo Handa 213b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 2145448ec4fSTetsuo Handa enum tomoyo_transition_type { 2155448ec4fSTetsuo Handa /* Do not change this order, */ 216bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 217bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 2185448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 2195448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 2205448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 2215448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 2225448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 2235448ec4fSTetsuo Handa }; 2245448ec4fSTetsuo Handa 22576bb0895STetsuo Handa /* Index numbers for Access Controls. */ 226084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 2277ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 2287ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 229a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 23075093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 2312106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 232059d84dbSTetsuo Handa TOMOYO_TYPE_INET_ACL, 233059d84dbSTetsuo Handa TOMOYO_TYPE_UNIX_ACL, 234d58e0da8STetsuo Handa TOMOYO_TYPE_ENV_ACL, 235731d37aaSTetsuo Handa TOMOYO_TYPE_MANUAL_TASK_ACL, 236084da356STetsuo Handa }; 23776bb0895STetsuo Handa 238b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 239084da356STetsuo Handa enum tomoyo_path_acl_index { 2407ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 2417ef61233STetsuo Handa TOMOYO_TYPE_READ, 2427ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 2437c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 2447ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 2457c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 2467ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 2477ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 2487ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 2497ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 2507ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 2517ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 252084da356STetsuo Handa }; 25376bb0895STetsuo Handa 254b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 255eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 256eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 257eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 258eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 259eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 260eadd99ccSTetsuo Handa }; 261eadd99ccSTetsuo Handa 26275093152STetsuo Handa enum tomoyo_mkdev_acl_index { 263a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 264a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 26575093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 266a1f9bb6aSTetsuo Handa }; 267a1f9bb6aSTetsuo Handa 268059d84dbSTetsuo Handa /* Index numbers for socket operations. */ 269059d84dbSTetsuo Handa enum tomoyo_network_acl_index { 270059d84dbSTetsuo Handa TOMOYO_NETWORK_BIND, /* bind() operation. */ 271059d84dbSTetsuo Handa TOMOYO_NETWORK_LISTEN, /* listen() operation. */ 272059d84dbSTetsuo Handa TOMOYO_NETWORK_CONNECT, /* connect() operation. */ 273059d84dbSTetsuo Handa TOMOYO_NETWORK_SEND, /* send() operation. */ 274059d84dbSTetsuo Handa TOMOYO_MAX_NETWORK_OPERATION 275059d84dbSTetsuo Handa }; 276059d84dbSTetsuo Handa 277b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 278084da356STetsuo Handa enum tomoyo_path2_acl_index { 2797ef61233STetsuo Handa TOMOYO_TYPE_LINK, 2807ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 2817ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 2827ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 283084da356STetsuo Handa }; 28476bb0895STetsuo Handa 285b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 286a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 287a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 288a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 289a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 290a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 291a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 292a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 293a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 294a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 295a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 296a1f9bb6aSTetsuo Handa }; 297a1f9bb6aSTetsuo Handa 298b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 299084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 300084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 301084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 302084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 303b22b8b9fSTetsuo Handa TOMOYO_STAT, 304eadd99ccSTetsuo Handa TOMOYO_AUDIT, 305084da356STetsuo Handa TOMOYO_VERSION, 306084da356STetsuo Handa TOMOYO_PROFILE, 30717fcfbd9STetsuo Handa TOMOYO_QUERY, 308084da356STetsuo Handa TOMOYO_MANAGER 309084da356STetsuo Handa }; 31076bb0895STetsuo Handa 311b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 312b5bc60b4STetsuo Handa enum tomoyo_special_mount { 313b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 314b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 315b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 316b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 317b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 318b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 319b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 320b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 321b5bc60b4STetsuo Handa }; 322b5bc60b4STetsuo Handa 323b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 32457c2590fSTetsuo Handa enum tomoyo_mac_index { 32557c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 32657c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 32757c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 32857c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 3297c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 33057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 33157c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 33257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 33357c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 33457c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 33557c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 33657c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 33757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 33857c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 33957c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 34057c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 34157c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 34257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 34357c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 34457c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 34557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 34657c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 34757c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 348059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_BIND, 349059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN, 350059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT, 351059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_BIND, 352059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_SEND, 353059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_BIND, 354059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_SEND, 355059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND, 356059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN, 357059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT, 358059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND, 359059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND, 360059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND, 361059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN, 362059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT, 363d58e0da8STetsuo Handa TOMOYO_MAC_ENVIRON, 36457c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 36557c2590fSTetsuo Handa }; 36657c2590fSTetsuo Handa 367b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 36857c2590fSTetsuo Handa enum tomoyo_mac_category_index { 36957c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 370059d84dbSTetsuo Handa TOMOYO_MAC_CATEGORY_NETWORK, 371d58e0da8STetsuo Handa TOMOYO_MAC_CATEGORY_MISC, 37257c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 37357c2590fSTetsuo Handa }; 37457c2590fSTetsuo Handa 375b5bc60b4STetsuo Handa /* 376b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 377b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 378b5bc60b4STetsuo Handa * 379b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 380b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 381b5bc60b4STetsuo Handa */ 382b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 38317fcfbd9STetsuo Handa 384b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 385b22b8b9fSTetsuo Handa enum tomoyo_policy_stat_type { 386b22b8b9fSTetsuo Handa /* Do not change this order. */ 387b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_UPDATES, 388b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_LEARNING, /* == TOMOYO_CONFIG_LEARNING */ 389b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_PERMISSIVE, /* == TOMOYO_CONFIG_PERMISSIVE */ 390b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_ENFORCING, /* == TOMOYO_CONFIG_ENFORCING */ 391b22b8b9fSTetsuo Handa TOMOYO_MAX_POLICY_STAT 392b22b8b9fSTetsuo Handa }; 393b22b8b9fSTetsuo Handa 394d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 395d5ca1725STetsuo Handa enum tomoyo_pref_index { 396eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 397d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 398d5ca1725STetsuo Handa TOMOYO_MAX_PREF 399d5ca1725STetsuo Handa }; 400d5ca1725STetsuo Handa 40176bb0895STetsuo Handa /********** Structure definitions. **********/ 4029590837bSKentaro Takeda 403b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 40482e0f001STetsuo Handa struct tomoyo_acl_head { 40582e0f001STetsuo Handa struct list_head list; 406f9732ea1STetsuo Handa s8 is_deleted; /* true or false or TOMOYO_GC_IN_PROGRESS */ 40782e0f001STetsuo Handa } __packed; 40882e0f001STetsuo Handa 4090df7e8b8STetsuo Handa /* Common header for shared entries. */ 4100df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 4110df7e8b8STetsuo Handa struct list_head list; 4120df7e8b8STetsuo Handa atomic_t users; 4130df7e8b8STetsuo Handa } __packed; 4140df7e8b8STetsuo Handa 415bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 416bd03a3e4STetsuo Handa 417b5bc60b4STetsuo Handa /* Structure for request info. */ 418cb0abe6aSTetsuo Handa struct tomoyo_request_info { 4198761afd4STetsuo Handa /* 4208761afd4STetsuo Handa * For holding parameters specific to operations which deal files. 4218761afd4STetsuo Handa * NULL if not dealing files. 4228761afd4STetsuo Handa */ 4238761afd4STetsuo Handa struct tomoyo_obj_info *obj; 4242ca9bf45STetsuo Handa /* 4252ca9bf45STetsuo Handa * For holding parameters specific to execve() request. 4262ca9bf45STetsuo Handa * NULL if not dealing do_execve(). 4272ca9bf45STetsuo Handa */ 4282ca9bf45STetsuo Handa struct tomoyo_execve *ee; 429cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 430cf6e9a64STetsuo Handa /* For holding parameters. */ 431cf6e9a64STetsuo Handa union { 432cf6e9a64STetsuo Handa struct { 433cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 434484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 435484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 436b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 437cf6e9a64STetsuo Handa u8 operation; 438cf6e9a64STetsuo Handa } path; 439cf6e9a64STetsuo Handa struct { 440cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 441cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 442b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 443cf6e9a64STetsuo Handa u8 operation; 444cf6e9a64STetsuo Handa } path2; 445cf6e9a64STetsuo Handa struct { 446cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 447cf6e9a64STetsuo Handa unsigned int mode; 448cf6e9a64STetsuo Handa unsigned int major; 449cf6e9a64STetsuo Handa unsigned int minor; 450b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 451cf6e9a64STetsuo Handa u8 operation; 452cf6e9a64STetsuo Handa } mkdev; 453cf6e9a64STetsuo Handa struct { 454cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 455cf6e9a64STetsuo Handa unsigned long number; 456b5bc60b4STetsuo Handa /* 457b5bc60b4STetsuo Handa * One of values in 458b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 459b5bc60b4STetsuo Handa */ 460cf6e9a64STetsuo Handa u8 operation; 461cf6e9a64STetsuo Handa } path_number; 462cf6e9a64STetsuo Handa struct { 463d58e0da8STetsuo Handa const struct tomoyo_path_info *name; 464d58e0da8STetsuo Handa } environ; 465d58e0da8STetsuo Handa struct { 466059d84dbSTetsuo Handa const __be32 *address; 467059d84dbSTetsuo Handa u16 port; 468059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 469059d84dbSTetsuo Handa u8 protocol; 470059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 471059d84dbSTetsuo Handa u8 operation; 472059d84dbSTetsuo Handa bool is_ipv6; 473059d84dbSTetsuo Handa } inet_network; 474059d84dbSTetsuo Handa struct { 475059d84dbSTetsuo Handa const struct tomoyo_path_info *address; 476059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 477059d84dbSTetsuo Handa u8 protocol; 478059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 479059d84dbSTetsuo Handa u8 operation; 480059d84dbSTetsuo Handa } unix_network; 481059d84dbSTetsuo Handa struct { 482cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 483cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 484cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 485cf6e9a64STetsuo Handa unsigned long flags; 486cf6e9a64STetsuo Handa int need_dev; 487cf6e9a64STetsuo Handa } mount; 488731d37aaSTetsuo Handa struct { 489731d37aaSTetsuo Handa const struct tomoyo_path_info *domainname; 490731d37aaSTetsuo Handa } task; 491cf6e9a64STetsuo Handa } param; 4921f067a68STetsuo Handa struct tomoyo_acl_info *matched_acl; 493cf6e9a64STetsuo Handa u8 param_type; 494cf6e9a64STetsuo Handa bool granted; 49517fcfbd9STetsuo Handa u8 retry; 49617fcfbd9STetsuo Handa u8 profile; 497cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 49857c2590fSTetsuo Handa u8 type; 499cb0abe6aSTetsuo Handa }; 500cb0abe6aSTetsuo Handa 501b5bc60b4STetsuo Handa /* Structure for holding a token. */ 5029590837bSKentaro Takeda struct tomoyo_path_info { 5039590837bSKentaro Takeda const char *name; 5049590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 5059590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 5069590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 5079590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 5089590837bSKentaro Takeda }; 5099590837bSKentaro Takeda 510b5bc60b4STetsuo Handa /* Structure for holding string data. */ 511e2bf6907STetsuo Handa struct tomoyo_name { 5120df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 51376bb0895STetsuo Handa struct tomoyo_path_info entry; 51476bb0895STetsuo Handa }; 5159590837bSKentaro Takeda 516b5bc60b4STetsuo Handa /* Structure for holding a word. */ 5177762fbffSTetsuo Handa struct tomoyo_name_union { 518b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 5197762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 520a98aa4deSTetsuo Handa struct tomoyo_group *group; 5217762fbffSTetsuo Handa }; 5227762fbffSTetsuo Handa 523b5bc60b4STetsuo Handa /* Structure for holding a number. */ 5244c3e9e2dSTetsuo Handa struct tomoyo_number_union { 5254c3e9e2dSTetsuo Handa unsigned long values[2]; 526b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 527b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 5280df7e8b8STetsuo Handa u8 value_type[2]; 5294c3e9e2dSTetsuo Handa }; 5304c3e9e2dSTetsuo Handa 531059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 532059d84dbSTetsuo Handa struct tomoyo_ipaddr_union { 533059d84dbSTetsuo Handa struct in6_addr ip[2]; /* Big endian. */ 534059d84dbSTetsuo Handa struct tomoyo_group *group; /* Pointer to address group. */ 535059d84dbSTetsuo Handa bool is_ipv6; /* Valid only if @group == NULL. */ 536059d84dbSTetsuo Handa }; 537059d84dbSTetsuo Handa 538059d84dbSTetsuo Handa /* Structure for "path_group"/"number_group"/"address_group" directive. */ 539a98aa4deSTetsuo Handa struct tomoyo_group { 5400df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 541a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 542a98aa4deSTetsuo Handa struct list_head member_list; 543a98aa4deSTetsuo Handa }; 544a98aa4deSTetsuo Handa 5457762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 5467762fbffSTetsuo Handa struct tomoyo_path_group { 54782e0f001STetsuo Handa struct tomoyo_acl_head head; 5487762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 5497762fbffSTetsuo Handa }; 5507762fbffSTetsuo Handa 5514c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 552a98aa4deSTetsuo Handa struct tomoyo_number_group { 55382e0f001STetsuo Handa struct tomoyo_acl_head head; 5544c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 5554c3e9e2dSTetsuo Handa }; 5564c3e9e2dSTetsuo Handa 557059d84dbSTetsuo Handa /* Structure for "address_group" directive. */ 558059d84dbSTetsuo Handa struct tomoyo_address_group { 559059d84dbSTetsuo Handa struct tomoyo_acl_head head; 560059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 561059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 562059d84dbSTetsuo Handa }; 563059d84dbSTetsuo Handa 5648761afd4STetsuo Handa /* Subset of "struct stat". Used by conditional ACL and audit logs. */ 5658761afd4STetsuo Handa struct tomoyo_mini_stat { 566609fcd1bSEric W. Biederman kuid_t uid; 567609fcd1bSEric W. Biederman kgid_t gid; 5688761afd4STetsuo Handa ino_t ino; 569d179333fSAl Viro umode_t mode; 5708761afd4STetsuo Handa dev_t dev; 5718761afd4STetsuo Handa dev_t rdev; 5728761afd4STetsuo Handa }; 5738761afd4STetsuo Handa 5745b636857STetsuo Handa /* Structure for dumping argv[] and envp[] of "struct linux_binprm". */ 5755b636857STetsuo Handa struct tomoyo_page_dump { 5765b636857STetsuo Handa struct page *page; /* Previously dumped page. */ 5775b636857STetsuo Handa char *data; /* Contents of "page". Size is PAGE_SIZE. */ 5785b636857STetsuo Handa }; 5795b636857STetsuo Handa 5808761afd4STetsuo Handa /* Structure for attribute checks in addition to pathname checks. */ 5818761afd4STetsuo Handa struct tomoyo_obj_info { 5828761afd4STetsuo Handa /* 5838761afd4STetsuo Handa * True if tomoyo_get_attributes() was already called, false otherwise. 5848761afd4STetsuo Handa */ 5858761afd4STetsuo Handa bool validate_done; 5868761afd4STetsuo Handa /* True if @stat[] is valid. */ 5878761afd4STetsuo Handa bool stat_valid[TOMOYO_MAX_PATH_STAT]; 5888761afd4STetsuo Handa /* First pathname. Initialized with { NULL, NULL } if no path. */ 5898761afd4STetsuo Handa struct path path1; 5908761afd4STetsuo Handa /* Second pathname. Initialized with { NULL, NULL } if no path. */ 5918761afd4STetsuo Handa struct path path2; 5928761afd4STetsuo Handa /* 5938761afd4STetsuo Handa * Information on @path1, @path1's parent directory, @path2, @path2's 5948761afd4STetsuo Handa * parent directory. 5958761afd4STetsuo Handa */ 5968761afd4STetsuo Handa struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT]; 5972ca9bf45STetsuo Handa /* 5982ca9bf45STetsuo Handa * Content of symbolic link to be created. NULL for operations other 5992ca9bf45STetsuo Handa * than symlink(). 6002ca9bf45STetsuo Handa */ 6012ca9bf45STetsuo Handa struct tomoyo_path_info *symlink_target; 6022ca9bf45STetsuo Handa }; 6032ca9bf45STetsuo Handa 6045b636857STetsuo Handa /* Structure for argv[]. */ 6055b636857STetsuo Handa struct tomoyo_argv { 6065b636857STetsuo Handa unsigned long index; 6075b636857STetsuo Handa const struct tomoyo_path_info *value; 6085b636857STetsuo Handa bool is_not; 6095b636857STetsuo Handa }; 6105b636857STetsuo Handa 6115b636857STetsuo Handa /* Structure for envp[]. */ 6125b636857STetsuo Handa struct tomoyo_envp { 6135b636857STetsuo Handa const struct tomoyo_path_info *name; 6145b636857STetsuo Handa const struct tomoyo_path_info *value; 6155b636857STetsuo Handa bool is_not; 6165b636857STetsuo Handa }; 6175b636857STetsuo Handa 6182ca9bf45STetsuo Handa /* Structure for execve() operation. */ 6192ca9bf45STetsuo Handa struct tomoyo_execve { 6202ca9bf45STetsuo Handa struct tomoyo_request_info r; 6212ca9bf45STetsuo Handa struct tomoyo_obj_info obj; 6222ca9bf45STetsuo Handa struct linux_binprm *bprm; 6236bce98edSTetsuo Handa const struct tomoyo_path_info *transition; 6245b636857STetsuo Handa /* For dumping argv[] and envp[]. */ 6255b636857STetsuo Handa struct tomoyo_page_dump dump; 6262ca9bf45STetsuo Handa /* For temporary use. */ 6272ca9bf45STetsuo Handa char *tmp; /* Size is TOMOYO_EXEC_TMPSIZE bytes */ 6288761afd4STetsuo Handa }; 6298761afd4STetsuo Handa 6302066a361STetsuo Handa /* Structure for entries which follows "struct tomoyo_condition". */ 6312066a361STetsuo Handa struct tomoyo_condition_element { 6325b636857STetsuo Handa /* 6335b636857STetsuo Handa * Left hand operand. A "struct tomoyo_argv" for TOMOYO_ARGV_ENTRY, a 6345b636857STetsuo Handa * "struct tomoyo_envp" for TOMOYO_ENVP_ENTRY is attached to the tail 6355b636857STetsuo Handa * of the array of this struct. 6365b636857STetsuo Handa */ 6372066a361STetsuo Handa u8 left; 6385b636857STetsuo Handa /* 6395b636857STetsuo Handa * Right hand operand. A "struct tomoyo_number_union" for 6405b636857STetsuo Handa * TOMOYO_NUMBER_UNION, a "struct tomoyo_name_union" for 6415b636857STetsuo Handa * TOMOYO_NAME_UNION is attached to the tail of the array of this 6425b636857STetsuo Handa * struct. 6435b636857STetsuo Handa */ 6442066a361STetsuo Handa u8 right; 6452066a361STetsuo Handa /* Equation operator. True if equals or overlaps, false otherwise. */ 6462066a361STetsuo Handa bool equals; 6472066a361STetsuo Handa }; 6482066a361STetsuo Handa 6492066a361STetsuo Handa /* Structure for optional arguments. */ 6502066a361STetsuo Handa struct tomoyo_condition { 6512066a361STetsuo Handa struct tomoyo_shared_acl_head head; 6522066a361STetsuo Handa u32 size; /* Memory size allocated for this entry. */ 6532066a361STetsuo Handa u16 condc; /* Number of conditions in this struct. */ 6542066a361STetsuo Handa u16 numbers_count; /* Number of "struct tomoyo_number_union values". */ 6552ca9bf45STetsuo Handa u16 names_count; /* Number of "struct tomoyo_name_union names". */ 6565b636857STetsuo Handa u16 argc; /* Number of "struct tomoyo_argv". */ 6575b636857STetsuo Handa u16 envc; /* Number of "struct tomoyo_envp". */ 6581f067a68STetsuo Handa u8 grant_log; /* One of values in "enum tomoyo_grant_log". */ 6596bce98edSTetsuo Handa const struct tomoyo_path_info *transit; /* Maybe NULL. */ 6602066a361STetsuo Handa /* 6612066a361STetsuo Handa * struct tomoyo_condition_element condition[condc]; 6622066a361STetsuo Handa * struct tomoyo_number_union values[numbers_count]; 6632ca9bf45STetsuo Handa * struct tomoyo_name_union names[names_count]; 6645b636857STetsuo Handa * struct tomoyo_argv argv[argc]; 6655b636857STetsuo Handa * struct tomoyo_envp envp[envc]; 6662066a361STetsuo Handa */ 6672066a361STetsuo Handa }; 6682066a361STetsuo Handa 669b5bc60b4STetsuo Handa /* Common header for individual entries. */ 6709590837bSKentaro Takeda struct tomoyo_acl_info { 6719590837bSKentaro Takeda struct list_head list; 6722066a361STetsuo Handa struct tomoyo_condition *cond; /* Maybe NULL. */ 673f9732ea1STetsuo Handa s8 is_deleted; /* true or false or TOMOYO_GC_IN_PROGRESS */ 674b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 6759590837bSKentaro Takeda } __packed; 6769590837bSKentaro Takeda 677b5bc60b4STetsuo Handa /* Structure for domain information. */ 6789590837bSKentaro Takeda struct tomoyo_domain_info { 6799590837bSKentaro Takeda struct list_head list; 6809590837bSKentaro Takeda struct list_head acl_info_list; 6819590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 6829590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 683bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 684bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 6859590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 68632997144STetsuo Handa u8 group; /* Group number to use. */ 687a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 6882c47ab93STetsuo Handa bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 6898c6cb983STetsuo Handa atomic_t users; /* Number of referring tasks. */ 6909590837bSKentaro Takeda }; 6919590837bSKentaro Takeda 6929590837bSKentaro Takeda /* 693731d37aaSTetsuo Handa * Structure for "task manual_domain_transition" directive. 694731d37aaSTetsuo Handa */ 695731d37aaSTetsuo Handa struct tomoyo_task_acl { 696731d37aaSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MANUAL_TASK_ACL */ 697731d37aaSTetsuo Handa /* Pointer to domainname. */ 698731d37aaSTetsuo Handa const struct tomoyo_path_info *domainname; 699731d37aaSTetsuo Handa }; 700731d37aaSTetsuo Handa 701731d37aaSTetsuo Handa /* 702b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 703b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 704b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 7059590837bSKentaro Takeda */ 7067ef61233STetsuo Handa struct tomoyo_path_acl { 7077ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 708b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 7097762fbffSTetsuo Handa struct tomoyo_name_union name; 7109590837bSKentaro Takeda }; 7119590837bSKentaro Takeda 712c3fa109aSTetsuo Handa /* 713b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 714b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 715a1f9bb6aSTetsuo Handa */ 716a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 717a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 718b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 719a1f9bb6aSTetsuo Handa u8 perm; 720a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 721a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 722a1f9bb6aSTetsuo Handa }; 723a1f9bb6aSTetsuo Handa 724b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 72575093152STetsuo Handa struct tomoyo_mkdev_acl { 72675093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 727b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 728a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 729a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 730a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 731a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 732a1f9bb6aSTetsuo Handa }; 733a1f9bb6aSTetsuo Handa 734a1f9bb6aSTetsuo Handa /* 735b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 736c3fa109aSTetsuo Handa */ 7377ef61233STetsuo Handa struct tomoyo_path2_acl { 7387ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 739b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 7407762fbffSTetsuo Handa struct tomoyo_name_union name1; 7417762fbffSTetsuo Handa struct tomoyo_name_union name2; 7429590837bSKentaro Takeda }; 7439590837bSKentaro Takeda 744b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 7452106ccd9STetsuo Handa struct tomoyo_mount_acl { 7462106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 7472106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 7482106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 7492106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 7502106ccd9STetsuo Handa struct tomoyo_number_union flags; 7512106ccd9STetsuo Handa }; 7522106ccd9STetsuo Handa 753d58e0da8STetsuo Handa /* Structure for "misc env" directive in domain policy. */ 754d58e0da8STetsuo Handa struct tomoyo_env_acl { 755d58e0da8STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_ENV_ACL */ 756d58e0da8STetsuo Handa const struct tomoyo_path_info *env; /* environment variable */ 757d58e0da8STetsuo Handa }; 758d58e0da8STetsuo Handa 759059d84dbSTetsuo Handa /* Structure for "network inet" directive. */ 760059d84dbSTetsuo Handa struct tomoyo_inet_acl { 761059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */ 762059d84dbSTetsuo Handa u8 protocol; 763059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 764059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 765059d84dbSTetsuo Handa struct tomoyo_number_union port; 766059d84dbSTetsuo Handa }; 767059d84dbSTetsuo Handa 768059d84dbSTetsuo Handa /* Structure for "network unix" directive. */ 769059d84dbSTetsuo Handa struct tomoyo_unix_acl { 770059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */ 771059d84dbSTetsuo Handa u8 protocol; 772059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 773059d84dbSTetsuo Handa struct tomoyo_name_union name; 774059d84dbSTetsuo Handa }; 775059d84dbSTetsuo Handa 776a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 777a238cf5bSTetsuo Handa struct tomoyo_acl_param { 778a238cf5bSTetsuo Handa char *data; 779a238cf5bSTetsuo Handa struct list_head *list; 780bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 781a238cf5bSTetsuo Handa bool is_delete; 782a238cf5bSTetsuo Handa }; 783a238cf5bSTetsuo Handa 7840d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 785f23571e8STetsuo Handa 7862106ccd9STetsuo Handa /* 787f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 788f23571e8STetsuo Handa * interfaces. 789c3fa109aSTetsuo Handa */ 7909590837bSKentaro Takeda struct tomoyo_io_buffer { 7918fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 7929590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 793c0d4be28SAl Viro __poll_t (*poll) (struct file *file, poll_table *wait); 7949590837bSKentaro Takeda /* Exclusive lock for this structure. */ 7959590837bSKentaro Takeda struct mutex io_sem; 796f23571e8STetsuo Handa char __user *read_user_buf; 7972c47ab93STetsuo Handa size_t read_user_buf_avail; 798f23571e8STetsuo Handa struct { 799bd03a3e4STetsuo Handa struct list_head *ns; 800f23571e8STetsuo Handa struct list_head *domain; 801f23571e8STetsuo Handa struct list_head *group; 802f23571e8STetsuo Handa struct list_head *acl; 8032c47ab93STetsuo Handa size_t avail; 8042c47ab93STetsuo Handa unsigned int step; 8052c47ab93STetsuo Handa unsigned int query_index; 806f23571e8STetsuo Handa u16 index; 8072066a361STetsuo Handa u16 cond_index; 80832997144STetsuo Handa u8 acl_group_index; 8092066a361STetsuo Handa u8 cond_step; 810f23571e8STetsuo Handa u8 bit; 811f23571e8STetsuo Handa u8 w_pos; 812f23571e8STetsuo Handa bool eof; 813f23571e8STetsuo Handa bool print_this_domain_only; 814bd03a3e4STetsuo Handa bool print_transition_related_only; 8152066a361STetsuo Handa bool print_cond_part; 816f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 817f23571e8STetsuo Handa } r; 8180df7e8b8STetsuo Handa struct { 819bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 8209590837bSKentaro Takeda /* The position currently writing to. */ 8210df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 8220df7e8b8STetsuo Handa /* Bytes available for writing. */ 8232c47ab93STetsuo Handa size_t avail; 824bd03a3e4STetsuo Handa bool is_delete; 8250df7e8b8STetsuo Handa } w; 8269590837bSKentaro Takeda /* Buffer for reading. */ 8279590837bSKentaro Takeda char *read_buf; 8289590837bSKentaro Takeda /* Size of read buffer. */ 8292c47ab93STetsuo Handa size_t readbuf_size; 8309590837bSKentaro Takeda /* Buffer for writing. */ 8319590837bSKentaro Takeda char *write_buf; 8329590837bSKentaro Takeda /* Size of write buffer. */ 8332c47ab93STetsuo Handa size_t writebuf_size; 83417fcfbd9STetsuo Handa /* Type of this interface. */ 8352c47ab93STetsuo Handa enum tomoyo_securityfs_interface_index type; 8362e503bbbSTetsuo Handa /* Users counter protected by tomoyo_io_buffer_list_lock. */ 8372e503bbbSTetsuo Handa u8 users; 8382e503bbbSTetsuo Handa /* List for telling GC not to kfree() elements. */ 8392e503bbbSTetsuo Handa struct list_head list; 8409590837bSKentaro Takeda }; 8419590837bSKentaro Takeda 84276bb0895STetsuo Handa /* 843b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 844b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 84576bb0895STetsuo Handa */ 8465448ec4fSTetsuo Handa struct tomoyo_transition_control { 84782e0f001STetsuo Handa struct tomoyo_acl_head head; 8485448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 84976bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 85076bb0895STetsuo Handa bool is_last_name; 8515448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 8525448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 85376bb0895STetsuo Handa }; 85476bb0895STetsuo Handa 855b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 856e2bf6907STetsuo Handa struct tomoyo_aggregator { 85782e0f001STetsuo Handa struct tomoyo_acl_head head; 8581084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 8591084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 8601084307cSTetsuo Handa }; 8611084307cSTetsuo Handa 862b5bc60b4STetsuo Handa /* Structure for policy manager. */ 863e2bf6907STetsuo Handa struct tomoyo_manager { 86482e0f001STetsuo Handa struct tomoyo_acl_head head; 86576bb0895STetsuo Handa /* A path to program or a domainname. */ 86676bb0895STetsuo Handa const struct tomoyo_path_info *manager; 86776bb0895STetsuo Handa }; 86876bb0895STetsuo Handa 86957c2590fSTetsuo Handa struct tomoyo_preference { 87057c2590fSTetsuo Handa unsigned int learning_max_entry; 87157c2590fSTetsuo Handa bool enforcing_verbose; 87257c2590fSTetsuo Handa bool learning_verbose; 87357c2590fSTetsuo Handa bool permissive_verbose; 87457c2590fSTetsuo Handa }; 87557c2590fSTetsuo Handa 876b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 87757c2590fSTetsuo Handa struct tomoyo_profile { 87857c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 87957c2590fSTetsuo Handa struct tomoyo_preference *learning; 88057c2590fSTetsuo Handa struct tomoyo_preference *permissive; 88157c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 88257c2590fSTetsuo Handa struct tomoyo_preference preference; 88357c2590fSTetsuo Handa u8 default_config; 88457c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 885d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 88657c2590fSTetsuo Handa }; 88757c2590fSTetsuo Handa 888eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 889eadd99ccSTetsuo Handa struct tomoyo_time { 890eadd99ccSTetsuo Handa u16 year; 891eadd99ccSTetsuo Handa u8 month; 892eadd99ccSTetsuo Handa u8 day; 893eadd99ccSTetsuo Handa u8 hour; 894eadd99ccSTetsuo Handa u8 min; 895eadd99ccSTetsuo Handa u8 sec; 896eadd99ccSTetsuo Handa }; 897eadd99ccSTetsuo Handa 898bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 899bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 900bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 901bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 902bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 903bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 904bd03a3e4STetsuo Handa /* List of policy. */ 905bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 906bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 907bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 908bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 909bd03a3e4STetsuo Handa struct list_head namespace_list; 910843d183cSTetsuo Handa /* Profile version. Currently only 20110903 is defined. */ 911bd03a3e4STetsuo Handa unsigned int profile_version; 912bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 913bd03a3e4STetsuo Handa const char *name; 914bd03a3e4STetsuo Handa }; 915bd03a3e4STetsuo Handa 9168c6cb983STetsuo Handa /* Structure for "struct task_struct"->security. */ 9178c6cb983STetsuo Handa struct tomoyo_task { 9188c6cb983STetsuo Handa struct tomoyo_domain_info *domain_info; 9198c6cb983STetsuo Handa struct tomoyo_domain_info *old_domain_info; 9208c6cb983STetsuo Handa }; 9218c6cb983STetsuo Handa 92276bb0895STetsuo Handa /********** Function prototypes. **********/ 92376bb0895STetsuo Handa 924059d84dbSTetsuo Handa bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address, 925059d84dbSTetsuo Handa const struct tomoyo_group *group); 9262106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 9272106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 9282066a361STetsuo Handa bool tomoyo_condition(struct tomoyo_request_info *r, 9292066a361STetsuo Handa const struct tomoyo_condition *cond); 93075093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 93175093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 93275093152STetsuo Handa bool tomoyo_correct_word(const char *string); 93375093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 9343ddf17f0STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 9355b636857STetsuo Handa bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, 9365b636857STetsuo Handa struct tomoyo_page_dump *dump); 9373ddf17f0STetsuo Handa bool tomoyo_memory_ok(void *ptr); 9384c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 9394c3e9e2dSTetsuo Handa const unsigned long max, 940a98aa4deSTetsuo Handa const struct tomoyo_group *group); 941059d84dbSTetsuo Handa bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param, 942059d84dbSTetsuo Handa struct tomoyo_ipaddr_union *ptr); 9433ddf17f0STetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 9443ddf17f0STetsuo Handa struct tomoyo_name_union *ptr); 945a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 946a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 9473ddf17f0STetsuo Handa bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 9483ddf17f0STetsuo Handa const struct tomoyo_path_info *pattern); 9493ddf17f0STetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 9503ddf17f0STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 9513ddf17f0STetsuo Handa char *tomoyo_encode(const char *str); 952059d84dbSTetsuo Handa char *tomoyo_encode2(const char *str, int str_len); 9533ddf17f0STetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 9543ddf17f0STetsuo Handa va_list args); 9553ddf17f0STetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 95622473862SAl Viro char *tomoyo_realpath_from_path(const struct path *path); 9573ddf17f0STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 9583ddf17f0STetsuo Handa const char *tomoyo_get_exe(void); 9593ddf17f0STetsuo Handa const char *tomoyo_yesno(const unsigned int value); 9603ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_compare_name_union 9613ddf17f0STetsuo Handa (const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr); 962731d37aaSTetsuo Handa const struct tomoyo_path_info *tomoyo_get_domainname 963731d37aaSTetsuo Handa (struct tomoyo_acl_param *param); 9643ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 9653ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_path_matches_group 9663ddf17f0STetsuo Handa (const struct tomoyo_path_info *pathname, const struct tomoyo_group *group); 9673ddf17f0STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 968e6641eddSAl Viro const struct path *path, const int flag); 969e53cfda5SAl Viro void tomoyo_close_control(struct tomoyo_io_buffer *head); 970d58e0da8STetsuo Handa int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env); 9716bce98edSTetsuo Handa int tomoyo_execute_permission(struct tomoyo_request_info *r, 9726bce98edSTetsuo Handa const struct tomoyo_path_info *filename); 9733ddf17f0STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 9743ddf17f0STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 9753ddf17f0STetsuo Handa const u8 index); 9762106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 97757c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 97857c2590fSTetsuo Handa const u8 index); 979e6641eddSAl Viro int tomoyo_mkdev_perm(const u8 operation, const struct path *path, 9803ddf17f0STetsuo Handa const unsigned int mode, unsigned int dev); 981e6641eddSAl Viro int tomoyo_mount_permission(const char *dev_name, const struct path *path, 982b5bc60b4STetsuo Handa const char *type, unsigned long flags, 983b5bc60b4STetsuo Handa void *data_page); 9843ddf17f0STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 985e6641eddSAl Viro int tomoyo_path2_perm(const u8 operation, const struct path *path1, 986e6641eddSAl Viro const struct path *path2); 987e6641eddSAl Viro int tomoyo_path_number_perm(const u8 operation, const struct path *path, 9883ddf17f0STetsuo Handa unsigned long number); 9893f7036a0SAl Viro int tomoyo_path_perm(const u8 operation, const struct path *path, 99097fb35e4STetsuo Handa const char *target); 991c0d4be28SAl Viro __poll_t tomoyo_poll_control(struct file *file, poll_table *wait); 992c0d4be28SAl Viro __poll_t tomoyo_poll_log(struct file *file, poll_table *wait); 993059d84dbSTetsuo Handa int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr, 994059d84dbSTetsuo Handa int addr_len); 995059d84dbSTetsuo Handa int tomoyo_socket_connect_permission(struct socket *sock, 996059d84dbSTetsuo Handa struct sockaddr *addr, int addr_len); 997059d84dbSTetsuo Handa int tomoyo_socket_listen_permission(struct socket *sock); 998059d84dbSTetsuo Handa int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg, 999059d84dbSTetsuo Handa int size); 10003ddf17f0STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 10013ddf17f0STetsuo Handa __printf(2, 3); 1002237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 1003a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 10043ddf17f0STetsuo Handa bool (*check_duplicate) 10053ddf17f0STetsuo Handa (const struct tomoyo_acl_info *, 10063ddf17f0STetsuo Handa const struct tomoyo_acl_info *), 10073ddf17f0STetsuo Handa bool (*merge_duplicate) 10083ddf17f0STetsuo Handa (struct tomoyo_acl_info *, struct tomoyo_acl_info *, 1009237ab459STetsuo Handa const bool)); 101036f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 1011a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 10123ddf17f0STetsuo Handa bool (*check_duplicate) 10133ddf17f0STetsuo Handa (const struct tomoyo_acl_head *, 10143ddf17f0STetsuo Handa const struct tomoyo_acl_head *)); 10153ddf17f0STetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 10163ddf17f0STetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 10173ddf17f0STetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 1018d58e0da8STetsuo Handa int tomoyo_write_misc(struct tomoyo_acl_param *param); 1019059d84dbSTetsuo Handa int tomoyo_write_inet_network(struct tomoyo_acl_param *param); 10203ddf17f0STetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 10213ddf17f0STetsuo Handa const u8 type); 1022059d84dbSTetsuo Handa int tomoyo_write_unix_network(struct tomoyo_acl_param *param); 10233ddf17f0STetsuo Handa ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 10243ddf17f0STetsuo Handa const int buffer_len); 10253ddf17f0STetsuo Handa ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 10263ddf17f0STetsuo Handa const char __user *buffer, const int buffer_len); 10272066a361STetsuo Handa struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param); 10283ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 10293ddf17f0STetsuo Handa const bool transit); 10308c6cb983STetsuo Handa struct tomoyo_domain_info *tomoyo_domain(void); 10313ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 10323ddf17f0STetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 10333ddf17f0STetsuo Handa const u8 idx); 10343ddf17f0STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 10353ddf17f0STetsuo Handa (const char *domainname); 10363ddf17f0STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 10373ddf17f0STetsuo Handa const u8 profile); 10383ddf17f0STetsuo Handa unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 10393ddf17f0STetsuo Handa const u8 index); 10402066a361STetsuo Handa u8 tomoyo_parse_ulong(unsigned long *result, char **str); 10413ddf17f0STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 10423ddf17f0STetsuo Handa void __init tomoyo_load_builtin_policy(void); 10433ddf17f0STetsuo Handa void __init tomoyo_mm_init(void); 104499a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 1045484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 104699a85259STetsuo Handa const struct tomoyo_acl_info *)); 10473ddf17f0STetsuo Handa void tomoyo_check_profile(void); 104892734092SArnd Bergmann void tomoyo_convert_time(time64_t time, struct tomoyo_time *stamp); 10492066a361STetsuo Handa void tomoyo_del_condition(struct list_head *element); 10503ddf17f0STetsuo Handa void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 10518761afd4STetsuo Handa void tomoyo_get_attributes(struct tomoyo_obj_info *obj); 10523ddf17f0STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 10533ddf17f0STetsuo Handa void tomoyo_load_policy(const char *filename); 10543ddf17f0STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 10553ddf17f0STetsuo Handa void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); 1056059d84dbSTetsuo Handa void tomoyo_print_ip(char *buf, const unsigned int size, 1057059d84dbSTetsuo Handa const struct tomoyo_ipaddr_union *ptr); 10583ddf17f0STetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 10593ddf17f0STetsuo Handa const unsigned long value, const u8 type); 10603ddf17f0STetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 10613ddf17f0STetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 1062eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 10633ddf17f0STetsuo Handa void tomoyo_update_stat(const u8 index); 10643ddf17f0STetsuo Handa void tomoyo_warn_oom(const char *function); 10653ddf17f0STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 10663ddf17f0STetsuo Handa __printf(2, 3); 10673ddf17f0STetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 1068eadd99ccSTetsuo Handa va_list args); 1069eadd99ccSTetsuo Handa 107076bb0895STetsuo Handa /********** External variable definitions. **********/ 107176bb0895STetsuo Handa 107276bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 107343fc4609SCasey Schaufler extern int tomoyo_enabled; 10742066a361STetsuo Handa extern const char * const tomoyo_condition_keyword 10752066a361STetsuo Handa [TOMOYO_MAX_CONDITION_KEYWORD]; 10763ddf17f0STetsuo Handa extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 10773ddf17f0STetsuo Handa extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX 10783ddf17f0STetsuo Handa + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 10793ddf17f0STetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 10802c47ab93STetsuo Handa extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 1081059d84dbSTetsuo Handa extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX]; 1082059d84dbSTetsuo Handa extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION]; 10832c47ab93STetsuo Handa extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; 10843ddf17f0STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 10850d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 10860d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 10872066a361STetsuo Handa extern struct list_head tomoyo_condition_list; 10883ddf17f0STetsuo Handa extern struct list_head tomoyo_domain_list; 10893ddf17f0STetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 10903ddf17f0STetsuo Handa extern struct list_head tomoyo_namespace_list; 10913ddf17f0STetsuo Handa extern struct mutex tomoyo_policy_lock; 10923ddf17f0STetsuo Handa extern struct srcu_struct tomoyo_ss; 10933ddf17f0STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 10943ddf17f0STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 1095eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 1096eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 1097bbd3662aSCasey Schaufler extern struct lsm_blob_sizes tomoyo_blob_sizes; 109817fcfbd9STetsuo Handa 109976bb0895STetsuo Handa /********** Inlined functions. **********/ 110076bb0895STetsuo Handa 1101b5bc60b4STetsuo Handa /** 1102b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 1103b5bc60b4STetsuo Handa * 1104b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 1105b5bc60b4STetsuo Handa */ 110676bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 110776bb0895STetsuo Handa { 110876bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 110976bb0895STetsuo Handa } 111076bb0895STetsuo Handa 1111b5bc60b4STetsuo Handa /** 1112b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 1113b5bc60b4STetsuo Handa * 1114b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 1115b5bc60b4STetsuo Handa * 1116b5bc60b4STetsuo Handa * Returns nothing. 1117b5bc60b4STetsuo Handa */ 111876bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 111976bb0895STetsuo Handa { 112076bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 112176bb0895STetsuo Handa } 112276bb0895STetsuo Handa 1123b5bc60b4STetsuo Handa /** 11242066a361STetsuo Handa * tomoyo_sys_getppid - Copy of getppid(). 11252066a361STetsuo Handa * 11262066a361STetsuo Handa * Returns parent process's PID. 11272066a361STetsuo Handa * 11282066a361STetsuo Handa * Alpha does not have getppid() defined. To be able to build this module on 11292066a361STetsuo Handa * Alpha, I have to copy getppid() from kernel/timer.c. 11302066a361STetsuo Handa */ 11312066a361STetsuo Handa static inline pid_t tomoyo_sys_getppid(void) 11322066a361STetsuo Handa { 11332066a361STetsuo Handa pid_t pid; 11342066a361STetsuo Handa rcu_read_lock(); 1135bb80d880SKees Cook pid = task_tgid_vnr(rcu_dereference(current->real_parent)); 11362066a361STetsuo Handa rcu_read_unlock(); 11372066a361STetsuo Handa return pid; 11382066a361STetsuo Handa } 11392066a361STetsuo Handa 11402066a361STetsuo Handa /** 11412066a361STetsuo Handa * tomoyo_sys_getpid - Copy of getpid(). 11422066a361STetsuo Handa * 11432066a361STetsuo Handa * Returns current thread's PID. 11442066a361STetsuo Handa * 11452066a361STetsuo Handa * Alpha does not have getpid() defined. To be able to build this module on 11462066a361STetsuo Handa * Alpha, I have to copy getpid() from kernel/timer.c. 11472066a361STetsuo Handa */ 11482066a361STetsuo Handa static inline pid_t tomoyo_sys_getpid(void) 11492066a361STetsuo Handa { 11502066a361STetsuo Handa return task_tgid_vnr(current); 11512066a361STetsuo Handa } 11522066a361STetsuo Handa 11532066a361STetsuo Handa /** 1154b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 1155b5bc60b4STetsuo Handa * 1156b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 1157b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 1158b5bc60b4STetsuo Handa * 1159b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1160b5bc60b4STetsuo Handa */ 11619590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 11629590837bSKentaro Takeda const struct tomoyo_path_info *b) 11639590837bSKentaro Takeda { 11649590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 11659590837bSKentaro Takeda } 11669590837bSKentaro Takeda 11679590837bSKentaro Takeda /** 1168b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 1169b5bc60b4STetsuo Handa * 1170b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 1171b5bc60b4STetsuo Handa * 1172b5bc60b4STetsuo Handa * Returns nothing. 1173b5bc60b4STetsuo Handa */ 117476bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 117576bb0895STetsuo Handa { 117676bb0895STetsuo Handa if (name) { 1177e2bf6907STetsuo Handa struct tomoyo_name *ptr = 1178e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 11790df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 118076bb0895STetsuo Handa } 118176bb0895STetsuo Handa } 11829590837bSKentaro Takeda 1183b5bc60b4STetsuo Handa /** 11842066a361STetsuo Handa * tomoyo_put_condition - Drop reference on "struct tomoyo_condition". 11852066a361STetsuo Handa * 11862066a361STetsuo Handa * @cond: Pointer to "struct tomoyo_condition". Maybe NULL. 11872066a361STetsuo Handa * 11882066a361STetsuo Handa * Returns nothing. 11892066a361STetsuo Handa */ 11902066a361STetsuo Handa static inline void tomoyo_put_condition(struct tomoyo_condition *cond) 11912066a361STetsuo Handa { 11922066a361STetsuo Handa if (cond) 11932066a361STetsuo Handa atomic_dec(&cond->head.users); 11942066a361STetsuo Handa } 11952066a361STetsuo Handa 11962066a361STetsuo Handa /** 1197b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 1198b5bc60b4STetsuo Handa * 1199b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 1200b5bc60b4STetsuo Handa * 1201b5bc60b4STetsuo Handa * Returns nothing. 1202b5bc60b4STetsuo Handa */ 1203a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 12044c3e9e2dSTetsuo Handa { 12054c3e9e2dSTetsuo Handa if (group) 12060df7e8b8STetsuo Handa atomic_dec(&group->head.users); 12074c3e9e2dSTetsuo Handa } 12084c3e9e2dSTetsuo Handa 1209b5bc60b4STetsuo Handa /** 12108c6cb983STetsuo Handa * tomoyo_task - Get "struct tomoyo_task" for specified thread. 121143fc4609SCasey Schaufler * 12128c6cb983STetsuo Handa * @task - Pointer to "struct task_struct". 12138c6cb983STetsuo Handa * 12148c6cb983STetsuo Handa * Returns pointer to "struct tomoyo_task" for specified thread. 121543fc4609SCasey Schaufler */ 12168c6cb983STetsuo Handa static inline struct tomoyo_task *tomoyo_task(struct task_struct *task) 121743fc4609SCasey Schaufler { 12188c6cb983STetsuo Handa return task->security + tomoyo_blob_sizes.lbs_task; 121976bb0895STetsuo Handa } 12209590837bSKentaro Takeda 1221b5bc60b4STetsuo Handa /** 1222b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 1223b5bc60b4STetsuo Handa * 1224b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 1225b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 1226b5bc60b4STetsuo Handa * 1227b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1228b5bc60b4STetsuo Handa */ 122975093152STetsuo Handa static inline bool tomoyo_same_name_union 1230b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 12317762fbffSTetsuo Handa { 12320df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 12337762fbffSTetsuo Handa } 12347762fbffSTetsuo Handa 1235b5bc60b4STetsuo Handa /** 1236b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 1237b5bc60b4STetsuo Handa * 1238b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 1239b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 1240b5bc60b4STetsuo Handa * 1241b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1242b5bc60b4STetsuo Handa */ 124375093152STetsuo Handa static inline bool tomoyo_same_number_union 1244b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 12454c3e9e2dSTetsuo Handa { 1246b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 12470df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 12480df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 12494c3e9e2dSTetsuo Handa } 12504c3e9e2dSTetsuo Handa 1251bd03a3e4STetsuo Handa /** 1252059d84dbSTetsuo Handa * tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry. 1253059d84dbSTetsuo Handa * 1254059d84dbSTetsuo Handa * @a: Pointer to "struct tomoyo_ipaddr_union". 1255059d84dbSTetsuo Handa * @b: Pointer to "struct tomoyo_ipaddr_union". 1256059d84dbSTetsuo Handa * 1257059d84dbSTetsuo Handa * Returns true if @a == @b, false otherwise. 1258059d84dbSTetsuo Handa */ 1259059d84dbSTetsuo Handa static inline bool tomoyo_same_ipaddr_union 1260059d84dbSTetsuo Handa (const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b) 1261059d84dbSTetsuo Handa { 1262059d84dbSTetsuo Handa return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group && 1263059d84dbSTetsuo Handa a->is_ipv6 == b->is_ipv6; 1264059d84dbSTetsuo Handa } 1265059d84dbSTetsuo Handa 1266059d84dbSTetsuo Handa /** 1267bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 1268bd03a3e4STetsuo Handa * 1269bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 1270bd03a3e4STetsuo Handa */ 1271bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 1272bd03a3e4STetsuo Handa { 1273bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 1274bd03a3e4STetsuo Handa } 1275bd03a3e4STetsuo Handa 1276eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 1277eadd99ccSTetsuo Handa 1278eadd99ccSTetsuo Handa /** 1279eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1280eadd99ccSTetsuo Handa * 1281eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1282eadd99ccSTetsuo Handa * 1283eadd99ccSTetsuo Handa * Returns @size. 1284eadd99ccSTetsuo Handa * 1285eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 1286eadd99ccSTetsuo Handa */ 1287eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1288eadd99ccSTetsuo Handa { 1289eadd99ccSTetsuo Handa return size; 1290eadd99ccSTetsuo Handa } 1291eadd99ccSTetsuo Handa 1292eadd99ccSTetsuo Handa #else 1293eadd99ccSTetsuo Handa 1294eadd99ccSTetsuo Handa /** 1295eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1296eadd99ccSTetsuo Handa * 1297eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1298eadd99ccSTetsuo Handa * 1299eadd99ccSTetsuo Handa * Returns rounded size. 1300eadd99ccSTetsuo Handa * 1301eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 1302eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 1303eadd99ccSTetsuo Handa */ 1304eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1305eadd99ccSTetsuo Handa { 1306eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 1307eadd99ccSTetsuo Handa size_t bsize = 32; 1308eadd99ccSTetsuo Handa #else 1309eadd99ccSTetsuo Handa size_t bsize = 64; 1310eadd99ccSTetsuo Handa #endif 1311eadd99ccSTetsuo Handa if (!size) 1312eadd99ccSTetsuo Handa return 0; 1313eadd99ccSTetsuo Handa while (size > bsize) 1314eadd99ccSTetsuo Handa bsize <<= 1; 1315eadd99ccSTetsuo Handa return bsize; 1316eadd99ccSTetsuo Handa } 1317eadd99ccSTetsuo Handa 1318eadd99ccSTetsuo Handa #endif 1319eadd99ccSTetsuo Handa 13209590837bSKentaro Takeda /** 13219590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 13229590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 13239590837bSKentaro Takeda * @head: the head for your list. 13249590837bSKentaro Takeda */ 1325475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 1326475e6fa3STetsuo Handa if (!pos) \ 1327475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 1328475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 1329fdb8ebb7STetsuo Handa 13309590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 1331