19590837bSKentaro Takeda /* 29590837bSKentaro Takeda * security/tomoyo/common.h 39590837bSKentaro Takeda * 476bb0895STetsuo Handa * Header file for TOMOYO. 59590837bSKentaro Takeda * 676bb0895STetsuo Handa * Copyright (C) 2005-2010 NTT DATA CORPORATION 79590837bSKentaro Takeda */ 89590837bSKentaro Takeda 99590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 109590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda 129590837bSKentaro Takeda #include <linux/ctype.h> 139590837bSKentaro Takeda #include <linux/string.h> 149590837bSKentaro Takeda #include <linux/mm.h> 159590837bSKentaro Takeda #include <linux/file.h> 169590837bSKentaro Takeda #include <linux/kmod.h> 179590837bSKentaro Takeda #include <linux/fs.h> 189590837bSKentaro Takeda #include <linux/sched.h> 199590837bSKentaro Takeda #include <linux/namei.h> 209590837bSKentaro Takeda #include <linux/mount.h> 219590837bSKentaro Takeda #include <linux/list.h> 2276bb0895STetsuo Handa #include <linux/cred.h> 2317fcfbd9STetsuo Handa #include <linux/poll.h> 2476bb0895STetsuo Handa struct linux_binprm; 259590837bSKentaro Takeda 2676bb0895STetsuo Handa /********** Constants definitions. **********/ 2776bb0895STetsuo Handa 2876bb0895STetsuo Handa /* 2976bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 3076bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 3176bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 3276bb0895STetsuo Handa */ 3376bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 3476bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 3576bb0895STetsuo Handa 36c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 3776bb0895STetsuo Handa 3876bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 3976bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 4076bb0895STetsuo Handa 4132997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 4232997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 4332997144STetsuo Handa 44b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 45cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 46cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 47cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 48cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 4957c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 50eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 51eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 52eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 53eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 54cb0abe6aSTetsuo Handa }; 55cb0abe6aSTetsuo Handa 56b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 57a230f9e7STetsuo Handa enum tomoyo_policy_id { 58a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 59a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 60a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 615448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 62a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 63a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 64a230f9e7STetsuo Handa TOMOYO_ID_NAME, 65a230f9e7STetsuo Handa TOMOYO_ID_ACL, 66a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 67a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 68a230f9e7STetsuo Handa }; 69a230f9e7STetsuo Handa 702c47ab93STetsuo Handa /* Index numbers for domain's attributes. */ 712c47ab93STetsuo Handa enum tomoyo_domain_info_flags_index { 722c47ab93STetsuo Handa /* Quota warnning flag. */ 732c47ab93STetsuo Handa TOMOYO_DIF_QUOTA_WARNED, 742c47ab93STetsuo Handa /* 752c47ab93STetsuo Handa * This domain was unable to create a new domain at 762c47ab93STetsuo Handa * tomoyo_find_next_domain() because the name of the domain to be 772c47ab93STetsuo Handa * created was too long or it could not allocate memory. 782c47ab93STetsuo Handa * More than one process continued execve() without domain transition. 792c47ab93STetsuo Handa */ 802c47ab93STetsuo Handa TOMOYO_DIF_TRANSITION_FAILED, 812c47ab93STetsuo Handa TOMOYO_MAX_DOMAIN_INFO_FLAGS 822c47ab93STetsuo Handa }; 832c47ab93STetsuo Handa 84b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 85a230f9e7STetsuo Handa enum tomoyo_group_id { 86a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 87a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 88a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 89a230f9e7STetsuo Handa }; 90a230f9e7STetsuo Handa 91b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 92b5bc60b4STetsuo Handa enum tomoyo_value_type { 93b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 94b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 95b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 96b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 97b5bc60b4STetsuo Handa }; 984c3e9e2dSTetsuo Handa 99b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 1005448ec4fSTetsuo Handa enum tomoyo_transition_type { 1015448ec4fSTetsuo Handa /* Do not change this order, */ 102bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 103bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 1045448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 1055448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 1065448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 1075448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 1085448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 1095448ec4fSTetsuo Handa }; 1105448ec4fSTetsuo Handa 11176bb0895STetsuo Handa /* Index numbers for Access Controls. */ 112084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 1137ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 1147ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 115a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 11675093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 1172106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 118084da356STetsuo Handa }; 11976bb0895STetsuo Handa 120b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 121084da356STetsuo Handa enum tomoyo_path_acl_index { 1227ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 1237ef61233STetsuo Handa TOMOYO_TYPE_READ, 1247ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 1257c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 1267ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 1277c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 1287ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 1297ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 1307ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 1317ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 1327ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 1337ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 134084da356STetsuo Handa }; 13576bb0895STetsuo Handa 136b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 137eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 138eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 139eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 140eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 141eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 142eadd99ccSTetsuo Handa }; 143eadd99ccSTetsuo Handa 14475093152STetsuo Handa enum tomoyo_mkdev_acl_index { 145a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 146a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 14775093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 148a1f9bb6aSTetsuo Handa }; 149a1f9bb6aSTetsuo Handa 150b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 151084da356STetsuo Handa enum tomoyo_path2_acl_index { 1527ef61233STetsuo Handa TOMOYO_TYPE_LINK, 1537ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 1547ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 1557ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 156084da356STetsuo Handa }; 15776bb0895STetsuo Handa 158b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 159a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 160a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 161a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 162a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 163a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 164a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 165a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 166a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 167a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 168a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 169a1f9bb6aSTetsuo Handa }; 170a1f9bb6aSTetsuo Handa 171b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 172084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 173084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 174084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 175084da356STetsuo Handa TOMOYO_DOMAIN_STATUS, 176084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 177b22b8b9fSTetsuo Handa TOMOYO_STAT, 178084da356STetsuo Handa TOMOYO_SELFDOMAIN, 179eadd99ccSTetsuo Handa TOMOYO_AUDIT, 180084da356STetsuo Handa TOMOYO_VERSION, 181084da356STetsuo Handa TOMOYO_PROFILE, 18217fcfbd9STetsuo Handa TOMOYO_QUERY, 183084da356STetsuo Handa TOMOYO_MANAGER 184084da356STetsuo Handa }; 18576bb0895STetsuo Handa 186b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 187b5bc60b4STetsuo Handa enum tomoyo_special_mount { 188b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 189b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 190b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 191b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 192b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 193b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 194b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 195b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 196b5bc60b4STetsuo Handa }; 197b5bc60b4STetsuo Handa 198b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 19957c2590fSTetsuo Handa enum tomoyo_mac_index { 20057c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 20157c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 20257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 20357c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 2047c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 20557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 20657c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 20757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 20857c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 20957c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 21057c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 21157c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 21257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 21357c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 21457c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 21557c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 21657c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 21757c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 21857c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 21957c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 22057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 22157c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 22257c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 22357c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 22457c2590fSTetsuo Handa }; 22557c2590fSTetsuo Handa 226b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 22757c2590fSTetsuo Handa enum tomoyo_mac_category_index { 22857c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 22957c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 23057c2590fSTetsuo Handa }; 23157c2590fSTetsuo Handa 232b5bc60b4STetsuo Handa /* 233b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 234b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 235b5bc60b4STetsuo Handa * 236b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 237b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 238b5bc60b4STetsuo Handa */ 239b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 24017fcfbd9STetsuo Handa 241b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 242b22b8b9fSTetsuo Handa enum tomoyo_policy_stat_type { 243b22b8b9fSTetsuo Handa /* Do not change this order. */ 244b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_UPDATES, 245b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_LEARNING, /* == TOMOYO_CONFIG_LEARNING */ 246b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_PERMISSIVE, /* == TOMOYO_CONFIG_PERMISSIVE */ 247b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_ENFORCING, /* == TOMOYO_CONFIG_ENFORCING */ 248b22b8b9fSTetsuo Handa TOMOYO_MAX_POLICY_STAT 249b22b8b9fSTetsuo Handa }; 250b22b8b9fSTetsuo Handa 251d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 252d5ca1725STetsuo Handa enum tomoyo_pref_index { 253eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 254d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 255d5ca1725STetsuo Handa TOMOYO_MAX_PREF 256d5ca1725STetsuo Handa }; 257d5ca1725STetsuo Handa 25876bb0895STetsuo Handa /********** Structure definitions. **********/ 2599590837bSKentaro Takeda 260b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 26182e0f001STetsuo Handa struct tomoyo_acl_head { 26282e0f001STetsuo Handa struct list_head list; 26382e0f001STetsuo Handa bool is_deleted; 26482e0f001STetsuo Handa } __packed; 26582e0f001STetsuo Handa 2660df7e8b8STetsuo Handa /* Common header for shared entries. */ 2670df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 2680df7e8b8STetsuo Handa struct list_head list; 2690df7e8b8STetsuo Handa atomic_t users; 2700df7e8b8STetsuo Handa } __packed; 2710df7e8b8STetsuo Handa 272bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 273bd03a3e4STetsuo Handa 274b5bc60b4STetsuo Handa /* Structure for request info. */ 275cb0abe6aSTetsuo Handa struct tomoyo_request_info { 276cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 277cf6e9a64STetsuo Handa /* For holding parameters. */ 278cf6e9a64STetsuo Handa union { 279cf6e9a64STetsuo Handa struct { 280cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 281484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 282484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 283b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 284cf6e9a64STetsuo Handa u8 operation; 285cf6e9a64STetsuo Handa } path; 286cf6e9a64STetsuo Handa struct { 287cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 288cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 289b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 290cf6e9a64STetsuo Handa u8 operation; 291cf6e9a64STetsuo Handa } path2; 292cf6e9a64STetsuo Handa struct { 293cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 294cf6e9a64STetsuo Handa unsigned int mode; 295cf6e9a64STetsuo Handa unsigned int major; 296cf6e9a64STetsuo Handa unsigned int minor; 297b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 298cf6e9a64STetsuo Handa u8 operation; 299cf6e9a64STetsuo Handa } mkdev; 300cf6e9a64STetsuo Handa struct { 301cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 302cf6e9a64STetsuo Handa unsigned long number; 303b5bc60b4STetsuo Handa /* 304b5bc60b4STetsuo Handa * One of values in 305b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 306b5bc60b4STetsuo Handa */ 307cf6e9a64STetsuo Handa u8 operation; 308cf6e9a64STetsuo Handa } path_number; 309cf6e9a64STetsuo Handa struct { 310cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 311cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 312cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 313cf6e9a64STetsuo Handa unsigned long flags; 314cf6e9a64STetsuo Handa int need_dev; 315cf6e9a64STetsuo Handa } mount; 316cf6e9a64STetsuo Handa } param; 317cf6e9a64STetsuo Handa u8 param_type; 318cf6e9a64STetsuo Handa bool granted; 31917fcfbd9STetsuo Handa u8 retry; 32017fcfbd9STetsuo Handa u8 profile; 321cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 32257c2590fSTetsuo Handa u8 type; 323cb0abe6aSTetsuo Handa }; 324cb0abe6aSTetsuo Handa 325b5bc60b4STetsuo Handa /* Structure for holding a token. */ 3269590837bSKentaro Takeda struct tomoyo_path_info { 3279590837bSKentaro Takeda const char *name; 3289590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 3299590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 3309590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 3319590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 3329590837bSKentaro Takeda }; 3339590837bSKentaro Takeda 334b5bc60b4STetsuo Handa /* Structure for holding string data. */ 335e2bf6907STetsuo Handa struct tomoyo_name { 3360df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 33776bb0895STetsuo Handa struct tomoyo_path_info entry; 33876bb0895STetsuo Handa }; 3399590837bSKentaro Takeda 340b5bc60b4STetsuo Handa /* Structure for holding a word. */ 3417762fbffSTetsuo Handa struct tomoyo_name_union { 342b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 3437762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 344a98aa4deSTetsuo Handa struct tomoyo_group *group; 3457762fbffSTetsuo Handa }; 3467762fbffSTetsuo Handa 347b5bc60b4STetsuo Handa /* Structure for holding a number. */ 3484c3e9e2dSTetsuo Handa struct tomoyo_number_union { 3494c3e9e2dSTetsuo Handa unsigned long values[2]; 350b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 351b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 3520df7e8b8STetsuo Handa u8 value_type[2]; 3534c3e9e2dSTetsuo Handa }; 3544c3e9e2dSTetsuo Handa 355a98aa4deSTetsuo Handa /* Structure for "path_group"/"number_group" directive. */ 356a98aa4deSTetsuo Handa struct tomoyo_group { 3570df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 358a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 359a98aa4deSTetsuo Handa struct list_head member_list; 360a98aa4deSTetsuo Handa }; 361a98aa4deSTetsuo Handa 3627762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 3637762fbffSTetsuo Handa struct tomoyo_path_group { 36482e0f001STetsuo Handa struct tomoyo_acl_head head; 3657762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 3667762fbffSTetsuo Handa }; 3677762fbffSTetsuo Handa 3684c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 369a98aa4deSTetsuo Handa struct tomoyo_number_group { 37082e0f001STetsuo Handa struct tomoyo_acl_head head; 3714c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 3724c3e9e2dSTetsuo Handa }; 3734c3e9e2dSTetsuo Handa 374b5bc60b4STetsuo Handa /* Common header for individual entries. */ 3759590837bSKentaro Takeda struct tomoyo_acl_info { 3769590837bSKentaro Takeda struct list_head list; 377237ab459STetsuo Handa bool is_deleted; 378b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 3799590837bSKentaro Takeda } __packed; 3809590837bSKentaro Takeda 381b5bc60b4STetsuo Handa /* Structure for domain information. */ 3829590837bSKentaro Takeda struct tomoyo_domain_info { 3839590837bSKentaro Takeda struct list_head list; 3849590837bSKentaro Takeda struct list_head acl_info_list; 3859590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 3869590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 387bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 388bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 3899590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 39032997144STetsuo Handa u8 group; /* Group number to use. */ 391a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 3922c47ab93STetsuo Handa bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 393ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 3949590837bSKentaro Takeda }; 3959590837bSKentaro Takeda 3969590837bSKentaro Takeda /* 397b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 398b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 399b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 4009590837bSKentaro Takeda */ 4017ef61233STetsuo Handa struct tomoyo_path_acl { 4027ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 403b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 4047762fbffSTetsuo Handa struct tomoyo_name_union name; 4059590837bSKentaro Takeda }; 4069590837bSKentaro Takeda 407c3fa109aSTetsuo Handa /* 408b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 409b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 410a1f9bb6aSTetsuo Handa */ 411a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 412a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 413b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 414a1f9bb6aSTetsuo Handa u8 perm; 415a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 416a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 417a1f9bb6aSTetsuo Handa }; 418a1f9bb6aSTetsuo Handa 419b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 42075093152STetsuo Handa struct tomoyo_mkdev_acl { 42175093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 422b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 423a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 424a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 425a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 426a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 427a1f9bb6aSTetsuo Handa }; 428a1f9bb6aSTetsuo Handa 429a1f9bb6aSTetsuo Handa /* 430b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 431c3fa109aSTetsuo Handa */ 4327ef61233STetsuo Handa struct tomoyo_path2_acl { 4337ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 434b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 4357762fbffSTetsuo Handa struct tomoyo_name_union name1; 4367762fbffSTetsuo Handa struct tomoyo_name_union name2; 4379590837bSKentaro Takeda }; 4389590837bSKentaro Takeda 439b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 4402106ccd9STetsuo Handa struct tomoyo_mount_acl { 4412106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 4422106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 4432106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 4442106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 4452106ccd9STetsuo Handa struct tomoyo_number_union flags; 4462106ccd9STetsuo Handa }; 4472106ccd9STetsuo Handa 448a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 449a238cf5bSTetsuo Handa struct tomoyo_acl_param { 450a238cf5bSTetsuo Handa char *data; 451a238cf5bSTetsuo Handa struct list_head *list; 452bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 453a238cf5bSTetsuo Handa bool is_delete; 454a238cf5bSTetsuo Handa }; 455a238cf5bSTetsuo Handa 4560d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 457f23571e8STetsuo Handa 4582106ccd9STetsuo Handa /* 459f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 460f23571e8STetsuo Handa * interfaces. 461c3fa109aSTetsuo Handa */ 4629590837bSKentaro Takeda struct tomoyo_io_buffer { 4638fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 4649590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 46517fcfbd9STetsuo Handa int (*poll) (struct file *file, poll_table *wait); 4669590837bSKentaro Takeda /* Exclusive lock for this structure. */ 4679590837bSKentaro Takeda struct mutex io_sem; 468f23571e8STetsuo Handa char __user *read_user_buf; 4692c47ab93STetsuo Handa size_t read_user_buf_avail; 470f23571e8STetsuo Handa struct { 471bd03a3e4STetsuo Handa struct list_head *ns; 472f23571e8STetsuo Handa struct list_head *domain; 473f23571e8STetsuo Handa struct list_head *group; 474f23571e8STetsuo Handa struct list_head *acl; 4752c47ab93STetsuo Handa size_t avail; 4762c47ab93STetsuo Handa unsigned int step; 4772c47ab93STetsuo Handa unsigned int query_index; 478f23571e8STetsuo Handa u16 index; 47932997144STetsuo Handa u8 acl_group_index; 480f23571e8STetsuo Handa u8 bit; 481f23571e8STetsuo Handa u8 w_pos; 482f23571e8STetsuo Handa bool eof; 483f23571e8STetsuo Handa bool print_this_domain_only; 484bd03a3e4STetsuo Handa bool print_transition_related_only; 485f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 486f23571e8STetsuo Handa } r; 4870df7e8b8STetsuo Handa struct { 488bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 4899590837bSKentaro Takeda /* The position currently writing to. */ 4900df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 4910df7e8b8STetsuo Handa /* Bytes available for writing. */ 4922c47ab93STetsuo Handa size_t avail; 493bd03a3e4STetsuo Handa bool is_delete; 4940df7e8b8STetsuo Handa } w; 4959590837bSKentaro Takeda /* Buffer for reading. */ 4969590837bSKentaro Takeda char *read_buf; 4979590837bSKentaro Takeda /* Size of read buffer. */ 4982c47ab93STetsuo Handa size_t readbuf_size; 4999590837bSKentaro Takeda /* Buffer for writing. */ 5009590837bSKentaro Takeda char *write_buf; 5019590837bSKentaro Takeda /* Size of write buffer. */ 5022c47ab93STetsuo Handa size_t writebuf_size; 50317fcfbd9STetsuo Handa /* Type of this interface. */ 5042c47ab93STetsuo Handa enum tomoyo_securityfs_interface_index type; 5052e503bbbSTetsuo Handa /* Users counter protected by tomoyo_io_buffer_list_lock. */ 5062e503bbbSTetsuo Handa u8 users; 5072e503bbbSTetsuo Handa /* List for telling GC not to kfree() elements. */ 5082e503bbbSTetsuo Handa struct list_head list; 5099590837bSKentaro Takeda }; 5109590837bSKentaro Takeda 51176bb0895STetsuo Handa /* 512b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 513b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 51476bb0895STetsuo Handa */ 5155448ec4fSTetsuo Handa struct tomoyo_transition_control { 51682e0f001STetsuo Handa struct tomoyo_acl_head head; 5175448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 51876bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 51976bb0895STetsuo Handa bool is_last_name; 5205448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 5215448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 52276bb0895STetsuo Handa }; 52376bb0895STetsuo Handa 524b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 525e2bf6907STetsuo Handa struct tomoyo_aggregator { 52682e0f001STetsuo Handa struct tomoyo_acl_head head; 5271084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 5281084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 5291084307cSTetsuo Handa }; 5301084307cSTetsuo Handa 531b5bc60b4STetsuo Handa /* Structure for policy manager. */ 532e2bf6907STetsuo Handa struct tomoyo_manager { 53382e0f001STetsuo Handa struct tomoyo_acl_head head; 53482e0f001STetsuo Handa bool is_domain; /* True if manager is a domainname. */ 53576bb0895STetsuo Handa /* A path to program or a domainname. */ 53676bb0895STetsuo Handa const struct tomoyo_path_info *manager; 53776bb0895STetsuo Handa }; 53876bb0895STetsuo Handa 53957c2590fSTetsuo Handa struct tomoyo_preference { 54057c2590fSTetsuo Handa unsigned int learning_max_entry; 54157c2590fSTetsuo Handa bool enforcing_verbose; 54257c2590fSTetsuo Handa bool learning_verbose; 54357c2590fSTetsuo Handa bool permissive_verbose; 54457c2590fSTetsuo Handa }; 54557c2590fSTetsuo Handa 546b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 54757c2590fSTetsuo Handa struct tomoyo_profile { 54857c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 54957c2590fSTetsuo Handa struct tomoyo_preference *learning; 55057c2590fSTetsuo Handa struct tomoyo_preference *permissive; 55157c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 55257c2590fSTetsuo Handa struct tomoyo_preference preference; 55357c2590fSTetsuo Handa u8 default_config; 55457c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 555d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 55657c2590fSTetsuo Handa }; 55757c2590fSTetsuo Handa 558eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 559eadd99ccSTetsuo Handa struct tomoyo_time { 560eadd99ccSTetsuo Handa u16 year; 561eadd99ccSTetsuo Handa u8 month; 562eadd99ccSTetsuo Handa u8 day; 563eadd99ccSTetsuo Handa u8 hour; 564eadd99ccSTetsuo Handa u8 min; 565eadd99ccSTetsuo Handa u8 sec; 566eadd99ccSTetsuo Handa }; 567eadd99ccSTetsuo Handa 568bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 569bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 570bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 571bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 572bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 573bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 574bd03a3e4STetsuo Handa /* List of policy. */ 575bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 576bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 577bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 578bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 579bd03a3e4STetsuo Handa struct list_head namespace_list; 580bd03a3e4STetsuo Handa /* Profile version. Currently only 20100903 is defined. */ 581bd03a3e4STetsuo Handa unsigned int profile_version; 582bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 583bd03a3e4STetsuo Handa const char *name; 584bd03a3e4STetsuo Handa }; 585bd03a3e4STetsuo Handa 58676bb0895STetsuo Handa /********** Function prototypes. **********/ 58776bb0895STetsuo Handa 588bd03a3e4STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 589c3ef1500STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 590c3ef1500STetsuo Handa const char *tomoyo_get_exe(void); 591c3ef1500STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 592c3ef1500STetsuo Handa void tomoyo_check_profile(void); 593c3ef1500STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 5940df7e8b8STetsuo Handa int tomoyo_close_control(struct tomoyo_io_buffer *head); 5950849e3baSTetsuo Handa int tomoyo_poll_control(struct file *file, poll_table *wait); 5962c47ab93STetsuo Handa ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 597c3ef1500STetsuo Handa const int buffer_len); 5982c47ab93STetsuo Handa ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 5990df7e8b8STetsuo Handa const char __user *buffer, const int buffer_len); 600c3ef1500STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 601c3ef1500STetsuo Handa void tomoyo_warn_oom(const char *function); 602484ca79cSTetsuo Handa const struct tomoyo_path_info * 603484ca79cSTetsuo Handa tomoyo_compare_name_union(const struct tomoyo_path_info *name, 6047762fbffSTetsuo Handa const struct tomoyo_name_union *ptr); 6052106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 6062106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 607bd03a3e4STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 608bd03a3e4STetsuo Handa const u8 index); 609f23571e8STetsuo Handa void tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 6109590837bSKentaro Takeda __attribute__ ((format(printf, 2, 3))); 61175093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 61275093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 61375093152STetsuo Handa bool tomoyo_correct_word(const char *string); 61475093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 615a238cf5bSTetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 6167762fbffSTetsuo Handa struct tomoyo_name_union *ptr); 617484ca79cSTetsuo Handa const struct tomoyo_path_info * 618484ca79cSTetsuo Handa tomoyo_path_matches_group(const struct tomoyo_path_info *pathname, 619a98aa4deSTetsuo Handa const struct tomoyo_group *group); 6204c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 6214c3e9e2dSTetsuo Handa const unsigned long max, 622a98aa4deSTetsuo Handa const struct tomoyo_group *group); 6239590837bSKentaro Takeda bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 6249590837bSKentaro Takeda const struct tomoyo_path_info *pattern); 625a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 626a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 6277762fbffSTetsuo Handa bool tomoyo_tokenize(char *buffer, char *w[], size_t size); 6289590837bSKentaro Takeda bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain); 6292106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 63057c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 63157c2590fSTetsuo Handa const u8 index); 632b5bc60b4STetsuo Handa int tomoyo_mount_permission(char *dev_name, struct path *path, 633b5bc60b4STetsuo Handa const char *type, unsigned long flags, 634b5bc60b4STetsuo Handa void *data_page); 635a238cf5bSTetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 636a238cf5bSTetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 6375448ec4fSTetsuo Handa const u8 type); 638a238cf5bSTetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 639a238cf5bSTetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 64017fcfbd9STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 64117fcfbd9STetsuo Handa __attribute__ ((format(printf, 2, 3))); 6429590837bSKentaro Takeda struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 643e2bf6907STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 644bd03a3e4STetsuo Handa const bool transit); 645bd03a3e4STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 6469590837bSKentaro Takeda const u8 profile); 647bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 648bd03a3e4STetsuo Handa (const char *domainname); 649a238cf5bSTetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 650a238cf5bSTetsuo Handa const u8 idx); 6519590837bSKentaro Takeda unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 6529590837bSKentaro Takeda const u8 index); 6539590837bSKentaro Takeda void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 6549590837bSKentaro Takeda void tomoyo_load_policy(const char *filename); 6554c3e9e2dSTetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 656c8c57e84STetsuo Handa char *tomoyo_encode(const char *str); 65776bb0895STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 65876bb0895STetsuo Handa char *tomoyo_realpath_from_path(struct path *path); 65976bb0895STetsuo Handa bool tomoyo_memory_ok(void *ptr); 6609e4b50e9STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 66176bb0895STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 662b22b8b9fSTetsuo Handa void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp); 663b22b8b9fSTetsuo Handa void tomoyo_update_stat(const u8 index); 664c3ef1500STetsuo Handa void __init tomoyo_mm_init(void); 66505336deeSTetsuo Handa int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 66676bb0895STetsuo Handa const struct tomoyo_path_info *filename); 66776bb0895STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 66876bb0895STetsuo Handa struct path *path, const int flag); 669a1f9bb6aSTetsuo Handa int tomoyo_path_number_perm(const u8 operation, struct path *path, 670a1f9bb6aSTetsuo Handa unsigned long number); 67175093152STetsuo Handa int tomoyo_mkdev_perm(const u8 operation, struct path *path, 672a1f9bb6aSTetsuo Handa const unsigned int mode, unsigned int dev); 67397d6931eSTetsuo Handa int tomoyo_path_perm(const u8 operation, struct path *path); 67497d6931eSTetsuo Handa int tomoyo_path2_perm(const u8 operation, struct path *path1, 67597d6931eSTetsuo Handa struct path *path2); 67676bb0895STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 677a1f9bb6aSTetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 678a1f9bb6aSTetsuo Handa const unsigned long value, const u8 type); 6797762fbffSTetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 6802e503bbbSTetsuo Handa void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); 681847b173eSTetsuo Handa void tomoyo_memory_free(void *ptr); 682237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 683a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 684237ab459STetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_info 685237ab459STetsuo Handa *, 686237ab459STetsuo Handa const struct tomoyo_acl_info 687237ab459STetsuo Handa *), 688237ab459STetsuo Handa bool (*merge_duplicate) (struct tomoyo_acl_info *, 689237ab459STetsuo Handa struct tomoyo_acl_info *, 690237ab459STetsuo Handa const bool)); 69136f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 692a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 69336f5e1ffSTetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_head 69436f5e1ffSTetsuo Handa *, 69536f5e1ffSTetsuo Handa const struct tomoyo_acl_head 69636f5e1ffSTetsuo Handa *)); 69799a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 698484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 69999a85259STetsuo Handa const struct tomoyo_acl_info *)); 700a238cf5bSTetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 701a238cf5bSTetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 702237ab459STetsuo Handa 703eadd99ccSTetsuo Handa const char *tomoyo_yesno(const unsigned int value); 704bd03a3e4STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 705bd03a3e4STetsuo Handa __attribute__ ((format(printf, 2, 3))); 706eadd99ccSTetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 707eadd99ccSTetsuo Handa va_list args); 708eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 709eadd99ccSTetsuo Handa int tomoyo_poll_log(struct file *file, poll_table *wait); 710eadd99ccSTetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 711eadd99ccSTetsuo Handa va_list args); 712eadd99ccSTetsuo Handa 71376bb0895STetsuo Handa /********** External variable definitions. **********/ 71476bb0895STetsuo Handa 71576bb0895STetsuo Handa /* Lock for GC. */ 71676bb0895STetsuo Handa extern struct srcu_struct tomoyo_ss; 71776bb0895STetsuo Handa 71876bb0895STetsuo Handa /* The list for "struct tomoyo_domain_info". */ 71976bb0895STetsuo Handa extern struct list_head tomoyo_domain_list; 72076bb0895STetsuo Handa 721847b173eSTetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 722847b173eSTetsuo Handa 72376bb0895STetsuo Handa /* Lock for protecting policy. */ 72476bb0895STetsuo Handa extern struct mutex tomoyo_policy_lock; 72576bb0895STetsuo Handa 72676bb0895STetsuo Handa /* Has /sbin/init started? */ 72776bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 72876bb0895STetsuo Handa 72976bb0895STetsuo Handa /* The kernel's domain. */ 73076bb0895STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 731bd03a3e4STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 732bd03a3e4STetsuo Handa extern struct list_head tomoyo_namespace_list; 73376bb0895STetsuo Handa 7342c47ab93STetsuo Handa extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX + 7352c47ab93STetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX]; 7362c47ab93STetsuo Handa extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 7372c47ab93STetsuo Handa extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; 7382c47ab93STetsuo Handa 73971c28236STetsuo Handa 7400d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 7410d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 7420d2171d7STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 7430d2171d7STetsuo Handa 7442c47ab93STetsuo Handa extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 745eadd99ccSTetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 746eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 747eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 74817fcfbd9STetsuo Handa 74976bb0895STetsuo Handa /********** Inlined functions. **********/ 75076bb0895STetsuo Handa 751b5bc60b4STetsuo Handa /** 752b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 753b5bc60b4STetsuo Handa * 754b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 755b5bc60b4STetsuo Handa */ 75676bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 75776bb0895STetsuo Handa { 75876bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 75976bb0895STetsuo Handa } 76076bb0895STetsuo Handa 761b5bc60b4STetsuo Handa /** 762b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 763b5bc60b4STetsuo Handa * 764b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 765b5bc60b4STetsuo Handa * 766b5bc60b4STetsuo Handa * Returns nothing. 767b5bc60b4STetsuo Handa */ 76876bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 76976bb0895STetsuo Handa { 77076bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 77176bb0895STetsuo Handa } 77276bb0895STetsuo Handa 773b5bc60b4STetsuo Handa /** 774b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 775b5bc60b4STetsuo Handa * 776b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 777b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 778b5bc60b4STetsuo Handa * 779b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 780b5bc60b4STetsuo Handa */ 7819590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 7829590837bSKentaro Takeda const struct tomoyo_path_info *b) 7839590837bSKentaro Takeda { 7849590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 7859590837bSKentaro Takeda } 7869590837bSKentaro Takeda 7879590837bSKentaro Takeda /** 788b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 789b5bc60b4STetsuo Handa * 790b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 791b5bc60b4STetsuo Handa * 792b5bc60b4STetsuo Handa * Returns nothing. 793b5bc60b4STetsuo Handa */ 79476bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 79576bb0895STetsuo Handa { 79676bb0895STetsuo Handa if (name) { 797e2bf6907STetsuo Handa struct tomoyo_name *ptr = 798e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 7990df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 80076bb0895STetsuo Handa } 80176bb0895STetsuo Handa } 8029590837bSKentaro Takeda 803b5bc60b4STetsuo Handa /** 804b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 805b5bc60b4STetsuo Handa * 806b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 807b5bc60b4STetsuo Handa * 808b5bc60b4STetsuo Handa * Returns nothing. 809b5bc60b4STetsuo Handa */ 810a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 8114c3e9e2dSTetsuo Handa { 8124c3e9e2dSTetsuo Handa if (group) 8130df7e8b8STetsuo Handa atomic_dec(&group->head.users); 8144c3e9e2dSTetsuo Handa } 8154c3e9e2dSTetsuo Handa 816b5bc60b4STetsuo Handa /** 817b5bc60b4STetsuo Handa * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 818b5bc60b4STetsuo Handa * 819b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_domain_info" for current thread. 820b5bc60b4STetsuo Handa */ 82176bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 82276bb0895STetsuo Handa { 82376bb0895STetsuo Handa return current_cred()->security; 82476bb0895STetsuo Handa } 8259590837bSKentaro Takeda 826b5bc60b4STetsuo Handa /** 827b5bc60b4STetsuo Handa * tomoyo_real_domain - Get "struct tomoyo_domain_info" for specified thread. 828b5bc60b4STetsuo Handa * 829b5bc60b4STetsuo Handa * @task: Pointer to "struct task_struct". 830b5bc60b4STetsuo Handa * 831b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_security" for specified thread. 832b5bc60b4STetsuo Handa */ 83376bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 83476bb0895STetsuo Handa *task) 83576bb0895STetsuo Handa { 83676bb0895STetsuo Handa return task_cred_xxx(task, security); 83776bb0895STetsuo Handa } 8389590837bSKentaro Takeda 839b5bc60b4STetsuo Handa /** 840b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 841b5bc60b4STetsuo Handa * 842b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 843b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 844b5bc60b4STetsuo Handa * 845b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 846b5bc60b4STetsuo Handa */ 84775093152STetsuo Handa static inline bool tomoyo_same_name_union 848b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 8497762fbffSTetsuo Handa { 8500df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 8517762fbffSTetsuo Handa } 8527762fbffSTetsuo Handa 853b5bc60b4STetsuo Handa /** 854b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 855b5bc60b4STetsuo Handa * 856b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 857b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 858b5bc60b4STetsuo Handa * 859b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 860b5bc60b4STetsuo Handa */ 86175093152STetsuo Handa static inline bool tomoyo_same_number_union 862b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 8634c3e9e2dSTetsuo Handa { 864b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 8650df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 8660df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 8674c3e9e2dSTetsuo Handa } 8684c3e9e2dSTetsuo Handa 869bd03a3e4STetsuo Handa /** 870bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 871bd03a3e4STetsuo Handa * 872bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 873bd03a3e4STetsuo Handa */ 874bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 875bd03a3e4STetsuo Handa { 876bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 877bd03a3e4STetsuo Handa } 878bd03a3e4STetsuo Handa 879eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 880eadd99ccSTetsuo Handa 881eadd99ccSTetsuo Handa /** 882eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 883eadd99ccSTetsuo Handa * 884eadd99ccSTetsuo Handa * @size: Size to be rounded up. 885eadd99ccSTetsuo Handa * 886eadd99ccSTetsuo Handa * Returns @size. 887eadd99ccSTetsuo Handa * 888eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 889eadd99ccSTetsuo Handa */ 890eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 891eadd99ccSTetsuo Handa { 892eadd99ccSTetsuo Handa return size; 893eadd99ccSTetsuo Handa } 894eadd99ccSTetsuo Handa 895eadd99ccSTetsuo Handa #else 896eadd99ccSTetsuo Handa 897eadd99ccSTetsuo Handa /** 898eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 899eadd99ccSTetsuo Handa * 900eadd99ccSTetsuo Handa * @size: Size to be rounded up. 901eadd99ccSTetsuo Handa * 902eadd99ccSTetsuo Handa * Returns rounded size. 903eadd99ccSTetsuo Handa * 904eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 905eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 906eadd99ccSTetsuo Handa */ 907eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 908eadd99ccSTetsuo Handa { 909eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 910eadd99ccSTetsuo Handa size_t bsize = 32; 911eadd99ccSTetsuo Handa #else 912eadd99ccSTetsuo Handa size_t bsize = 64; 913eadd99ccSTetsuo Handa #endif 914eadd99ccSTetsuo Handa if (!size) 915eadd99ccSTetsuo Handa return 0; 916eadd99ccSTetsuo Handa while (size > bsize) 917eadd99ccSTetsuo Handa bsize <<= 1; 918eadd99ccSTetsuo Handa return bsize; 919eadd99ccSTetsuo Handa } 920eadd99ccSTetsuo Handa 921eadd99ccSTetsuo Handa #endif 922eadd99ccSTetsuo Handa 9239590837bSKentaro Takeda /** 9249590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 9259590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 9269590837bSKentaro Takeda * @head: the head for your list. 9279590837bSKentaro Takeda */ 928475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 929475e6fa3STetsuo Handa if (!pos) \ 930475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 931475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 932fdb8ebb7STetsuo Handa 9339590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 934