19590837bSKentaro Takeda /* 29590837bSKentaro Takeda * security/tomoyo/common.h 39590837bSKentaro Takeda * 476bb0895STetsuo Handa * Header file for TOMOYO. 59590837bSKentaro Takeda * 676bb0895STetsuo Handa * Copyright (C) 2005-2010 NTT DATA CORPORATION 79590837bSKentaro Takeda */ 89590837bSKentaro Takeda 99590837bSKentaro Takeda #ifndef _SECURITY_TOMOYO_COMMON_H 109590837bSKentaro Takeda #define _SECURITY_TOMOYO_COMMON_H 119590837bSKentaro Takeda 129590837bSKentaro Takeda #include <linux/ctype.h> 139590837bSKentaro Takeda #include <linux/string.h> 149590837bSKentaro Takeda #include <linux/mm.h> 159590837bSKentaro Takeda #include <linux/file.h> 169590837bSKentaro Takeda #include <linux/kmod.h> 179590837bSKentaro Takeda #include <linux/fs.h> 189590837bSKentaro Takeda #include <linux/sched.h> 199590837bSKentaro Takeda #include <linux/namei.h> 209590837bSKentaro Takeda #include <linux/mount.h> 219590837bSKentaro Takeda #include <linux/list.h> 2276bb0895STetsuo Handa #include <linux/cred.h> 2317fcfbd9STetsuo Handa #include <linux/poll.h> 2476bb0895STetsuo Handa struct linux_binprm; 259590837bSKentaro Takeda 2676bb0895STetsuo Handa /********** Constants definitions. **********/ 2776bb0895STetsuo Handa 2876bb0895STetsuo Handa /* 2976bb0895STetsuo Handa * TOMOYO uses this hash only when appending a string into the string 3076bb0895STetsuo Handa * table. Frequency of appending strings is very low. So we don't need 3176bb0895STetsuo Handa * large (e.g. 64k) hash size. 256 will be sufficient. 3276bb0895STetsuo Handa */ 3376bb0895STetsuo Handa #define TOMOYO_HASH_BITS 8 3476bb0895STetsuo Handa #define TOMOYO_MAX_HASH (1u<<TOMOYO_HASH_BITS) 3576bb0895STetsuo Handa 36c8c57e84STetsuo Handa #define TOMOYO_EXEC_TMPSIZE 4096 3776bb0895STetsuo Handa 3876bb0895STetsuo Handa /* Profile number is an integer between 0 and 255. */ 3976bb0895STetsuo Handa #define TOMOYO_MAX_PROFILES 256 4076bb0895STetsuo Handa 4132997144STetsuo Handa /* Group number is an integer between 0 and 255. */ 4232997144STetsuo Handa #define TOMOYO_MAX_ACL_GROUPS 256 4332997144STetsuo Handa 44b5bc60b4STetsuo Handa /* Index numbers for operation mode. */ 45cb0abe6aSTetsuo Handa enum tomoyo_mode_index { 46cb0abe6aSTetsuo Handa TOMOYO_CONFIG_DISABLED, 47cb0abe6aSTetsuo Handa TOMOYO_CONFIG_LEARNING, 48cb0abe6aSTetsuo Handa TOMOYO_CONFIG_PERMISSIVE, 4957c2590fSTetsuo Handa TOMOYO_CONFIG_ENFORCING, 50eadd99ccSTetsuo Handa TOMOYO_CONFIG_MAX_MODE, 51eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_REJECT_LOG = 64, 52eadd99ccSTetsuo Handa TOMOYO_CONFIG_WANT_GRANT_LOG = 128, 53eadd99ccSTetsuo Handa TOMOYO_CONFIG_USE_DEFAULT = 255, 54cb0abe6aSTetsuo Handa }; 55cb0abe6aSTetsuo Handa 56b5bc60b4STetsuo Handa /* Index numbers for entry type. */ 57a230f9e7STetsuo Handa enum tomoyo_policy_id { 58a230f9e7STetsuo Handa TOMOYO_ID_GROUP, 59a230f9e7STetsuo Handa TOMOYO_ID_PATH_GROUP, 60a230f9e7STetsuo Handa TOMOYO_ID_NUMBER_GROUP, 615448ec4fSTetsuo Handa TOMOYO_ID_TRANSITION_CONTROL, 62a230f9e7STetsuo Handa TOMOYO_ID_AGGREGATOR, 63a230f9e7STetsuo Handa TOMOYO_ID_MANAGER, 64a230f9e7STetsuo Handa TOMOYO_ID_NAME, 65a230f9e7STetsuo Handa TOMOYO_ID_ACL, 66a230f9e7STetsuo Handa TOMOYO_ID_DOMAIN, 67a230f9e7STetsuo Handa TOMOYO_MAX_POLICY 68a230f9e7STetsuo Handa }; 69a230f9e7STetsuo Handa 70b5bc60b4STetsuo Handa /* Index numbers for group entries. */ 71a230f9e7STetsuo Handa enum tomoyo_group_id { 72a230f9e7STetsuo Handa TOMOYO_PATH_GROUP, 73a230f9e7STetsuo Handa TOMOYO_NUMBER_GROUP, 74a230f9e7STetsuo Handa TOMOYO_MAX_GROUP 75a230f9e7STetsuo Handa }; 76a230f9e7STetsuo Handa 77b5bc60b4STetsuo Handa /* Index numbers for type of numeric values. */ 78b5bc60b4STetsuo Handa enum tomoyo_value_type { 79b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_INVALID, 80b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_DECIMAL, 81b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_OCTAL, 82b5bc60b4STetsuo Handa TOMOYO_VALUE_TYPE_HEXADECIMAL, 83b5bc60b4STetsuo Handa }; 844c3e9e2dSTetsuo Handa 85b5bc60b4STetsuo Handa /* Index numbers for domain transition control keywords. */ 865448ec4fSTetsuo Handa enum tomoyo_transition_type { 875448ec4fSTetsuo Handa /* Do not change this order, */ 88bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_RESET, 89bd03a3e4STetsuo Handa TOMOYO_TRANSITION_CONTROL_RESET, 905448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_INITIALIZE, 915448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_INITIALIZE, 925448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_NO_KEEP, 935448ec4fSTetsuo Handa TOMOYO_TRANSITION_CONTROL_KEEP, 945448ec4fSTetsuo Handa TOMOYO_MAX_TRANSITION_TYPE 955448ec4fSTetsuo Handa }; 965448ec4fSTetsuo Handa 9776bb0895STetsuo Handa /* Index numbers for Access Controls. */ 98084da356STetsuo Handa enum tomoyo_acl_entry_type_index { 997ef61233STetsuo Handa TOMOYO_TYPE_PATH_ACL, 1007ef61233STetsuo Handa TOMOYO_TYPE_PATH2_ACL, 101a1f9bb6aSTetsuo Handa TOMOYO_TYPE_PATH_NUMBER_ACL, 10275093152STetsuo Handa TOMOYO_TYPE_MKDEV_ACL, 1032106ccd9STetsuo Handa TOMOYO_TYPE_MOUNT_ACL, 104084da356STetsuo Handa }; 10576bb0895STetsuo Handa 106b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname. */ 107084da356STetsuo Handa enum tomoyo_path_acl_index { 1087ef61233STetsuo Handa TOMOYO_TYPE_EXECUTE, 1097ef61233STetsuo Handa TOMOYO_TYPE_READ, 1107ef61233STetsuo Handa TOMOYO_TYPE_WRITE, 1117c75964fSTetsuo Handa TOMOYO_TYPE_APPEND, 1127ef61233STetsuo Handa TOMOYO_TYPE_UNLINK, 1137c75964fSTetsuo Handa TOMOYO_TYPE_GETATTR, 1147ef61233STetsuo Handa TOMOYO_TYPE_RMDIR, 1157ef61233STetsuo Handa TOMOYO_TYPE_TRUNCATE, 1167ef61233STetsuo Handa TOMOYO_TYPE_SYMLINK, 1177ef61233STetsuo Handa TOMOYO_TYPE_CHROOT, 1187ef61233STetsuo Handa TOMOYO_TYPE_UMOUNT, 1197ef61233STetsuo Handa TOMOYO_MAX_PATH_OPERATION 120084da356STetsuo Handa }; 12176bb0895STetsuo Handa 122eadd99ccSTetsuo Handa enum tomoyo_memory_stat_type { 123eadd99ccSTetsuo Handa TOMOYO_MEMORY_POLICY, 124eadd99ccSTetsuo Handa TOMOYO_MEMORY_AUDIT, 125eadd99ccSTetsuo Handa TOMOYO_MEMORY_QUERY, 126eadd99ccSTetsuo Handa TOMOYO_MAX_MEMORY_STAT 127eadd99ccSTetsuo Handa }; 128eadd99ccSTetsuo Handa 12975093152STetsuo Handa enum tomoyo_mkdev_acl_index { 130a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKBLOCK, 131a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKCHAR, 13275093152STetsuo Handa TOMOYO_MAX_MKDEV_OPERATION 133a1f9bb6aSTetsuo Handa }; 134a1f9bb6aSTetsuo Handa 135b5bc60b4STetsuo Handa /* Index numbers for access controls with two pathnames. */ 136084da356STetsuo Handa enum tomoyo_path2_acl_index { 1377ef61233STetsuo Handa TOMOYO_TYPE_LINK, 1387ef61233STetsuo Handa TOMOYO_TYPE_RENAME, 1397ef61233STetsuo Handa TOMOYO_TYPE_PIVOT_ROOT, 1407ef61233STetsuo Handa TOMOYO_MAX_PATH2_OPERATION 141084da356STetsuo Handa }; 14276bb0895STetsuo Handa 143b5bc60b4STetsuo Handa /* Index numbers for access controls with one pathname and one number. */ 144a1f9bb6aSTetsuo Handa enum tomoyo_path_number_acl_index { 145a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CREATE, 146a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKDIR, 147a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKFIFO, 148a1f9bb6aSTetsuo Handa TOMOYO_TYPE_MKSOCK, 149a1f9bb6aSTetsuo Handa TOMOYO_TYPE_IOCTL, 150a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHMOD, 151a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHOWN, 152a1f9bb6aSTetsuo Handa TOMOYO_TYPE_CHGRP, 153a1f9bb6aSTetsuo Handa TOMOYO_MAX_PATH_NUMBER_OPERATION 154a1f9bb6aSTetsuo Handa }; 155a1f9bb6aSTetsuo Handa 156b5bc60b4STetsuo Handa /* Index numbers for /sys/kernel/security/tomoyo/ interfaces. */ 157084da356STetsuo Handa enum tomoyo_securityfs_interface_index { 158084da356STetsuo Handa TOMOYO_DOMAINPOLICY, 159084da356STetsuo Handa TOMOYO_EXCEPTIONPOLICY, 160084da356STetsuo Handa TOMOYO_DOMAIN_STATUS, 161084da356STetsuo Handa TOMOYO_PROCESS_STATUS, 162084da356STetsuo Handa TOMOYO_MEMINFO, 163084da356STetsuo Handa TOMOYO_SELFDOMAIN, 164eadd99ccSTetsuo Handa TOMOYO_AUDIT, 165084da356STetsuo Handa TOMOYO_VERSION, 166084da356STetsuo Handa TOMOYO_PROFILE, 16717fcfbd9STetsuo Handa TOMOYO_QUERY, 168084da356STetsuo Handa TOMOYO_MANAGER 169084da356STetsuo Handa }; 17076bb0895STetsuo Handa 171b5bc60b4STetsuo Handa /* Index numbers for special mount operations. */ 172b5bc60b4STetsuo Handa enum tomoyo_special_mount { 173b5bc60b4STetsuo Handa TOMOYO_MOUNT_BIND, /* mount --bind /source /dest */ 174b5bc60b4STetsuo Handa TOMOYO_MOUNT_MOVE, /* mount --move /old /new */ 175b5bc60b4STetsuo Handa TOMOYO_MOUNT_REMOUNT, /* mount -o remount /dir */ 176b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_UNBINDABLE, /* mount --make-unbindable /dir */ 177b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_PRIVATE, /* mount --make-private /dir */ 178b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SLAVE, /* mount --make-slave /dir */ 179b5bc60b4STetsuo Handa TOMOYO_MOUNT_MAKE_SHARED, /* mount --make-shared /dir */ 180b5bc60b4STetsuo Handa TOMOYO_MAX_SPECIAL_MOUNT 181b5bc60b4STetsuo Handa }; 182b5bc60b4STetsuo Handa 183b5bc60b4STetsuo Handa /* Index numbers for functionality. */ 18457c2590fSTetsuo Handa enum tomoyo_mac_index { 18557c2590fSTetsuo Handa TOMOYO_MAC_FILE_EXECUTE, 18657c2590fSTetsuo Handa TOMOYO_MAC_FILE_OPEN, 18757c2590fSTetsuo Handa TOMOYO_MAC_FILE_CREATE, 18857c2590fSTetsuo Handa TOMOYO_MAC_FILE_UNLINK, 1897c75964fSTetsuo Handa TOMOYO_MAC_FILE_GETATTR, 19057c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKDIR, 19157c2590fSTetsuo Handa TOMOYO_MAC_FILE_RMDIR, 19257c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKFIFO, 19357c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKSOCK, 19457c2590fSTetsuo Handa TOMOYO_MAC_FILE_TRUNCATE, 19557c2590fSTetsuo Handa TOMOYO_MAC_FILE_SYMLINK, 19657c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKBLOCK, 19757c2590fSTetsuo Handa TOMOYO_MAC_FILE_MKCHAR, 19857c2590fSTetsuo Handa TOMOYO_MAC_FILE_LINK, 19957c2590fSTetsuo Handa TOMOYO_MAC_FILE_RENAME, 20057c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHMOD, 20157c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHOWN, 20257c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHGRP, 20357c2590fSTetsuo Handa TOMOYO_MAC_FILE_IOCTL, 20457c2590fSTetsuo Handa TOMOYO_MAC_FILE_CHROOT, 20557c2590fSTetsuo Handa TOMOYO_MAC_FILE_MOUNT, 20657c2590fSTetsuo Handa TOMOYO_MAC_FILE_UMOUNT, 20757c2590fSTetsuo Handa TOMOYO_MAC_FILE_PIVOT_ROOT, 20857c2590fSTetsuo Handa TOMOYO_MAX_MAC_INDEX 20957c2590fSTetsuo Handa }; 21057c2590fSTetsuo Handa 211b5bc60b4STetsuo Handa /* Index numbers for category of functionality. */ 21257c2590fSTetsuo Handa enum tomoyo_mac_category_index { 21357c2590fSTetsuo Handa TOMOYO_MAC_CATEGORY_FILE, 21457c2590fSTetsuo Handa TOMOYO_MAX_MAC_CATEGORY_INDEX 21557c2590fSTetsuo Handa }; 21657c2590fSTetsuo Handa 217b5bc60b4STetsuo Handa /* 218b5bc60b4STetsuo Handa * Retry this request. Returned by tomoyo_supervisor() if policy violation has 219b5bc60b4STetsuo Handa * occurred in enforcing mode and the userspace daemon decided to retry. 220b5bc60b4STetsuo Handa * 221b5bc60b4STetsuo Handa * We must choose a positive value in order to distinguish "granted" (which is 222b5bc60b4STetsuo Handa * 0) and "rejected" (which is a negative value) and "retry". 223b5bc60b4STetsuo Handa */ 224b5bc60b4STetsuo Handa #define TOMOYO_RETRY_REQUEST 1 22517fcfbd9STetsuo Handa 226d5ca1725STetsuo Handa /* Index numbers for profile's PREFERENCE values. */ 227d5ca1725STetsuo Handa enum tomoyo_pref_index { 228eadd99ccSTetsuo Handa TOMOYO_PREF_MAX_AUDIT_LOG, 229d5ca1725STetsuo Handa TOMOYO_PREF_MAX_LEARNING_ENTRY, 230d5ca1725STetsuo Handa TOMOYO_MAX_PREF 231d5ca1725STetsuo Handa }; 232d5ca1725STetsuo Handa 23376bb0895STetsuo Handa /********** Structure definitions. **********/ 2349590837bSKentaro Takeda 235b5bc60b4STetsuo Handa /* Common header for holding ACL entries. */ 23682e0f001STetsuo Handa struct tomoyo_acl_head { 23782e0f001STetsuo Handa struct list_head list; 23882e0f001STetsuo Handa bool is_deleted; 23982e0f001STetsuo Handa } __packed; 24082e0f001STetsuo Handa 2410df7e8b8STetsuo Handa /* Common header for shared entries. */ 2420df7e8b8STetsuo Handa struct tomoyo_shared_acl_head { 2430df7e8b8STetsuo Handa struct list_head list; 2440df7e8b8STetsuo Handa atomic_t users; 2450df7e8b8STetsuo Handa } __packed; 2460df7e8b8STetsuo Handa 247bd03a3e4STetsuo Handa struct tomoyo_policy_namespace; 248bd03a3e4STetsuo Handa 249b5bc60b4STetsuo Handa /* Structure for request info. */ 250cb0abe6aSTetsuo Handa struct tomoyo_request_info { 251cb0abe6aSTetsuo Handa struct tomoyo_domain_info *domain; 252cf6e9a64STetsuo Handa /* For holding parameters. */ 253cf6e9a64STetsuo Handa union { 254cf6e9a64STetsuo Handa struct { 255cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 256484ca79cSTetsuo Handa /* For using wildcards at tomoyo_find_next_domain(). */ 257484ca79cSTetsuo Handa const struct tomoyo_path_info *matched_path; 258b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path_acl_index". */ 259cf6e9a64STetsuo Handa u8 operation; 260cf6e9a64STetsuo Handa } path; 261cf6e9a64STetsuo Handa struct { 262cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename1; 263cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename2; 264b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_path2_acl_index". */ 265cf6e9a64STetsuo Handa u8 operation; 266cf6e9a64STetsuo Handa } path2; 267cf6e9a64STetsuo Handa struct { 268cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 269cf6e9a64STetsuo Handa unsigned int mode; 270cf6e9a64STetsuo Handa unsigned int major; 271cf6e9a64STetsuo Handa unsigned int minor; 272b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_mkdev_acl_index". */ 273cf6e9a64STetsuo Handa u8 operation; 274cf6e9a64STetsuo Handa } mkdev; 275cf6e9a64STetsuo Handa struct { 276cf6e9a64STetsuo Handa const struct tomoyo_path_info *filename; 277cf6e9a64STetsuo Handa unsigned long number; 278b5bc60b4STetsuo Handa /* 279b5bc60b4STetsuo Handa * One of values in 280b5bc60b4STetsuo Handa * "enum tomoyo_path_number_acl_index". 281b5bc60b4STetsuo Handa */ 282cf6e9a64STetsuo Handa u8 operation; 283cf6e9a64STetsuo Handa } path_number; 284cf6e9a64STetsuo Handa struct { 285cf6e9a64STetsuo Handa const struct tomoyo_path_info *type; 286cf6e9a64STetsuo Handa const struct tomoyo_path_info *dir; 287cf6e9a64STetsuo Handa const struct tomoyo_path_info *dev; 288cf6e9a64STetsuo Handa unsigned long flags; 289cf6e9a64STetsuo Handa int need_dev; 290cf6e9a64STetsuo Handa } mount; 291cf6e9a64STetsuo Handa } param; 292cf6e9a64STetsuo Handa u8 param_type; 293cf6e9a64STetsuo Handa bool granted; 29417fcfbd9STetsuo Handa u8 retry; 29517fcfbd9STetsuo Handa u8 profile; 296cb0abe6aSTetsuo Handa u8 mode; /* One of tomoyo_mode_index . */ 29757c2590fSTetsuo Handa u8 type; 298cb0abe6aSTetsuo Handa }; 299cb0abe6aSTetsuo Handa 300b5bc60b4STetsuo Handa /* Structure for holding a token. */ 3019590837bSKentaro Takeda struct tomoyo_path_info { 3029590837bSKentaro Takeda const char *name; 3039590837bSKentaro Takeda u32 hash; /* = full_name_hash(name, strlen(name)) */ 3049590837bSKentaro Takeda u16 const_len; /* = tomoyo_const_part_length(name) */ 3059590837bSKentaro Takeda bool is_dir; /* = tomoyo_strendswith(name, "/") */ 3069590837bSKentaro Takeda bool is_patterned; /* = tomoyo_path_contains_pattern(name) */ 3079590837bSKentaro Takeda }; 3089590837bSKentaro Takeda 309b5bc60b4STetsuo Handa /* Structure for holding string data. */ 310e2bf6907STetsuo Handa struct tomoyo_name { 3110df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 31276bb0895STetsuo Handa struct tomoyo_path_info entry; 31376bb0895STetsuo Handa }; 3149590837bSKentaro Takeda 315b5bc60b4STetsuo Handa /* Structure for holding a word. */ 3167762fbffSTetsuo Handa struct tomoyo_name_union { 317b5bc60b4STetsuo Handa /* Either @filename or @group is NULL. */ 3187762fbffSTetsuo Handa const struct tomoyo_path_info *filename; 319a98aa4deSTetsuo Handa struct tomoyo_group *group; 3207762fbffSTetsuo Handa }; 3217762fbffSTetsuo Handa 322b5bc60b4STetsuo Handa /* Structure for holding a number. */ 3234c3e9e2dSTetsuo Handa struct tomoyo_number_union { 3244c3e9e2dSTetsuo Handa unsigned long values[2]; 325b5bc60b4STetsuo Handa struct tomoyo_group *group; /* Maybe NULL. */ 326b5bc60b4STetsuo Handa /* One of values in "enum tomoyo_value_type". */ 3270df7e8b8STetsuo Handa u8 value_type[2]; 3284c3e9e2dSTetsuo Handa }; 3294c3e9e2dSTetsuo Handa 330a98aa4deSTetsuo Handa /* Structure for "path_group"/"number_group" directive. */ 331a98aa4deSTetsuo Handa struct tomoyo_group { 3320df7e8b8STetsuo Handa struct tomoyo_shared_acl_head head; 333a98aa4deSTetsuo Handa const struct tomoyo_path_info *group_name; 334a98aa4deSTetsuo Handa struct list_head member_list; 335a98aa4deSTetsuo Handa }; 336a98aa4deSTetsuo Handa 3377762fbffSTetsuo Handa /* Structure for "path_group" directive. */ 3387762fbffSTetsuo Handa struct tomoyo_path_group { 33982e0f001STetsuo Handa struct tomoyo_acl_head head; 3407762fbffSTetsuo Handa const struct tomoyo_path_info *member_name; 3417762fbffSTetsuo Handa }; 3427762fbffSTetsuo Handa 3434c3e9e2dSTetsuo Handa /* Structure for "number_group" directive. */ 344a98aa4deSTetsuo Handa struct tomoyo_number_group { 34582e0f001STetsuo Handa struct tomoyo_acl_head head; 3464c3e9e2dSTetsuo Handa struct tomoyo_number_union number; 3474c3e9e2dSTetsuo Handa }; 3484c3e9e2dSTetsuo Handa 349b5bc60b4STetsuo Handa /* Common header for individual entries. */ 3509590837bSKentaro Takeda struct tomoyo_acl_info { 3519590837bSKentaro Takeda struct list_head list; 352237ab459STetsuo Handa bool is_deleted; 353b5bc60b4STetsuo Handa u8 type; /* One of values in "enum tomoyo_acl_entry_type_index". */ 3549590837bSKentaro Takeda } __packed; 3559590837bSKentaro Takeda 356b5bc60b4STetsuo Handa /* Structure for domain information. */ 3579590837bSKentaro Takeda struct tomoyo_domain_info { 3589590837bSKentaro Takeda struct list_head list; 3599590837bSKentaro Takeda struct list_head acl_info_list; 3609590837bSKentaro Takeda /* Name of this domain. Never NULL. */ 3619590837bSKentaro Takeda const struct tomoyo_path_info *domainname; 362bd03a3e4STetsuo Handa /* Namespace for this domain. Never NULL. */ 363bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 3649590837bSKentaro Takeda u8 profile; /* Profile number to use. */ 36532997144STetsuo Handa u8 group; /* Group number to use. */ 366a0558fc3STetsuo Handa bool is_deleted; /* Delete flag. */ 3679590837bSKentaro Takeda bool quota_warned; /* Quota warnning flag. */ 368ea13ddbaSTetsuo Handa bool transition_failed; /* Domain transition failed flag. */ 369ec8e6a4eSTetsuo Handa atomic_t users; /* Number of referring credentials. */ 3709590837bSKentaro Takeda }; 3719590837bSKentaro Takeda 3729590837bSKentaro Takeda /* 373b5bc60b4STetsuo Handa * Structure for "file execute", "file read", "file write", "file append", 374b5bc60b4STetsuo Handa * "file unlink", "file getattr", "file rmdir", "file truncate", 375b5bc60b4STetsuo Handa * "file symlink", "file chroot" and "file unmount" directive. 3769590837bSKentaro Takeda */ 3777ef61233STetsuo Handa struct tomoyo_path_acl { 3787ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_ACL */ 379b5bc60b4STetsuo Handa u16 perm; /* Bitmask of values in "enum tomoyo_path_acl_index". */ 3807762fbffSTetsuo Handa struct tomoyo_name_union name; 3819590837bSKentaro Takeda }; 3829590837bSKentaro Takeda 383c3fa109aSTetsuo Handa /* 384b5bc60b4STetsuo Handa * Structure for "file create", "file mkdir", "file mkfifo", "file mksock", 385b5bc60b4STetsuo Handa * "file ioctl", "file chmod", "file chown" and "file chgrp" directive. 386a1f9bb6aSTetsuo Handa */ 387a1f9bb6aSTetsuo Handa struct tomoyo_path_number_acl { 388a1f9bb6aSTetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH_NUMBER_ACL */ 389b5bc60b4STetsuo Handa /* Bitmask of values in "enum tomoyo_path_number_acl_index". */ 390a1f9bb6aSTetsuo Handa u8 perm; 391a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 392a1f9bb6aSTetsuo Handa struct tomoyo_number_union number; 393a1f9bb6aSTetsuo Handa }; 394a1f9bb6aSTetsuo Handa 395b5bc60b4STetsuo Handa /* Structure for "file mkblock" and "file mkchar" directive. */ 39675093152STetsuo Handa struct tomoyo_mkdev_acl { 39775093152STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MKDEV_ACL */ 398b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_mkdev_acl_index". */ 399a1f9bb6aSTetsuo Handa struct tomoyo_name_union name; 400a1f9bb6aSTetsuo Handa struct tomoyo_number_union mode; 401a1f9bb6aSTetsuo Handa struct tomoyo_number_union major; 402a1f9bb6aSTetsuo Handa struct tomoyo_number_union minor; 403a1f9bb6aSTetsuo Handa }; 404a1f9bb6aSTetsuo Handa 405a1f9bb6aSTetsuo Handa /* 406b5bc60b4STetsuo Handa * Structure for "file rename", "file link" and "file pivot_root" directive. 407c3fa109aSTetsuo Handa */ 4087ef61233STetsuo Handa struct tomoyo_path2_acl { 4097ef61233STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_PATH2_ACL */ 410b5bc60b4STetsuo Handa u8 perm; /* Bitmask of values in "enum tomoyo_path2_acl_index". */ 4117762fbffSTetsuo Handa struct tomoyo_name_union name1; 4127762fbffSTetsuo Handa struct tomoyo_name_union name2; 4139590837bSKentaro Takeda }; 4149590837bSKentaro Takeda 415b5bc60b4STetsuo Handa /* Structure for "file mount" directive. */ 4162106ccd9STetsuo Handa struct tomoyo_mount_acl { 4172106ccd9STetsuo Handa struct tomoyo_acl_info head; /* type = TOMOYO_TYPE_MOUNT_ACL */ 4182106ccd9STetsuo Handa struct tomoyo_name_union dev_name; 4192106ccd9STetsuo Handa struct tomoyo_name_union dir_name; 4202106ccd9STetsuo Handa struct tomoyo_name_union fs_type; 4212106ccd9STetsuo Handa struct tomoyo_number_union flags; 4222106ccd9STetsuo Handa }; 4232106ccd9STetsuo Handa 424a238cf5bSTetsuo Handa /* Structure for holding a line from /sys/kernel/security/tomoyo/ interface. */ 425a238cf5bSTetsuo Handa struct tomoyo_acl_param { 426a238cf5bSTetsuo Handa char *data; 427a238cf5bSTetsuo Handa struct list_head *list; 428bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 429a238cf5bSTetsuo Handa bool is_delete; 430a238cf5bSTetsuo Handa }; 431a238cf5bSTetsuo Handa 4320d2171d7STetsuo Handa #define TOMOYO_MAX_IO_READ_QUEUE 64 433f23571e8STetsuo Handa 4342106ccd9STetsuo Handa /* 435f23571e8STetsuo Handa * Structure for reading/writing policy via /sys/kernel/security/tomoyo 436f23571e8STetsuo Handa * interfaces. 437c3fa109aSTetsuo Handa */ 4389590837bSKentaro Takeda struct tomoyo_io_buffer { 4398fbe71f0STetsuo Handa void (*read) (struct tomoyo_io_buffer *); 4409590837bSKentaro Takeda int (*write) (struct tomoyo_io_buffer *); 44117fcfbd9STetsuo Handa int (*poll) (struct file *file, poll_table *wait); 4429590837bSKentaro Takeda /* Exclusive lock for this structure. */ 4439590837bSKentaro Takeda struct mutex io_sem; 444fdb8ebb7STetsuo Handa /* Index returned by tomoyo_read_lock(). */ 445fdb8ebb7STetsuo Handa int reader_idx; 446f23571e8STetsuo Handa char __user *read_user_buf; 447f23571e8STetsuo Handa int read_user_buf_avail; 448f23571e8STetsuo Handa struct { 449bd03a3e4STetsuo Handa struct list_head *ns; 450f23571e8STetsuo Handa struct list_head *domain; 451f23571e8STetsuo Handa struct list_head *group; 452f23571e8STetsuo Handa struct list_head *acl; 453f23571e8STetsuo Handa int avail; 454f23571e8STetsuo Handa int step; 455f23571e8STetsuo Handa int query_index; 456f23571e8STetsuo Handa u16 index; 45732997144STetsuo Handa u8 acl_group_index; 458f23571e8STetsuo Handa u8 bit; 459f23571e8STetsuo Handa u8 w_pos; 460f23571e8STetsuo Handa bool eof; 461f23571e8STetsuo Handa bool print_this_domain_only; 462bd03a3e4STetsuo Handa bool print_transition_related_only; 463f23571e8STetsuo Handa const char *w[TOMOYO_MAX_IO_READ_QUEUE]; 464f23571e8STetsuo Handa } r; 4650df7e8b8STetsuo Handa struct { 466bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *ns; 4679590837bSKentaro Takeda /* The position currently writing to. */ 4680df7e8b8STetsuo Handa struct tomoyo_domain_info *domain; 4690df7e8b8STetsuo Handa /* Bytes available for writing. */ 4700df7e8b8STetsuo Handa int avail; 471bd03a3e4STetsuo Handa bool is_delete; 4720df7e8b8STetsuo Handa } w; 4739590837bSKentaro Takeda /* Buffer for reading. */ 4749590837bSKentaro Takeda char *read_buf; 4759590837bSKentaro Takeda /* Size of read buffer. */ 4769590837bSKentaro Takeda int readbuf_size; 4779590837bSKentaro Takeda /* Buffer for writing. */ 4789590837bSKentaro Takeda char *write_buf; 4799590837bSKentaro Takeda /* Size of write buffer. */ 4809590837bSKentaro Takeda int writebuf_size; 48117fcfbd9STetsuo Handa /* Type of this interface. */ 48217fcfbd9STetsuo Handa u8 type; 4839590837bSKentaro Takeda }; 4849590837bSKentaro Takeda 48576bb0895STetsuo Handa /* 486b5bc60b4STetsuo Handa * Structure for "initialize_domain"/"no_initialize_domain"/"keep_domain"/ 487b5bc60b4STetsuo Handa * "no_keep_domain" keyword. 48876bb0895STetsuo Handa */ 4895448ec4fSTetsuo Handa struct tomoyo_transition_control { 49082e0f001STetsuo Handa struct tomoyo_acl_head head; 4915448ec4fSTetsuo Handa u8 type; /* One of values in "enum tomoyo_transition_type". */ 49276bb0895STetsuo Handa /* True if the domainname is tomoyo_get_last_name(). */ 49376bb0895STetsuo Handa bool is_last_name; 4945448ec4fSTetsuo Handa const struct tomoyo_path_info *domainname; /* Maybe NULL */ 4955448ec4fSTetsuo Handa const struct tomoyo_path_info *program; /* Maybe NULL */ 49676bb0895STetsuo Handa }; 49776bb0895STetsuo Handa 498b5bc60b4STetsuo Handa /* Structure for "aggregator" keyword. */ 499e2bf6907STetsuo Handa struct tomoyo_aggregator { 50082e0f001STetsuo Handa struct tomoyo_acl_head head; 5011084307cSTetsuo Handa const struct tomoyo_path_info *original_name; 5021084307cSTetsuo Handa const struct tomoyo_path_info *aggregated_name; 5031084307cSTetsuo Handa }; 5041084307cSTetsuo Handa 505b5bc60b4STetsuo Handa /* Structure for policy manager. */ 506e2bf6907STetsuo Handa struct tomoyo_manager { 50782e0f001STetsuo Handa struct tomoyo_acl_head head; 50882e0f001STetsuo Handa bool is_domain; /* True if manager is a domainname. */ 50976bb0895STetsuo Handa /* A path to program or a domainname. */ 51076bb0895STetsuo Handa const struct tomoyo_path_info *manager; 51176bb0895STetsuo Handa }; 51276bb0895STetsuo Handa 51357c2590fSTetsuo Handa struct tomoyo_preference { 51457c2590fSTetsuo Handa unsigned int learning_max_entry; 51557c2590fSTetsuo Handa bool enforcing_verbose; 51657c2590fSTetsuo Handa bool learning_verbose; 51757c2590fSTetsuo Handa bool permissive_verbose; 51857c2590fSTetsuo Handa }; 51957c2590fSTetsuo Handa 520b5bc60b4STetsuo Handa /* Structure for /sys/kernel/security/tomnoyo/profile interface. */ 52157c2590fSTetsuo Handa struct tomoyo_profile { 52257c2590fSTetsuo Handa const struct tomoyo_path_info *comment; 52357c2590fSTetsuo Handa struct tomoyo_preference *learning; 52457c2590fSTetsuo Handa struct tomoyo_preference *permissive; 52557c2590fSTetsuo Handa struct tomoyo_preference *enforcing; 52657c2590fSTetsuo Handa struct tomoyo_preference preference; 52757c2590fSTetsuo Handa u8 default_config; 52857c2590fSTetsuo Handa u8 config[TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX]; 529d5ca1725STetsuo Handa unsigned int pref[TOMOYO_MAX_PREF]; 53057c2590fSTetsuo Handa }; 53157c2590fSTetsuo Handa 532eadd99ccSTetsuo Handa /* Structure for representing YYYY/MM/DD hh/mm/ss. */ 533eadd99ccSTetsuo Handa struct tomoyo_time { 534eadd99ccSTetsuo Handa u16 year; 535eadd99ccSTetsuo Handa u8 month; 536eadd99ccSTetsuo Handa u8 day; 537eadd99ccSTetsuo Handa u8 hour; 538eadd99ccSTetsuo Handa u8 min; 539eadd99ccSTetsuo Handa u8 sec; 540eadd99ccSTetsuo Handa }; 541eadd99ccSTetsuo Handa 542bd03a3e4STetsuo Handa /* Structure for policy namespace. */ 543bd03a3e4STetsuo Handa struct tomoyo_policy_namespace { 544bd03a3e4STetsuo Handa /* Profile table. Memory is allocated as needed. */ 545bd03a3e4STetsuo Handa struct tomoyo_profile *profile_ptr[TOMOYO_MAX_PROFILES]; 546bd03a3e4STetsuo Handa /* List of "struct tomoyo_group". */ 547bd03a3e4STetsuo Handa struct list_head group_list[TOMOYO_MAX_GROUP]; 548bd03a3e4STetsuo Handa /* List of policy. */ 549bd03a3e4STetsuo Handa struct list_head policy_list[TOMOYO_MAX_POLICY]; 550bd03a3e4STetsuo Handa /* The global ACL referred by "use_group" keyword. */ 551bd03a3e4STetsuo Handa struct list_head acl_group[TOMOYO_MAX_ACL_GROUPS]; 552bd03a3e4STetsuo Handa /* List for connecting to tomoyo_namespace_list list. */ 553bd03a3e4STetsuo Handa struct list_head namespace_list; 554bd03a3e4STetsuo Handa /* Profile version. Currently only 20100903 is defined. */ 555bd03a3e4STetsuo Handa unsigned int profile_version; 556bd03a3e4STetsuo Handa /* Name of this namespace (e.g. "<kernel>", "</usr/sbin/httpd>" ). */ 557bd03a3e4STetsuo Handa const char *name; 558bd03a3e4STetsuo Handa }; 559bd03a3e4STetsuo Handa 56076bb0895STetsuo Handa /********** Function prototypes. **********/ 56176bb0895STetsuo Handa 562bd03a3e4STetsuo Handa void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns); 563c3ef1500STetsuo Handa bool tomoyo_str_starts(char **src, const char *find); 564c3ef1500STetsuo Handa const char *tomoyo_get_exe(void); 565c3ef1500STetsuo Handa void tomoyo_normalize_line(unsigned char *buffer); 566c3ef1500STetsuo Handa void tomoyo_check_profile(void); 567c3ef1500STetsuo Handa int tomoyo_open_control(const u8 type, struct file *file); 5680df7e8b8STetsuo Handa int tomoyo_close_control(struct tomoyo_io_buffer *head); 5690849e3baSTetsuo Handa int tomoyo_poll_control(struct file *file, poll_table *wait); 5700df7e8b8STetsuo Handa int tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer, 571c3ef1500STetsuo Handa const int buffer_len); 5720df7e8b8STetsuo Handa int tomoyo_write_control(struct tomoyo_io_buffer *head, 5730df7e8b8STetsuo Handa const char __user *buffer, const int buffer_len); 574c3ef1500STetsuo Handa bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r); 575c3ef1500STetsuo Handa void tomoyo_warn_oom(const char *function); 576484ca79cSTetsuo Handa const struct tomoyo_path_info * 577484ca79cSTetsuo Handa tomoyo_compare_name_union(const struct tomoyo_path_info *name, 5787762fbffSTetsuo Handa const struct tomoyo_name_union *ptr); 5792106ccd9STetsuo Handa bool tomoyo_compare_number_union(const unsigned long value, 5802106ccd9STetsuo Handa const struct tomoyo_number_union *ptr); 581bd03a3e4STetsuo Handa int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile, 582bd03a3e4STetsuo Handa const u8 index); 583f23571e8STetsuo Handa void tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...) 5849590837bSKentaro Takeda __attribute__ ((format(printf, 2, 3))); 58575093152STetsuo Handa bool tomoyo_correct_domain(const unsigned char *domainname); 58675093152STetsuo Handa bool tomoyo_correct_path(const char *filename); 58775093152STetsuo Handa bool tomoyo_correct_word(const char *string); 58875093152STetsuo Handa bool tomoyo_domain_def(const unsigned char *buffer); 589a238cf5bSTetsuo Handa bool tomoyo_parse_name_union(struct tomoyo_acl_param *param, 5907762fbffSTetsuo Handa struct tomoyo_name_union *ptr); 591484ca79cSTetsuo Handa const struct tomoyo_path_info * 592484ca79cSTetsuo Handa tomoyo_path_matches_group(const struct tomoyo_path_info *pathname, 593a98aa4deSTetsuo Handa const struct tomoyo_group *group); 5944c3e9e2dSTetsuo Handa bool tomoyo_number_matches_group(const unsigned long min, 5954c3e9e2dSTetsuo Handa const unsigned long max, 596a98aa4deSTetsuo Handa const struct tomoyo_group *group); 5979590837bSKentaro Takeda bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename, 5989590837bSKentaro Takeda const struct tomoyo_path_info *pattern); 599a238cf5bSTetsuo Handa bool tomoyo_parse_number_union(struct tomoyo_acl_param *param, 600a238cf5bSTetsuo Handa struct tomoyo_number_union *ptr); 6017762fbffSTetsuo Handa bool tomoyo_tokenize(char *buffer, char *w[], size_t size); 6029590837bSKentaro Takeda bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain); 6032106ccd9STetsuo Handa int tomoyo_init_request_info(struct tomoyo_request_info *r, 60457c2590fSTetsuo Handa struct tomoyo_domain_info *domain, 60557c2590fSTetsuo Handa const u8 index); 606b5bc60b4STetsuo Handa int tomoyo_mount_permission(char *dev_name, struct path *path, 607b5bc60b4STetsuo Handa const char *type, unsigned long flags, 608b5bc60b4STetsuo Handa void *data_page); 609a238cf5bSTetsuo Handa int tomoyo_write_aggregator(struct tomoyo_acl_param *param); 610a238cf5bSTetsuo Handa int tomoyo_write_transition_control(struct tomoyo_acl_param *param, 6115448ec4fSTetsuo Handa const u8 type); 612a238cf5bSTetsuo Handa int tomoyo_write_file(struct tomoyo_acl_param *param); 613a238cf5bSTetsuo Handa int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type); 61417fcfbd9STetsuo Handa int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...) 61517fcfbd9STetsuo Handa __attribute__ ((format(printf, 2, 3))); 6169590837bSKentaro Takeda struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname); 617e2bf6907STetsuo Handa struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname, 618bd03a3e4STetsuo Handa const bool transit); 619bd03a3e4STetsuo Handa struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns, 6209590837bSKentaro Takeda const u8 profile); 621bd03a3e4STetsuo Handa struct tomoyo_policy_namespace *tomoyo_assign_namespace 622bd03a3e4STetsuo Handa (const char *domainname); 623a238cf5bSTetsuo Handa struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param, 624a238cf5bSTetsuo Handa const u8 idx); 6259590837bSKentaro Takeda unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain, 6269590837bSKentaro Takeda const u8 index); 6279590837bSKentaro Takeda void tomoyo_fill_path_info(struct tomoyo_path_info *ptr); 6289590837bSKentaro Takeda void tomoyo_load_policy(const char *filename); 6294c3e9e2dSTetsuo Handa void tomoyo_put_number_union(struct tomoyo_number_union *ptr); 630c8c57e84STetsuo Handa char *tomoyo_encode(const char *str); 63176bb0895STetsuo Handa char *tomoyo_realpath_nofollow(const char *pathname); 63276bb0895STetsuo Handa char *tomoyo_realpath_from_path(struct path *path); 63376bb0895STetsuo Handa bool tomoyo_memory_ok(void *ptr); 6349e4b50e9STetsuo Handa void *tomoyo_commit_ok(void *data, const unsigned int size); 63576bb0895STetsuo Handa const struct tomoyo_path_info *tomoyo_get_name(const char *name); 6368fbe71f0STetsuo Handa void tomoyo_read_memory_counter(struct tomoyo_io_buffer *head); 63776bb0895STetsuo Handa int tomoyo_write_memory_quota(struct tomoyo_io_buffer *head); 638c3ef1500STetsuo Handa void __init tomoyo_mm_init(void); 63905336deeSTetsuo Handa int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation, 64076bb0895STetsuo Handa const struct tomoyo_path_info *filename); 64176bb0895STetsuo Handa int tomoyo_check_open_permission(struct tomoyo_domain_info *domain, 64276bb0895STetsuo Handa struct path *path, const int flag); 643a1f9bb6aSTetsuo Handa int tomoyo_path_number_perm(const u8 operation, struct path *path, 644a1f9bb6aSTetsuo Handa unsigned long number); 64575093152STetsuo Handa int tomoyo_mkdev_perm(const u8 operation, struct path *path, 646a1f9bb6aSTetsuo Handa const unsigned int mode, unsigned int dev); 64797d6931eSTetsuo Handa int tomoyo_path_perm(const u8 operation, struct path *path); 64897d6931eSTetsuo Handa int tomoyo_path2_perm(const u8 operation, struct path *path1, 64997d6931eSTetsuo Handa struct path *path2); 65076bb0895STetsuo Handa int tomoyo_find_next_domain(struct linux_binprm *bprm); 651a1f9bb6aSTetsuo Handa void tomoyo_print_ulong(char *buffer, const int buffer_len, 652a1f9bb6aSTetsuo Handa const unsigned long value, const u8 type); 6537762fbffSTetsuo Handa void tomoyo_put_name_union(struct tomoyo_name_union *ptr); 654847b173eSTetsuo Handa void tomoyo_run_gc(void); 655847b173eSTetsuo Handa void tomoyo_memory_free(void *ptr); 656237ab459STetsuo Handa int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 657a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 658237ab459STetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_info 659237ab459STetsuo Handa *, 660237ab459STetsuo Handa const struct tomoyo_acl_info 661237ab459STetsuo Handa *), 662237ab459STetsuo Handa bool (*merge_duplicate) (struct tomoyo_acl_info *, 663237ab459STetsuo Handa struct tomoyo_acl_info *, 664237ab459STetsuo Handa const bool)); 66536f5e1ffSTetsuo Handa int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 666a238cf5bSTetsuo Handa struct tomoyo_acl_param *param, 66736f5e1ffSTetsuo Handa bool (*check_duplicate) (const struct tomoyo_acl_head 66836f5e1ffSTetsuo Handa *, 66936f5e1ffSTetsuo Handa const struct tomoyo_acl_head 67036f5e1ffSTetsuo Handa *)); 67199a85259STetsuo Handa void tomoyo_check_acl(struct tomoyo_request_info *r, 672484ca79cSTetsuo Handa bool (*check_entry) (struct tomoyo_request_info *, 67399a85259STetsuo Handa const struct tomoyo_acl_info *)); 674a238cf5bSTetsuo Handa char *tomoyo_read_token(struct tomoyo_acl_param *param); 675a238cf5bSTetsuo Handa bool tomoyo_permstr(const char *string, const char *keyword); 676237ab459STetsuo Handa 677eadd99ccSTetsuo Handa const char *tomoyo_yesno(const unsigned int value); 678bd03a3e4STetsuo Handa void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...) 679bd03a3e4STetsuo Handa __attribute__ ((format(printf, 2, 3))); 680eadd99ccSTetsuo Handa void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt, 681eadd99ccSTetsuo Handa va_list args); 682eadd99ccSTetsuo Handa void tomoyo_read_log(struct tomoyo_io_buffer *head); 683eadd99ccSTetsuo Handa int tomoyo_poll_log(struct file *file, poll_table *wait); 684eadd99ccSTetsuo Handa char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt, 685eadd99ccSTetsuo Handa va_list args); 686eadd99ccSTetsuo Handa 68776bb0895STetsuo Handa /********** External variable definitions. **********/ 68876bb0895STetsuo Handa 68976bb0895STetsuo Handa /* Lock for GC. */ 69076bb0895STetsuo Handa extern struct srcu_struct tomoyo_ss; 69176bb0895STetsuo Handa 69276bb0895STetsuo Handa /* The list for "struct tomoyo_domain_info". */ 69376bb0895STetsuo Handa extern struct list_head tomoyo_domain_list; 69476bb0895STetsuo Handa 695847b173eSTetsuo Handa extern struct list_head tomoyo_name_list[TOMOYO_MAX_HASH]; 696847b173eSTetsuo Handa 69776bb0895STetsuo Handa /* Lock for protecting policy. */ 69876bb0895STetsuo Handa extern struct mutex tomoyo_policy_lock; 69976bb0895STetsuo Handa 70076bb0895STetsuo Handa /* Has /sbin/init started? */ 70176bb0895STetsuo Handa extern bool tomoyo_policy_loaded; 70276bb0895STetsuo Handa 70376bb0895STetsuo Handa /* The kernel's domain. */ 70476bb0895STetsuo Handa extern struct tomoyo_domain_info tomoyo_kernel_domain; 705bd03a3e4STetsuo Handa extern struct tomoyo_policy_namespace tomoyo_kernel_namespace; 706bd03a3e4STetsuo Handa extern struct list_head tomoyo_namespace_list; 70776bb0895STetsuo Handa 70871c28236STetsuo Handa extern const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION]; 70971c28236STetsuo Handa extern const char *tomoyo_mkdev_keyword[TOMOYO_MAX_MKDEV_OPERATION]; 71071c28236STetsuo Handa extern const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION]; 71171c28236STetsuo Handa extern const char *tomoyo_path_number_keyword[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 71271c28236STetsuo Handa 7130d2171d7STetsuo Handa extern const u8 tomoyo_pnnn2mac[TOMOYO_MAX_MKDEV_OPERATION]; 7140d2171d7STetsuo Handa extern const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION]; 7150d2171d7STetsuo Handa extern const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION]; 7160d2171d7STetsuo Handa 717eadd99ccSTetsuo Handa extern const char * const tomoyo_mode[TOMOYO_CONFIG_MAX_MODE]; 718eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_quota[TOMOYO_MAX_MEMORY_STAT]; 719eadd99ccSTetsuo Handa extern unsigned int tomoyo_memory_used[TOMOYO_MAX_MEMORY_STAT]; 72017fcfbd9STetsuo Handa 72176bb0895STetsuo Handa /********** Inlined functions. **********/ 72276bb0895STetsuo Handa 723b5bc60b4STetsuo Handa /** 724b5bc60b4STetsuo Handa * tomoyo_read_lock - Take lock for protecting policy. 725b5bc60b4STetsuo Handa * 726b5bc60b4STetsuo Handa * Returns index number for tomoyo_read_unlock(). 727b5bc60b4STetsuo Handa */ 72876bb0895STetsuo Handa static inline int tomoyo_read_lock(void) 72976bb0895STetsuo Handa { 73076bb0895STetsuo Handa return srcu_read_lock(&tomoyo_ss); 73176bb0895STetsuo Handa } 73276bb0895STetsuo Handa 733b5bc60b4STetsuo Handa /** 734b5bc60b4STetsuo Handa * tomoyo_read_unlock - Release lock for protecting policy. 735b5bc60b4STetsuo Handa * 736b5bc60b4STetsuo Handa * @idx: Index number returned by tomoyo_read_lock(). 737b5bc60b4STetsuo Handa * 738b5bc60b4STetsuo Handa * Returns nothing. 739b5bc60b4STetsuo Handa */ 74076bb0895STetsuo Handa static inline void tomoyo_read_unlock(int idx) 74176bb0895STetsuo Handa { 74276bb0895STetsuo Handa srcu_read_unlock(&tomoyo_ss, idx); 74376bb0895STetsuo Handa } 74476bb0895STetsuo Handa 745b5bc60b4STetsuo Handa /** 746b5bc60b4STetsuo Handa * tomoyo_pathcmp - strcmp() for "struct tomoyo_path_info" structure. 747b5bc60b4STetsuo Handa * 748b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_path_info". 749b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_path_info". 750b5bc60b4STetsuo Handa * 751b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 752b5bc60b4STetsuo Handa */ 7539590837bSKentaro Takeda static inline bool tomoyo_pathcmp(const struct tomoyo_path_info *a, 7549590837bSKentaro Takeda const struct tomoyo_path_info *b) 7559590837bSKentaro Takeda { 7569590837bSKentaro Takeda return a->hash != b->hash || strcmp(a->name, b->name); 7579590837bSKentaro Takeda } 7589590837bSKentaro Takeda 7599590837bSKentaro Takeda /** 760b5bc60b4STetsuo Handa * tomoyo_put_name - Drop reference on "struct tomoyo_name". 761b5bc60b4STetsuo Handa * 762b5bc60b4STetsuo Handa * @name: Pointer to "struct tomoyo_path_info". Maybe NULL. 763b5bc60b4STetsuo Handa * 764b5bc60b4STetsuo Handa * Returns nothing. 765b5bc60b4STetsuo Handa */ 76676bb0895STetsuo Handa static inline void tomoyo_put_name(const struct tomoyo_path_info *name) 76776bb0895STetsuo Handa { 76876bb0895STetsuo Handa if (name) { 769e2bf6907STetsuo Handa struct tomoyo_name *ptr = 770e2bf6907STetsuo Handa container_of(name, typeof(*ptr), entry); 7710df7e8b8STetsuo Handa atomic_dec(&ptr->head.users); 77276bb0895STetsuo Handa } 77376bb0895STetsuo Handa } 7749590837bSKentaro Takeda 775b5bc60b4STetsuo Handa /** 776b5bc60b4STetsuo Handa * tomoyo_put_group - Drop reference on "struct tomoyo_group". 777b5bc60b4STetsuo Handa * 778b5bc60b4STetsuo Handa * @group: Pointer to "struct tomoyo_group". Maybe NULL. 779b5bc60b4STetsuo Handa * 780b5bc60b4STetsuo Handa * Returns nothing. 781b5bc60b4STetsuo Handa */ 782a98aa4deSTetsuo Handa static inline void tomoyo_put_group(struct tomoyo_group *group) 7834c3e9e2dSTetsuo Handa { 7844c3e9e2dSTetsuo Handa if (group) 7850df7e8b8STetsuo Handa atomic_dec(&group->head.users); 7864c3e9e2dSTetsuo Handa } 7874c3e9e2dSTetsuo Handa 788b5bc60b4STetsuo Handa /** 789b5bc60b4STetsuo Handa * tomoyo_domain - Get "struct tomoyo_domain_info" for current thread. 790b5bc60b4STetsuo Handa * 791b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_domain_info" for current thread. 792b5bc60b4STetsuo Handa */ 79376bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_domain(void) 79476bb0895STetsuo Handa { 79576bb0895STetsuo Handa return current_cred()->security; 79676bb0895STetsuo Handa } 7979590837bSKentaro Takeda 798b5bc60b4STetsuo Handa /** 799b5bc60b4STetsuo Handa * tomoyo_real_domain - Get "struct tomoyo_domain_info" for specified thread. 800b5bc60b4STetsuo Handa * 801b5bc60b4STetsuo Handa * @task: Pointer to "struct task_struct". 802b5bc60b4STetsuo Handa * 803b5bc60b4STetsuo Handa * Returns pointer to "struct tomoyo_security" for specified thread. 804b5bc60b4STetsuo Handa */ 80576bb0895STetsuo Handa static inline struct tomoyo_domain_info *tomoyo_real_domain(struct task_struct 80676bb0895STetsuo Handa *task) 80776bb0895STetsuo Handa { 80876bb0895STetsuo Handa return task_cred_xxx(task, security); 80976bb0895STetsuo Handa } 8109590837bSKentaro Takeda 811b5bc60b4STetsuo Handa /** 812b5bc60b4STetsuo Handa * tomoyo_same_name_union - Check for duplicated "struct tomoyo_name_union" entry. 813b5bc60b4STetsuo Handa * 814b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_name_union". 815b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_name_union". 816b5bc60b4STetsuo Handa * 817b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 818b5bc60b4STetsuo Handa */ 81975093152STetsuo Handa static inline bool tomoyo_same_name_union 820b5bc60b4STetsuo Handa (const struct tomoyo_name_union *a, const struct tomoyo_name_union *b) 8217762fbffSTetsuo Handa { 8220df7e8b8STetsuo Handa return a->filename == b->filename && a->group == b->group; 8237762fbffSTetsuo Handa } 8247762fbffSTetsuo Handa 825b5bc60b4STetsuo Handa /** 826b5bc60b4STetsuo Handa * tomoyo_same_number_union - Check for duplicated "struct tomoyo_number_union" entry. 827b5bc60b4STetsuo Handa * 828b5bc60b4STetsuo Handa * @a: Pointer to "struct tomoyo_number_union". 829b5bc60b4STetsuo Handa * @b: Pointer to "struct tomoyo_number_union". 830b5bc60b4STetsuo Handa * 831b5bc60b4STetsuo Handa * Returns true if @a == @b, false otherwise. 832b5bc60b4STetsuo Handa */ 83375093152STetsuo Handa static inline bool tomoyo_same_number_union 834b5bc60b4STetsuo Handa (const struct tomoyo_number_union *a, const struct tomoyo_number_union *b) 8354c3e9e2dSTetsuo Handa { 836b5bc60b4STetsuo Handa return a->values[0] == b->values[0] && a->values[1] == b->values[1] && 8370df7e8b8STetsuo Handa a->group == b->group && a->value_type[0] == b->value_type[0] && 8380df7e8b8STetsuo Handa a->value_type[1] == b->value_type[1]; 8394c3e9e2dSTetsuo Handa } 8404c3e9e2dSTetsuo Handa 841bd03a3e4STetsuo Handa /** 842bd03a3e4STetsuo Handa * tomoyo_current_namespace - Get "struct tomoyo_policy_namespace" for current thread. 843bd03a3e4STetsuo Handa * 844bd03a3e4STetsuo Handa * Returns pointer to "struct tomoyo_policy_namespace" for current thread. 845bd03a3e4STetsuo Handa */ 846bd03a3e4STetsuo Handa static inline struct tomoyo_policy_namespace *tomoyo_current_namespace(void) 847bd03a3e4STetsuo Handa { 848bd03a3e4STetsuo Handa return tomoyo_domain()->ns; 849bd03a3e4STetsuo Handa } 850bd03a3e4STetsuo Handa 851eadd99ccSTetsuo Handa #if defined(CONFIG_SLOB) 852eadd99ccSTetsuo Handa 853eadd99ccSTetsuo Handa /** 854eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 855eadd99ccSTetsuo Handa * 856eadd99ccSTetsuo Handa * @size: Size to be rounded up. 857eadd99ccSTetsuo Handa * 858eadd99ccSTetsuo Handa * Returns @size. 859eadd99ccSTetsuo Handa * 860eadd99ccSTetsuo Handa * Since SLOB does not round up, this function simply returns @size. 861eadd99ccSTetsuo Handa */ 862eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 863eadd99ccSTetsuo Handa { 864eadd99ccSTetsuo Handa return size; 865eadd99ccSTetsuo Handa } 866eadd99ccSTetsuo Handa 867eadd99ccSTetsuo Handa #else 868eadd99ccSTetsuo Handa 869eadd99ccSTetsuo Handa /** 870eadd99ccSTetsuo Handa * tomoyo_round2 - Round up to power of 2 for calculating memory usage. 871eadd99ccSTetsuo Handa * 872eadd99ccSTetsuo Handa * @size: Size to be rounded up. 873eadd99ccSTetsuo Handa * 874eadd99ccSTetsuo Handa * Returns rounded size. 875eadd99ccSTetsuo Handa * 876eadd99ccSTetsuo Handa * Strictly speaking, SLAB may be able to allocate (e.g.) 96 bytes instead of 877eadd99ccSTetsuo Handa * (e.g.) 128 bytes. 878eadd99ccSTetsuo Handa */ 879eadd99ccSTetsuo Handa static inline int tomoyo_round2(size_t size) 880eadd99ccSTetsuo Handa { 881eadd99ccSTetsuo Handa #if PAGE_SIZE == 4096 882eadd99ccSTetsuo Handa size_t bsize = 32; 883eadd99ccSTetsuo Handa #else 884eadd99ccSTetsuo Handa size_t bsize = 64; 885eadd99ccSTetsuo Handa #endif 886eadd99ccSTetsuo Handa if (!size) 887eadd99ccSTetsuo Handa return 0; 888eadd99ccSTetsuo Handa while (size > bsize) 889eadd99ccSTetsuo Handa bsize <<= 1; 890eadd99ccSTetsuo Handa return bsize; 891eadd99ccSTetsuo Handa } 892eadd99ccSTetsuo Handa 893eadd99ccSTetsuo Handa #endif 894eadd99ccSTetsuo Handa 8959590837bSKentaro Takeda /** 8969590837bSKentaro Takeda * list_for_each_cookie - iterate over a list with cookie. 8979590837bSKentaro Takeda * @pos: the &struct list_head to use as a loop cursor. 8989590837bSKentaro Takeda * @head: the head for your list. 8999590837bSKentaro Takeda */ 900475e6fa3STetsuo Handa #define list_for_each_cookie(pos, head) \ 901475e6fa3STetsuo Handa if (!pos) \ 902475e6fa3STetsuo Handa pos = srcu_dereference((head)->next, &tomoyo_ss); \ 903475e6fa3STetsuo Handa for ( ; pos != (head); pos = srcu_dereference(pos->next, &tomoyo_ss)) 904fdb8ebb7STetsuo Handa 9059590837bSKentaro Takeda #endif /* !defined(_SECURITY_TOMOYO_COMMON_H) */ 906