オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.7.x/ccs-patch/security/ccsecurity/util.c

Diff of /trunk/1.7.x/ccs-patch/security/ccsecurity/util.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

trunk/1.5.x/ccs-patch/fs/ccs_common.c revision 813 by kumaneko, Tue Dec 18 05:35:28 2007 UTC trunk/1.6.x/ccs-patch/fs/ccs_common.c revision 924 by kumaneko, Thu Jan 24 03:18:27 2008 UTC
# Line 3  Line 3 
3   *   *
4   * Common functions for SAKURA and TOMOYO.   * Common functions for SAKURA and TOMOYO.
5   *   *
6   * Copyright (C) 2005-2007  NTT DATA CORPORATION   * Copyright (C) 2005-2008  NTT DATA CORPORATION
7   *   *
8   * Version: 1.5.3-pre   2007/12/18   * Version: 1.6.0-pre   2008/01/24
9   *   *
10   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * This file is applicable to both 2.4.30 and 2.6.11 and later.
11   * See README.ccs for ChangeLog.   * See README.ccs for ChangeLog.
# Line 52  static const int lookup_flags = LOOKUP_F Line 52  static const int lookup_flags = LOOKUP_F
52  /*************************  VARIABLES  *************************/  /*************************  VARIABLES  *************************/
53    
54  /* /sbin/init started? */  /* /sbin/init started? */
55  int sbin_init_started = 0;  bool sbin_init_started = 0;
56    
57  const char *ccs_log_level = KERN_DEBUG;  const char *ccs_log_level = KERN_DEBUG;
58    
# Line 103  __setup("TOMOYO_QUIET", TOMOYO_Quiet_Set Line 103  __setup("TOMOYO_QUIET", TOMOYO_Quiet_Set
103  #endif  #endif
104    
105  /* Am I root? */  /* Am I root? */
106  static int isRoot(void)  static int isRoot(struct io_buffer *head)
107  {  {
108          return !current->uid && !current->euid;          const struct task_struct *task = current;
109            return (!task->uid && !task->euid) || (task->uid && task->uid == head->uid) || (task->gid && task->gid == head->gid);
110  }  }
111    
112  /*  /*
# Line 131  static void NormalizeLine(unsigned char Line 132  static void NormalizeLine(unsigned char
132   *  Check whether the given filename follows the naming rules.   *  Check whether the given filename follows the naming rules.
133   *  Returns nonzero if follows, zero otherwise.   *  Returns nonzero if follows, zero otherwise.
134   */   */
135  bool IsCorrectPath(const char *filename, const int start_type, const int pattern_type, const int end_type, const char *function)  bool IsCorrectPath(const char *filename, const s8 start_type, const s8 pattern_type, const s8 end_type, const char *function)
136  {  {
137          int contains_pattern = 0;          int contains_pattern = 0;
138          char c, d, e;          char c, d, e;
# Line 503  const char *GetAltExec(void) Line 504  const char *GetAltExec(void)
504  /*************************  DOMAIN POLICY HANDLER  *************************/  /*************************  DOMAIN POLICY HANDLER  *************************/
505    
506  /* Check whether the given access control is enabled. */  /* Check whether the given access control is enabled. */
507  unsigned int CheckCCSFlags(const unsigned int index)  unsigned int CheckCCSFlags_NoSleepCheck(const u8 index)
508  {  {
509          const u8 profile = current->domain_info->profile;          const u8 profile = current->domain_info->profile;
510          return sbin_init_started && index < CCS_MAX_CONTROL_INDEX          return sbin_init_started && index < CCS_MAX_CONTROL_INDEX
# Line 513  unsigned int CheckCCSFlags(const unsigne Line 514  unsigned int CheckCCSFlags(const unsigne
514                  && profile_ptr[profile] ? profile_ptr[profile]->value[index] : 0;                  && profile_ptr[profile] ? profile_ptr[profile]->value[index] : 0;
515  }  }
516    
517  bool TomoyoVerboseMode(void)  unsigned int CheckCCSFlags(const u8 index)
518  {  {
519          return CheckCCSFlags(CCS_TOMOYO_VERBOSE) != 0;  #if LINUX_VERSION_CODE < KERNEL_VERSION(2,5,0)
520            if (unlikely(in_interrupt()))
521    #else
522            if (unlikely(in_atomic()))
523    #endif
524            {
525                    static u8 count = 20;
526                    if (count) {
527                            count--;
528                            printk(KERN_ERR "BUG: sleeping function called from invalid context.\n");
529                            dump_stack();
530                    }
531                    /* Return 0 so that no MAC checks are performed. */
532                    return 0;
533            }
534            return CheckCCSFlags_NoSleepCheck(index);
535  }  }
536    
537  /* Check whether the given access control is enforce mode. */  bool TomoyoVerboseMode(void)
 bool CheckCCSEnforce(const unsigned int index)  
538  {  {
539          return CheckCCSFlags(index) == 3;          return CheckCCSFlags(CCS_TOMOYO_VERBOSE) != 0;
540  }  }
541    
542  bool CheckDomainQuota(struct domain_info * const domain)  bool CheckDomainQuota(struct domain_info * const domain)
# Line 530  bool CheckDomainQuota(struct domain_info Line 545  bool CheckDomainQuota(struct domain_info
545          struct acl_info *ptr;          struct acl_info *ptr;
546          if (!domain) return 1;          if (!domain) return 1;
547          list1_for_each_entry(ptr, &domain->acl_info_list, list) {          list1_for_each_entry(ptr, &domain->acl_info_list, list) {
548                  if (!ptr->is_deleted) count++;                  if (!(ptr->type & ACL_DELETED)) count++;
549          }          }
550          if (count < CheckCCSFlags(CCS_TOMOYO_MAX_ACCEPT_ENTRY)) return 1;          if (count < CheckCCSFlags(CCS_TOMOYO_MAX_ACCEPT_ENTRY)) return 1;
551          if (!domain->quota_warned) {          if (!domain->quota_warned) {
# Line 540  bool CheckDomainQuota(struct domain_info Line 555  bool CheckDomainQuota(struct domain_info
555          return 0;          return 0;
556  }  }
557    
 /* Check whether the given access control is learning mode. */  
 bool CheckCCSAccept(const unsigned int index, struct domain_info * const domain)  
 {  
         if (CheckCCSFlags(index) != 1) return 0;  
         return CheckDomainQuota(domain);  
 }  
   
558  static struct profile *FindOrAssignNewProfile(const unsigned int profile)  static struct profile *FindOrAssignNewProfile(const unsigned int profile)
559  {  {
560          static DEFINE_MUTEX(profile_lock);          static DEFINE_MUTEX(profile_lock);
# Line 572  static int SetProfile(struct io_buffer * Line 580  static int SetProfile(struct io_buffer *
580          unsigned int i, value;          unsigned int i, value;
581          char *cp;          char *cp;
582          struct profile *profile;          struct profile *profile;
583          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
584          i = simple_strtoul(data, &cp, 10);          i = simple_strtoul(data, &cp, 10);
585          if (data != cp) {          if (data != cp) {
586                  if (*cp != '-') return -EINVAL;                  if (*cp != '-') return -EINVAL;
# Line 616  static int SetProfile(struct io_buffer * Line 624  static int SetProfile(struct io_buffer *
624  static int ReadProfile(struct io_buffer *head)  static int ReadProfile(struct io_buffer *head)
625  {  {
626          if (!head->read_eof) {          if (!head->read_eof) {
627                  if (!isRoot()) return -EPERM;                  if (!isRoot(head)) return -EPERM;
628                  if (!head->read_var2) {                  if (!head->read_var2) {
629                          int step;                          int step;
630                          for (step = head->read_step; step < MAX_PROFILES * CCS_MAX_CONTROL_INDEX; step++) {                          for (step = head->read_step; step < MAX_PROFILES * CCS_MAX_CONTROL_INDEX; step++) {
# Line 693  static int AddManagerEntry(const char *m Line 701  static int AddManagerEntry(const char *m
701          const struct path_info *saved_manager;          const struct path_info *saved_manager;
702          int error = -ENOMEM;          int error = -ENOMEM;
703          bool is_domain = 0;          bool is_domain = 0;
         if (!isRoot()) return -EPERM;  
704          if (IsDomainDef(manager)) {          if (IsDomainDef(manager)) {
705                  if (!IsCorrectDomain(manager, __FUNCTION__)) return -EINVAL;                  if (!IsCorrectDomain(manager, __FUNCTION__)) return -EINVAL;
706                  is_domain = 1;                  is_domain = 1;
# Line 728  static int AddManagerPolicy(struct io_bu Line 735  static int AddManagerPolicy(struct io_bu
735  {  {
736          const char *data = head->write_buf;          const char *data = head->write_buf;
737          bool is_delete = 0;          bool is_delete = 0;
738          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
739          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {
740                  data += KEYWORD_DELETE_LEN;                  data += KEYWORD_DELETE_LEN;
741                  is_delete = 1;                  is_delete = 1;
# Line 740  static int ReadManagerPolicy(struct io_b Line 747  static int ReadManagerPolicy(struct io_b
747  {  {
748          struct list1_head *pos;          struct list1_head *pos;
749          if (head->read_eof) return 0;          if (head->read_eof) return 0;
750          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
751          list1_for_each_cookie(pos, head->read_var2, &policy_manager_list) {          list1_for_each_cookie(pos, head->read_var2, &policy_manager_list) {
752                  struct policy_manager_entry *ptr;                  struct policy_manager_entry *ptr;
753                  ptr = list1_entry(pos, struct policy_manager_entry, list);                  ptr = list1_entry(pos, struct policy_manager_entry, list);
# Line 802  static int AddDomainPolicy(struct io_buf Line 809  static int AddDomainPolicy(struct io_buf
809          bool is_delete = 0, is_select = 0, is_undelete = 0;          bool is_delete = 0, is_select = 0, is_undelete = 0;
810          unsigned int profile;          unsigned int profile;
811          const struct condition_list *cond = NULL;          const struct condition_list *cond = NULL;
812          char *cp;                char *cp;
813          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
814          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {
815                  data += KEYWORD_DELETE_LEN;                  data += KEYWORD_DELETE_LEN;
816                  is_delete = 1;                  is_delete = 1;
# Line 814  static int AddDomainPolicy(struct io_buf Line 821  static int AddDomainPolicy(struct io_buf
821                  data += KEYWORD_UNDELETE_LEN;                  data += KEYWORD_UNDELETE_LEN;
822                  is_undelete = 1;                  is_undelete = 1;
823          }          }
         UpdateCounter(CCS_UPDATES_COUNTER_DOMAIN_POLICY);  
824          if (IsDomainDef(data)) {          if (IsDomainDef(data)) {
825                  if (is_delete) {                  if (is_delete) {
826                          DeleteDomain(data);                          DeleteDomain(data);
# Line 827  static int AddDomainPolicy(struct io_buf Line 833  static int AddDomainPolicy(struct io_buf
833                          domain = FindOrAssignNewDomain(data, 0);                          domain = FindOrAssignNewDomain(data, 0);
834                  }                  }
835                  head->write_var1 = domain;                  head->write_var1 = domain;
836                    UpdateCounter(CCS_UPDATES_COUNTER_DOMAIN_POLICY);
837                  return 0;                  return 0;
838          }          }
839          if (!domain) return -EINVAL;          if (!domain) return -EINVAL;
# Line 853  static int AddDomainPolicy(struct io_buf Line 860  static int AddDomainPolicy(struct io_buf
860          return -EINVAL;          return -EINVAL;
861  }  }
862    
863    static bool print_single_path_acl(struct io_buffer *head, struct single_path_acl_record *ptr, const struct condition_list *cond)
864    {
865            int pos;
866            u8 bit;
867            const bool b = ptr->u_is_group;
868            const u16 perm = ptr->perm;
869            for (bit = head->read_bit; bit < MAX_SINGLE_PATH_OPERATION; bit++) {
870                    const char *msg;
871                    if (!(perm & (1 << bit))) continue;
872                    /* Print "read/write" instead of "read" and "write". */
873                    if ((bit == TYPE_READ_ACL || bit == TYPE_WRITE_ACL) && (perm & (1 << TYPE_READ_WRITE_ACL))) continue;
874                    msg = sp_operation2keyword(bit);
875                    pos = head->read_avail;
876                    if (b && io_printf(head, "allow_%s @%s ", msg, ptr->u.group->group_name->name)) goto out;
877                    if (!b && io_printf(head, "allow_%s %s ", msg, ptr->u.filename->name)) goto out;
878                    if (DumpCondition(head, cond)) goto out;
879            }
880            head->read_bit = 0;
881            return 1;
882     out:
883            head->read_bit = bit;
884            head->read_avail = pos;
885            return 0;
886    }
887    
888    static bool print_double_path_acl(struct io_buffer *head, struct double_path_acl_record *ptr, const struct condition_list *cond)
889    {
890            int pos;
891            const bool b0 = ptr->u1_is_group, b1 = ptr->u2_is_group;
892            const u8 perm = ptr->perm;
893            u8 bit;
894            for (bit = head->read_bit; bit < MAX_DOUBLE_PATH_OPERATION; bit++) {
895                    const char *msg;
896                    if (!(perm & (1 << bit))) continue;
897                    msg = dp_operation2keyword(bit);
898                    pos = head->read_avail;
899                    if (io_printf(head, "allow_%s ", msg)) goto out;
900                    if (b0 && io_printf(head, "@%s", ptr->u1.group1->group_name->name)) goto out;
901                    if (!b0 && io_printf(head, "%s", ptr->u1.filename1->name)) goto out;
902                    if (b1 && io_printf(head, "@%s", ptr->u2.group2->group_name->name)) goto out;
903                    if (!b1 && io_printf(head, "%s", ptr->u2.filename2->name)) goto out;
904                    if (DumpCondition(head, cond)) goto out;
905            }
906            head->read_bit = 0;
907            return 1;
908     out:
909            head->read_bit = bit;
910            head->read_avail = pos;
911            return 0;
912    }
913    
914    static bool print_argv0_acl(struct io_buffer *head, struct argv0_acl_record *ptr, const struct condition_list *cond)
915    {
916            int pos = head->read_avail;
917            if (io_printf(head, KEYWORD_ALLOW_ARGV0 "%s %s",
918                          ptr->filename->name, ptr->argv0->name)) goto out;
919            if (DumpCondition(head, cond)) goto out;
920            return 1;
921     out:
922            head->read_avail = pos;
923            return 0;
924    }
925    
926    static bool print_env_acl(struct io_buffer *head, struct env_acl_record *ptr, const struct condition_list *cond)
927    {
928            int pos = head->read_avail;
929            if (io_printf(head, KEYWORD_ALLOW_ENV "%s", ptr->env->name)) goto out;
930            if (DumpCondition(head, cond)) goto out;
931            return 1;
932     out:
933            head->read_avail = pos;
934            return 0;
935    }
936    
937    static bool print_capability_acl(struct io_buffer *head, struct capability_acl_record *ptr, const struct condition_list *cond)
938    {
939            int pos = head->read_avail;
940            if (io_printf(head, KEYWORD_ALLOW_CAPABILITY "%s", cap_operation2keyword(ptr->operation))) goto out;
941            if (DumpCondition(head, cond)) goto out;
942            return 1;
943     out:
944            head->read_avail = pos;
945            return 0;
946    }
947    
948    static bool print_network_acl(struct io_buffer *head, struct ip_network_acl_record *ptr, const struct condition_list *cond)
949    {
950            int pos = head->read_avail;
951            if (io_printf(head, KEYWORD_ALLOW_NETWORK "%s ", net_operation2keyword(ptr->operation_type))) goto out;
952            switch (ptr->record_type) {
953            case IP_RECORD_TYPE_ADDRESS_GROUP:
954                    if (io_printf(head, "@%s", ptr->u.group->group_name->name)) goto out;
955                    break;
956            case IP_RECORD_TYPE_IPv4:
957                    {
958                            const u32 min_address = ptr->u.ipv4.min, max_address = ptr->u.ipv4.max;
959                            if (io_printf(head, "%u.%u.%u.%u", HIPQUAD(min_address))) goto out;
960                            if (min_address != max_address && io_printf(head, "-%u.%u.%u.%u", HIPQUAD(max_address))) goto out;
961                    }
962                    break;
963            case IP_RECORD_TYPE_IPv6:
964                    {
965                            char buf[64];
966                            const struct in6_addr *min_address = ptr->u.ipv6.min, *max_address = ptr->u.ipv6.max;
967                            print_ipv6(buf, sizeof(buf), min_address);
968                            if (io_printf(head, "%s", buf)) goto out;
969                            if (min_address != max_address) {
970                                    print_ipv6(buf, sizeof(buf), max_address);
971                                    if (io_printf(head, "-%s", buf)) goto out;
972                            }
973                    }
974                    break;
975            }
976            {
977                    const u16 min_port = ptr->min_port, max_port = ptr->max_port;
978                    if (io_printf(head, " %u", min_port)) goto out;
979                    if (min_port != max_port && io_printf(head, "-%u", max_port)) goto out;
980            }
981            if (DumpCondition(head, cond)) goto out;
982            return 1;
983     out:
984            head->read_avail = pos;
985            return 0;
986    }
987    
988    static bool print_signal_acl(struct io_buffer *head, struct signal_acl_record *ptr, const struct condition_list *cond)
989    {
990            int pos = head->read_avail;
991            if (io_printf(head, KEYWORD_ALLOW_SIGNAL "%u %s", ptr->sig, ptr->domainname->name)) goto out;
992            if (DumpCondition(head, cond)) goto out;
993            return 1;
994     out:
995            head->read_avail = pos;
996            return 0;
997    }
998    
999  static int ReadDomainPolicy(struct io_buffer *head)  static int ReadDomainPolicy(struct io_buffer *head)
1000  {  {
1001          struct list1_head *dpos;          struct list1_head *dpos;
1002          struct list1_head *apos;          struct list1_head *apos;
1003          if (head->read_eof) return 0;          if (head->read_eof) return 0;
1004          if (head->read_step == 0) {          if (head->read_step == 0) {
1005                  if (!isRoot()) return -EPERM;                  if (!isRoot(head)) return -EPERM;
1006                  head->read_step = 1;                  head->read_step = 1;
1007          }          }
1008          list1_for_each_cookie(dpos, head->read_var1, &domain_list) {          list1_for_each_cookie(dpos, head->read_var1, &domain_list) {
# Line 873  static int ReadDomainPolicy(struct io_bu Line 1016  static int ReadDomainPolicy(struct io_bu
1016                  if (head->read_step == 3) goto tail_mark;                  if (head->read_step == 3) goto tail_mark;
1017                  list1_for_each_cookie(apos, head->read_var2, &domain->acl_info_list) {                  list1_for_each_cookie(apos, head->read_var2, &domain->acl_info_list) {
1018                          struct acl_info *ptr;                          struct acl_info *ptr;
                         int pos;  
1019                          u8 acl_type;                          u8 acl_type;
1020                            const struct condition_list *cond;
1021                          ptr = list1_entry(apos, struct acl_info, list);                          ptr = list1_entry(apos, struct acl_info, list);
1022                          if (ptr->is_deleted) continue;                          cond = GetConditionPart(ptr);
1023                          pos = head->read_avail;                          acl_type = ptr->type & ~ACL_WITH_CONDITION;
1024                          acl_type = ptr->type;                          if (acl_type & ACL_DELETED) {
1025                          if (acl_type == TYPE_FILE_ACL) {                                  /* Deleted entry. */
1026                                  struct file_acl_record *ptr2 = container_of(ptr, struct file_acl_record, head);                          } else if (acl_type == TYPE_SINGLE_PATH_ACL) {
1027                                  const unsigned char b = ptr2->u_is_group;                                  if (!print_single_path_acl(head, container_of(ptr, struct single_path_acl_record, head), cond)) return 0;
1028                                  if (io_printf(head, "%d %s%s", ptr2->perm,                          } else if (acl_type == TYPE_DOUBLE_PATH_ACL) {
1029                                                b ? "@" : "",                                  if (!print_double_path_acl(head, container_of(ptr, struct double_path_acl_record, head), cond)) return 0;
                                               b ? ptr2->u.group->group_name->name : ptr2->u.filename->name)) goto print_acl_rollback;  
1030                          } else if (acl_type == TYPE_ARGV0_ACL) {                          } else if (acl_type == TYPE_ARGV0_ACL) {
1031                                  struct argv0_acl_record *ptr2 = container_of(ptr, struct argv0_acl_record, head);                                  if (!print_argv0_acl(head, container_of(ptr, struct argv0_acl_record, head), cond)) return 0;
                                 if (io_printf(head, KEYWORD_ALLOW_ARGV0 "%s %s",  
                                               ptr2->filename->name, ptr2->argv0->name)) goto print_acl_rollback;  
1032                          } else if (acl_type == TYPE_ENV_ACL) {                          } else if (acl_type == TYPE_ENV_ACL) {
1033                                  struct env_acl_record *ptr2 = container_of(ptr, struct env_acl_record, head);                                  if (!print_env_acl(head, container_of(ptr, struct env_acl_record, head), cond)) return 0;
                                 if (io_printf(head, KEYWORD_ALLOW_ENV "%s", ptr2->env->name)) goto print_acl_rollback;  
1034                          } else if (acl_type == TYPE_CAPABILITY_ACL) {                          } else if (acl_type == TYPE_CAPABILITY_ACL) {
1035                                  struct capability_acl_record *ptr2 = container_of(ptr, struct capability_acl_record, head);                                  if (!print_capability_acl(head, container_of(ptr, struct capability_acl_record, head), cond)) return 0;
                                 if (io_printf(head, KEYWORD_ALLOW_CAPABILITY "%s", capability2keyword(ptr2->capability))) goto print_acl_rollback;  
1036                          } else if (acl_type == TYPE_IP_NETWORK_ACL) {                          } else if (acl_type == TYPE_IP_NETWORK_ACL) {
1037                                  struct ip_network_acl_record *ptr2 = container_of(ptr, struct ip_network_acl_record, head);                                  if (!print_network_acl(head, container_of(ptr, struct ip_network_acl_record, head), cond)) return 0;
                                 if (io_printf(head, KEYWORD_ALLOW_NETWORK "%s ", network2keyword(ptr2->operation_type))) goto print_acl_rollback;  
                                 switch (ptr2->record_type) {  
                                 case IP_RECORD_TYPE_ADDRESS_GROUP:  
                                         if (io_printf(head, "@%s", ptr2->u.group->group_name->name)) goto print_acl_rollback;  
                                         break;  
                                 case IP_RECORD_TYPE_IPv4:  
                                         {  
                                                 const u32 min_address = ptr2->u.ipv4.min, max_address = ptr2->u.ipv4.max;  
                                                 if (io_printf(head, "%u.%u.%u.%u", HIPQUAD(min_address))) goto print_acl_rollback;  
                                                 if (min_address != max_address && io_printf(head, "-%u.%u.%u.%u", HIPQUAD(max_address))) goto print_acl_rollback;  
                                         }  
                                         break;  
                                 case IP_RECORD_TYPE_IPv6:  
                                         {  
                                                 char buf[64];  
                                                 const struct in6_addr *min_address = ptr2->u.ipv6.min, *max_address = ptr2->u.ipv6.max;  
                                                 print_ipv6(buf, sizeof(buf), min_address);  
                                                 if (io_printf(head, "%s", buf)) goto print_acl_rollback;  
                                                 if (min_address != max_address) {  
                                                         print_ipv6(buf, sizeof(buf), max_address);  
                                                         if (io_printf(head, "-%s", buf)) goto print_acl_rollback;  
                                                 }  
                                         }  
                                         break;  
                                 }  
                                 {  
                                         const u16 min_port = ptr2->min_port, max_port = ptr2->max_port;  
                                         if (io_printf(head, " %u", min_port)) goto print_acl_rollback;  
                                         if (min_port != max_port && io_printf(head, "-%u", max_port)) goto print_acl_rollback;  
                                 }  
1038                          } else if (acl_type == TYPE_SIGNAL_ACL) {                          } else if (acl_type == TYPE_SIGNAL_ACL) {
1039                                  struct signal_acl_record *ptr2 = container_of(ptr, struct signal_acl_record, head);                                  if (!print_signal_acl(head, container_of(ptr, struct signal_acl_record, head), cond)) return 0;
                                 if (io_printf(head, KEYWORD_ALLOW_SIGNAL "%u %s", ptr2->sig, ptr2->domainname->name)) goto print_acl_rollback;  
1040                          } else {                          } else {
1041                                  const char *keyword = acltype2keyword(acl_type);                                  BUG();
                                 if (!keyword) continue;  
                                 if (acltype2paths(acl_type) == 2) {  
                                         struct double_acl_record *ptr2 = container_of(ptr, struct double_acl_record, head);  
                                         const bool b0 = ptr2->u1_is_group, b1 = ptr2->u2_is_group;  
                                         if (io_printf(head, "allow_%s %s%s %s%s", keyword,  
                                                       b0 ? "@" : "", b0 ? ptr2->u1.group1->group_name->name : ptr2->u1.filename1->name,  
                                                       b1 ? "@" : "", b1 ? ptr2->u2.group2->group_name->name : ptr2->u2.filename2->name)) goto print_acl_rollback;  
                                 } else {  
                                         struct single_acl_record *ptr2 = container_of(ptr, struct single_acl_record, head);  
                                         const bool b = ptr2->u_is_group;  
                                         if (io_printf(head, "allow_%s %s%s", keyword,  
                                                       b ? "@" : "", b ? ptr2->u.group->group_name->name : ptr2->u.filename->name)) goto print_acl_rollback;  
                                 }  
                         }  
                         if (DumpCondition(head, ptr->cond)) {  
                         print_acl_rollback: ;  
                         head->read_avail = pos;  
                         return 0;  
1042                          }                          }
1043                  }                  }
1044                  head->read_step = 3;                  head->read_step = 3;
# Line 969  static int UpdateDomainProfile(struct io Line 1058  static int UpdateDomainProfile(struct io
1058          char *cp = strchr(data, ' ');          char *cp = strchr(data, ' ');
1059          struct domain_info *domain;          struct domain_info *domain;
1060          unsigned int profile;          unsigned int profile;
1061          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
1062          if (!cp) return -EINVAL;          if (!cp) return -EINVAL;
1063          *cp = '\0';          *cp = '\0';
1064          domain = FindDomain(cp + 1);          domain = FindDomain(cp + 1);
# Line 983  static int ReadDomainProfile(struct io_b Line 1072  static int ReadDomainProfile(struct io_b
1072  {  {
1073          struct list1_head *pos;          struct list1_head *pos;
1074          if (head->read_eof) return 0;          if (head->read_eof) return 0;
1075          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
1076          list1_for_each_cookie(pos, head->read_var1, &domain_list) {          list1_for_each_cookie(pos, head->read_var1, &domain_list) {
1077                  struct domain_info *domain;                  struct domain_info *domain;
1078                  domain = list1_entry(pos, struct domain_info, list);                  domain = list1_entry(pos, struct domain_info, list);
# Line 1027  static int AddExceptionPolicy(struct io_ Line 1116  static int AddExceptionPolicy(struct io_
1116  {  {
1117          char *data = head->write_buf;          char *data = head->write_buf;
1118          bool is_delete = 0;          bool is_delete = 0;
1119          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
1120          UpdateCounter(CCS_UPDATES_COUNTER_EXCEPTION_POLICY);          UpdateCounter(CCS_UPDATES_COUNTER_EXCEPTION_POLICY);
1121          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {
1122                  data += KEYWORD_DELETE_LEN;                  data += KEYWORD_DELETE_LEN;
# Line 1050  static int AddExceptionPolicy(struct io_ Line 1139  static int AddExceptionPolicy(struct io_
1139          } else if (strncmp(data, KEYWORD_ALLOW_ENV, KEYWORD_ALLOW_ENV_LEN) == 0) {          } else if (strncmp(data, KEYWORD_ALLOW_ENV, KEYWORD_ALLOW_ENV_LEN) == 0) {
1140                  return AddGloballyUsableEnvPolicy(data + KEYWORD_ALLOW_ENV_LEN, is_delete);                  return AddGloballyUsableEnvPolicy(data + KEYWORD_ALLOW_ENV_LEN, is_delete);
1141          } else if (strncmp(data, KEYWORD_FILE_PATTERN, KEYWORD_FILE_PATTERN_LEN) == 0) {          } else if (strncmp(data, KEYWORD_FILE_PATTERN, KEYWORD_FILE_PATTERN_LEN) == 0) {
1142                  return AddPatternPolicy(data + KEYWORD_FILE_PATTERN_LEN, is_delete);                  return AddFilePatternPolicy(data + KEYWORD_FILE_PATTERN_LEN, is_delete);
1143          } else if (strncmp(data, KEYWORD_PATH_GROUP, KEYWORD_PATH_GROUP_LEN) == 0) {          } else if (strncmp(data, KEYWORD_PATH_GROUP, KEYWORD_PATH_GROUP_LEN) == 0) {
1144                  return AddPathGroupPolicy(data + KEYWORD_PATH_GROUP_LEN, is_delete);                  return AddPathGroupPolicy(data + KEYWORD_PATH_GROUP_LEN, is_delete);
1145          } else if (strncmp(data, KEYWORD_DENY_REWRITE, KEYWORD_DENY_REWRITE_LEN) == 0) {          } else if (strncmp(data, KEYWORD_DENY_REWRITE, KEYWORD_DENY_REWRITE_LEN) == 0) {
# Line 1066  static int ReadExceptionPolicy(struct io Line 1155  static int ReadExceptionPolicy(struct io
1155          if (!head->read_eof) {          if (!head->read_eof) {
1156                  switch (head->read_step) {                  switch (head->read_step) {
1157                  case 0:                  case 0:
1158                          if (!isRoot()) return -EPERM;                          if (!isRoot(head)) return -EPERM;
1159                          head->read_var2 = NULL; head->read_step = 1;                          head->read_var2 = NULL; head->read_step = 1;
1160                  case 1:                  case 1:
1161                          if (ReadDomainKeeperPolicy(head)) break;                          if (ReadDomainKeeperPolicy(head)) break;
# Line 1087  static int ReadExceptionPolicy(struct io Line 1176  static int ReadExceptionPolicy(struct io
1176                          if (ReadAggregatorPolicy(head)) break;                          if (ReadAggregatorPolicy(head)) break;
1177                          head->read_var2 = NULL; head->read_step = 7;                          head->read_var2 = NULL; head->read_step = 7;
1178                  case 7:                  case 7:
1179                          if (ReadPatternPolicy(head)) break;                          if (ReadFilePatternPolicy(head)) break;
1180                          head->read_var2 = NULL; head->read_step = 8;                          head->read_var2 = NULL; head->read_step = 8;
1181                  case 8:                  case 8:
1182                          if (ReadNoRewritePolicy(head)) break;                          if (ReadNoRewritePolicy(head)) break;
# Line 1116  static int AddSystemPolicy(struct io_buf Line 1205  static int AddSystemPolicy(struct io_buf
1205  {  {
1206          char *data = head->write_buf;          char *data = head->write_buf;
1207          bool is_delete = 0;          bool is_delete = 0;
1208          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
1209          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);          UpdateCounter(CCS_UPDATES_COUNTER_SYSTEM_POLICY);
1210          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {          if (strncmp(data, KEYWORD_DELETE, KEYWORD_DELETE_LEN) == 0) {
1211                  data += KEYWORD_DELETE_LEN;                  data += KEYWORD_DELETE_LEN;
# Line 1140  static int ReadSystemPolicy(struct io_bu Line 1229  static int ReadSystemPolicy(struct io_bu
1229          if (!head->read_eof) {          if (!head->read_eof) {
1230                  switch (head->read_step) {                  switch (head->read_step) {
1231                  case 0:                  case 0:
1232                          if (!isRoot()) return -EPERM;                          if (!isRoot(head)) return -EPERM;
1233                          head->read_var2 = NULL; head->read_step = 1;                          head->read_var2 = NULL; head->read_step = 1;
1234                  case 1:                  case 1:
1235                          if (ReadMountPolicy(head)) break;                          if (ReadMountPolicy(head)) break;
# Line 1225  void CCS_LoadPolicy(const char *filename Line 1314  void CCS_LoadPolicy(const char *filename
1314                  }                  }
1315          }          }
1316  #ifdef CONFIG_SAKURA  #ifdef CONFIG_SAKURA
1317          printk("SAKURA: 1.5.3-pre   2007/12/18\n");          printk("SAKURA: 1.6.0-pre   2008/01/24\n");
1318  #endif  #endif
1319  #ifdef CONFIG_TOMOYO  #ifdef CONFIG_TOMOYO
1320          printk("TOMOYO: 1.5.3-pre   2007/12/17\n");          printk("TOMOYO: 1.6.0-pre   2008/01/24\n");
1321  #endif  #endif
         //if (!profile_loaded) panic("No profiles loaded. Run policy loader using 'init=' option.\n");  
1322          printk("Mandatory Access Control activated.\n");          printk("Mandatory Access Control activated.\n");
1323          sbin_init_started = 1;          sbin_init_started = 1;
1324          ccs_log_level = KERN_WARNING;          ccs_log_level = KERN_WARNING;
# Line 1480  static int ReadUpdatesCounter(struct io_ Line 1568  static int ReadUpdatesCounter(struct io_
1568  static int ReadVersion(struct io_buffer *head)  static int ReadVersion(struct io_buffer *head)
1569  {  {
1570          if (!head->read_eof) {          if (!head->read_eof) {
1571                  if (io_printf(head, "1.5.3-pre") == 0) head->read_eof = 1;                  if (io_printf(head, "1.6.0-pre") == 0) head->read_eof = 1;
1572          }          }
1573          return 0;          return 0;
1574  }  }
# Line 1503  static int ReadSelfDomain(struct io_buff Line 1591  static int ReadSelfDomain(struct io_buff
1591          return 0;          return 0;
1592  }  }
1593    
1594  int CCS_OpenControl(const int type, struct file *file)  int CCS_OpenControl(const u8 type, struct file *file)
1595  {  {
1596          struct io_buffer *head = ccs_alloc(sizeof(*head));          struct io_buffer *head = ccs_alloc(sizeof(*head));
1597          if (!head) return -ENOMEM;          if (!head) return -ENOMEM;
# Line 1585  int CCS_OpenControl(const int type, stru Line 1673  int CCS_OpenControl(const int type, stru
1673                          return -ENOMEM;                          return -ENOMEM;
1674                  }                  }
1675          }          }
1676            { /* Set owner of this entry. */
1677                    struct inode *inode = file->f_dentry->d_inode;
1678                    head->uid = inode ? inode->i_uid : 0;
1679                    head->gid = inode ? inode->i_gid : 0;
1680            }
1681          file->private_data = head;          file->private_data = head;
1682          if (type == CCS_SELFDOMAIN) CCS_ReadControl(file, NULL, 0);          if (type == CCS_SELFDOMAIN) CCS_ReadControl(file, NULL, 0);
1683          else if (head->write == WriteAnswer) atomic_inc(&queryd_watcher);          else if (head->write == WriteAnswer) atomic_inc(&queryd_watcher);
# Line 1632  int CCS_WriteControl(struct file *file, Line 1725  int CCS_WriteControl(struct file *file,
1725          char *cp0 = head->write_buf;          char *cp0 = head->write_buf;
1726          if (!head->write) return -ENOSYS;          if (!head->write) return -ENOSYS;
1727          if (!access_ok(VERIFY_READ, buffer, buffer_len)) return -EFAULT;          if (!access_ok(VERIFY_READ, buffer, buffer_len)) return -EFAULT;
1728          if (!isRoot()) return -EPERM;          if (!isRoot(head)) return -EPERM;
1729          if (head->write != WritePID && !IsPolicyManager()) {          if (head->write != WritePID && !IsPolicyManager()) {
1730                  return -EPERM; /* Forbid updating policies for non manager programs. */                  return -EPERM; /* Forbid updating policies for non manager programs. */
1731          }          }
# Line 1670  int CCS_CloseControl(struct file *file) Line 1763  int CCS_CloseControl(struct file *file)
1763          file->private_data = NULL;          file->private_data = NULL;
1764          return 0;          return 0;
1765  }  }
1766    
1767    void *alloc_acl_element(const u8 acl_type, const struct condition_list *condition)
1768    {
1769            int len;
1770            struct acl_info *ptr;
1771            switch (acl_type) {
1772            case TYPE_SINGLE_PATH_ACL:
1773                    len = sizeof(struct single_path_acl_record);
1774                    break;
1775            case TYPE_DOUBLE_PATH_ACL:
1776                    len = sizeof(struct double_path_acl_record);
1777                    break;
1778            case TYPE_ARGV0_ACL:
1779                    len = sizeof(struct argv0_acl_record);
1780                    break;
1781            case TYPE_ENV_ACL:
1782                    len = sizeof(struct env_acl_record);
1783                    break;
1784            case TYPE_CAPABILITY_ACL:
1785                    len = sizeof(struct capability_acl_record);
1786                    break;
1787            case TYPE_IP_NETWORK_ACL:
1788                    len = sizeof(struct ip_network_acl_record);
1789                    break;
1790            case TYPE_SIGNAL_ACL:
1791                    len = sizeof(struct signal_acl_record);
1792                    break;
1793            default:
1794                    return NULL;
1795            }
1796            if (!condition) len -= sizeof(ptr->cond);
1797            ptr = alloc_element(len);
1798            if (!ptr) return NULL;
1799            if (condition) {
1800                    ptr->cond = condition;
1801                    ptr->type = acl_type | ACL_WITH_CONDITION;
1802                    return ptr;
1803            }
1804            ptr = (void *) (((u8 *) ptr) - sizeof(ptr->cond));
1805            ptr->type = acl_type;
1806            return ptr;
1807    }
1808    
1809    const struct condition_list *GetConditionPart(const struct acl_info *acl)
1810    {
1811            return (acl->type & ACL_WITH_CONDITION) ? acl->cond : NULL;
1812    }
Legend:
Removed from v.813  
changed lines
  Added in v.924
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ