1b2441318SGreg Kroah-Hartman /* SPDX-License-Identifier: GPL-2.0 */ 29590837bSKentaro Takeda /* 39590837bSKentaro Takeda * security/tomoyo/common.h 49590837bSKentaro Takeda * 576bb0895STetsuo Handa * Header file for TOMOYO. 69590837bSKentaro Takeda * 7843d183cSTetsuo Handa * Copyright (C) 2005-2011 NTT DATA CORPORATION 89590837bSKentaro Takeda */ 99590837bSKentaro Takeda 109590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 129590837bSKentaro Takeda 139590837bSKentaro Takeda #include <linux/ctype.h> 149590837bSKentaro Takeda #include <linux/string.h> 159590837bSKentaro Takeda #include <linux/mm.h> 169590837bSKentaro Takeda #include <linux/file.h> 179590837bSKentaro Takeda #include <linux/kmod.h> 189590837bSKentaro Takeda #include <linux/fs.h> 199590837bSKentaro Takeda #include <linux/sched.h> 209590837bSKentaro Takeda #include <linux/namei.h> 219590837bSKentaro Takeda #include <linux/mount.h> 229590837bSKentaro Takeda #include <linux/list.h> 2376bb0895STetsuo Handa #include <linux/cred.h> 2417fcfbd9STetsuo Handa #include <linux/poll.h> 252066a361STetsuo Handa #include <linux/binfmts.h> 262066a361STetsuo Handa #include <linux/highmem.h> 27059d84dbSTetsuo Handa #include <linux/net.h> 28059d84dbSTetsuo Handa #include <linux/inet.h> 29059d84dbSTetsuo Handa #include <linux/in.h> 30059d84dbSTetsuo Handa #include <linux/in6.h> 31059d84dbSTetsuo Handa #include <linux/un.h> 32059d84dbSTetsuo Handa #include <net/sock.h> 33059d84dbSTetsuo Handa #include <net/af_unix.h> 34059d84dbSTetsuo Handa #include <net/ip.h> 35059d84dbSTetsuo Handa #include <net/ipv6.h> 36059d84dbSTetsuo Handa #include <net/udp.h> 379590837bSKentaro Takeda 3876bb0895STetsuo Handa /********** Constants definitions. **********/ 3976bb0895STetsuo Handa 4076bb0895STetsuo Handa /* 4176bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 4276bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 4376bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 4476bb0895STetsuo Handa */ 4576bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 4676bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 4776bb0895STetsuo Handa 48059d84dbSTetsuo Handa /* 49059d84dbSTetsuo Handa * TOMOYO checks only SOCK_STREAM, SOCK_DGRAM, SOCK_RAW, SOCK_SEQPACKET. 50059d84dbSTetsuo Handa * Therefore, we don't need SOCK_MAX. 51059d84dbSTetsuo Handa */ 52059d84dbSTetsuo Handa #define TOMOYO_SOCK_MAX 6 53059d84dbSTetsuo Handa 54c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 5576bb0895STetsuo Handa 56f9732ea1STetsuo Handa /* Garbage collector is trying to kfree() this element. */ 57f9732ea1STetsuo Handa #define TOMOYO_GC_IN_PROGRESS -1 58f9732ea1STetsuo Handa 5976bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 6076bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 6176bb0895STetsuo Handa 6232997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 6332997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 6432997144STetsuo Handa 652066a361STetsuo Handa /* Index numbers for "struct tomoyo_condition". */ 662066a361STetsuo Handa enum tomoyo_conditions_index { 672066a361STetsuo Handa TOMOYO_TASK_UID, /* current_uid() */ 682066a361STetsuo Handa TOMOYO_TASK_EUID, /* current_euid() */ 692066a361STetsuo Handa TOMOYO_TASK_SUID, /* current_suid() */ 702066a361STetsuo Handa TOMOYO_TASK_FSUID, /* current_fsuid() */ 712066a361STetsuo Handa TOMOYO_TASK_GID, /* current_gid() */ 722066a361STetsuo Handa TOMOYO_TASK_EGID, /* current_egid() */ 732066a361STetsuo Handa TOMOYO_TASK_SGID, /* current_sgid() */ 742066a361STetsuo Handa TOMOYO_TASK_FSGID, /* current_fsgid() */ 752066a361STetsuo Handa TOMOYO_TASK_PID, /* sys_getpid() */ 762066a361STetsuo Handa TOMOYO_TASK_PPID, /* sys_getppid() */ 775b636857STetsuo Handa TOMOYO_EXEC_ARGC, /* "struct linux_binprm *"->argc */ 785b636857STetsuo Handa TOMOYO_EXEC_ENVC, /* "struct linux_binprm *"->envc */ 798761afd4STetsuo Handa TOMOYO_TYPE_IS_SOCKET, /* S_IFSOCK */ 808761afd4STetsuo Handa TOMOYO_TYPE_IS_SYMLINK, /* S_IFLNK */ 818761afd4STetsuo Handa TOMOYO_TYPE_IS_FILE, /* S_IFREG */ 828761afd4STetsuo Handa TOMOYO_TYPE_IS_BLOCK_DEV, /* S_IFBLK */ 838761afd4STetsuo Handa TOMOYO_TYPE_IS_DIRECTORY, /* S_IFDIR */ 848761afd4STetsuo Handa TOMOYO_TYPE_IS_CHAR_DEV, /* S_IFCHR */ 858761afd4STetsuo Handa TOMOYO_TYPE_IS_FIFO, /* S_IFIFO */ 868761afd4STetsuo Handa TOMOYO_MODE_SETUID, /* S_ISUID */ 878761afd4STetsuo Handa TOMOYO_MODE_SETGID, /* S_ISGID */ 888761afd4STetsuo Handa TOMOYO_MODE_STICKY, /* S_ISVTX */ 898761afd4STetsuo Handa TOMOYO_MODE_OWNER_READ, /* S_IRUSR */ 908761afd4STetsuo Handa TOMOYO_MODE_OWNER_WRITE, /* S_IWUSR */ 918761afd4STetsuo Handa TOMOYO_MODE_OWNER_EXECUTE, /* S_IXUSR */ 928761afd4STetsuo Handa TOMOYO_MODE_GROUP_READ, /* S_IRGRP */ 938761afd4STetsuo Handa TOMOYO_MODE_GROUP_WRITE, /* S_IWGRP */ 948761afd4STetsuo Handa TOMOYO_MODE_GROUP_EXECUTE, /* S_IXGRP */ 958761afd4STetsuo Handa TOMOYO_MODE_OTHERS_READ, /* S_IROTH */ 968761afd4STetsuo Handa TOMOYO_MODE_OTHERS_WRITE, /* S_IWOTH */ 978761afd4STetsuo Handa TOMOYO_MODE_OTHERS_EXECUTE, /* S_IXOTH */ 982ca9bf45STetsuo Handa TOMOYO_EXEC_REALPATH, 992ca9bf45STetsuo Handa TOMOYO_SYMLINK_TARGET, 1008761afd4STetsuo Handa TOMOYO_PATH1_UID, 1018761afd4STetsuo Handa TOMOYO_PATH1_GID, 1028761afd4STetsuo Handa TOMOYO_PATH1_INO, 1038761afd4STetsuo Handa TOMOYO_PATH1_MAJOR, 1048761afd4STetsuo Handa TOMOYO_PATH1_MINOR, 1058761afd4STetsuo Handa TOMOYO_PATH1_PERM, 1068761afd4STetsuo Handa TOMOYO_PATH1_TYPE, 1078761afd4STetsuo Handa TOMOYO_PATH1_DEV_MAJOR, 1088761afd4STetsuo Handa TOMOYO_PATH1_DEV_MINOR, 1098761afd4STetsuo Handa TOMOYO_PATH2_UID, 1108761afd4STetsuo Handa TOMOYO_PATH2_GID, 1118761afd4STetsuo Handa TOMOYO_PATH2_INO, 1128761afd4STetsuo Handa TOMOYO_PATH2_MAJOR, 1138761afd4STetsuo Handa TOMOYO_PATH2_MINOR, 1148761afd4STetsuo Handa TOMOYO_PATH2_PERM, 1158761afd4STetsuo Handa TOMOYO_PATH2_TYPE, 1168761afd4STetsuo Handa TOMOYO_PATH2_DEV_MAJOR, 1178761afd4STetsuo Handa TOMOYO_PATH2_DEV_MINOR, 1188761afd4STetsuo Handa TOMOYO_PATH1_PARENT_UID, 1198761afd4STetsuo Handa TOMOYO_PATH1_PARENT_GID, 1208761afd4STetsuo Handa TOMOYO_PATH1_PARENT_INO, 1218761afd4STetsuo Handa TOMOYO_PATH1_PARENT_PERM, 1228761afd4STetsuo Handa TOMOYO_PATH2_PARENT_UID, 1238761afd4STetsuo Handa TOMOYO_PATH2_PARENT_GID, 1248761afd4STetsuo Handa TOMOYO_PATH2_PARENT_INO, 1258761afd4STetsuo Handa TOMOYO_PATH2_PARENT_PERM, 1262066a361STetsuo Handa TOMOYO_MAX_CONDITION_KEYWORD, 1272066a361STetsuo Handa TOMOYO_NUMBER_UNION, 1282ca9bf45STetsuo Handa TOMOYO_NAME_UNION, 1295b636857STetsuo Handa TOMOYO_ARGV_ENTRY, 1305b636857STetsuo Handa TOMOYO_ENVP_ENTRY, 1312066a361STetsuo Handa }; 1322066a361STetsuo Handa 1338761afd4STetsuo Handa 1348761afd4STetsuo Handa /* Index numbers for stat(). */ 1358761afd4STetsuo Handa enum tomoyo_path_stat_index { 1368761afd4STetsuo Handa /* Do not change this order. */ 1378761afd4STetsuo Handa TOMOYO_PATH1, 1388761afd4STetsuo Handa TOMOYO_PATH1_PARENT, 1398761afd4STetsuo Handa TOMOYO_PATH2, 1408761afd4STetsuo Handa TOMOYO_PATH2_PARENT, 1418761afd4STetsuo Handa TOMOYO_MAX_PATH_STAT 1428761afd4STetsuo Handa }; 1438761afd4STetsuo Handa 144b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 145cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 146cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 147cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 148cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 14957c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 150eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 151eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 152eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 153eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 154cb0abe6aSTetsuo Handa }; 155cb0abe6aSTetsuo Handa 156b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 157a230f9e7STetsuo Handa enum tomoyo_policy_id { 158a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 159059d84dbSTetsuo Handa TOMOYO_ID_ADDRESS_GROUP, 160a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 161a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 1625448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 163a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 164a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 1652066a361STetsuo Handa TOMOYO_ID_CONDITION, 166a230f9e7STetsuo Handa TOMOYO_ID_NAME, 167a230f9e7STetsuo Handa TOMOYO_ID_ACL, 168a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 169a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 170a230f9e7STetsuo Handa }; 171a230f9e7STetsuo Handa 1722c47ab93STetsuo Handa /* Index numbers for domain's attributes. */ 1732c47ab93STetsuo Handa enum tomoyo_domain_info_flags_index { 1742c47ab93STetsuo Handa /* Quota warnning flag. */ 1752c47ab93STetsuo Handa TOMOYO_DIF_QUOTA_WARNED, 1762c47ab93STetsuo Handa /* 1772c47ab93STetsuo Handa * This domain was unable to create a new domain at 1782c47ab93STetsuo Handa * tomoyo_find_next_domain() because the name of the domain to be 1792c47ab93STetsuo Handa * created was too long or it could not allocate memory. 1802c47ab93STetsuo Handa * More than one process continued execve() without domain transition. 1812c47ab93STetsuo Handa */ 1822c47ab93STetsuo Handa TOMOYO_DIF_TRANSITION_FAILED, 1832c47ab93STetsuo Handa TOMOYO_MAX_DOMAIN_INFO_FLAGS 1842c47ab93STetsuo Handa }; 1852c47ab93STetsuo Handa 1861f067a68STetsuo Handa /* Index numbers for audit type. */ 1871f067a68STetsuo Handa enum tomoyo_grant_log { 1881f067a68STetsuo Handa /* Follow profile's configuration. */ 1891f067a68STetsuo Handa TOMOYO_GRANTLOG_AUTO, 1901f067a68STetsuo Handa /* Do not generate grant log. */ 1911f067a68STetsuo Handa TOMOYO_GRANTLOG_NO, 1921f067a68STetsuo Handa /* Generate grant_log. */ 1931f067a68STetsuo Handa TOMOYO_GRANTLOG_YES, 1941f067a68STetsuo Handa }; 1951f067a68STetsuo Handa 196b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 197a230f9e7STetsuo Handa enum tomoyo_group_id { 198a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 199a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 200059d84dbSTetsuo Handa TOMOYO_ADDRESS_GROUP, 201a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 202a230f9e7STetsuo Handa }; 203a230f9e7STetsuo Handa 204b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 205b5bc60b4STetsuo Handa enum tomoyo_value_type { 206b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 207b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 208b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 209b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 210b5bc60b4STetsuo Handa }; 2114c3e9e2dSTetsuo Handa 212b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 2135448ec4fSTetsuo Handa enum tomoyo_transition_type { 2145448ec4fSTetsuo Handa /* Do not change this order, */ 215bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 216bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 2175448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 2185448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 2195448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 2205448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 2215448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 2225448ec4fSTetsuo Handa }; 2235448ec4fSTetsuo Handa 22476bb0895STetsuo Handa /* Index numbers for Access Controls. */ 225084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 2267ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 2277ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 228a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 22975093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 2302106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 231059d84dbSTetsuo Handa TOMOYO_TYPE_INET_ACL, 232059d84dbSTetsuo Handa TOMOYO_TYPE_UNIX_ACL, 233d58e0da8STetsuo Handa TOMOYO_TYPE_ENV_ACL, 234731d37aaSTetsuo Handa TOMOYO_TYPE_MANUAL_TASK_ACL, 235084da356STetsuo Handa }; 23676bb0895STetsuo Handa 237b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 238084da356STetsuo Handa enum tomoyo_path_acl_index { 2397ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 2407ef61233STetsuo Handa TOMOYO_TYPE_READ, 2417ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 2427c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 2437ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 2447c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 2457ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 2467ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 2477ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 2487ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 2497ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 2507ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 251084da356STetsuo Handa }; 25276bb0895STetsuo Handa 253b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 254eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 255eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 256eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 257eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 258eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 259eadd99ccSTetsuo Handa }; 260eadd99ccSTetsuo Handa 26175093152STetsuo Handa enum tomoyo_mkdev_acl_index { 262a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 263a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 26475093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 265a1f9bb6aSTetsuo Handa }; 266a1f9bb6aSTetsuo Handa 267059d84dbSTetsuo Handa /* Index numbers for socket operations. */ 268059d84dbSTetsuo Handa enum tomoyo_network_acl_index { 269059d84dbSTetsuo Handa TOMOYO_NETWORK_BIND, /* bind() operation. */ 270059d84dbSTetsuo Handa TOMOYO_NETWORK_LISTEN, /* listen() operation. */ 271059d84dbSTetsuo Handa TOMOYO_NETWORK_CONNECT, /* connect() operation. */ 272059d84dbSTetsuo Handa TOMOYO_NETWORK_SEND, /* send() operation. */ 273059d84dbSTetsuo Handa TOMOYO_MAX_NETWORK_OPERATION 274059d84dbSTetsuo Handa }; 275059d84dbSTetsuo Handa 276b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 277084da356STetsuo Handa enum tomoyo_path2_acl_index { 2787ef61233STetsuo Handa TOMOYO_TYPE_LINK, 2797ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 2807ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 2817ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 282084da356STetsuo Handa }; 28376bb0895STetsuo Handa 284b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 285a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 286a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 287a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 288a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 289a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 290a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 291a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 292a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 293a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 294a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 295a1f9bb6aSTetsuo Handa }; 296a1f9bb6aSTetsuo Handa 297b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 298084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 299084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 300084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 301084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 302b22b8b9fSTetsuo Handa TOMOYO_STAT, 303eadd99ccSTetsuo Handa TOMOYO_AUDIT, 304084da356STetsuo Handa TOMOYO_VERSION, 305084da356STetsuo Handa TOMOYO_PROFILE, 30617fcfbd9STetsuo Handa TOMOYO_QUERY, 307084da356STetsuo Handa TOMOYO_MANAGER 308084da356STetsuo Handa }; 30976bb0895STetsuo Handa 310b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 311b5bc60b4STetsuo Handa enum tomoyo_special_mount { 312b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 313b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 314b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 315b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 316b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 317b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 318b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 319b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 320b5bc60b4STetsuo Handa }; 321b5bc60b4STetsuo Handa 322b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 32357c2590fSTetsuo Handa enum tomoyo_mac_index { 32457c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 32557c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 32657c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 32757c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 3287c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 32957c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 33057c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 33157c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 33257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 33357c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 33457c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 33557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 33657c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 33757c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 33857c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 33957c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 34057c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 34157c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 34257c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 34357c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 34457c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 34557c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 34657c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 347059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_BIND, 348059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN, 349059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT, 350059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_BIND, 351059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_DGRAM_SEND, 352059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_BIND, 353059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_INET_RAW_SEND, 354059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND, 355059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN, 356059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT, 357059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND, 358059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND, 359059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND, 360059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN, 361059d84dbSTetsuo Handa TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT, 362d58e0da8STetsuo Handa TOMOYO_MAC_ENVIRON, 36357c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 36457c2590fSTetsuo Handa }; 36557c2590fSTetsuo Handa 366b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 36757c2590fSTetsuo Handa enum tomoyo_mac_category_index { 36857c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 369059d84dbSTetsuo Handa TOMOYO_MAC_CATEGORY_NETWORK, 370d58e0da8STetsuo Handa TOMOYO_MAC_CATEGORY_MISC, 37157c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 37257c2590fSTetsuo Handa }; 37357c2590fSTetsuo Handa 374b5bc60b4STetsuo Handa /* 375b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 376b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 377b5bc60b4STetsuo Handa * 378b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 379b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 380b5bc60b4STetsuo Handa */ 381b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 38217fcfbd9STetsuo Handa 383b22b8b9fSTetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/stat interface. */ 384b22b8b9fSTetsuo Handa enum tomoyo_policy_stat_type { 385b22b8b9fSTetsuo Handa /* Do not change this order. */ 386b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_UPDATES, 387b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_LEARNING, /* == TOMOYO_CONFIG_LEARNING */ 388b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_PERMISSIVE, /* == TOMOYO_CONFIG_PERMISSIVE */ 389b22b8b9fSTetsuo Handa TOMOYO_STAT_POLICY_ENFORCING, /* == TOMOYO_CONFIG_ENFORCING */ 390b22b8b9fSTetsuo Handa TOMOYO_MAX_POLICY_STAT 391b22b8b9fSTetsuo Handa }; 392b22b8b9fSTetsuo Handa 393d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 394d5ca1725STetsuo Handa enum tomoyo_pref_index { 395eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 396d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 397d5ca1725STetsuo Handa TOMOYO_MAX_PREF 398d5ca1725STetsuo Handa }; 399d5ca1725STetsuo Handa 40076bb0895STetsuo Handa /********** Structure definitions. **********/ 4019590837bSKentaro Takeda 402b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 40382e0f001STetsuo Handa struct tomoyo_acl_head { 40482e0f001STetsuo Handa struct list_head list; 405f9732ea1STetsuo Handa s8 is_deleted; /* true or false or TOMOYO_GC_IN_PROGRESS */ 40682e0f001STetsuo Handa } __packed; 40782e0f001STetsuo Handa 4080df7e8b8STetsuo Handa /* Common header for shared entries. */ 4090df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 4100df7e8b8STetsuo Handa struct list_head list; 4110df7e8b8STetsuo Handa atomic_t users; 4120df7e8b8STetsuo Handa } __packed; 4130df7e8b8STetsuo Handa 414bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 415bd03a3e4STetsuo Handa 416b5bc60b4STetsuo Handa /* Structure for request info. */ 417cb0abe6aSTetsuo Handa struct tomoyo_request_info { 4188761afd4STetsuo Handa /* 4198761afd4STetsuo Handa * For holding parameters specific to operations which deal files. 4208761afd4STetsuo Handa * NULL if not dealing files. 4218761afd4STetsuo Handa */ 4228761afd4STetsuo Handa struct tomoyo_obj_info *obj; 4232ca9bf45STetsuo Handa /* 4242ca9bf45STetsuo Handa * For holding parameters specific to execve() request. 4252ca9bf45STetsuo Handa * NULL if not dealing do_execve(). 4262ca9bf45STetsuo Handa */ 4272ca9bf45STetsuo Handa struct tomoyo_execve *ee; 428cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 429cf6e9a64STetsuo Handa /* For holding parameters. */ 430cf6e9a64STetsuo Handa union { 431cf6e9a64STetsuo Handa struct { 432cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 433484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 434484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 435b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 436cf6e9a64STetsuo Handa u8 operation; 437cf6e9a64STetsuo Handa } path; 438cf6e9a64STetsuo Handa struct { 439cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 440cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 441b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 442cf6e9a64STetsuo Handa u8 operation; 443cf6e9a64STetsuo Handa } path2; 444cf6e9a64STetsuo Handa struct { 445cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 446cf6e9a64STetsuo Handa unsigned int mode; 447cf6e9a64STetsuo Handa unsigned int major; 448cf6e9a64STetsuo Handa unsigned int minor; 449b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 450cf6e9a64STetsuo Handa u8 operation; 451cf6e9a64STetsuo Handa } mkdev; 452cf6e9a64STetsuo Handa struct { 453cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 454cf6e9a64STetsuo Handa unsigned long number; 455b5bc60b4STetsuo Handa /* 456b5bc60b4STetsuo Handa * One of values in 457b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 458b5bc60b4STetsuo Handa */ 459cf6e9a64STetsuo Handa u8 operation; 460cf6e9a64STetsuo Handa } path_number; 461cf6e9a64STetsuo Handa struct { 462d58e0da8STetsuo Handa const struct tomoyo_path_info *name; 463d58e0da8STetsuo Handa } environ; 464d58e0da8STetsuo Handa struct { 465059d84dbSTetsuo Handa const __be32 *address; 466059d84dbSTetsuo Handa u16 port; 467059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 468059d84dbSTetsuo Handa u8 protocol; 469059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 470059d84dbSTetsuo Handa u8 operation; 471059d84dbSTetsuo Handa bool is_ipv6; 472059d84dbSTetsuo Handa } inet_network; 473059d84dbSTetsuo Handa struct { 474059d84dbSTetsuo Handa const struct tomoyo_path_info *address; 475059d84dbSTetsuo Handa /* One of values smaller than TOMOYO_SOCK_MAX. */ 476059d84dbSTetsuo Handa u8 protocol; 477059d84dbSTetsuo Handa /* One of values in "enum tomoyo_network_acl_index". */ 478059d84dbSTetsuo Handa u8 operation; 479059d84dbSTetsuo Handa } unix_network; 480059d84dbSTetsuo Handa struct { 481cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 482cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 483cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 484cf6e9a64STetsuo Handa unsigned long flags; 485cf6e9a64STetsuo Handa int need_dev; 486cf6e9a64STetsuo Handa } mount; 487731d37aaSTetsuo Handa struct { 488731d37aaSTetsuo Handa const struct tomoyo_path_info *domainname; 489731d37aaSTetsuo Handa } task; 490cf6e9a64STetsuo Handa } param; 4911f067a68STetsuo Handa struct tomoyo_acl_info *matched_acl; 492cf6e9a64STetsuo Handa u8 param_type; 493cf6e9a64STetsuo Handa bool granted; 49417fcfbd9STetsuo Handa u8 retry; 49517fcfbd9STetsuo Handa u8 profile; 496cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 49757c2590fSTetsuo Handa u8 type; 498cb0abe6aSTetsuo Handa }; 499cb0abe6aSTetsuo Handa 500b5bc60b4STetsuo Handa /* Structure for holding a token. */ 5019590837bSKentaro Takeda struct tomoyo_path_info { 5029590837bSKentaro Takeda const char *name; 5039590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 5049590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 5059590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 5069590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 5079590837bSKentaro Takeda }; 5089590837bSKentaro Takeda 509b5bc60b4STetsuo Handa /* Structure for holding string data. */ 510e2bf6907STetsuo Handa struct tomoyo_name { 5110df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 51276bb0895STetsuo Handa struct tomoyo_path_info entry; 51376bb0895STetsuo Handa }; 5149590837bSKentaro Takeda 515b5bc60b4STetsuo Handa /* Structure for holding a word. */ 5167762fbffSTetsuo Handa struct tomoyo_name_union { 517b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 5187762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 519a98aa4deSTetsuo Handa struct tomoyo_group *group; 5207762fbffSTetsuo Handa }; 5217762fbffSTetsuo Handa 522b5bc60b4STetsuo Handa /* Structure for holding a number. */ 5234c3e9e2dSTetsuo Handa struct tomoyo_number_union { 5244c3e9e2dSTetsuo Handa unsigned long values[2]; 525b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 526b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 5270df7e8b8STetsuo Handa u8 value_type[2]; 5284c3e9e2dSTetsuo Handa }; 5294c3e9e2dSTetsuo Handa 530059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 531059d84dbSTetsuo Handa struct tomoyo_ipaddr_union { 532059d84dbSTetsuo Handa struct in6_addr ip[2]; /* Big endian. */ 533059d84dbSTetsuo Handa struct tomoyo_group *group; /* Pointer to address group. */ 534059d84dbSTetsuo Handa bool is_ipv6; /* Valid only if @group == NULL. */ 535059d84dbSTetsuo Handa }; 536059d84dbSTetsuo Handa 537059d84dbSTetsuo Handa /* Structure for "path_group"/"number_group"/"address_group" directive. */ 538a98aa4deSTetsuo Handa struct tomoyo_group { 5390df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 540a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 541a98aa4deSTetsuo Handa struct list_head member_list; 542a98aa4deSTetsuo Handa }; 543a98aa4deSTetsuo Handa 5447762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 5457762fbffSTetsuo Handa struct tomoyo_path_group { 54682e0f001STetsuo Handa struct tomoyo_acl_head head; 5477762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 5487762fbffSTetsuo Handa }; 5497762fbffSTetsuo Handa 5504c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 551a98aa4deSTetsuo Handa struct tomoyo_number_group { 55282e0f001STetsuo Handa struct tomoyo_acl_head head; 5534c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 5544c3e9e2dSTetsuo Handa }; 5554c3e9e2dSTetsuo Handa 556059d84dbSTetsuo Handa /* Structure for "address_group" directive. */ 557059d84dbSTetsuo Handa struct tomoyo_address_group { 558059d84dbSTetsuo Handa struct tomoyo_acl_head head; 559059d84dbSTetsuo Handa /* Structure for holding an IP address. */ 560059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 561059d84dbSTetsuo Handa }; 562059d84dbSTetsuo Handa 5638761afd4STetsuo Handa /* Subset of "struct stat". Used by conditional ACL and audit logs. */ 5648761afd4STetsuo Handa struct tomoyo_mini_stat { 565609fcd1bSEric W. Biederman kuid_t uid; 566609fcd1bSEric W. Biederman kgid_t gid; 5678761afd4STetsuo Handa ino_t ino; 568d179333fSAl Viro umode_t mode; 5698761afd4STetsuo Handa dev_t dev; 5708761afd4STetsuo Handa dev_t rdev; 5718761afd4STetsuo Handa }; 5728761afd4STetsuo Handa 5735b636857STetsuo Handa /* Structure for dumping argv[] and envp[] of "struct linux_binprm". */ 5745b636857STetsuo Handa struct tomoyo_page_dump { 5755b636857STetsuo Handa struct page *page; /* Previously dumped page. */ 5765b636857STetsuo Handa char *data; /* Contents of "page". Size is PAGE_SIZE. */ 5775b636857STetsuo Handa }; 5785b636857STetsuo Handa 5798761afd4STetsuo Handa /* Structure for attribute checks in addition to pathname checks. */ 5808761afd4STetsuo Handa struct tomoyo_obj_info { 5818761afd4STetsuo Handa /* 5828761afd4STetsuo Handa * True if tomoyo_get_attributes() was already called, false otherwise. 5838761afd4STetsuo Handa */ 5848761afd4STetsuo Handa bool validate_done; 5858761afd4STetsuo Handa /* True if @stat[] is valid. */ 5868761afd4STetsuo Handa bool stat_valid[TOMOYO_MAX_PATH_STAT]; 5878761afd4STetsuo Handa /* First pathname. Initialized with { NULL, NULL } if no path. */ 5888761afd4STetsuo Handa struct path path1; 5898761afd4STetsuo Handa /* Second pathname. Initialized with { NULL, NULL } if no path. */ 5908761afd4STetsuo Handa struct path path2; 5918761afd4STetsuo Handa /* 5928761afd4STetsuo Handa * Information on @path1, @path1's parent directory, @path2, @path2's 5938761afd4STetsuo Handa * parent directory. 5948761afd4STetsuo Handa */ 5958761afd4STetsuo Handa struct tomoyo_mini_stat stat[TOMOYO_MAX_PATH_STAT]; 5962ca9bf45STetsuo Handa /* 5972ca9bf45STetsuo Handa * Content of symbolic link to be created. NULL for operations other 5982ca9bf45STetsuo Handa * than symlink(). 5992ca9bf45STetsuo Handa */ 6002ca9bf45STetsuo Handa struct tomoyo_path_info *symlink_target; 6012ca9bf45STetsuo Handa }; 6022ca9bf45STetsuo Handa 6035b636857STetsuo Handa /* Structure for argv[]. */ 6045b636857STetsuo Handa struct tomoyo_argv { 6055b636857STetsuo Handa unsigned long index; 6065b636857STetsuo Handa const struct tomoyo_path_info *value; 6075b636857STetsuo Handa bool is_not; 6085b636857STetsuo Handa }; 6095b636857STetsuo Handa 6105b636857STetsuo Handa /* Structure for envp[]. */ 6115b636857STetsuo Handa struct tomoyo_envp { 6125b636857STetsuo Handa const struct tomoyo_path_info *name; 6135b636857STetsuo Handa const struct tomoyo_path_info *value; 6145b636857STetsuo Handa bool is_not; 6155b636857STetsuo Handa }; 6165b636857STetsuo Handa 6172ca9bf45STetsuo Handa /* Structure for execve() operation. */ 6182ca9bf45STetsuo Handa struct tomoyo_execve { 6192ca9bf45STetsuo Handa struct tomoyo_request_info r; 6202ca9bf45STetsuo Handa struct tomoyo_obj_info obj; 6212ca9bf45STetsuo Handa struct linux_binprm *bprm; 6226bce98edSTetsuo Handa const struct tomoyo_path_info *transition; 6235b636857STetsuo Handa /* For dumping argv[] and envp[]. */ 6245b636857STetsuo Handa struct tomoyo_page_dump dump; 6252ca9bf45STetsuo Handa /* For temporary use. */ 6262ca9bf45STetsuo Handa char *tmp; /* Size is TOMOYO_EXEC_TMPSIZE bytes */ 6278761afd4STetsuo Handa }; 6288761afd4STetsuo Handa 6292066a361STetsuo Handa /* Structure for entries which follows "struct tomoyo_condition". */ 6302066a361STetsuo Handa struct tomoyo_condition_element { 6315b636857STetsuo Handa /* 6325b636857STetsuo Handa * Left hand operand. A "struct tomoyo_argv" for TOMOYO_ARGV_ENTRY, a 6335b636857STetsuo Handa * "struct tomoyo_envp" for TOMOYO_ENVP_ENTRY is attached to the tail 6345b636857STetsuo Handa * of the array of this struct. 6355b636857STetsuo Handa */ 6362066a361STetsuo Handa u8 left; 6375b636857STetsuo Handa /* 6385b636857STetsuo Handa * Right hand operand. A "struct tomoyo_number_union" for 6395b636857STetsuo Handa * TOMOYO_NUMBER_UNION, a "struct tomoyo_name_union" for 6405b636857STetsuo Handa * TOMOYO_NAME_UNION is attached to the tail of the array of this 6415b636857STetsuo Handa * struct. 6425b636857STetsuo Handa */ 6432066a361STetsuo Handa u8 right; 6442066a361STetsuo Handa /* Equation operator. True if equals or overlaps, false otherwise. */ 6452066a361STetsuo Handa bool equals; 6462066a361STetsuo Handa }; 6472066a361STetsuo Handa 6482066a361STetsuo Handa /* Structure for optional arguments. */ 6492066a361STetsuo Handa struct tomoyo_condition { 6502066a361STetsuo Handa struct tomoyo_shared_acl_head head; 6512066a361STetsuo Handa u32 size; /* Memory size allocated for this entry. */ 6522066a361STetsuo Handa u16 condc; /* Number of conditions in this struct. */ 6532066a361STetsuo Handa u16 numbers_count; /* Number of "struct tomoyo_number_union values". */ 6542ca9bf45STetsuo Handa u16 names_count; /* Number of "struct tomoyo_name_union names". */ 6555b636857STetsuo Handa u16 argc; /* Number of "struct tomoyo_argv". */ 6565b636857STetsuo Handa u16 envc; /* Number of "struct tomoyo_envp". */ 6571f067a68STetsuo Handa u8 grant_log; /* One of values in "enum tomoyo_grant_log". */ 6586bce98edSTetsuo Handa const struct tomoyo_path_info *transit; /* Maybe NULL. */ 6592066a361STetsuo Handa /* 6602066a361STetsuo Handa * struct tomoyo_condition_element condition[condc]; 6612066a361STetsuo Handa * struct tomoyo_number_union values[numbers_count]; 6622ca9bf45STetsuo Handa * struct tomoyo_name_union names[names_count]; 6635b636857STetsuo Handa * struct tomoyo_argv argv[argc]; 6645b636857STetsuo Handa * struct tomoyo_envp envp[envc]; 6652066a361STetsuo Handa */ 6662066a361STetsuo Handa }; 6672066a361STetsuo Handa 668b5bc60b4STetsuo Handa /* Common header for individual entries. */ 6699590837bSKentaro Takeda struct tomoyo_acl_info { 6709590837bSKentaro Takeda struct list_head list; 6712066a361STetsuo Handa struct tomoyo_condition *cond; /* Maybe NULL. */ 672f9732ea1STetsuo Handa s8 is_deleted; /* true or false or TOMOYO_GC_IN_PROGRESS */ 673b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 6749590837bSKentaro Takeda } __packed; 6759590837bSKentaro Takeda 676b5bc60b4STetsuo Handa /* Structure for domain information. */ 6779590837bSKentaro Takeda struct tomoyo_domain_info { 6789590837bSKentaro Takeda struct list_head list; 6799590837bSKentaro Takeda struct list_head acl_info_list; 6809590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 6819590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 682bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 683bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 6849590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 68532997144STetsuo Handa u8 group; /* Group number to use. */ 686a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 6872c47ab93STetsuo Handa bool flags[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 688ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 6899590837bSKentaro Takeda }; 6909590837bSKentaro Takeda 6919590837bSKentaro Takeda /* 692731d37aaSTetsuo Handa * Structure for "task manual_domain_transition" directive. 693731d37aaSTetsuo Handa */ 694731d37aaSTetsuo Handa struct tomoyo_task_acl { 695731d37aaSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MANUAL_TASK_ACL */ 696731d37aaSTetsuo Handa /* Pointer to domainname. */ 697731d37aaSTetsuo Handa const struct tomoyo_path_info *domainname; 698731d37aaSTetsuo Handa }; 699731d37aaSTetsuo Handa 700731d37aaSTetsuo Handa /* 701b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 702b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 703b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 7049590837bSKentaro Takeda */ 7057ef61233STetsuo Handa struct tomoyo_path_acl { 7067ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 707b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 7087762fbffSTetsuo Handa struct tomoyo_name_union name; 7099590837bSKentaro Takeda }; 7109590837bSKentaro Takeda 711c3fa109aSTetsuo Handa /* 712b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 713b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 714a1f9bb6aSTetsuo Handa */ 715a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 716a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 717b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 718a1f9bb6aSTetsuo Handa u8 perm; 719a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 720a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 721a1f9bb6aSTetsuo Handa }; 722a1f9bb6aSTetsuo Handa 723b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 72475093152STetsuo Handa struct tomoyo_mkdev_acl { 72575093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 726b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 727a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 728a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 729a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 730a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 731a1f9bb6aSTetsuo Handa }; 732a1f9bb6aSTetsuo Handa 733a1f9bb6aSTetsuo Handa /* 734b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 735c3fa109aSTetsuo Handa */ 7367ef61233STetsuo Handa struct tomoyo_path2_acl { 7377ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 738b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 7397762fbffSTetsuo Handa struct tomoyo_name_union name1; 7407762fbffSTetsuo Handa struct tomoyo_name_union name2; 7419590837bSKentaro Takeda }; 7429590837bSKentaro Takeda 743b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 7442106ccd9STetsuo Handa struct tomoyo_mount_acl { 7452106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 7462106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 7472106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 7482106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 7492106ccd9STetsuo Handa struct tomoyo_number_union flags; 7502106ccd9STetsuo Handa }; 7512106ccd9STetsuo Handa 752d58e0da8STetsuo Handa /* Structure for "misc env" directive in domain policy. */ 753d58e0da8STetsuo Handa struct tomoyo_env_acl { 754d58e0da8STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_ENV_ACL */ 755d58e0da8STetsuo Handa const struct tomoyo_path_info *env; /* environment variable */ 756d58e0da8STetsuo Handa }; 757d58e0da8STetsuo Handa 758059d84dbSTetsuo Handa /* Structure for "network inet" directive. */ 759059d84dbSTetsuo Handa struct tomoyo_inet_acl { 760059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_INET_ACL */ 761059d84dbSTetsuo Handa u8 protocol; 762059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 763059d84dbSTetsuo Handa struct tomoyo_ipaddr_union address; 764059d84dbSTetsuo Handa struct tomoyo_number_union port; 765059d84dbSTetsuo Handa }; 766059d84dbSTetsuo Handa 767059d84dbSTetsuo Handa /* Structure for "network unix" directive. */ 768059d84dbSTetsuo Handa struct tomoyo_unix_acl { 769059d84dbSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_UNIX_ACL */ 770059d84dbSTetsuo Handa u8 protocol; 771059d84dbSTetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_network_acl_index" */ 772059d84dbSTetsuo Handa struct tomoyo_name_union name; 773059d84dbSTetsuo Handa }; 774059d84dbSTetsuo Handa 775a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 776a238cf5bSTetsuo Handa struct tomoyo_acl_param { 777a238cf5bSTetsuo Handa char *data; 778a238cf5bSTetsuo Handa struct list_head *list; 779bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 780a238cf5bSTetsuo Handa bool is_delete; 781a238cf5bSTetsuo Handa }; 782a238cf5bSTetsuo Handa 7830d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 784f23571e8STetsuo Handa 7852106ccd9STetsuo Handa /* 786f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 787f23571e8STetsuo Handa * interfaces. 788c3fa109aSTetsuo Handa */ 7899590837bSKentaro Takeda struct tomoyo_io_buffer { 7908fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 7919590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 7926041e834STetsuo Handa unsigned int (*poll) (struct file *file, poll_table *wait); 7939590837bSKentaro Takeda /* Exclusive lock for this structure. */ 7949590837bSKentaro Takeda struct mutex io_sem; 795f23571e8STetsuo Handa char __user *read_user_buf; 7962c47ab93STetsuo Handa size_t read_user_buf_avail; 797f23571e8STetsuo Handa struct { 798bd03a3e4STetsuo Handa struct list_head *ns; 799f23571e8STetsuo Handa struct list_head *domain; 800f23571e8STetsuo Handa struct list_head *group; 801f23571e8STetsuo Handa struct list_head *acl; 8022c47ab93STetsuo Handa size_t avail; 8032c47ab93STetsuo Handa unsigned int step; 8042c47ab93STetsuo Handa unsigned int query_index; 805f23571e8STetsuo Handa u16 index; 8062066a361STetsuo Handa u16 cond_index; 80732997144STetsuo Handa u8 acl_group_index; 8082066a361STetsuo Handa u8 cond_step; 809f23571e8STetsuo Handa u8 bit; 810f23571e8STetsuo Handa u8 w_pos; 811f23571e8STetsuo Handa bool eof; 812f23571e8STetsuo Handa bool print_this_domain_only; 813bd03a3e4STetsuo Handa bool print_transition_related_only; 8142066a361STetsuo Handa bool print_cond_part; 815f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 816f23571e8STetsuo Handa } r; 8170df7e8b8STetsuo Handa struct { 818bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 8199590837bSKentaro Takeda /* The position currently writing to. */ 8200df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 8210df7e8b8STetsuo Handa /* Bytes available for writing. */ 8222c47ab93STetsuo Handa size_t avail; 823bd03a3e4STetsuo Handa bool is_delete; 8240df7e8b8STetsuo Handa } w; 8259590837bSKentaro Takeda /* Buffer for reading. */ 8269590837bSKentaro Takeda char *read_buf; 8279590837bSKentaro Takeda /* Size of read buffer. */ 8282c47ab93STetsuo Handa size_t readbuf_size; 8299590837bSKentaro Takeda /* Buffer for writing. */ 8309590837bSKentaro Takeda char *write_buf; 8319590837bSKentaro Takeda /* Size of write buffer. */ 8322c47ab93STetsuo Handa size_t writebuf_size; 83317fcfbd9STetsuo Handa /* Type of this interface. */ 8342c47ab93STetsuo Handa enum tomoyo_securityfs_interface_index type; 8352e503bbbSTetsuo Handa /* Users counter protected by tomoyo_io_buffer_list_lock. */ 8362e503bbbSTetsuo Handa u8 users; 8372e503bbbSTetsuo Handa /* List for telling GC not to kfree() elements. */ 8382e503bbbSTetsuo Handa struct list_head list; 8399590837bSKentaro Takeda }; 8409590837bSKentaro Takeda 84176bb0895STetsuo Handa /* 842b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 843b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 84476bb0895STetsuo Handa */ 8455448ec4fSTetsuo Handa struct tomoyo_transition_control { 84682e0f001STetsuo Handa struct tomoyo_acl_head head; 8475448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 84876bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 84976bb0895STetsuo Handa bool is_last_name; 8505448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 8515448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 85276bb0895STetsuo Handa }; 85376bb0895STetsuo Handa 854b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 855e2bf6907STetsuo Handa struct tomoyo_aggregator { 85682e0f001STetsuo Handa struct tomoyo_acl_head head; 8571084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 8581084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 8591084307cSTetsuo Handa }; 8601084307cSTetsuo Handa 861b5bc60b4STetsuo Handa /* Structure for policy manager. */ 862e2bf6907STetsuo Handa struct tomoyo_manager { 86382e0f001STetsuo Handa struct tomoyo_acl_head head; 86476bb0895STetsuo Handa /* A path to program or a domainname. */ 86576bb0895STetsuo Handa const struct tomoyo_path_info *manager; 86676bb0895STetsuo Handa }; 86776bb0895STetsuo Handa 86857c2590fSTetsuo Handa struct tomoyo_preference { 86957c2590fSTetsuo Handa unsigned int learning_max_entry; 87057c2590fSTetsuo Handa bool enforcing_verbose; 87157c2590fSTetsuo Handa bool learning_verbose; 87257c2590fSTetsuo Handa bool permissive_verbose; 87357c2590fSTetsuo Handa }; 87457c2590fSTetsuo Handa 875b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 87657c2590fSTetsuo Handa struct tomoyo_profile { 87757c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 87857c2590fSTetsuo Handa struct tomoyo_preference *learning; 87957c2590fSTetsuo Handa struct tomoyo_preference *permissive; 88057c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 88157c2590fSTetsuo Handa struct tomoyo_preference preference; 88257c2590fSTetsuo Handa u8 default_config; 88357c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 884d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 88557c2590fSTetsuo Handa }; 88657c2590fSTetsuo Handa 887eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 888eadd99ccSTetsuo Handa struct tomoyo_time { 889eadd99ccSTetsuo Handa u16 year; 890eadd99ccSTetsuo Handa u8 month; 891eadd99ccSTetsuo Handa u8 day; 892eadd99ccSTetsuo Handa u8 hour; 893eadd99ccSTetsuo Handa u8 min; 894eadd99ccSTetsuo Handa u8 sec; 895eadd99ccSTetsuo Handa }; 896eadd99ccSTetsuo Handa 897bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 898bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 899bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 900bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 901bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 902bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 903bd03a3e4STetsuo Handa /* List of policy. */ 904bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 905bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 906bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 907bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 908bd03a3e4STetsuo Handa struct list_head namespace_list; 909843d183cSTetsuo Handa /* Profile version. Currently only 20110903 is defined. */ 910bd03a3e4STetsuo Handa unsigned int profile_version; 911bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 912bd03a3e4STetsuo Handa const char *name; 913bd03a3e4STetsuo Handa }; 914bd03a3e4STetsuo Handa 91576bb0895STetsuo Handa /********** Function prototypes. **********/ 91676bb0895STetsuo Handa 917059d84dbSTetsuo Handa bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address, 918059d84dbSTetsuo Handa const struct tomoyo_group *group); 9192106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 9202106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 9212066a361STetsuo Handa bool tomoyo_condition(struct tomoyo_request_info *r, 9222066a361STetsuo Handa const struct tomoyo_condition *cond); 92375093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 92475093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 92575093152STetsuo Handa bool tomoyo_correct_word(const char *string); 92675093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 9273ddf17f0STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 9285b636857STetsuo Handa bool tomoyo_dump_page(struct linux_binprm *bprm, unsigned long pos, 9295b636857STetsuo Handa struct tomoyo_page_dump *dump); 9303ddf17f0STetsuo Handa bool tomoyo_memory_ok(void *ptr); 9314c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 9324c3e9e2dSTetsuo Handa const unsigned long max, 933a98aa4deSTetsuo Handa const struct tomoyo_group *group); 934059d84dbSTetsuo Handa bool tomoyo_parse_ipaddr_union(struct tomoyo_acl_param *param, 935059d84dbSTetsuo Handa struct tomoyo_ipaddr_union *ptr); 9363ddf17f0STetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 9373ddf17f0STetsuo Handa struct tomoyo_name_union *ptr); 938a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 939a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 9403ddf17f0STetsuo Handa bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 9413ddf17f0STetsuo Handa const struct tomoyo_path_info *pattern); 9423ddf17f0STetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 9433ddf17f0STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 9443ddf17f0STetsuo Handa char *tomoyo_encode(const char *str); 945059d84dbSTetsuo Handa char *tomoyo_encode2(const char *str, int str_len); 9463ddf17f0STetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 9473ddf17f0STetsuo Handa va_list args); 9483ddf17f0STetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 94922473862SAl Viro char *tomoyo_realpath_from_path(const struct path *path); 9503ddf17f0STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 9513ddf17f0STetsuo Handa const char *tomoyo_get_exe(void); 9523ddf17f0STetsuo Handa const char *tomoyo_yesno(const unsigned int value); 9533ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_compare_name_union 9543ddf17f0STetsuo Handa (const struct tomoyo_path_info *name, const struct tomoyo_name_union *ptr); 955731d37aaSTetsuo Handa const struct tomoyo_path_info *tomoyo_get_domainname 956731d37aaSTetsuo Handa (struct tomoyo_acl_param *param); 9573ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 9583ddf17f0STetsuo Handa const struct tomoyo_path_info *tomoyo_path_matches_group 9593ddf17f0STetsuo Handa (const struct tomoyo_path_info *pathname, const struct tomoyo_group *group); 9603ddf17f0STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 961e6641eddSAl Viro const struct path *path, const int flag); 962e53cfda5SAl Viro void tomoyo_close_control(struct tomoyo_io_buffer *head); 963d58e0da8STetsuo Handa int tomoyo_env_perm(struct tomoyo_request_info *r, const char *env); 9646bce98edSTetsuo Handa int tomoyo_execute_permission(struct tomoyo_request_info *r, 9656bce98edSTetsuo Handa const struct tomoyo_path_info *filename); 9663ddf17f0STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 9673ddf17f0STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 9683ddf17f0STetsuo Handa const u8 index); 9692106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 97057c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 97157c2590fSTetsuo Handa const u8 index); 972e6641eddSAl Viro int tomoyo_mkdev_perm(const u8 operation, const struct path *path, 9733ddf17f0STetsuo Handa const unsigned int mode, unsigned int dev); 974e6641eddSAl Viro int tomoyo_mount_permission(const char *dev_name, const struct path *path, 975b5bc60b4STetsuo Handa const char *type, unsigned long flags, 976b5bc60b4STetsuo Handa void *data_page); 9773ddf17f0STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 978e6641eddSAl Viro int tomoyo_path2_perm(const u8 operation, const struct path *path1, 979e6641eddSAl Viro const struct path *path2); 980e6641eddSAl Viro int tomoyo_path_number_perm(const u8 operation, const struct path *path, 9813ddf17f0STetsuo Handa unsigned long number); 9823f7036a0SAl Viro int tomoyo_path_perm(const u8 operation, const struct path *path, 98397fb35e4STetsuo Handa const char *target); 9846041e834STetsuo Handa unsigned int tomoyo_poll_control(struct file *file, poll_table *wait); 9856041e834STetsuo Handa unsigned int tomoyo_poll_log(struct file *file, poll_table *wait); 986059d84dbSTetsuo Handa int tomoyo_socket_bind_permission(struct socket *sock, struct sockaddr *addr, 987059d84dbSTetsuo Handa int addr_len); 988059d84dbSTetsuo Handa int tomoyo_socket_connect_permission(struct socket *sock, 989059d84dbSTetsuo Handa struct sockaddr *addr, int addr_len); 990059d84dbSTetsuo Handa int tomoyo_socket_listen_permission(struct socket *sock); 991059d84dbSTetsuo Handa int tomoyo_socket_sendmsg_permission(struct socket *sock, struct msghdr *msg, 992059d84dbSTetsuo Handa int size); 9933ddf17f0STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 9943ddf17f0STetsuo Handa __printf(2, 3); 995237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 996a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 9973ddf17f0STetsuo Handa bool (*check_duplicate) 9983ddf17f0STetsuo Handa (const struct tomoyo_acl_info *, 9993ddf17f0STetsuo Handa const struct tomoyo_acl_info *), 10003ddf17f0STetsuo Handa bool (*merge_duplicate) 10013ddf17f0STetsuo Handa (struct tomoyo_acl_info *, struct tomoyo_acl_info *, 1002237ab459STetsuo Handa const bool)); 100336f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 1004a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 10053ddf17f0STetsuo Handa bool (*check_duplicate) 10063ddf17f0STetsuo Handa (const struct tomoyo_acl_head *, 10073ddf17f0STetsuo Handa const struct tomoyo_acl_head *)); 10083ddf17f0STetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 10093ddf17f0STetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 10103ddf17f0STetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 1011d58e0da8STetsuo Handa int tomoyo_write_misc(struct tomoyo_acl_param *param); 1012059d84dbSTetsuo Handa int tomoyo_write_inet_network(struct tomoyo_acl_param *param); 10133ddf17f0STetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 10143ddf17f0STetsuo Handa const u8 type); 1015059d84dbSTetsuo Handa int tomoyo_write_unix_network(struct tomoyo_acl_param *param); 10163ddf17f0STetsuo Handa ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 10173ddf17f0STetsuo Handa const int buffer_len); 10183ddf17f0STetsuo Handa ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head, 10193ddf17f0STetsuo Handa const char __user *buffer, const int buffer_len); 10202066a361STetsuo Handa struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param); 10213ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 10223ddf17f0STetsuo Handa const bool transit); 10233ddf17f0STetsuo Handa struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 10243ddf17f0STetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 10253ddf17f0STetsuo Handa const u8 idx); 10263ddf17f0STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 10273ddf17f0STetsuo Handa (const char *domainname); 10283ddf17f0STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 10293ddf17f0STetsuo Handa const u8 profile); 10303ddf17f0STetsuo Handa unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 10313ddf17f0STetsuo Handa const u8 index); 10322066a361STetsuo Handa u8 tomoyo_parse_ulong(unsigned long *result, char **str); 10333ddf17f0STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 10343ddf17f0STetsuo Handa void __init tomoyo_load_builtin_policy(void); 10353ddf17f0STetsuo Handa void __init tomoyo_mm_init(void); 103699a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 1037484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 103899a85259STetsuo Handa const struct tomoyo_acl_info *)); 10393ddf17f0STetsuo Handa void tomoyo_check_profile(void); 10403ddf17f0STetsuo Handa void tomoyo_convert_time(time_t time, struct tomoyo_time *stamp); 10412066a361STetsuo Handa void tomoyo_del_condition(struct list_head *element); 10423ddf17f0STetsuo Handa void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 10438761afd4STetsuo Handa void tomoyo_get_attributes(struct tomoyo_obj_info *obj); 10443ddf17f0STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 10453ddf17f0STetsuo Handa void tomoyo_load_policy(const char *filename); 10463ddf17f0STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 10473ddf17f0STetsuo Handa void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register); 1048059d84dbSTetsuo Handa void tomoyo_print_ip(char *buf, const unsigned int size, 1049059d84dbSTetsuo Handa const struct tomoyo_ipaddr_union *ptr); 10503ddf17f0STetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 10513ddf17f0STetsuo Handa const unsigned long value, const u8 type); 10523ddf17f0STetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 10533ddf17f0STetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 1054eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 10553ddf17f0STetsuo Handa void tomoyo_update_stat(const u8 index); 10563ddf17f0STetsuo Handa void tomoyo_warn_oom(const char *function); 10573ddf17f0STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 10583ddf17f0STetsuo Handa __printf(2, 3); 10593ddf17f0STetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 1060eadd99ccSTetsuo Handa va_list args); 1061eadd99ccSTetsuo Handa 106276bb0895STetsuo Handa /********** External variable definitions. **********/ 106376bb0895STetsuo Handa 106476bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 10652066a361STetsuo Handa extern const char * const tomoyo_condition_keyword 10662066a361STetsuo Handa [TOMOYO_MAX_CONDITION_KEYWORD]; 10673ddf17f0STetsuo Handa extern const char * const tomoyo_dif[TOMOYO_MAX_DOMAIN_INFO_FLAGS]; 10683ddf17f0STetsuo Handa extern const char * const tomoyo_mac_keywords[TOMOYO_MAX_MAC_INDEX 10693ddf17f0STetsuo Handa + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 10703ddf17f0STetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 10712c47ab93STetsuo Handa extern const char * const tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 1072059d84dbSTetsuo Handa extern const char * const tomoyo_proto_keyword[TOMOYO_SOCK_MAX]; 1073059d84dbSTetsuo Handa extern const char * const tomoyo_socket_keyword[TOMOYO_MAX_NETWORK_OPERATION]; 10742c47ab93STetsuo Handa extern const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX]; 10753ddf17f0STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 10760d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 10770d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 10782066a361STetsuo Handa extern struct list_head tomoyo_condition_list; 10793ddf17f0STetsuo Handa extern struct list_head tomoyo_domain_list; 10803ddf17f0STetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 10813ddf17f0STetsuo Handa extern struct list_head tomoyo_namespace_list; 10823ddf17f0STetsuo Handa extern struct mutex tomoyo_policy_lock; 10833ddf17f0STetsuo Handa extern struct srcu_struct tomoyo_ss; 10843ddf17f0STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 10853ddf17f0STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 1086eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 1087eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 108817fcfbd9STetsuo Handa 108976bb0895STetsuo Handa /********** Inlined functions. **********/ 109076bb0895STetsuo Handa 1091b5bc60b4STetsuo Handa /** 1092b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 1093b5bc60b4STetsuo Handa * 1094b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 1095b5bc60b4STetsuo Handa */ 109676bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 109776bb0895STetsuo Handa { 109876bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 109976bb0895STetsuo Handa } 110076bb0895STetsuo Handa 1101b5bc60b4STetsuo Handa /** 1102b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 1103b5bc60b4STetsuo Handa * 1104b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 1105b5bc60b4STetsuo Handa * 1106b5bc60b4STetsuo Handa * Returns nothing. 1107b5bc60b4STetsuo Handa */ 110876bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 110976bb0895STetsuo Handa { 111076bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 111176bb0895STetsuo Handa } 111276bb0895STetsuo Handa 1113b5bc60b4STetsuo Handa /** 11142066a361STetsuo Handa * tomoyo_sys_getppid - Copy of getppid(). 11152066a361STetsuo Handa * 11162066a361STetsuo Handa * Returns parent process's PID. 11172066a361STetsuo Handa * 11182066a361STetsuo Handa * Alpha does not have getppid() defined. To be able to build this module on 11192066a361STetsuo Handa * Alpha, I have to copy getppid() from kernel/timer.c. 11202066a361STetsuo Handa */ 11212066a361STetsuo Handa static inline pid_t tomoyo_sys_getppid(void) 11222066a361STetsuo Handa { 11232066a361STetsuo Handa pid_t pid; 11242066a361STetsuo Handa rcu_read_lock(); 1125bb80d880SKees Cook pid = task_tgid_vnr(rcu_dereference(current->real_parent)); 11262066a361STetsuo Handa rcu_read_unlock(); 11272066a361STetsuo Handa return pid; 11282066a361STetsuo Handa } 11292066a361STetsuo Handa 11302066a361STetsuo Handa /** 11312066a361STetsuo Handa * tomoyo_sys_getpid - Copy of getpid(). 11322066a361STetsuo Handa * 11332066a361STetsuo Handa * Returns current thread's PID. 11342066a361STetsuo Handa * 11352066a361STetsuo Handa * Alpha does not have getpid() defined. To be able to build this module on 11362066a361STetsuo Handa * Alpha, I have to copy getpid() from kernel/timer.c. 11372066a361STetsuo Handa */ 11382066a361STetsuo Handa static inline pid_t tomoyo_sys_getpid(void) 11392066a361STetsuo Handa { 11402066a361STetsuo Handa return task_tgid_vnr(current); 11412066a361STetsuo Handa } 11422066a361STetsuo Handa 11432066a361STetsuo Handa /** 1144b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 1145b5bc60b4STetsuo Handa * 1146b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 1147b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 1148b5bc60b4STetsuo Handa * 1149b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1150b5bc60b4STetsuo Handa */ 11519590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 11529590837bSKentaro Takeda const struct tomoyo_path_info *b) 11539590837bSKentaro Takeda { 11549590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 11559590837bSKentaro Takeda } 11569590837bSKentaro Takeda 11579590837bSKentaro Takeda /** 1158b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 1159b5bc60b4STetsuo Handa * 1160b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 1161b5bc60b4STetsuo Handa * 1162b5bc60b4STetsuo Handa * Returns nothing. 1163b5bc60b4STetsuo Handa */ 116476bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 116576bb0895STetsuo Handa { 116676bb0895STetsuo Handa if (name) { 1167e2bf6907STetsuo Handa struct tomoyo_name *ptr = 1168e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 11690df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 117076bb0895STetsuo Handa } 117176bb0895STetsuo Handa } 11729590837bSKentaro Takeda 1173b5bc60b4STetsuo Handa /** 11742066a361STetsuo Handa * tomoyo_put_condition - Drop reference on "struct tomoyo_condition". 11752066a361STetsuo Handa * 11762066a361STetsuo Handa * @cond: Pointer to "struct tomoyo_condition". Maybe NULL. 11772066a361STetsuo Handa * 11782066a361STetsuo Handa * Returns nothing. 11792066a361STetsuo Handa */ 11802066a361STetsuo Handa static inline void tomoyo_put_condition(struct tomoyo_condition *cond) 11812066a361STetsuo Handa { 11822066a361STetsuo Handa if (cond) 11832066a361STetsuo Handa atomic_dec(&cond->head.users); 11842066a361STetsuo Handa } 11852066a361STetsuo Handa 11862066a361STetsuo Handa /** 1187b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 1188b5bc60b4STetsuo Handa * 1189b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 1190b5bc60b4STetsuo Handa * 1191b5bc60b4STetsuo Handa * Returns nothing. 1192b5bc60b4STetsuo Handa */ 1193a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 11944c3e9e2dSTetsuo Handa { 11954c3e9e2dSTetsuo Handa if (group) 11960df7e8b8STetsuo Handa atomic_dec(&group->head.users); 11974c3e9e2dSTetsuo Handa } 11984c3e9e2dSTetsuo Handa 1199b5bc60b4STetsuo Handa /** 1200b5bc60b4STetsuo Handa * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 1201b5bc60b4STetsuo Handa * 1202b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_domain_info" for current thread. 1203b5bc60b4STetsuo Handa */ 120476bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 120576bb0895STetsuo Handa { 120676bb0895STetsuo Handa return current_cred()->security; 120776bb0895STetsuo Handa } 12089590837bSKentaro Takeda 1209b5bc60b4STetsuo Handa /** 1210b5bc60b4STetsuo Handa * tomoyo_real_domain - Get "struct tomoyo_domain_info" for specified thread. 1211b5bc60b4STetsuo Handa * 1212b5bc60b4STetsuo Handa * @task: Pointer to "struct task_struct". 1213b5bc60b4STetsuo Handa * 1214b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_security" for specified thread. 1215b5bc60b4STetsuo Handa */ 121676bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 121776bb0895STetsuo Handa *task) 121876bb0895STetsuo Handa { 121976bb0895STetsuo Handa return task_cred_xxx(task, security); 122076bb0895STetsuo Handa } 12219590837bSKentaro Takeda 1222b5bc60b4STetsuo Handa /** 1223b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 1224b5bc60b4STetsuo Handa * 1225b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 1226b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 1227b5bc60b4STetsuo Handa * 1228b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1229b5bc60b4STetsuo Handa */ 123075093152STetsuo Handa static inline bool tomoyo_same_name_union 1231b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 12327762fbffSTetsuo Handa { 12330df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 12347762fbffSTetsuo Handa } 12357762fbffSTetsuo Handa 1236b5bc60b4STetsuo Handa /** 1237b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 1238b5bc60b4STetsuo Handa * 1239b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 1240b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 1241b5bc60b4STetsuo Handa * 1242b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 1243b5bc60b4STetsuo Handa */ 124475093152STetsuo Handa static inline bool tomoyo_same_number_union 1245b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 12464c3e9e2dSTetsuo Handa { 1247b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 12480df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 12490df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 12504c3e9e2dSTetsuo Handa } 12514c3e9e2dSTetsuo Handa 1252bd03a3e4STetsuo Handa /** 1253059d84dbSTetsuo Handa * tomoyo_same_ipaddr_union - Check for duplicated "struct tomoyo_ipaddr_union" entry. 1254059d84dbSTetsuo Handa * 1255059d84dbSTetsuo Handa * @a: Pointer to "struct tomoyo_ipaddr_union". 1256059d84dbSTetsuo Handa * @b: Pointer to "struct tomoyo_ipaddr_union". 1257059d84dbSTetsuo Handa * 1258059d84dbSTetsuo Handa * Returns true if @a == @b, false otherwise. 1259059d84dbSTetsuo Handa */ 1260059d84dbSTetsuo Handa static inline bool tomoyo_same_ipaddr_union 1261059d84dbSTetsuo Handa (const struct tomoyo_ipaddr_union *a, const struct tomoyo_ipaddr_union *b) 1262059d84dbSTetsuo Handa { 1263059d84dbSTetsuo Handa return !memcmp(a->ip, b->ip, sizeof(a->ip)) && a->group == b->group && 1264059d84dbSTetsuo Handa a->is_ipv6 == b->is_ipv6; 1265059d84dbSTetsuo Handa } 1266059d84dbSTetsuo Handa 1267059d84dbSTetsuo Handa /** 1268bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 1269bd03a3e4STetsuo Handa * 1270bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 1271bd03a3e4STetsuo Handa */ 1272bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 1273bd03a3e4STetsuo Handa { 1274bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 1275bd03a3e4STetsuo Handa } 1276bd03a3e4STetsuo Handa 1277eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 1278eadd99ccSTetsuo Handa 1279eadd99ccSTetsuo Handa /** 1280eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1281eadd99ccSTetsuo Handa * 1282eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1283eadd99ccSTetsuo Handa * 1284eadd99ccSTetsuo Handa * Returns @size. 1285eadd99ccSTetsuo Handa * 1286eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 1287eadd99ccSTetsuo Handa */ 1288eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1289eadd99ccSTetsuo Handa { 1290eadd99ccSTetsuo Handa return size; 1291eadd99ccSTetsuo Handa } 1292eadd99ccSTetsuo Handa 1293eadd99ccSTetsuo Handa #else 1294eadd99ccSTetsuo Handa 1295eadd99ccSTetsuo Handa /** 1296eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 1297eadd99ccSTetsuo Handa * 1298eadd99ccSTetsuo Handa * @size: Size to be rounded up. 1299eadd99ccSTetsuo Handa * 1300eadd99ccSTetsuo Handa * Returns rounded size. 1301eadd99ccSTetsuo Handa * 1302eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 1303eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 1304eadd99ccSTetsuo Handa */ 1305eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 1306eadd99ccSTetsuo Handa { 1307eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 1308eadd99ccSTetsuo Handa size_t bsize = 32; 1309eadd99ccSTetsuo Handa #else 1310eadd99ccSTetsuo Handa size_t bsize = 64; 1311eadd99ccSTetsuo Handa #endif 1312eadd99ccSTetsuo Handa if (!size) 1313eadd99ccSTetsuo Handa return 0; 1314eadd99ccSTetsuo Handa while (size > bsize) 1315eadd99ccSTetsuo Handa bsize <<= 1; 1316eadd99ccSTetsuo Handa return bsize; 1317eadd99ccSTetsuo Handa } 1318eadd99ccSTetsuo Handa 1319eadd99ccSTetsuo Handa #endif 1320eadd99ccSTetsuo Handa 13219590837bSKentaro Takeda /** 13229590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 13239590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 13249590837bSKentaro Takeda * @head: the head for your list. 13259590837bSKentaro Takeda */ 1326475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 1327475e6fa3STetsuo Handa if (!pos) \ 1328475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 1329475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 1330fdb8ebb7STetsuo Handa 13319590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 1332