19590837bSKentaro Takeda /* 29590837bSKentaro Takeda * security/tomoyo/common.h 39590837bSKentaro Takeda * 476bb0895STetsuo Handa * Header file for TOMOYO. 59590837bSKentaro Takeda * 676bb0895STetsuo Handa * Copyright (C) 2005-2010 NTT DATA CORPORATION 79590837bSKentaro Takeda */ 89590837bSKentaro Takeda 99590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 109590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda 129590837bSKentaro Takeda #include <linux/ctype.h> 139590837bSKentaro Takeda #include <linux/string.h> 149590837bSKentaro Takeda #include <linux/mm.h> 159590837bSKentaro Takeda #include <linux/file.h> 169590837bSKentaro Takeda #include <linux/kmod.h> 179590837bSKentaro Takeda #include <linux/fs.h> 189590837bSKentaro Takeda #include <linux/sched.h> 199590837bSKentaro Takeda #include <linux/namei.h> 209590837bSKentaro Takeda #include <linux/mount.h> 219590837bSKentaro Takeda #include <linux/list.h> 2276bb0895STetsuo Handa #include <linux/cred.h> 2317fcfbd9STetsuo Handa #include <linux/poll.h> 242066a361STetsuo Handa #include <linux/binfmts.h> 252066a361STetsuo Handa #include <linux/highmem.h> 269590837bSKentaro Takeda 2776bb0895STetsuo Handa /********** Constants definitions. **********/ 2876bb0895STetsuo Handa 2976bb0895STetsuo Handa /* 3076bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 3176bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 3276bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 3376bb0895STetsuo Handa */ 3476bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 3576bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 3676bb0895STetsuo Handa 37c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 3876bb0895STetsuo Handa 3976bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 4076bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 4176bb0895STetsuo Handa 4232997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 4332997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 4432997144STetsuo Handa 452066a361STetsuo Handa /* Index numbers for "struct tomoyo_condition". */ 462066a361STetsuo Handa enum tomoyo_conditions_index { 472066a361STetsuo Handa TOMOYO_TASK_UID, /* current_uid() */ 482066a361STetsuo Handa TOMOYO_TASK_EUID, /* current_euid() */ 492066a361STetsuo Handa TOMOYO_TASK_SUID, /* current_suid() */ 502066a361STetsuo Handa TOMOYO_TASK_FSUID, /* current_fsuid() */ 512066a361STetsuo Handa TOMOYO_TASK_GID, /* current_gid() */ 522066a361STetsuo Handa TOMOYO_TASK_EGID, /* current_egid() */ 532066a361STetsuo Handa TOMOYO_TASK_SGID, /* current_sgid() */ 542066a361STetsuo Handa TOMOYO_TASK_FSGID, /* current_fsgid() */ 552066a361STetsuo Handa TOMOYO_TASK_PID, /* sys_getpid() */ 562066a361STetsuo Handa TOMOYO_TASK_PPID, /* sys_getppid() */ 575b636857STetsuo Handa TOMOYO_EXEC_ARGC, /* "struct linux_binprm *"->argc */ 585b636857STetsuo Handa TOMOYO_EXEC_ENVC, /* "struct linux_binprm *"->envc */ 598761afd4STetsuo Handa TOMOYO_TYPE_IS_SOCKET, /* S_IFSOCK */ 608761afd4STetsuo Handa TOMOYO_TYPE_IS_SYMLINK, /* S_IFLNK */ 618761afd4STetsuo Handa TOMOYO_TYPE_IS_FILE, /* S_IFREG */ 628761afd4STetsuo Handa TOMOYO_TYPE_IS_BLOCK_DEV, /* S_IFBLK */ 638761afd4STetsuo Handa TOMOYO_TYPE_IS_DIRECTORY, /* S_IFDIR */ 648761afd4STetsuo Handa TOMOYO_TYPE_IS_CHAR_DEV, /* S_IFCHR */ 658761afd4STetsuo Handa TOMOYO_TYPE_IS_FIFO, /* S_IFIFO */ 668761afd4STetsuo Handa TOMOYO_MODE_SETUID, /* S_ISUID */ 678761afd4STetsuo Handa TOMOYO_MODE_SETGID, /* S_ISGID */ 688761afd4STetsuo Handa TOMOYO_MODE_STICKY, /* S_ISVTX */ 698761afd4STetsuo Handa TOMOYO_MODE_OWNER_READ, /* S_IRUSR */ 708761afd4STetsuo Handa TOMOYO_MODE_OWNER_WRITE, /* S_IWUSR */ 718761afd4STetsuo Handa TOMOYO_MODE_OWNER_EXECUTE, /* S_IXUSR */ 728761afd4STetsuo Handa TOMOYO_MODE_GROUP_READ, /* S_IRGRP */ 738761afd4STetsuo Handa TOMOYO_MODE_GROUP_WRITE, /* S_IWGRP */ 748761afd4STetsuo Handa TOMOYO_MODE_GROUP_EXECUTE, /* S_IXGRP */ 758761afd4STetsuo Handa TOMOYO_MODE_OTHERS_READ, /* S_IROTH */ 768761afd4STetsuo Handa TOMOYO_MODE_OTHERS_WRITE, /* S_IWOTH */ 778761afd4STetsuo Handa TOMOYO_MODE_OTHERS_EXECUTE, /* S_IXOTH */ 782ca9bf45STetsuo Handa TOMOYO_EXEC_REALPATH, 792ca9bf45STetsuo Handa TOMOYO_SYMLINK_TARGET, 808761afd4STetsuo Handa TOMOYO_PATH1_UID, 818761afd4STetsuo Handa TOMOYO_PATH1_GID, 828761afd4STetsuo Handa TOMOYO_PATH1_INO, 838761afd4STetsuo Handa TOMOYO_PATH1_MAJOR, 848761afd4STetsuo Handa TOMOYO_PATH1_MINOR, 858761afd4STetsuo Handa TOMOYO_PATH1_PERM, 868761afd4STetsuo Handa TOMOYO_PATH1_TYPE, 878761afd4STetsuo Handa TOMOYO_PATH1_DEV_MAJOR, 888761afd4STetsuo Handa TOMOYO_PATH1_DEV_MINOR, 898761afd4STetsuo Handa TOMOYO_PATH2_UID, 908761afd4STetsuo Handa TOMOYO_PATH2_GID, 918761afd4STetsuo Handa TOMOYO_PATH2_INO, 928761afd4STetsuo Handa TOMOYO_PATH2_MAJOR, 938761afd4STetsuo Handa TOMOYO_PATH2_MINOR, 948761afd4STetsuo Handa TOMOYO_PATH2_PERM, 958761afd4STetsuo Handa TOMOYO_PATH2_TYPE, 968761afd4STetsuo Handa TOMOYO_PATH2_DEV_MAJOR, 978761afd4STetsuo Handa TOMOYO_PATH2_DEV_MINOR, 988761afd4STetsuo Handa TOMOYO_PATH1_PARENT_UID, 998761afd4STetsuo Handa TOMOYO_PATH1_PARENT_GID, 1008761afd4STetsuo Handa TOMOYO_PATH1_PARENT_INO, 1018761afd4STetsuo Handa TOMOYO_PATH1_PARENT_PERM, 1028761afd4STetsuo Handa TOMOYO_PATH2_PARENT_UID, 1038761afd4STetsuo Handa TOMOYO_PATH2_PARENT_GID, 1048761afd4STetsuo Handa TOMOYO_PATH2_PARENT_INO, 1058761afd4STetsuo Handa TOMOYO_PATH2_PARENT_PERM, 1062066a361STetsuo Handa TOMOYO_MAX_CONDITION_KEYWORD, 1072066a361STetsuo Handa TOMOYO_NUMBER_UNION, 1082ca9bf45STetsuo Handa TOMOYO_NAME_UNION, 1095b636857STetsuo Handa TOMOYO_ARGV_ENTRY, 1105b636857STetsuo Handa TOMOYO_ENVP_ENTRY, 1112066a361STetsuo Handa }; 1122066a361STetsuo Handa 1138761afd4STetsuo Handa 1148761afd4STetsuo Handa /* Index numbers for stat(). */ 1158761afd4STetsuo Handa enum tomoyo_path_stat_index { 1168761afd4STetsuo Handa /* Do not change this order. */ 1178761afd4STetsuo Handa TOMOYO_PATH1, 1188761afd4STetsuo Handa TOMOYO_PATH1_PARENT, 1198761afd4STetsuo Handa TOMOYO_PATH2, 1208761afd4STetsuo Handa TOMOYO_PATH2_PARENT, 1218761afd4STetsuo Handa TOMOYO_MAX_PATH_STAT 1228761afd4STetsuo Handa }; 1238761afd4STetsuo Handa 124b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 125cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 126cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 127cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 128cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 12957c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 130eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 131eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 132eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 133eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 134cb0abe6aSTetsuo Handa }; 135cb0abe6aSTetsuo Handa 136b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 137a230f9e7STetsuo Handa enum tomoyo_policy_id { 138a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 139a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 140a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 1415448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 142a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 143a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 1442066a361STetsuo Handa TOMOYO_ID_CONDITION, 145a230f9e7STetsuo Handa TOMOYO_ID_NAME, 146a230f9e7STetsuo Handa TOMOYO_ID_ACL, 147a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 148a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 149a230f9e7STetsuo Handa }; 150a230f9e7STetsuo Handa 1512c47ab93STetsuo Handa /* Index numbers for domain's attributes. */ 1522c47ab93STetsuo Handa enum tomoyo_domain_info_flags_index { 1532c47ab93STetsuo Handa /* Quota warnning flag. */ 1542c47ab93STetsuo Handa TOMOYO_DIF_QUOTA_WARNED, 1552c47ab93STetsuo Handa /* 1562c47ab93STetsuo Handa * This domain was unable to create a new domain at 1572c47ab93STetsuo Handa * tomoyo_find_next_domain() because the name of the domain to be 1582c47ab93STetsuo Handa * created was too long or it could not allocate memory. 1592c47ab93STetsuo Handa * More than one process continued execve() without domain transition. 1602c47ab93STetsuo Handa */ 1612c47ab93STetsuo Handa TOMOYO_DIF_TRANSITION_FAILED, 1622c47ab93STetsuo Handa TOMOYO_MAX_DOMAIN_INFO_FLAGS 1632c47ab93STetsuo Handa }; 1642c47ab93STetsuo Handa 165b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 166a230f9e7STetsuo Handa enum tomoyo_group_id { 167a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 168a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 169a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 170a230f9e7STetsuo Handa }; 171a230f9e7STetsuo Handa 172b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 173b5bc60b4STetsuo Handa enum tomoyo_value_type { 174b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 175b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 176b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 177b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 178b5bc60b4STetsuo Handa }; 1794c3e9e2dSTetsuo Handa 180b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 1815448ec4fSTetsuo Handa enum tomoyo_transition_type { 1825448ec4fSTetsuo Handa /* Do not change this order, */ 183bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 184bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 1855448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 1865448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 1875448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 1885448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 1895448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 1905448ec4fSTetsuo Handa }; 1915448ec4fSTetsuo Handa 19276bb0895STetsuo Handa /* Index numbers for Access Controls. */ 193084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 1947ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 1957ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 196a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 19775093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 1982106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 199084da356STetsuo Handa }; 20076bb0895STetsuo Handa 201b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 202084da356STetsuo Handa enum tomoyo_path_acl_index { 2037ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 2047ef61233STetsuo Handa TOMOYO_TYPE_READ, 2057ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 2067c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 2077ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 2087c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 2097ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 2107ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 2117ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 2127ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 2137ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 2147ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 215084da356STetsuo Handa }; 21676bb0895STetsuo Handa 217b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 218eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 219eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 220eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 221eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 222eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 223eadd99ccSTetsuo Handa }; 224eadd99ccSTetsuo Handa 22575093152STetsuo Handa enum tomoyo_mkdev_acl_index { 226a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 227a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 22875093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 229a1f9bb6aSTetsuo Handa }; 230a1f9bb6aSTetsuo Handa 231b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 232084da356STetsuo Handa enum tomoyo_path2_acl_index { 2337ef61233STetsuo Handa TOMOYO_TYPE_LINK, 2347ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 2357ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 2367ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 237084da356STetsuo Handa }; 23876bb0895STetsuo Handa 239b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 240a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 241a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 242a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 243a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 244a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 245a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 246a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 247a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 248a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 249a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 250a1f9bb6aSTetsuo Handa }; 251a1f9bb6aSTetsuo Handa 252b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 253084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 254084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 255084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 256084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 257b22b8b9fSTetsuo Handa TOMOYO_STAT, 258084da356STetsuo Handa TOMOYO_SELFDOMAIN, 259eadd99ccSTetsuo Handa TOMOYO_AUDIT, 260084da356STetsuo Handa TOMOYO_VERSION, 261084da356STetsuo Handa TOMOYO_PROFILE, 26217fcfbd9STetsuo Handa TOMOYO_QUERY, 263084da356STetsuo Handa TOMOYO_MANAGER 264084da356STetsuo Handa }; 26576bb0895STetsuo Handa 266b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 267b5bc60b4STetsuo Handa enum tomoyo_special_mount { 268b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 269b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 270b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 271b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 272b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 273b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 274b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 275b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 276b5bc60b4STetsuo Handa }; 277b5bc60b4STetsuo Handa 278b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 27957c2590fSTetsuo Handa enum tomoyo_mac_index { 28057c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 28157c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 28257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 28357c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 2847c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 28557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 28657c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 28757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 28857c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 28957c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 29057c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 29157c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 29257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 29357c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 29457c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 29557c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 29657c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 29757c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 29857c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 29957c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 30057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 30157c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 30257c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 30357c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 30457c2590fSTetsuo Handa }; 30557c2590fSTetsuo Handa 306b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 30757c2590fSTetsuo Handa enum tomoyo_mac_category_index { 30857c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 30957c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 31057c2590fSTetsuo Handa }; 31157c2590fSTetsuo Handa 312b5bc60b4STetsuo Handa /* 313b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 314b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 315b5bc60b4STetsuo Handa * 316b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 317b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 318b5bc60b4STetsuo Handa */ 319b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 32017fcfbd9STetsuo Handa 321b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 322b22b8b9fSTetsuo Handa enum tomoyo_policy_stat_type { 323b22b8b9fSTetsuo Handa /* Do not change this order. */ 324b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_UPDATES, 325b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_LEARNING, /* == TOMOYO_CONFIG_LEARNING */ 326b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_PERMISSIVE, /* == TOMOYO_CONFIG_PERMISSIVE */ 327b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_ENFORCING, /* == TOMOYO_CONFIG_ENFORCING */ 328b22b8b9fSTetsuo Handa TOMOYO_MAX_POLICY_STAT 329b22b8b9fSTetsuo Handa }; 330b22b8b9fSTetsuo Handa 331d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 332d5ca1725STetsuo Handa enum tomoyo_pref_index { 333eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 334d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 335d5ca1725STetsuo Handa TOMOYO_MAX_PREF 336d5ca1725STetsuo Handa }; 337d5ca1725STetsuo Handa 33876bb0895STetsuo Handa /********** Structure definitions. **********/ 3399590837bSKentaro Takeda 340b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 34182e0f001STetsuo Handa struct tomoyo_acl_head { 34282e0f001STetsuo Handa struct list_head list; 34382e0f001STetsuo Handa bool is_deleted; 34482e0f001STetsuo Handa } __packed; 34582e0f001STetsuo Handa 3460df7e8b8STetsuo Handa /* Common header for shared entries. */ 3470df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 3480df7e8b8STetsuo Handa struct list_head list; 3490df7e8b8STetsuo Handa atomic_t users; 3500df7e8b8STetsuo Handa } __packed; 3510df7e8b8STetsuo Handa 352bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 353bd03a3e4STetsuo Handa 354b5bc60b4STetsuo Handa /* Structure for request info. */ 355cb0abe6aSTetsuo Handa struct tomoyo_request_info { 3568761afd4STetsuo Handa /* 3578761afd4STetsuo Handa * For holding parameters specific to operations which deal files. 3588761afd4STetsuo Handa * NULL if not dealing files. 3598761afd4STetsuo Handa */ 3608761afd4STetsuo Handa struct tomoyo_obj_info *obj; 3612ca9bf45STetsuo Handa /* 3622ca9bf45STetsuo Handa * For holding parameters specific to execve() request. 3632ca9bf45STetsuo Handa * NULL if not dealing do_execve(). 3642ca9bf45STetsuo Handa */ 3652ca9bf45STetsuo Handa struct tomoyo_execve *ee; 366cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 367cf6e9a64STetsuo Handa /* For holding parameters. */ 368cf6e9a64STetsuo Handa union { 369cf6e9a64STetsuo Handa struct { 370cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 371484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 372484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 373b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 374cf6e9a64STetsuo Handa u8 operation; 375cf6e9a64STetsuo Handa } path; 376cf6e9a64STetsuo Handa struct { 377cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 378cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 379b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 380cf6e9a64STetsuo Handa u8 operation; 381cf6e9a64STetsuo Handa } path2; 382cf6e9a64STetsuo Handa struct { 383cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 384cf6e9a64STetsuo Handa unsigned int mode; 385cf6e9a64STetsuo Handa unsigned int major; 386cf6e9a64STetsuo Handa unsigned int minor; 387b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 388cf6e9a64STetsuo Handa u8 operation; 389cf6e9a64STetsuo Handa } mkdev; 390cf6e9a64STetsuo Handa struct { 391cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 392cf6e9a64STetsuo Handa unsigned long number; 393b5bc60b4STetsuo Handa /* 394b5bc60b4STetsuo Handa * One of values in 395b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 396b5bc60b4STetsuo Handa */ 397cf6e9a64STetsuo Handa u8 operation; 398cf6e9a64STetsuo Handa } path_number; 399cf6e9a64STetsuo Handa struct { 400cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 401cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 402cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 403cf6e9a64STetsuo Handa unsigned long flags; 404cf6e9a64STetsuo Handa int need_dev; 405cf6e9a64STetsuo Handa } mount; 406cf6e9a64STetsuo Handa } param; 407cf6e9a64STetsuo Handa u8 param_type; 408cf6e9a64STetsuo Handa bool granted; 40917fcfbd9STetsuo Handa u8 retry; 41017fcfbd9STetsuo Handa u8 profile; 411cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 41257c2590fSTetsuo Handa u8 type; 413cb0abe6aSTetsuo Handa }; 414cb0abe6aSTetsuo Handa 415b5bc60b4STetsuo Handa /* Structure for holding a token. */ 4169590837bSKentaro Takeda struct tomoyo_path_info { 4179590837bSKentaro Takeda const char *name; 4189590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 4199590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 4209590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 4219590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 4229590837bSKentaro Takeda }; 4239590837bSKentaro Takeda 424b5bc60b4STetsuo Handa /* Structure for holding string data. */ 425e2bf6907STetsuo Handa struct tomoyo_name { 4260df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 42776bb0895STetsuo Handa struct tomoyo_path_info entry; 42876bb0895STetsuo Handa }; 4299590837bSKentaro Takeda 430b5bc60b4STetsuo Handa /* Structure for holding a word. */ 4317762fbffSTetsuo Handa struct tomoyo_name_union { 432b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 4337762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 434a98aa4deSTetsuo Handa struct tomoyo_group *group; 4357762fbffSTetsuo Handa }; 4367762fbffSTetsuo Handa 437b5bc60b4STetsuo Handa /* Structure for holding a number. */ 4384c3e9e2dSTetsuo Handa struct tomoyo_number_union { 4394c3e9e2dSTetsuo Handa unsigned long values[2]; 440b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 441b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 4420df7e8b8STetsuo Handa u8 value_type[2]; 4434c3e9e2dSTetsuo Handa }; 4444c3e9e2dSTetsuo Handa 445a98aa4deSTetsuo Handa /* Structure for "path_group"/"number_group" directive. */ 446a98aa4deSTetsuo Handa struct tomoyo_group { 4470df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 448a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 449a98aa4deSTetsuo Handa struct list_head member_list; 450a98aa4deSTetsuo Handa }; 451a98aa4deSTetsuo Handa 4527762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 4537762fbffSTetsuo Handa struct tomoyo_path_group { 45482e0f001STetsuo Handa struct tomoyo_acl_head head; 4557762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 4567762fbffSTetsuo Handa }; 4577762fbffSTetsuo Handa 4584c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 459a98aa4deSTetsuo Handa struct tomoyo_number_group { 46082e0f001STetsuo Handa struct tomoyo_acl_head head; 4614c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 4624c3e9e2dSTetsuo Handa }; 4634c3e9e2dSTetsuo Handa 4648761afd4STetsuo Handa /* Subset of "struct stat". Used by conditional ACL and audit logs. */ 4658761afd4STetsuo Handa struct tomoyo_mini_stat { 4668761afd4STetsuo Handa uid_t uid; 4678761afd4STetsuo Handa gid_t gid; 4688761afd4STetsuo Handa ino_t ino; 4698761afd4STetsuo Handa mode_t mode; 4708761afd4STetsuo Handa dev_t dev; 4718761afd4STetsuo Handa dev_t rdev; 4728761afd4STetsuo Handa }; 4738761afd4STetsuo Handa 4745b636857STetsuo Handa /* Structure for dumping argv[] and envp[] of "struct linux_binprm". */ 4755b636857STetsuo Handa struct tomoyo_page_dump { 4765b636857STetsuo Handa struct page *page; /* Previously dumped page. */ 4775b636857STetsuo Handa char *data; /* Contents of "page". Size is PAGE_SIZE. */ 4785b636857STetsuo Handa }; 4795b636857STetsuo Handa 4808761afd4STetsuo Handa /* Structure for attribute checks in addition to pathname checks. */ 4818761afd4STetsuo Handa struct tomoyo_obj_info { 4828761afd4STetsuo Handa /* 4838761afd4STetsuo Handa * True if tomoyo_get_attributes() was already called, false otherwise. 4848761afd4STetsuo Handa */ 4858761afd4STetsuo Handa bool validate_done; 4868761afd4STetsuo Handa /* True if @stat[] is valid. */ 4878761afd4STetsuo Handa bool stat_valid[TOMOYO_MAX_PATH_STAT]; 4888761afd4STetsuo Handa /* First pathname. Initialized with { NULL, NULL } if no path. */ 4898761afd4STetsuo Handa struct path path1; 4908761afd4STetsuo Handa /* Second pathname. Initialized with { NULL, NULL } if no path. */ 4918761afd4STetsuo Handa struct path path2; 4928761afd4STetsuo Handa /* 4938761afd4STetsuo Handa * Information on @path1, @path1's parent directory, @path2, @path2's 4948761afd4STetsuo Handa * parent directory. 4958761afd4STetsuo Handa */ 4968761afd4STetsuo Handa struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT]; 4972ca9bf45STetsuo Handa /* 4982ca9bf45STetsuo Handa * Content of symbolic link to be created. NULL for operations other 4992ca9bf45STetsuo Handa * than symlink(). 5002ca9bf45STetsuo Handa */ 5012ca9bf45STetsuo Handa struct tomoyo_path_info *symlink_target; 5022ca9bf45STetsuo Handa }; 5032ca9bf45STetsuo Handa 5045b636857STetsuo Handa /* Structure for argv[]. */ 5055b636857STetsuo Handa struct tomoyo_argv { 5065b636857STetsuo Handa unsigned long index; 5075b636857STetsuo Handa const struct tomoyo_path_info *value; 5085b636857STetsuo Handa bool is_not; 5095b636857STetsuo Handa }; 5105b636857STetsuo Handa 5115b636857STetsuo Handa /* Structure for envp[]. */ 5125b636857STetsuo Handa struct tomoyo_envp { 5135b636857STetsuo Handa const struct tomoyo_path_info *name; 5145b636857STetsuo Handa const struct tomoyo_path_info *value; 5155b636857STetsuo Handa bool is_not; 5165b636857STetsuo Handa }; 5175b636857STetsuo Handa 5182ca9bf45STetsuo Handa /* Structure for execve() operation. */ 5192ca9bf45STetsuo Handa struct tomoyo_execve { 5202ca9bf45STetsuo Handa struct tomoyo_request_info r; 5212ca9bf45STetsuo Handa struct tomoyo_obj_info obj; 5222ca9bf45STetsuo Handa struct linux_binprm *bprm; 5235b636857STetsuo Handa /* For dumping argv[] and envp[]. */ 5245b636857STetsuo Handa struct tomoyo_page_dump dump; 5252ca9bf45STetsuo Handa /* For temporary use. */ 5262ca9bf45STetsuo Handa char *tmp; /* Size is TOMOYO_EXEC_TMPSIZE bytes */ 5278761afd4STetsuo Handa }; 5288761afd4STetsuo Handa 5292066a361STetsuo Handa /* Structure for entries which follows "struct tomoyo_condition". */ 5302066a361STetsuo Handa struct tomoyo_condition_element { 5315b636857STetsuo Handa /* 5325b636857STetsuo Handa * Left hand operand. A "struct tomoyo_argv" for TOMOYO_ARGV_ENTRY, a 5335b636857STetsuo Handa * "struct tomoyo_envp" for TOMOYO_ENVP_ENTRY is attached to the tail 5345b636857STetsuo Handa * of the array of this struct. 5355b636857STetsuo Handa */ 5362066a361STetsuo Handa u8 left; 5375b636857STetsuo Handa /* 5385b636857STetsuo Handa * Right hand operand. A "struct tomoyo_number_union" for 5395b636857STetsuo Handa * TOMOYO_NUMBER_UNION, a "struct tomoyo_name_union" for 5405b636857STetsuo Handa * TOMOYO_NAME_UNION is attached to the tail of the array of this 5415b636857STetsuo Handa * struct. 5425b636857STetsuo Handa */ 5432066a361STetsuo Handa u8 right; 5442066a361STetsuo Handa /* Equation operator. True if equals or overlaps, false otherwise. */ 5452066a361STetsuo Handa bool equals; 5462066a361STetsuo Handa }; 5472066a361STetsuo Handa 5482066a361STetsuo Handa /* Structure for optional arguments. */ 5492066a361STetsuo Handa struct tomoyo_condition { 5502066a361STetsuo Handa struct tomoyo_shared_acl_head head; 5512066a361STetsuo Handa u32 size; /* Memory size allocated for this entry. */ 5522066a361STetsuo Handa u16 condc; /* Number of conditions in this struct. */ 5532066a361STetsuo Handa u16 numbers_count; /* Number of "struct tomoyo_number_union values". */ 5542ca9bf45STetsuo Handa u16 names_count; /* Number of "struct tomoyo_name_union names". */ 5555b636857STetsuo Handa u16 argc; /* Number of "struct tomoyo_argv". */ 5565b636857STetsuo Handa u16 envc; /* Number of "struct tomoyo_envp". */ 5572066a361STetsuo Handa /* 5582066a361STetsuo Handa * struct tomoyo_condition_element condition[condc]; 5592066a361STetsuo Handa * struct tomoyo_number_union values[numbers_count]; 5602ca9bf45STetsuo Handa * struct tomoyo_name_union names[names_count]; 5615b636857STetsuo Handa * struct tomoyo_argv argv[argc]; 5625b636857STetsuo Handa * struct tomoyo_envp envp[envc]; 5632066a361STetsuo Handa */ 5642066a361STetsuo Handa }; 5652066a361STetsuo Handa 566b5bc60b4STetsuo Handa /* Common header for individual entries. */ 5679590837bSKentaro Takeda struct tomoyo_acl_info { 5689590837bSKentaro Takeda struct list_head list; 5692066a361STetsuo Handa struct tomoyo_condition *cond; /* Maybe NULL. */ 570237ab459STetsuo Handa bool is_deleted; 571b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 5729590837bSKentaro Takeda } __packed; 5739590837bSKentaro Takeda 574b5bc60b4STetsuo Handa /* Structure for domain information. */ 5759590837bSKentaro Takeda struct tomoyo_domain_info { 5769590837bSKentaro Takeda struct list_head list; 5779590837bSKentaro Takeda struct list_head acl_info_list; 5789590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 5799590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 580bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 581bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 5829590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 58332997144STetsuo Handa u8 group; /* Group number to use. */ 584a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 5852c47ab93STetsuo Handa bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 586ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 5879590837bSKentaro Takeda }; 5889590837bSKentaro Takeda 5899590837bSKentaro Takeda /* 590b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 591b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 592b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 5939590837bSKentaro Takeda */ 5947ef61233STetsuo Handa struct tomoyo_path_acl { 5957ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 596b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 5977762fbffSTetsuo Handa struct tomoyo_name_union name; 5989590837bSKentaro Takeda }; 5999590837bSKentaro Takeda 600c3fa109aSTetsuo Handa /* 601b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 602b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 603a1f9bb6aSTetsuo Handa */ 604a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 605a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 606b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 607a1f9bb6aSTetsuo Handa u8 perm; 608a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 609a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 610a1f9bb6aSTetsuo Handa }; 611a1f9bb6aSTetsuo Handa 612b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 61375093152STetsuo Handa struct tomoyo_mkdev_acl { 61475093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 615b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 616a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 617a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 618a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 619a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 620a1f9bb6aSTetsuo Handa }; 621a1f9bb6aSTetsuo Handa 622a1f9bb6aSTetsuo Handa /* 623b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 624c3fa109aSTetsuo Handa */ 6257ef61233STetsuo Handa struct tomoyo_path2_acl { 6267ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 627b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 6287762fbffSTetsuo Handa struct tomoyo_name_union name1; 6297762fbffSTetsuo Handa struct tomoyo_name_union name2; 6309590837bSKentaro Takeda }; 6319590837bSKentaro Takeda 632b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 6332106ccd9STetsuo Handa struct tomoyo_mount_acl { 6342106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 6352106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 6362106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 6372106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 6382106ccd9STetsuo Handa struct tomoyo_number_union flags; 6392106ccd9STetsuo Handa }; 6402106ccd9STetsuo Handa 641a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 642a238cf5bSTetsuo Handa struct tomoyo_acl_param { 643a238cf5bSTetsuo Handa char *data; 644a238cf5bSTetsuo Handa struct list_head *list; 645bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 646a238cf5bSTetsuo Handa bool is_delete; 647a238cf5bSTetsuo Handa }; 648a238cf5bSTetsuo Handa 6490d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 650f23571e8STetsuo Handa 6512106ccd9STetsuo Handa /* 652f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 653f23571e8STetsuo Handa * interfaces. 654c3fa109aSTetsuo Handa */ 6559590837bSKentaro Takeda struct tomoyo_io_buffer { 6568fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 6579590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 65817fcfbd9STetsuo Handa int (*poll) (struct file *file, poll_table *wait); 6599590837bSKentaro Takeda /* Exclusive lock for this structure. */ 6609590837bSKentaro Takeda struct mutex io_sem; 661f23571e8STetsuo Handa char __user *read_user_buf; 6622c47ab93STetsuo Handa size_t read_user_buf_avail; 663f23571e8STetsuo Handa struct { 664bd03a3e4STetsuo Handa struct list_head *ns; 665f23571e8STetsuo Handa struct list_head *domain; 666f23571e8STetsuo Handa struct list_head *group; 667f23571e8STetsuo Handa struct list_head *acl; 6682c47ab93STetsuo Handa size_t avail; 6692c47ab93STetsuo Handa unsigned int step; 6702c47ab93STetsuo Handa unsigned int query_index; 671f23571e8STetsuo Handa u16 index; 6722066a361STetsuo Handa u16 cond_index; 67332997144STetsuo Handa u8 acl_group_index; 6742066a361STetsuo Handa u8 cond_step; 675f23571e8STetsuo Handa u8 bit; 676f23571e8STetsuo Handa u8 w_pos; 677f23571e8STetsuo Handa bool eof; 678f23571e8STetsuo Handa bool print_this_domain_only; 679bd03a3e4STetsuo Handa bool print_transition_related_only; 6802066a361STetsuo Handa bool print_cond_part; 681f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 682f23571e8STetsuo Handa } r; 6830df7e8b8STetsuo Handa struct { 684bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 6859590837bSKentaro Takeda /* The position currently writing to. */ 6860df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 6870df7e8b8STetsuo Handa /* Bytes available for writing. */ 6882c47ab93STetsuo Handa size_t avail; 689bd03a3e4STetsuo Handa bool is_delete; 6900df7e8b8STetsuo Handa } w; 6919590837bSKentaro Takeda /* Buffer for reading. */ 6929590837bSKentaro Takeda char *read_buf; 6939590837bSKentaro Takeda /* Size of read buffer. */ 6942c47ab93STetsuo Handa size_t readbuf_size; 6959590837bSKentaro Takeda /* Buffer for writing. */ 6969590837bSKentaro Takeda char *write_buf; 6979590837bSKentaro Takeda /* Size of write buffer. */ 6982c47ab93STetsuo Handa size_t writebuf_size; 69917fcfbd9STetsuo Handa /* Type of this interface. */ 7002c47ab93STetsuo Handa enum tomoyo_securityfs_interface_index type; 7012e503bbbSTetsuo Handa /* Users counter protected by tomoyo_io_buffer_list_lock. */ 7022e503bbbSTetsuo Handa u8 users; 7032e503bbbSTetsuo Handa /* List for telling GC not to kfree() elements. */ 7042e503bbbSTetsuo Handa struct list_head list; 7059590837bSKentaro Takeda }; 7069590837bSKentaro Takeda 70776bb0895STetsuo Handa /* 708b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 709b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 71076bb0895STetsuo Handa */ 7115448ec4fSTetsuo Handa struct tomoyo_transition_control { 71282e0f001STetsuo Handa struct tomoyo_acl_head head; 7135448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 71476bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 71576bb0895STetsuo Handa bool is_last_name; 7165448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 7175448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 71876bb0895STetsuo Handa }; 71976bb0895STetsuo Handa 720b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 721e2bf6907STetsuo Handa struct tomoyo_aggregator { 72282e0f001STetsuo Handa struct tomoyo_acl_head head; 7231084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 7241084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 7251084307cSTetsuo Handa }; 7261084307cSTetsuo Handa 727b5bc60b4STetsuo Handa /* Structure for policy manager. */ 728e2bf6907STetsuo Handa struct tomoyo_manager { 72982e0f001STetsuo Handa struct tomoyo_acl_head head; 73082e0f001STetsuo Handa bool is_domain; /* True if manager is a domainname. */ 73176bb0895STetsuo Handa /* A path to program or a domainname. */ 73276bb0895STetsuo Handa const struct tomoyo_path_info *manager; 73376bb0895STetsuo Handa }; 73476bb0895STetsuo Handa 73557c2590fSTetsuo Handa struct tomoyo_preference { 73657c2590fSTetsuo Handa unsigned int learning_max_entry; 73757c2590fSTetsuo Handa bool enforcing_verbose; 73857c2590fSTetsuo Handa bool learning_verbose; 73957c2590fSTetsuo Handa bool permissive_verbose; 74057c2590fSTetsuo Handa }; 74157c2590fSTetsuo Handa 742b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 74357c2590fSTetsuo Handa struct tomoyo_profile { 74457c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 74557c2590fSTetsuo Handa struct tomoyo_preference *learning; 74657c2590fSTetsuo Handa struct tomoyo_preference *permissive; 74757c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 74857c2590fSTetsuo Handa struct tomoyo_preference preference; 74957c2590fSTetsuo Handa u8 default_config; 75057c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 751d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 75257c2590fSTetsuo Handa }; 75357c2590fSTetsuo Handa 754eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 755eadd99ccSTetsuo Handa struct tomoyo_time { 756eadd99ccSTetsuo Handa u16 year; 757eadd99ccSTetsuo Handa u8 month; 758eadd99ccSTetsuo Handa u8 day; 759eadd99ccSTetsuo Handa u8 hour; 760eadd99ccSTetsuo Handa u8 min; 761eadd99ccSTetsuo Handa u8 sec; 762eadd99ccSTetsuo Handa }; 763eadd99ccSTetsuo Handa 764bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 765bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 766bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 767bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 768bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 769bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 770bd03a3e4STetsuo Handa /* List of policy. */ 771bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 772bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 773bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 774bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 775bd03a3e4STetsuo Handa struct list_head namespace_list; 776bd03a3e4STetsuo Handa /* Profile version. Currently only 20100903 is defined. */ 777bd03a3e4STetsuo Handa unsigned int profile_version; 778bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 779bd03a3e4STetsuo Handa const char *name; 780bd03a3e4STetsuo Handa }; 781bd03a3e4STetsuo Handa 78276bb0895STetsuo Handa /********** Function prototypes. **********/ 78376bb0895STetsuo Handa 7842106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 7852106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 7862066a361STetsuo Handa bool tomoyo_condition(struct tomoyo_request_info *r, 7872066a361STetsuo Handa const struct tomoyo_condition *cond); 78875093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 78975093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 79075093152STetsuo Handa bool tomoyo_correct_word(const char *string); 79175093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 7923ddf17f0STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 7935b636857STetsuo Handa bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, 7945b636857STetsuo Handa struct tomoyo_page_dump *dump); 7953ddf17f0STetsuo Handa bool tomoyo_memory_ok(void *ptr); 7964c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 7974c3e9e2dSTetsuo Handa const unsigned long max, 798a98aa4deSTetsuo Handa const struct tomoyo_group *group); 7993ddf17f0STetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 8003ddf17f0STetsuo Handa struct tomoyo_name_union *ptr); 801a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 802a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 8033ddf17f0STetsuo Handa bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 8043ddf17f0STetsuo Handa const struct tomoyo_path_info *pattern); 8053ddf17f0STetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 8063ddf17f0STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 8073ddf17f0STetsuo Handa char *tomoyo_encode(const char *str); 8083ddf17f0STetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 8093ddf17f0STetsuo Handa va_list args); 8103ddf17f0STetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 8113ddf17f0STetsuo Handa char *tomoyo_realpath_from_path(struct path *path); 8123ddf17f0STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 8133ddf17f0STetsuo Handa const char *tomoyo_get_exe(void); 8143ddf17f0STetsuo Handa const char *tomoyo_yesno(const unsigned int value); 8153ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_compare_name_union 8163ddf17f0STetsuo Handa (const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr); 8173ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 8183ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_path_matches_group 8193ddf17f0STetsuo Handa (const struct tomoyo_path_info *pathname, const struct tomoyo_group *group); 8203ddf17f0STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 8213ddf17f0STetsuo Handa struct path *path, const int flag); 8223ddf17f0STetsuo Handa int tomoyo_close_control(struct tomoyo_io_buffer *head); 8233ddf17f0STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 8243ddf17f0STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 8253ddf17f0STetsuo Handa const u8 index); 8262106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 82757c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 82857c2590fSTetsuo Handa const u8 index); 8293ddf17f0STetsuo Handa int tomoyo_mkdev_perm(const u8 operation, struct path *path, 8303ddf17f0STetsuo Handa const unsigned int mode, unsigned int dev); 831b5bc60b4STetsuo Handa int tomoyo_mount_permission(char *dev_name, struct path *path, 832b5bc60b4STetsuo Handa const char *type, unsigned long flags, 833b5bc60b4STetsuo Handa void *data_page); 8343ddf17f0STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 83597d6931eSTetsuo Handa int tomoyo_path2_perm(const u8 operation, struct path *path1, 83697d6931eSTetsuo Handa struct path *path2); 8373ddf17f0STetsuo Handa int tomoyo_path_number_perm(const u8 operation, struct path *path, 8383ddf17f0STetsuo Handa unsigned long number); 83997fb35e4STetsuo Handa int tomoyo_path_perm(const u8 operation, struct path *path, 84097fb35e4STetsuo Handa const char *target); 8413ddf17f0STetsuo Handa int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 8423ddf17f0STetsuo Handa const struct tomoyo_path_info *filename); 8433ddf17f0STetsuo Handa int tomoyo_poll_control(struct file *file, poll_table *wait); 8443ddf17f0STetsuo Handa int tomoyo_poll_log(struct file *file, poll_table *wait); 8453ddf17f0STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 8463ddf17f0STetsuo Handa __printf(2, 3); 847237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 848a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 8493ddf17f0STetsuo Handa bool (*check_duplicate) 8503ddf17f0STetsuo Handa (const struct tomoyo_acl_info *, 8513ddf17f0STetsuo Handa const struct tomoyo_acl_info *), 8523ddf17f0STetsuo Handa bool (*merge_duplicate) 8533ddf17f0STetsuo Handa (struct tomoyo_acl_info *, struct tomoyo_acl_info *, 854237ab459STetsuo Handa const bool)); 85536f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 856a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 8573ddf17f0STetsuo Handa bool (*check_duplicate) 8583ddf17f0STetsuo Handa (const struct tomoyo_acl_head *, 8593ddf17f0STetsuo Handa const struct tomoyo_acl_head *)); 8603ddf17f0STetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 8613ddf17f0STetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 8623ddf17f0STetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 8633ddf17f0STetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 8643ddf17f0STetsuo Handa const u8 type); 8653ddf17f0STetsuo Handa ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 8663ddf17f0STetsuo Handa const int buffer_len); 8673ddf17f0STetsuo Handa ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 8683ddf17f0STetsuo Handa const char __user *buffer, const int buffer_len); 8692066a361STetsuo Handa struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param); 8703ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 8713ddf17f0STetsuo Handa const bool transit); 8723ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 8733ddf17f0STetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 8743ddf17f0STetsuo Handa const u8 idx); 8753ddf17f0STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 8763ddf17f0STetsuo Handa (const char *domainname); 8773ddf17f0STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 8783ddf17f0STetsuo Handa const u8 profile); 8793ddf17f0STetsuo Handa unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 8803ddf17f0STetsuo Handa const u8 index); 8812066a361STetsuo Handa u8 tomoyo_parse_ulong(unsigned long *result, char **str); 8823ddf17f0STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 8833ddf17f0STetsuo Handa void __init tomoyo_load_builtin_policy(void); 8843ddf17f0STetsuo Handa void __init tomoyo_mm_init(void); 88599a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 886484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 88799a85259STetsuo Handa const struct tomoyo_acl_info *)); 8883ddf17f0STetsuo Handa void tomoyo_check_profile(void); 8893ddf17f0STetsuo Handa void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp); 8902066a361STetsuo Handa void tomoyo_del_condition(struct list_head *element); 8913ddf17f0STetsuo Handa void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 8928761afd4STetsuo Handa void tomoyo_get_attributes(struct tomoyo_obj_info *obj); 8933ddf17f0STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 8943ddf17f0STetsuo Handa void tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 8953ddf17f0STetsuo Handa __printf(2, 3); 8963ddf17f0STetsuo Handa void tomoyo_load_policy(const char *filename); 8973ddf17f0STetsuo Handa void tomoyo_memory_free(void *ptr); 8983ddf17f0STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 8993ddf17f0STetsuo Handa void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); 9003ddf17f0STetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 9013ddf17f0STetsuo Handa const unsigned long value, const u8 type); 9023ddf17f0STetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 9033ddf17f0STetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 904eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 9053ddf17f0STetsuo Handa void tomoyo_update_stat(const u8 index); 9063ddf17f0STetsuo Handa void tomoyo_warn_oom(const char *function); 9073ddf17f0STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 9083ddf17f0STetsuo Handa __printf(2, 3); 9093ddf17f0STetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 910eadd99ccSTetsuo Handa va_list args); 911eadd99ccSTetsuo Handa 91276bb0895STetsuo Handa /********** External variable definitions. **********/ 91376bb0895STetsuo Handa 91476bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 9152066a361STetsuo Handa extern const char * const tomoyo_condition_keyword 9162066a361STetsuo Handa [TOMOYO_MAX_CONDITION_KEYWORD]; 9173ddf17f0STetsuo Handa extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 9183ddf17f0STetsuo Handa extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX 9193ddf17f0STetsuo Handa + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 9203ddf17f0STetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 9212c47ab93STetsuo Handa extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 9222c47ab93STetsuo Handa extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; 9233ddf17f0STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 9240d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 9250d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 9262066a361STetsuo Handa extern struct list_head tomoyo_condition_list; 9273ddf17f0STetsuo Handa extern struct list_head tomoyo_domain_list; 9283ddf17f0STetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 9293ddf17f0STetsuo Handa extern struct list_head tomoyo_namespace_list; 9303ddf17f0STetsuo Handa extern struct mutex tomoyo_policy_lock; 9313ddf17f0STetsuo Handa extern struct srcu_struct tomoyo_ss; 9323ddf17f0STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 9333ddf17f0STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 934eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 935eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 93617fcfbd9STetsuo Handa 93776bb0895STetsuo Handa /********** Inlined functions. **********/ 93876bb0895STetsuo Handa 939b5bc60b4STetsuo Handa /** 940b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 941b5bc60b4STetsuo Handa * 942b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 943b5bc60b4STetsuo Handa */ 94476bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 94576bb0895STetsuo Handa { 94676bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 94776bb0895STetsuo Handa } 94876bb0895STetsuo Handa 949b5bc60b4STetsuo Handa /** 950b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 951b5bc60b4STetsuo Handa * 952b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 953b5bc60b4STetsuo Handa * 954b5bc60b4STetsuo Handa * Returns nothing. 955b5bc60b4STetsuo Handa */ 95676bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 95776bb0895STetsuo Handa { 95876bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 95976bb0895STetsuo Handa } 96076bb0895STetsuo Handa 961b5bc60b4STetsuo Handa /** 9622066a361STetsuo Handa * tomoyo_sys_getppid - Copy of getppid(). 9632066a361STetsuo Handa * 9642066a361STetsuo Handa * Returns parent process's PID. 9652066a361STetsuo Handa * 9662066a361STetsuo Handa * Alpha does not have getppid() defined. To be able to build this module on 9672066a361STetsuo Handa * Alpha, I have to copy getppid() from kernel/timer.c. 9682066a361STetsuo Handa */ 9692066a361STetsuo Handa static inline pid_t tomoyo_sys_getppid(void) 9702066a361STetsuo Handa { 9712066a361STetsuo Handa pid_t pid; 9722066a361STetsuo Handa rcu_read_lock(); 9732066a361STetsuo Handa pid = task_tgid_vnr(current->real_parent); 9742066a361STetsuo Handa rcu_read_unlock(); 9752066a361STetsuo Handa return pid; 9762066a361STetsuo Handa } 9772066a361STetsuo Handa 9782066a361STetsuo Handa /** 9792066a361STetsuo Handa * tomoyo_sys_getpid - Copy of getpid(). 9802066a361STetsuo Handa * 9812066a361STetsuo Handa * Returns current thread's PID. 9822066a361STetsuo Handa * 9832066a361STetsuo Handa * Alpha does not have getpid() defined. To be able to build this module on 9842066a361STetsuo Handa * Alpha, I have to copy getpid() from kernel/timer.c. 9852066a361STetsuo Handa */ 9862066a361STetsuo Handa static inline pid_t tomoyo_sys_getpid(void) 9872066a361STetsuo Handa { 9882066a361STetsuo Handa return task_tgid_vnr(current); 9892066a361STetsuo Handa } 9902066a361STetsuo Handa 9912066a361STetsuo Handa /** 992b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 993b5bc60b4STetsuo Handa * 994b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 995b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 996b5bc60b4STetsuo Handa * 997b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 998b5bc60b4STetsuo Handa */ 9999590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 10009590837bSKentaro Takeda const struct tomoyo_path_info *b) 10019590837bSKentaro Takeda { 10029590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 10039590837bSKentaro Takeda } 10049590837bSKentaro Takeda 10059590837bSKentaro Takeda /** 1006b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 1007b5bc60b4STetsuo Handa * 1008b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 1009b5bc60b4STetsuo Handa * 1010b5bc60b4STetsuo Handa * Returns nothing. 1011b5bc60b4STetsuo Handa */ 101276bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 101376bb0895STetsuo Handa { 101476bb0895STetsuo Handa if (name) { 1015e2bf6907STetsuo Handa struct tomoyo_name *ptr = 1016e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 10170df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 101876bb0895STetsuo Handa } 101976bb0895STetsuo Handa } 10209590837bSKentaro Takeda 1021b5bc60b4STetsuo Handa /** 10222066a361STetsuo Handa * tomoyo_put_condition - Drop reference on "struct tomoyo_condition". 10232066a361STetsuo Handa * 10242066a361STetsuo Handa * @cond: Pointer to "struct tomoyo_condition". Maybe NULL. 10252066a361STetsuo Handa * 10262066a361STetsuo Handa * Returns nothing. 10272066a361STetsuo Handa */ 10282066a361STetsuo Handa static inline void tomoyo_put_condition(struct tomoyo_condition *cond) 10292066a361STetsuo Handa { 10302066a361STetsuo Handa if (cond) 10312066a361STetsuo Handa atomic_dec(&cond->head.users); 10322066a361STetsuo Handa } 10332066a361STetsuo Handa 10342066a361STetsuo Handa /** 1035b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 1036b5bc60b4STetsuo Handa * 1037b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 1038b5bc60b4STetsuo Handa * 1039b5bc60b4STetsuo Handa * Returns nothing. 1040b5bc60b4STetsuo Handa */ 1041a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 10424c3e9e2dSTetsuo Handa { 10434c3e9e2dSTetsuo Handa if (group) 10440df7e8b8STetsuo Handa atomic_dec(&group->head.users); 10454c3e9e2dSTetsuo Handa } 10464c3e9e2dSTetsuo Handa 1047b5bc60b4STetsuo Handa /** 1048b5bc60b4STetsuo Handa * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 1049b5bc60b4STetsuo Handa * 1050b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_domain_info" for current thread. 1051b5bc60b4STetsuo Handa */ 105276bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 105376bb0895STetsuo Handa { 105476bb0895STetsuo Handa return current_cred()->security; 105576bb0895STetsuo Handa } 10569590837bSKentaro Takeda 1057b5bc60b4STetsuo Handa /** 1058b5bc60b4STetsuo Handa * tomoyo_real_domain - Get "struct tomoyo_domain_info" for specified thread. 1059b5bc60b4STetsuo Handa * 1060b5bc60b4STetsuo Handa * @task: Pointer to "struct task_struct". 1061b5bc60b4STetsuo Handa * 1062b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_security" for specified thread. 1063b5bc60b4STetsuo Handa */ 106476bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 106576bb0895STetsuo Handa *task) 106676bb0895STetsuo Handa { 106776bb0895STetsuo Handa return task_cred_xxx(task, security); 106876bb0895STetsuo Handa } 10699590837bSKentaro Takeda 1070b5bc60b4STetsuo Handa /** 1071b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 1072b5bc60b4STetsuo Handa * 1073b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 1074b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 1075b5bc60b4STetsuo Handa * 1076b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1077b5bc60b4STetsuo Handa */ 107875093152STetsuo Handa static inline bool tomoyo_same_name_union 1079b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 10807762fbffSTetsuo Handa { 10810df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 10827762fbffSTetsuo Handa } 10837762fbffSTetsuo Handa 1084b5bc60b4STetsuo Handa /** 1085b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 1086b5bc60b4STetsuo Handa * 1087b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 1088b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 1089b5bc60b4STetsuo Handa * 1090b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1091b5bc60b4STetsuo Handa */ 109275093152STetsuo Handa static inline bool tomoyo_same_number_union 1093b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 10944c3e9e2dSTetsuo Handa { 1095b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 10960df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 10970df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 10984c3e9e2dSTetsuo Handa } 10994c3e9e2dSTetsuo Handa 1100bd03a3e4STetsuo Handa /** 1101bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 1102bd03a3e4STetsuo Handa * 1103bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 1104bd03a3e4STetsuo Handa */ 1105bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 1106bd03a3e4STetsuo Handa { 1107bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 1108bd03a3e4STetsuo Handa } 1109bd03a3e4STetsuo Handa 1110eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 1111eadd99ccSTetsuo Handa 1112eadd99ccSTetsuo Handa /** 1113eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1114eadd99ccSTetsuo Handa * 1115eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1116eadd99ccSTetsuo Handa * 1117eadd99ccSTetsuo Handa * Returns @size. 1118eadd99ccSTetsuo Handa * 1119eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 1120eadd99ccSTetsuo Handa */ 1121eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1122eadd99ccSTetsuo Handa { 1123eadd99ccSTetsuo Handa return size; 1124eadd99ccSTetsuo Handa } 1125eadd99ccSTetsuo Handa 1126eadd99ccSTetsuo Handa #else 1127eadd99ccSTetsuo Handa 1128eadd99ccSTetsuo Handa /** 1129eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1130eadd99ccSTetsuo Handa * 1131eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1132eadd99ccSTetsuo Handa * 1133eadd99ccSTetsuo Handa * Returns rounded size. 1134eadd99ccSTetsuo Handa * 1135eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 1136eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 1137eadd99ccSTetsuo Handa */ 1138eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1139eadd99ccSTetsuo Handa { 1140eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 1141eadd99ccSTetsuo Handa size_t bsize = 32; 1142eadd99ccSTetsuo Handa #else 1143eadd99ccSTetsuo Handa size_t bsize = 64; 1144eadd99ccSTetsuo Handa #endif 1145eadd99ccSTetsuo Handa if (!size) 1146eadd99ccSTetsuo Handa return 0; 1147eadd99ccSTetsuo Handa while (size > bsize) 1148eadd99ccSTetsuo Handa bsize <<= 1; 1149eadd99ccSTetsuo Handa return bsize; 1150eadd99ccSTetsuo Handa } 1151eadd99ccSTetsuo Handa 1152eadd99ccSTetsuo Handa #endif 1153eadd99ccSTetsuo Handa 11549590837bSKentaro Takeda /** 11559590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 11569590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 11579590837bSKentaro Takeda * @head: the head for your list. 11589590837bSKentaro Takeda */ 1159475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 1160475e6fa3STetsuo Handa if (!pos) \ 1161475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 1162475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 1163fdb8ebb7STetsuo Handa 11649590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 1165