オープンソース・ソフトウェアの開発とダウンロード

TOMOYO

Subversion リポジトリの参照

/[tomoyo]/trunk/1.8.x/ccs-patch/security/ccsecurity/policy_io.c

Diff of /trunk/1.8.x/ccs-patch/security/ccsecurity/policy_io.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 4056 by kumaneko, Sat Oct 9 23:48:20 2010 UTC revision 4280 by kumaneko, Fri Dec 31 02:05:48 2010 UTC
# Line 3  Line 3 
3   *   *
4   * Copyright (C) 2005-2010  NTT DATA CORPORATION   * Copyright (C) 2005-2010  NTT DATA CORPORATION
5   *   *
6   * Version: 1.8.0-pre   2010/10/10   * Version: 1.8.0+   2010/12/31
7     */
8    
9    #include "internal.h"
10    
11    #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
12    
13    /**
14     * __wait_event_interruptible_timeout - Sleep until a condition gets true or a timeout elapses.
15   *   *
16   * This file is applicable to both 2.4.30 and 2.6.11 and later.   * @wq:        The waitqueue to wait on.
17   * See README.ccs for ChangeLog.   * @condition: A C expression for the event to wait for.
18     * @ret:       Timeout, in jiffies.
19     *
20     * Returns 0 if the @timeout elapsed, -ERESTARTSYS if it was interrupted by a
21     * signal, and the remaining jiffies otherwise if the condition evaluated to
22     * true before the timeout elapsed.
23     *
24     * This is for compatibility with older kernels.
25     */
26    #define __wait_event_interruptible_timeout(wq, condition, ret)          \
27    do {                                                                    \
28            wait_queue_t __wait;                                            \
29            init_waitqueue_entry(&__wait, current);                         \
30                                                                            \
31            add_wait_queue(&wq, &__wait);                                   \
32            for (;;) {                                                      \
33                    set_current_state(TASK_INTERRUPTIBLE);                  \
34                    if (condition)                                          \
35                            break;                                          \
36                    if (!signal_pending(current)) {                         \
37                            ret = schedule_timeout(ret);                    \
38                            if (!ret)                                       \
39                                    break;                                  \
40                            continue;                                       \
41                    }                                                       \
42                    ret = -ERESTARTSYS;                                     \
43                    break;                                                  \
44            }                                                               \
45            current->state = TASK_RUNNING;                                  \
46            remove_wait_queue(&wq, &__wait);                                \
47    } while (0)
48    
49    /**
50     * wait_event_interruptible_timeout - Sleep until a condition gets true or a timeout elapses.
51     *
52     * @wq:        The waitqueue to wait on.
53     * @condition: A C expression for the event to wait for.
54     * @timeout:   Timeout, in jiffies.
55     *
56     * Returns 0 if the @timeout elapsed, -ERESTARTSYS if it was interrupted by a
57     * signal, and the remaining jiffies otherwise if the condition evaluated to
58     * true before the timeout elapsed.
59     *
60     * This is for compatibility with older kernels.
61     */
62    #define wait_event_interruptible_timeout(wq, condition, timeout)        \
63    ({                                                                      \
64            long __ret = timeout;                                           \
65            if (!(condition))                                               \
66                    __wait_event_interruptible_timeout(wq, condition, __ret); \
67            __ret;                                                          \
68    })
69    
70    #endif
71    
72    /**
73     * list_for_each_cookie - iterate over a list with cookie.
74   *   *
75     * @pos:  Pointer to "struct list_head".
76     * @head: Pointer to "struct list_head".
77   */   */
78    #define list_for_each_cookie(pos, head)                                 \
79            for (pos = pos ? pos : srcu_dereference((head)->next, &ccs_ss); \
80                 pos != (head); pos = srcu_dereference(pos->next, &ccs_ss))
81    
 #include "internal.h"  
82    
83  /* Profile version. Currently only 20100903 is defined. */  /* Profile version. Currently only 20100903 is defined. */
84  static unsigned int ccs_profile_version;  static unsigned int ccs_profile_version;
# Line 18  static unsigned int ccs_profile_version; Line 86  static unsigned int ccs_profile_version;
86  /* Profile table. Memory is allocated as needed. */  /* Profile table. Memory is allocated as needed. */
87  static struct ccs_profile *ccs_profile_ptr[CCS_MAX_PROFILES];  static struct ccs_profile *ccs_profile_ptr[CCS_MAX_PROFILES];
88    
89  /* String table for functionality that takes 4 modes. */  /* String table for operation mode. */
90  const char * const ccs_mode[CCS_CONFIG_MAX_MODE] = {  const char * const ccs_mode[CCS_CONFIG_MAX_MODE] = {
91          [CCS_CONFIG_DISABLED]   = "disabled",          [CCS_CONFIG_DISABLED]   = "disabled",
92          [CCS_CONFIG_LEARNING]   = "learning",          [CCS_CONFIG_LEARNING]   = "learning",
# Line 26  const char * const ccs_mode[CCS_CONFIG_M Line 94  const char * const ccs_mode[CCS_CONFIG_M
94          [CCS_CONFIG_ENFORCING]  = "enforcing"          [CCS_CONFIG_ENFORCING]  = "enforcing"
95  };  };
96    
97  /* String table for /proc/ccs/profile */  /* String table for /proc/ccs/profile interface. */
98  const char * const ccs_mac_keywords[CCS_MAX_MAC_INDEX  const char * const ccs_mac_keywords[CCS_MAX_MAC_INDEX
99                                      + CCS_MAX_MAC_CATEGORY_INDEX] = {                                      + CCS_MAX_MAC_CATEGORY_INDEX] = {
100            /* CONFIG::file group */
101          [CCS_MAC_FILE_EXECUTE]    = "execute",          [CCS_MAC_FILE_EXECUTE]    = "execute",
102          [CCS_MAC_FILE_OPEN]       = "open",          [CCS_MAC_FILE_OPEN]       = "open",
103          [CCS_MAC_FILE_CREATE]     = "create",          [CCS_MAC_FILE_CREATE]     = "create",
104          [CCS_MAC_FILE_UNLINK]     = "unlink",          [CCS_MAC_FILE_UNLINK]     = "unlink",
105            [CCS_MAC_FILE_GETATTR]    = "getattr",
106          [CCS_MAC_FILE_MKDIR]      = "mkdir",          [CCS_MAC_FILE_MKDIR]      = "mkdir",
107          [CCS_MAC_FILE_RMDIR]      = "rmdir",          [CCS_MAC_FILE_RMDIR]      = "rmdir",
108          [CCS_MAC_FILE_MKFIFO]     = "mkfifo",          [CCS_MAC_FILE_MKFIFO]     = "mkfifo",
# Line 51  const char * const ccs_mac_keywords[CCS_ Line 121  const char * const ccs_mac_keywords[CCS_
121          [CCS_MAC_FILE_MOUNT]      = "mount",          [CCS_MAC_FILE_MOUNT]      = "mount",
122          [CCS_MAC_FILE_UMOUNT]     = "unmount",          [CCS_MAC_FILE_UMOUNT]     = "unmount",
123          [CCS_MAC_FILE_PIVOT_ROOT] = "pivot_root",          [CCS_MAC_FILE_PIVOT_ROOT] = "pivot_root",
124            /* CONFIG::misc group */
125          [CCS_MAC_ENVIRON] = "env",          [CCS_MAC_ENVIRON] = "env",
126            /* CONFIG::network group */
127          [CCS_MAC_NETWORK_INET_STREAM_BIND]       = "inet_stream_bind",          [CCS_MAC_NETWORK_INET_STREAM_BIND]       = "inet_stream_bind",
128          [CCS_MAC_NETWORK_INET_STREAM_LISTEN]     = "inet_stream_listen",          [CCS_MAC_NETWORK_INET_STREAM_LISTEN]     = "inet_stream_listen",
129          [CCS_MAC_NETWORK_INET_STREAM_CONNECT]    = "inet_stream_connect",          [CCS_MAC_NETWORK_INET_STREAM_CONNECT]    = "inet_stream_connect",
# Line 73  const char * const ccs_mac_keywords[CCS_ Line 145  const char * const ccs_mac_keywords[CCS_
145          [CCS_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  = "unix_seqpacket_listen",          [CCS_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  = "unix_seqpacket_listen",
146          [CCS_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",          [CCS_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] = "unix_seqpacket_connect",
147          [CCS_MAC_NETWORK_UNIX_SEQPACKET_ACCEPT]  = "unix_seqpacket_accept",          [CCS_MAC_NETWORK_UNIX_SEQPACKET_ACCEPT]  = "unix_seqpacket_accept",
148            /* CONFIG::ipc group */
149          [CCS_MAC_SIGNAL] = "signal",          [CCS_MAC_SIGNAL] = "signal",
150            /* CONFIG::capability group */
151          [CCS_MAC_CAPABILITY_USE_ROUTE_SOCKET]  = "use_route",          [CCS_MAC_CAPABILITY_USE_ROUTE_SOCKET]  = "use_route",
152          [CCS_MAC_CAPABILITY_USE_PACKET_SOCKET] = "use_packet",          [CCS_MAC_CAPABILITY_USE_PACKET_SOCKET] = "use_packet",
153          [CCS_MAC_CAPABILITY_SYS_REBOOT]        = "SYS_REBOOT",          [CCS_MAC_CAPABILITY_SYS_REBOOT]        = "SYS_REBOOT",
# Line 84  const char * const ccs_mac_keywords[CCS_ Line 158  const char * const ccs_mac_keywords[CCS_
158          [CCS_MAC_CAPABILITY_USE_KERNEL_MODULE] = "use_kernel_module",          [CCS_MAC_CAPABILITY_USE_KERNEL_MODULE] = "use_kernel_module",
159          [CCS_MAC_CAPABILITY_SYS_KEXEC_LOAD]    = "SYS_KEXEC_LOAD",          [CCS_MAC_CAPABILITY_SYS_KEXEC_LOAD]    = "SYS_KEXEC_LOAD",
160          [CCS_MAC_CAPABILITY_SYS_PTRACE]        = "SYS_PTRACE",          [CCS_MAC_CAPABILITY_SYS_PTRACE]        = "SYS_PTRACE",
161            /* CONFIG group */
162          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_FILE]       = "file",          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_FILE]       = "file",
163          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_NETWORK]    = "network",          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_NETWORK]    = "network",
164          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_MISC]       = "misc",          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_MISC]       = "misc",
# Line 91  const char * const ccs_mac_keywords[CCS_ Line 166  const char * const ccs_mac_keywords[CCS_
166          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_CAPABILITY] = "capability",          [CCS_MAX_MAC_INDEX + CCS_MAC_CATEGORY_CAPABILITY] = "capability",
167  };  };
168    
169    /* String table for path operation. */
170  const char * const ccs_path_keyword[CCS_MAX_PATH_OPERATION] = {  const char * const ccs_path_keyword[CCS_MAX_PATH_OPERATION] = {
171          [CCS_TYPE_EXECUTE]    = "execute",          [CCS_TYPE_EXECUTE]    = "execute",
172          [CCS_TYPE_READ]       = "read",          [CCS_TYPE_READ]       = "read",
173          [CCS_TYPE_WRITE]      = "write",          [CCS_TYPE_WRITE]      = "write",
174          [CCS_TYPE_APPEND]     = "append",          [CCS_TYPE_APPEND]     = "append",
175          [CCS_TYPE_UNLINK]     = "unlink",          [CCS_TYPE_UNLINK]     = "unlink",
176            [CCS_TYPE_GETATTR]    = "getattr",
177          [CCS_TYPE_RMDIR]      = "rmdir",          [CCS_TYPE_RMDIR]      = "rmdir",
178          [CCS_TYPE_TRUNCATE]   = "truncate",          [CCS_TYPE_TRUNCATE]   = "truncate",
179          [CCS_TYPE_SYMLINK]    = "symlink",          [CCS_TYPE_SYMLINK]    = "symlink",
# Line 104  const char * const ccs_path_keyword[CCS_ Line 181  const char * const ccs_path_keyword[CCS_
181          [CCS_TYPE_UMOUNT]     = "unmount",          [CCS_TYPE_UMOUNT]     = "unmount",
182  };  };
183    
184    /* String table for categories. */
185  static const char * const ccs_category_keywords[CCS_MAX_MAC_CATEGORY_INDEX] = {  static const char * const ccs_category_keywords[CCS_MAX_MAC_CATEGORY_INDEX] = {
186          [CCS_MAC_CATEGORY_FILE]       = "file",          [CCS_MAC_CATEGORY_FILE]       = "file",
187          [CCS_MAC_CATEGORY_NETWORK]    = "network",          [CCS_MAC_CATEGORY_NETWORK]    = "network",
# Line 112  static const char * const ccs_category_k Line 190  static const char * const ccs_category_k
190          [CCS_MAC_CATEGORY_CAPABILITY] = "capability",          [CCS_MAC_CATEGORY_CAPABILITY] = "capability",
191  };  };
192    
193    /* String table for conditions. */
194  const char * const ccs_condition_keyword[CCS_MAX_CONDITION_KEYWORD] = {  const char * const ccs_condition_keyword[CCS_MAX_CONDITION_KEYWORD] = {
195          [CCS_TASK_UID]             = "task.uid",          [CCS_TASK_UID]             = "task.uid",
196          [CCS_TASK_EUID]            = "task.euid",          [CCS_TASK_EUID]            = "task.euid",
# Line 176  const char * const ccs_condition_keyword Line 255  const char * const ccs_condition_keyword
255          [CCS_PATH2_PARENT_PERM]    = "path2.parent.perm",          [CCS_PATH2_PARENT_PERM]    = "path2.parent.perm",
256  };  };
257    
258    /* String table for PREFERENCE keyword. */
259  static const char * const ccs_pref_keywords[CCS_MAX_PREF] = {  static const char * const ccs_pref_keywords[CCS_MAX_PREF] = {
260          [CCS_PREF_MAX_GRANT_LOG]      = "max_grant_log",          [CCS_PREF_MAX_AUDIT_LOG]      = "max_audit_log",
         [CCS_PREF_MAX_REJECT_LOG]     = "max_reject_log",  
261          [CCS_PREF_MAX_LEARNING_ENTRY] = "max_learning_entry",          [CCS_PREF_MAX_LEARNING_ENTRY] = "max_learning_entry",
262          [CCS_PREF_ENFORCING_PENALTY]  = "enforcing_penalty",          [CCS_PREF_ENFORCING_PENALTY]  = "enforcing_penalty",
263  };  };
# Line 190  static bool ccs_manage_by_non_root; Line 269  static bool ccs_manage_by_non_root;
269   * ccs_yesno - Return "yes" or "no".   * ccs_yesno - Return "yes" or "no".
270   *   *
271   * @value: Bool value.   * @value: Bool value.
272     *
273     * Returns "yes" if @value is not 0, "no" otherwise.
274   */   */
275  static const char *ccs_yesno(const unsigned int value)  const char *ccs_yesno(const unsigned int value)
276  {  {
277          return value ? "yes" : "no";          return value ? "yes" : "no";
278  }  }
279    
280    /* Prototype fpr ccs_addprintf(). */
281  static void ccs_addprintf(char *buffer, int len, const char *fmt, ...)  static void ccs_addprintf(char *buffer, int len, const char *fmt, ...)
282       __attribute__ ((format(printf, 3, 4)));          __attribute__ ((format(printf, 3, 4)));
283    
284    /**
285     * ccs_addprintf - strncat()-like-snprintf().
286     *
287     * @buffer: Buffer to write to. Must be '\0'-terminated.
288     * @len:    Size of @buffer.
289     * @fmt:    The printf()'s format string, followed by parameters.
290     *
291     * Returns nothing.
292     */
293  static void ccs_addprintf(char *buffer, int len, const char *fmt, ...)  static void ccs_addprintf(char *buffer, int len, const char *fmt, ...)
294  {  {
295          va_list args;          va_list args;
# Line 211  static void ccs_addprintf(char *buffer, Line 302  static void ccs_addprintf(char *buffer,
302  /**  /**
303   * ccs_flush - Flush queued string to userspace's buffer.   * ccs_flush - Flush queued string to userspace's buffer.
304   *   *
305   * @head:   Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
306   *   *
307   * Returns true if all data was flushed, false otherwise.   * Returns true if all data was flushed, false otherwise.
308   */   */
# Line 257  static bool ccs_flush(struct ccs_io_buff Line 348  static bool ccs_flush(struct ccs_io_buff
348   * @head:   Pointer to "struct ccs_io_buffer".   * @head:   Pointer to "struct ccs_io_buffer".
349   * @string: String to print.   * @string: String to print.
350   *   *
351     * Returns nothing.
352     *
353   * Note that @string has to be kept valid until @head is kfree()d.   * Note that @string has to be kept valid until @head is kfree()d.
354   * This means that char[] allocated on stack memory cannot be passed to   * This means that char[] allocated on stack memory cannot be passed to
355   * this function. Use ccs_io_printf() for char[] allocated on stack memory.   * this function. Use ccs_io_printf() for char[] allocated on stack memory.
# Line 275  static void ccs_set_string(struct ccs_io Line 368  static void ccs_set_string(struct ccs_io
368   *   *
369   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
370   * @fmt:  The printf()'s format string, followed by parameters.   * @fmt:  The printf()'s format string, followed by parameters.
371     *
372     * Returns nothing.
373   */   */
374  void ccs_io_printf(struct ccs_io_buffer *head, const char *fmt, ...)  void ccs_io_printf(struct ccs_io_buffer *head, const char *fmt, ...)
375  {  {
# Line 295  void ccs_io_printf(struct ccs_io_buffer Line 390  void ccs_io_printf(struct ccs_io_buffer
390          ccs_set_string(head, head->read_buf + pos);          ccs_set_string(head, head->read_buf + pos);
391  }  }
392    
393    /**
394     * ccs_set_space - Put a space to "struct ccs_io_buffer" structure.
395     *
396     * @head: Pointer to "struct ccs_io_buffer".
397     *
398     * Returns nothing.
399     */
400  static void ccs_set_space(struct ccs_io_buffer *head)  static void ccs_set_space(struct ccs_io_buffer *head)
401  {  {
402          ccs_set_string(head, " ");          ccs_set_string(head, " ");
403  }  }
404    
405    /**
406     * ccs_set_lf - Put a line feed to "struct ccs_io_buffer" structure.
407     *
408     * @head: Pointer to "struct ccs_io_buffer".
409     *
410     * Returns nothing.
411     */
412  static bool ccs_set_lf(struct ccs_io_buffer *head)  static bool ccs_set_lf(struct ccs_io_buffer *head)
413  {  {
414          ccs_set_string(head, "\n");          ccs_set_string(head, "\n");
# Line 332  static struct ccs_profile *ccs_assign_pr Line 441  static struct ccs_profile *ccs_assign_pr
441                          CCS_CONFIG_WANT_GRANT_LOG | CCS_CONFIG_WANT_REJECT_LOG;                          CCS_CONFIG_WANT_GRANT_LOG | CCS_CONFIG_WANT_REJECT_LOG;
442                  memset(ptr->config, CCS_CONFIG_USE_DEFAULT,                  memset(ptr->config, CCS_CONFIG_USE_DEFAULT,
443                         sizeof(ptr->config));                         sizeof(ptr->config));
444                  ptr->pref[CCS_PREF_MAX_GRANT_LOG] =                  ptr->pref[CCS_PREF_MAX_AUDIT_LOG] =
445                          CONFIG_CCSECURITY_MAX_GRANT_LOG;                          CONFIG_CCSECURITY_MAX_AUDIT_LOG;
                 ptr->pref[CCS_PREF_MAX_REJECT_LOG] =  
                         CONFIG_CCSECURITY_MAX_REJECT_LOG;  
446                  ptr->pref[CCS_PREF_MAX_LEARNING_ENTRY] =                  ptr->pref[CCS_PREF_MAX_LEARNING_ENTRY] =
447                          CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY;                          CONFIG_CCSECURITY_MAX_ACCEPT_ENTRY;
448                  mb(); /* Avoid out-of-order execution. */                  mb(); /* Avoid out-of-order execution. */
# Line 350  out: Line 457  out:
457    
458  /**  /**
459   * ccs_check_profile - Check all profiles currently assigned to domains are defined.   * ccs_check_profile - Check all profiles currently assigned to domains are defined.
460     *
461     * Returns nothing.
462   */   */
463  static void ccs_check_profile(void)  static void ccs_check_profile(void)
464  {  {
# Line 360  static void ccs_check_profile(void) Line 469  static void ccs_check_profile(void)
469                  const u8 profile = domain->profile;                  const u8 profile = domain->profile;
470                  if (ccs_profile_ptr[profile])                  if (ccs_profile_ptr[profile])
471                          continue;                          continue;
472                  printk(KERN_ERR "You need to define profile %u before using it.\n",                  printk(KERN_ERR "Profile %u must be defined before using it.\n",
473                         profile);                         profile);
474                  printk(KERN_ERR "Please see http://tomoyo.sourceforge.jp/1.8/ "                  printk(KERN_ERR "Please see http://tomoyo.sourceforge.jp/1.8/ "
475                         "for more information.\n");                         "for more information.\n");
# Line 369  static void ccs_check_profile(void) Line 478  static void ccs_check_profile(void)
478          }          }
479          ccs_read_unlock(idx);          ccs_read_unlock(idx);
480          if (ccs_profile_version != 20100903) {          if (ccs_profile_version != 20100903) {
481                  printk(KERN_ERR "You need to install userland programs for "                  printk(KERN_ERR "Userland tools must be installed for "
482                         "TOMOYO 1.8 and initialize policy configuration.\n");                         "TOMOYO 1.8, and policy must be initialized.\n");
483                  printk(KERN_ERR "Please see http://tomoyo.sourceforge.jp/1.8/ "                  printk(KERN_ERR "Please see http://tomoyo.sourceforge.jp/1.8/ "
484                         "for more information.\n");                         "for more information.\n");
485                  panic("Profile version %u is not supported.\n",                  panic("Profile version %u is not supported.\n",
486                        ccs_profile_version);                        ccs_profile_version);
487          }          }
488          printk(KERN_INFO "CCSecurity: 1.8.0-pre   2010/10/10\n");          printk(KERN_INFO "CCSecurity: 1.8.0+   2010/12/31\n");
489          printk(KERN_INFO "Mandatory Access Control activated.\n");          printk(KERN_INFO "Mandatory Access Control activated.\n");
490  }  }
491    
# Line 396  struct ccs_profile *ccs_profile(const u8 Line 505  struct ccs_profile *ccs_profile(const u8
505          return ptr;          return ptr;
506  }  }
507    
508    /**
509     * ccs_find_yesno - Find values for specified keyword.
510     *
511     * @string: String to check.
512     * @find:   Name of keyword.
513     *
514     * Returns 1 if "@find=yes" was found, 0 if "@find=no" was found, -1 otherwise.
515     */
516  static s8 ccs_find_yesno(const char *string, const char *find)  static s8 ccs_find_yesno(const char *string, const char *find)
517  {  {
518          const char *cp = strstr(string, find);          const char *cp = strstr(string, find);
# Line 409  static s8 ccs_find_yesno(const char *str Line 526  static s8 ccs_find_yesno(const char *str
526          return -1;          return -1;
527  }  }
528    
529    /**
530     * ccs_set_uint - Set value for specified preference.
531     *
532     * @i:      Pointer to "unsigned int".
533     * @string: String to check.
534     * @find:   Name of keyword.
535     *
536     * Returns nothing.
537     */
538  static void ccs_set_uint(unsigned int *i, const char *string, const char *find)  static void ccs_set_uint(unsigned int *i, const char *string, const char *find)
539  {  {
540          const char *cp = strstr(string, find);          const char *cp = strstr(string, find);
# Line 416  static void ccs_set_uint(unsigned int *i Line 542  static void ccs_set_uint(unsigned int *i
542                  sscanf(cp + strlen(find), "=%u", i);                  sscanf(cp + strlen(find), "=%u", i);
543  }  }
544    
545    /**
546     * ccs_set_mode - Set mode for specified profile.
547     *
548     * @name:    Name of functionality.
549     * @value:   Mode for @name.
550     * @profile: Pointer to "struct ccs_profile".
551     *
552     * Returns 0 on success, negative value otherwise.
553     */
554  static int ccs_set_mode(char *name, const char *value,  static int ccs_set_mode(char *name, const char *value,
555                          struct ccs_profile *profile)                          struct ccs_profile *profile)
556  {  {
# Line 526  static int ccs_write_profile(struct ccs_ Line 661  static int ccs_write_profile(struct ccs_
661          return ccs_set_mode(data, cp, profile);          return ccs_set_mode(data, cp, profile);
662  }  }
663    
664    /**
665     * ccs_print_config - Print mode for specified functionality.
666     *
667     * @head:   Pointer to "struct ccs_io_buffer".
668     * @config: Mode for that functionality.
669     *
670     * Returns nothing.
671     *
672     * Caller prints functionality's name.
673     */
674  static void ccs_print_config(struct ccs_io_buffer *head, const u8 config)  static void ccs_print_config(struct ccs_io_buffer *head, const u8 config)
675  {  {
676          ccs_io_printf(head, "={ mode=%s grant_log=%s reject_log=%s }\n",          ccs_io_printf(head, "={ mode=%s grant_log=%s reject_log=%s }\n",
# Line 538  static void ccs_print_config(struct ccs_ Line 683  static void ccs_print_config(struct ccs_
683   * ccs_read_profile - Read profile table.   * ccs_read_profile - Read profile table.
684   *   *
685   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
686     *
687     * Returns nothing.
688   */   */
689  static void ccs_read_profile(struct ccs_io_buffer *head)  static void ccs_read_profile(struct ccs_io_buffer *head)
690  {  {
# Line 614  next: Line 761  next:
761                  goto next;                  goto next;
762  }  }
763    
764    /**
765     * ccs_same_manager - Check for duplicated "struct ccs_manager" entry.
766     *
767     * @a: Pointer to "struct ccs_acl_head".
768     * @b: Pointer to "struct ccs_acl_head".
769     *
770     * Returns true if @a == @b, false otherwise.
771     */
772  static bool ccs_same_manager(const struct ccs_acl_head *a,  static bool ccs_same_manager(const struct ccs_acl_head *a,
773                               const struct ccs_acl_head *b)                               const struct ccs_acl_head *b)
774  {  {
# Line 674  static int ccs_write_manager(struct ccs_ Line 829  static int ccs_write_manager(struct ccs_
829   *   *
830   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
831   *   *
832     * Returns nothing.
833     *
834   * Caller holds ccs_read_lock().   * Caller holds ccs_read_lock().
835   */   */
836  static void ccs_read_manager(struct ccs_io_buffer *head)  static void ccs_read_manager(struct ccs_io_buffer *head)
# Line 801  static bool ccs_select_one(struct ccs_io Line 958  static bool ccs_select_one(struct ccs_io
958          return true;          return true;
959  }  }
960    
961    /**
962     * ccs_same_handler_acl - Check for duplicated "struct ccs_handler_acl" entry.
963     *
964     * @a: Pointer to "struct ccs_acl_info".
965     * @b: Pointer to "struct ccs_acl_info".
966     *
967     * Returns true if @a == @b, false otherwise.
968     */
969  static bool ccs_same_handler_acl(const struct ccs_acl_info *a,  static bool ccs_same_handler_acl(const struct ccs_acl_info *a,
970                                   const struct ccs_acl_info *b)                                   const struct ccs_acl_info *b)
971  {  {
# Line 809  static bool ccs_same_handler_acl(const s Line 974  static bool ccs_same_handler_acl(const s
974          return p1->handler == p2->handler;          return p1->handler == p2->handler;
975  }  }
976    
977    /**
978     * ccs_same_task_acl - Check for duplicated "struct ccs_task_acl" entry.
979     *
980     * @a: Pointer to "struct ccs_acl_info".
981     * @b: Pointer to "struct ccs_acl_info".
982     *
983     * Returns true if @a == @b, false otherwise.
984     */
985  static bool ccs_same_task_acl(const struct ccs_acl_info *a,  static bool ccs_same_task_acl(const struct ccs_acl_info *a,
986                                const struct ccs_acl_info *b)                                const struct ccs_acl_info *b)
987  {  {
# Line 868  static int ccs_write_task(struct ccs_acl Line 1041  static int ccs_write_task(struct ccs_acl
1041          return error;          return error;
1042  }  }
1043    
1044    /**
1045     * ccs_write_domain2 - Write domain policy.
1046     *
1047     * @data:      Policy to be interpreted.
1048     * @domain:    Pointer to "struct ccs_domain_info".
1049     * @is_delete: True if it is a delete request.
1050     *
1051     * Returns 0 on success, negative value otherwise.
1052     */
1053  static int ccs_write_domain2(char *data, struct ccs_domain_info *domain,  static int ccs_write_domain2(char *data, struct ccs_domain_info *domain,
1054                               const bool is_delete)                               const bool is_delete)
1055  {  {
# Line 897  static int ccs_write_domain2(char *data, Line 1079  static int ccs_write_domain2(char *data,
1079          return -EINVAL;          return -EINVAL;
1080  }  }
1081    
1082    /* String table for domain flags. */
1083  const char * const ccs_dif[CCS_MAX_DOMAIN_INFO_FLAGS] = {  const char * const ccs_dif[CCS_MAX_DOMAIN_INFO_FLAGS] = {
1084          [CCS_DIF_QUOTA_WARNED]      = "quota_exceeded\n",          [CCS_DIF_QUOTA_WARNED]      = "quota_exceeded\n",
1085          [CCS_DIF_TRANSITION_FAILED] = "transition_failed\n",          [CCS_DIF_TRANSITION_FAILED] = "transition_failed\n",
# Line 942  static int ccs_write_domain(struct ccs_i Line 1125  static int ccs_write_domain(struct ccs_i
1125          if (sscanf(data, "use_profile %u\n", &profile) == 1          if (sscanf(data, "use_profile %u\n", &profile) == 1
1126              && profile < CCS_MAX_PROFILES) {              && profile < CCS_MAX_PROFILES) {
1127                  if (!ccs_policy_loaded || ccs_profile_ptr[(u8) profile])                  if (!ccs_policy_loaded || ccs_profile_ptr[(u8) profile])
1128                          domain->profile = (u8) profile;                          if (!is_delete)
1129                                    domain->profile = (u8) profile;
1130                  return 0;                  return 0;
1131          }          }
1132          if (sscanf(data, "use_group %u\n", &profile) == 1          if (sscanf(data, "use_group %u\n", &profile) == 1
1133              && profile < CCS_MAX_ACL_GROUPS) {              && profile < CCS_MAX_ACL_GROUPS) {
1134                  domain->group = (u8) profile;                  if (!is_delete)
1135                            domain->group = (u8) profile;
1136                  return 0;                  return 0;
1137          }          }
1138          for (profile = 0; profile < CCS_MAX_DOMAIN_INFO_FLAGS; profile++) {          for (profile = 0; profile < CCS_MAX_DOMAIN_INFO_FLAGS; profile++) {
# Line 965  static int ccs_write_domain(struct ccs_i Line 1150  static int ccs_write_domain(struct ccs_i
1150   *   *
1151   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1152   * @ptr:  Pointer to "struct ccs_name_union".   * @ptr:  Pointer to "struct ccs_name_union".
1153     *
1154     * Returns nothing.
1155   */   */
1156  static void ccs_print_name_union(struct ccs_io_buffer *head,  static void ccs_print_name_union(struct ccs_io_buffer *head,
1157                                   const struct ccs_name_union *ptr)                                   const struct ccs_name_union *ptr)
# Line 989  static void ccs_print_name_union(struct Line 1176  static void ccs_print_name_union(struct
1176   *   *
1177   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1178   * @ptr:  Pointer to "struct ccs_number_union".   * @ptr:  Pointer to "struct ccs_number_union".
1179     *
1180     * Returns nothing.
1181   */   */
1182  static void ccs_print_number_union(struct ccs_io_buffer *head,  static void ccs_print_number_union(struct ccs_io_buffer *head,
1183                                     const struct ccs_number_union *ptr)                                     const struct ccs_number_union *ptr)
# Line 1154  static bool ccs_print_condition(struct c Line 1343  static bool ccs_print_condition(struct c
1343                  head->r.cond_step++;                  head->r.cond_step++;
1344                  /* fall through */                  /* fall through */
1345          case 3:          case 3:
1346                  if (cond->grant_log)                  if (cond->grant_log != CCS_GRANTLOG_AUTO)
1347                          ccs_io_printf(head, " grant_log=%s",                          ccs_io_printf(head, " grant_log=%s",
1348                                        ccs_yesno(cond->grant_log == 2));                                        ccs_yesno(cond->grant_log ==
1349                                                    CCS_GRANTLOG_YES));
1350                  if (cond->transit) {                  if (cond->transit) {
1351                          ccs_set_string(head, " auto_domain_transitition=\"");                          ccs_set_string(head, " auto_domain_transition=\"");
1352                          ccs_set_string(head, cond->transit->name);                          ccs_set_string(head, cond->transit->name);
1353                          ccs_set_string(head, "\"");                          ccs_set_string(head, "\"");
1354                  }                  }
# Line 1184  static u8 ccs_fns(const u8 perm, u8 bit) Line 1374  static u8 ccs_fns(const u8 perm, u8 bit)
1374          return bit;          return bit;
1375  }  }
1376    
1377    /**
1378     * ccs_set_group - Print "acl_group " header keyword.
1379     *
1380     * @head: Pointer to "struct ccs_io_buffer".
1381     *
1382     * Returns nothing.
1383     */
1384  static void ccs_set_group(struct ccs_io_buffer *head)  static void ccs_set_group(struct ccs_io_buffer *head)
1385  {  {
1386          if (head->type == CCS_EXCEPTIONPOLICY)          if (head->type == CCS_EXCEPTIONPOLICY)
# Line 1394  done: Line 1591  done:
1591   * @domain: Pointer to "struct ccs_domain_info".   * @domain: Pointer to "struct ccs_domain_info".
1592   * @index:  Index number.   * @index:  Index number.
1593   *   *
  * Caller holds ccs_read_lock().  
  *  
1594   * Returns true on success, false otherwise.   * Returns true on success, false otherwise.
1595     *
1596     * Caller holds ccs_read_lock().
1597   */   */
1598  static bool ccs_read_domain2(struct ccs_io_buffer *head,  static bool ccs_read_domain2(struct ccs_io_buffer *head,
1599                               struct ccs_domain_info *domain,                               struct ccs_domain_info *domain,
# Line 1417  static bool ccs_read_domain2(struct ccs_ Line 1614  static bool ccs_read_domain2(struct ccs_
1614   *   *
1615   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1616   *   *
1617     * Returns nothing.
1618     *
1619   * Caller holds ccs_read_lock().   * Caller holds ccs_read_lock().
1620   */   */
1621  static void ccs_read_domain(struct ccs_io_buffer *head)  static void ccs_read_domain(struct ccs_io_buffer *head)
# Line 1503  static int ccs_write_domain_profile(stru Line 1702  static int ccs_write_domain_profile(stru
1702   *   *
1703   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1704   *   *
1705     * Returns nothing.
1706     *
1707   * This is equivalent to doing   * This is equivalent to doing
1708   *   *
1709   *     grep -A 1 '^<kernel>' /proc/ccs/domain_policy |   *     grep -A 1 '^<kernel>' /proc/ccs/domain_policy |
# Line 1531  static void ccs_read_domain_profile(stru Line 1732  static void ccs_read_domain_profile(stru
1732  }  }
1733    
1734  /**  /**
1735   * ccs_write_pid: Specify PID to obtain domainname.   * ccs_write_pid - Specify PID to obtain domainname.
1736   *   *
1737   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1738   *   *
# Line 1604  static void ccs_read_pid(struct ccs_io_b Line 1805  static void ccs_read_pid(struct ccs_io_b
1805          }          }
1806  }  }
1807    
1808    /* String table for domain transition control keywords. */
1809  static const char * const ccs_transition_type[CCS_MAX_TRANSITION_TYPE] = {  static const char * const ccs_transition_type[CCS_MAX_TRANSITION_TYPE] = {
1810          [CCS_TRANSITION_CONTROL_NO_INITIALIZE] = "no_initialize_domain ",          [CCS_TRANSITION_CONTROL_NO_INITIALIZE] = "no_initialize_domain ",
1811          [CCS_TRANSITION_CONTROL_INITIALIZE]    = "initialize_domain ",          [CCS_TRANSITION_CONTROL_INITIALIZE]    = "initialize_domain ",
# Line 1611  static const char * const ccs_transition Line 1813  static const char * const ccs_transition
1813          [CCS_TRANSITION_CONTROL_KEEP]          = "keep_domain ",          [CCS_TRANSITION_CONTROL_KEEP]          = "keep_domain ",
1814  };  };
1815    
1816    /* String table for grouping keywords. */
1817  static const char * const ccs_group_name[CCS_MAX_GROUP] = {  static const char * const ccs_group_name[CCS_MAX_GROUP] = {
1818          [CCS_PATH_GROUP]    = "path_group ",          [CCS_PATH_GROUP]    = "path_group ",
1819          [CCS_NUMBER_GROUP]  = "number_group ",          [CCS_NUMBER_GROUP]  = "number_group ",
# Line 1786  static bool ccs_read_policy(struct ccs_i Line 1989  static bool ccs_read_policy(struct ccs_i
1989   *   *
1990   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
1991   *   *
1992     * Returns nothing.
1993     *
1994   * Caller holds ccs_read_lock().   * Caller holds ccs_read_lock().
1995   */   */
1996  static void ccs_read_exception(struct ccs_io_buffer *head)  static void ccs_read_exception(struct ccs_io_buffer *head)
# Line 1815  static void ccs_read_exception(struct cc Line 2020  static void ccs_read_exception(struct cc
2020          head->r.eof = true;          head->r.eof = true;
2021  }  }
2022    
2023  /* Wait queue for ccs_query_list. */  /* Wait queue for kernel -> userspace notification. */
2024  static DECLARE_WAIT_QUEUE_HEAD(ccs_query_wait);  static DECLARE_WAIT_QUEUE_HEAD(ccs_query_wait);
2025    /* Wait queue for userspace -> kernel notification. */
2026  static DECLARE_WAIT_QUEUE_HEAD(ccs_answer_wait);  static DECLARE_WAIT_QUEUE_HEAD(ccs_answer_wait);
2027    
 /* Lock for manipulating ccs_query_list. */  
 static DEFINE_SPINLOCK(ccs_query_list_lock);  
   
2028  /* Structure for query. */  /* Structure for query. */
2029  struct ccs_query {  struct ccs_query {
2030          struct list_head list;          struct list_head list;
# Line 1836  struct ccs_query { Line 2039  struct ccs_query {
2039  /* The list for "struct ccs_query". */  /* The list for "struct ccs_query". */
2040  static LIST_HEAD(ccs_query_list);  static LIST_HEAD(ccs_query_list);
2041    
2042    /* Lock for manipulating ccs_query_list. */
2043    static DEFINE_SPINLOCK(ccs_query_list_lock);
2044    
2045  /* Number of "struct file" referring /proc/ccs/query interface. */  /* Number of "struct file" referring /proc/ccs/query interface. */
2046  static atomic_t ccs_query_observers = ATOMIC_INIT(0);  static atomic_t ccs_query_observers = ATOMIC_INIT(0);
2047    
2048    /**
2049     * ccs_truncate - Truncate a line.
2050     *
2051     * @str: String to truncate.
2052     *
2053     * Returns length of truncated @str.
2054     */
2055  static int ccs_truncate(char *str)  static int ccs_truncate(char *str)
2056  {  {
2057          char *start = str;          char *start = str;
# Line 1848  static int ccs_truncate(char *str) Line 2061  static int ccs_truncate(char *str)
2061          return strlen(start) + 1;          return strlen(start) + 1;
2062  }  }
2063    
2064    /**
2065     * ccs_add_entry - Add an ACL to current thread's domain. Used by learning mode.
2066     *
2067     * @header: Lines containing ACL.
2068     *
2069     * Returns nothing.
2070     */
2071  static void ccs_add_entry(char *header)  static void ccs_add_entry(char *header)
2072  {  {
2073          char *buffer;          char *buffer;
# Line 1923  int ccs_supervisor(struct ccs_request_in Line 2143  int ccs_supervisor(struct ccs_request_in
2143          va_start(args, fmt);          va_start(args, fmt);
2144          len = vsnprintf((char *) &len, 1, fmt, args) + 1;          len = vsnprintf((char *) &len, 1, fmt, args) + 1;
2145          va_end(args);          va_end(args);
2146          /* Write /proc/ccs/grant_log or /proc/ccs/reject_log . */          /* Write /proc/ccs/audit. */
2147          va_start(args, fmt);          va_start(args, fmt);
2148          ccs_write_log2(r, len, fmt, args);          ccs_write_log2(r, len, fmt, args);
2149          va_end(args);          va_end(args);
# Line 1939  int ccs_supervisor(struct ccs_request_in Line 2159  int ccs_supervisor(struct ccs_request_in
2159                  error = -EPERM;                  error = -EPERM;
2160                  if (atomic_read(&ccs_query_observers))                  if (atomic_read(&ccs_query_observers))
2161                          break;                          break;
2162                  if (ccs_current_flags() & CCS_DONT_SLEEP_ON_ENFORCE_ERROR)                  if (r->dont_sleep_on_enforce_error)
2163                          goto out;                          goto out;
2164                  p = ccs_profile(r->profile);                  p = ccs_profile(r->profile);
2165                  /* Check enforcing_penalty parameter. */                  /* Check enforcing_penalty parameter. */
# Line 2054  static int ccs_poll_query(struct file *f Line 2274  static int ccs_poll_query(struct file *f
2274   * ccs_read_query - Read access requests which violated policy in enforcing mode.   * ccs_read_query - Read access requests which violated policy in enforcing mode.
2275   *   *
2276   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
2277     *
2278     * Returns nothing.
2279   */   */
2280  static void ccs_read_query(struct ccs_io_buffer *head)  static void ccs_read_query(struct ccs_io_buffer *head)
2281  {  {
# Line 2063  static void ccs_read_query(struct ccs_io Line 2285  static void ccs_read_query(struct ccs_io
2285          char *buf;          char *buf;
2286          if (head->r.w_pos)          if (head->r.w_pos)
2287                  return;                  return;
2288          if (head->read_buf) {          kfree(head->read_buf);
2289                  kfree(head->read_buf);          head->read_buf = NULL;
                 head->read_buf = NULL;  
         }  
2290          spin_lock(&ccs_query_list_lock);          spin_lock(&ccs_query_list_lock);
2291          list_for_each(tmp, &ccs_query_list) {          list_for_each(tmp, &ccs_query_list) {
2292                  struct ccs_query *ptr = list_entry(tmp, typeof(*ptr), list);                  struct ccs_query *ptr = list_entry(tmp, typeof(*ptr), list);
# Line 2148  static int ccs_write_answer(struct ccs_i Line 2368  static int ccs_write_answer(struct ccs_i
2368  }  }
2369    
2370  /**  /**
2371   * ccs_read_version: Get version.   * ccs_read_version - Get version.
2372   *   *
2373   * @head: Pointer to "struct ccs_io_buffer".   * @head: Pointer to "struct ccs_io_buffer".
2374     *
2375     * Returns nothing.
2376   */   */
2377  static void ccs_read_version(struct ccs_io_buffer *head)  static void ccs_read_version(struct ccs_io_buffer *head)
2378  {  {
2379          if (head->r.eof)          if (head->r.eof)
2380                  return;                  return;
2381          ccs_set_string(head, "1.8.0-pre");          ccs_set_string(head, "1.8.0");
2382          head->r.eof = true;          head->r.eof = true;
2383  }  }
2384    
2385    /* String table for /proc/ccs/meminfo interface. */
2386    static const char * const ccs_policy_headers[CCS_MAX_POLICY_STAT] = {
2387            [CCS_STAT_POLICY_UPDATES]    = "update:",
2388            [CCS_STAT_POLICY_LEARNING]   = "violation in learning mode:",
2389            [CCS_STAT_POLICY_PERMISSIVE] = "violation in permissive mode:",
2390            [CCS_STAT_POLICY_ENFORCING]  = "violation in enforcing mode:",
2391    };
2392    
2393    /* String table for /proc/ccs/meminfo interface. */
2394    static const char * const ccs_memory_headers[CCS_MAX_MEMORY_STAT] = {
2395            [CCS_MEMORY_POLICY] = "policy:",
2396            [CCS_MEMORY_AUDIT]  = "audit log:",
2397            [CCS_MEMORY_QUERY]  = "query message:",
2398    };
2399    
2400    /* Timestamp counter for last updated. */
2401    static unsigned int ccs_stat_updated[CCS_MAX_POLICY_STAT];
2402    /* Counter for number of updates. */
2403    static unsigned int ccs_stat_modified[CCS_MAX_POLICY_STAT];
2404    
2405    /**
2406     * ccs_update_stat - Update statistic counters.
2407     *
2408     * @index: Index for policy type.
2409     *
2410     * Returns nothing.
2411     */
2412    void ccs_update_stat(const u8 index)
2413    {
2414            struct timeval tv;
2415            do_gettimeofday(&tv);
2416            /*
2417             * I don't use atomic operations because race condition is not fatal.
2418             */
2419            ccs_stat_updated[index]++;
2420            ccs_stat_modified[index] = tv.tv_sec;
2421    }
2422    
2423    /**
2424     * ccs_read_stat - Read statistic data.
2425     *
2426     * @head: Pointer to "struct ccs_io_buffer".
2427     *
2428     * Returns nothing.
2429     */
2430    static void ccs_read_stat(struct ccs_io_buffer *head)
2431    {
2432            u8 i;
2433            unsigned int total = 0;
2434            if (head->r.eof)
2435                    return;
2436            for (i = 0; i < CCS_MAX_POLICY_STAT; i++) {
2437                    ccs_io_printf(head, "Policy %-30s %10u", ccs_policy_headers[i],
2438                                  ccs_stat_updated[i]);
2439                    if (ccs_stat_modified[i]) {
2440                            struct ccs_time stamp;
2441                            ccs_convert_time(ccs_stat_modified[i], &stamp);
2442                            ccs_io_printf(head, " (Last: %04u/%02u/%02u "
2443                                          "%02u:%02u:%02u)",
2444                                          stamp.year, stamp.month, stamp.day,
2445                                          stamp.hour, stamp.min, stamp.sec);
2446                    }
2447                    ccs_set_lf(head);
2448            }
2449            for (i = 0; i < CCS_MAX_MEMORY_STAT; i++) {
2450                    unsigned int used = ccs_memory_used[i];
2451                    total += used;
2452                    ccs_io_printf(head, "Memory used by %-22s %10u",
2453                                  ccs_memory_headers[i], used);
2454                    used = ccs_memory_quota[i];
2455                    if (used)
2456                            ccs_io_printf(head, " (Quota: %10u)", used);
2457                    ccs_set_lf(head);
2458            }
2459            ccs_io_printf(head, "Total memory used:                    %10u\n",
2460                          total);
2461            head->r.eof = true;
2462    }
2463    
2464    /**
2465     * ccs_write_stat - Set memory quota.
2466     *
2467     * @head: Pointer to "struct ccs_io_buffer".
2468     *
2469     * Returns 0.
2470     */
2471    static int ccs_write_stat(struct ccs_io_buffer *head)
2472    {
2473            char *data = head->write_buf;
2474            u8 i;
2475            if (ccs_str_starts(&data, "Memory used by "))
2476                    for (i = 0; i < CCS_MAX_MEMORY_STAT; i++)
2477                            if (ccs_str_starts(&data, ccs_memory_headers[i]))
2478                                    sscanf(data, "%u", &ccs_memory_quota[i]);
2479            return 0;
2480    }
2481    
2482    /* String table for /proc/ccs/meminfo interface. */
2483    static const char * const ccs_old_memory_header[CCS_MAX_MEMORY_STAT] = {
2484            [CCS_MEMORY_POLICY] = "Policy:",
2485            [CCS_MEMORY_AUDIT]  = "Audit logs:",
2486            [CCS_MEMORY_QUERY]  = "Query lists:",
2487    };
2488    
2489    /**
2490     * ccs_read_memory_counter - Read memory usage.
2491     *
2492     * @head: Pointer to "struct ccs_io_buffer".
2493     *
2494     * Returns nothing.
2495     */
2496    static void ccs_read_memory_counter(struct ccs_io_buffer *head)
2497    {
2498            unsigned int total = 0;
2499            int i;
2500            if (head->r.eof)
2501                    return;
2502            for (i = 0; i < CCS_MAX_MEMORY_STAT; i++) {
2503                    unsigned int used = ccs_memory_used[i];
2504                    total += used;
2505                    ccs_io_printf(head, "%-12s %10u", ccs_old_memory_header[i],
2506                                  used);
2507                    if (ccs_memory_quota[i])
2508                            ccs_io_printf(head, "   (Quota: %10u)",
2509                                          ccs_memory_quota[i]);
2510                    ccs_io_printf(head, "\n");
2511            }
2512            ccs_io_printf(head, "%-12s %10u\n", "Total:", total);
2513            head->r.eof = true;
2514    }
2515    
2516    /**
2517     * ccs_write_memory_quota - Set memory quota.
2518     *
2519     * @head: Pointer to "struct ccs_io_buffer".
2520     *
2521     * Returns 0.
2522     */
2523    static int ccs_write_memory_quota(struct ccs_io_buffer *head)
2524    {
2525            char *data = head->write_buf;
2526            u8 i;
2527            for (i = 0; i < CCS_MAX_MEMORY_STAT; i++)
2528                    if (ccs_str_starts(&data, ccs_old_memory_header[i]))
2529                            sscanf(data, "%u", &ccs_memory_quota[i]);
2530            return 0;
2531    }
2532    
2533  /**  /**
2534   * ccs_open_control - open() for /proc/ccs/ interface.   * ccs_open_control - open() for /proc/ccs/ interface.
2535   *   *
2536   * @type: Type of interface.   * @type: Type of interface.
2537   * @file: Pointer to "struct file".   * @file: Pointer to "struct file".
2538   *   *
2539   * Associates policy handler and returns 0 on success, -ENOMEM otherwise.   * Returns 0 on success, negative value otherwise.
2540   */   */
2541  int ccs_open_control(const u8 type, struct file *file)  int ccs_open_control(const u8 type, struct file *file)
2542  {  {
# Line 2184  int ccs_open_control(const u8 type, stru Line 2554  int ccs_open_control(const u8 type, stru
2554                  head->write = ccs_write_exception;                  head->write = ccs_write_exception;
2555                  head->read = ccs_read_exception;                  head->read = ccs_read_exception;
2556                  break;                  break;
2557          case CCS_GRANTLOG: /* /proc/ccs/grant_log */          case CCS_AUDIT: /* /proc/ccs/audit */
         case CCS_REJECTLOG: /* /proc/ccs/reject_log */  
2558                  head->poll = ccs_poll_log;                  head->poll = ccs_poll_log;
2559                  head->read = ccs_read_log;                  head->read = ccs_read_log;
2560                  break;                  break;
# Line 2208  int ccs_open_control(const u8 type, stru Line 2577  int ccs_open_control(const u8 type, stru
2577                  head->read = ccs_read_version;                  head->read = ccs_read_version;
2578                  head->readbuf_size = 128;                  head->readbuf_size = 128;
2579                  break;                  break;
2580            case CCS_STAT: /* /proc/ccs/stat */
2581                    head->write = ccs_write_stat;
2582                    head->read = ccs_read_stat;
2583                    head->readbuf_size = 1024;
2584                    break;
2585          case CCS_MEMINFO: /* /proc/ccs/meminfo */          case CCS_MEMINFO: /* /proc/ccs/meminfo */
2586                  head->write = ccs_write_memory_quota;                  head->write = ccs_write_memory_quota;
2587                  head->read = ccs_read_memory_counter;                  head->read = ccs_read_memory_counter;
# Line 2260  int ccs_open_control(const u8 type, stru Line 2634  int ccs_open_control(const u8 type, stru
2634                  }                  }
2635          }          }
2636          /*          /*
2637           * If the file is /proc/ccs/query , increment the observer counter.           * If the file is /proc/ccs/query, increment the observer counter.
2638           * The obserber counter is used by ccs_supervisor() to see if           * The obserber counter is used by ccs_supervisor() to see if
2639           * there is some process monitoring /proc/ccs/query.           * there is some process monitoring /proc/ccs/query.
2640           */           */
2641          if (type == CCS_QUERY)          if (type == CCS_QUERY)
2642                  atomic_inc(&ccs_query_observers);                  atomic_inc(&ccs_query_observers);
2643          else if (type != CCS_GRANTLOG && type != CCS_REJECTLOG)          else if (type != CCS_AUDIT && type != CCS_VERSION &&
2644                     type != CCS_MEMINFO && type != CCS_STAT)
2645                  head->reader_idx = ccs_lock();                  head->reader_idx = ccs_lock();
2646          file->private_data = head;          file->private_data = head;
2647          return 0;          return 0;
# Line 2278  int ccs_open_control(const u8 type, stru Line 2653  int ccs_open_control(const u8 type, stru
2653   * @file: Pointer to "struct file".   * @file: Pointer to "struct file".
2654   * @wait: Pointer to "poll_table".   * @wait: Pointer to "poll_table".
2655   *   *
2656     * Returns return value of poll().
2657     *
2658   * Waits for read readiness.   * Waits for read readiness.
2659   * /proc/ccs/query is handled by /usr/sbin/ccs-queryd and   * /proc/ccs/query is handled by /usr/sbin/ccs-queryd and
2660   * /proc/ccs/grant_log and /proc/ccs/reject_log are handled by   * /proc/ccs/audit is handled by /usr/sbin/ccs-auditd.
  * /usr/sbin/ccs-auditd .  
2661   */   */
2662  int ccs_poll_control(struct file *file, poll_table *wait)  int ccs_poll_control(struct file *file, poll_table *wait)
2663  {  {
# Line 2406  int ccs_write_control(struct file *file, Line 2782  int ccs_write_control(struct file *file,
2782   *   *
2783   * @file: Pointer to "struct file".   * @file: Pointer to "struct file".
2784   *   *
2785   * Releases memory and returns 0.   * Returns 0.
2786   */   */
2787  int ccs_close_control(struct file *file)  int ccs_close_control(struct file *file)
2788  {  {
# Line 2414  int ccs_close_control(struct file *file) Line 2790  int ccs_close_control(struct file *file)
2790          const bool is_write = head->write_buf != NULL;          const bool is_write = head->write_buf != NULL;
2791          const u8 type = head->type;          const u8 type = head->type;
2792          /*          /*
2793           * If the file is /proc/ccs/query , decrement the observer counter.           * If the file is /proc/ccs/query, decrement the observer counter.
2794           */           */
2795          if (type == CCS_QUERY) {          if (type == CCS_QUERY) {
2796                  if (atomic_dec_and_test(&ccs_query_observers))                  if (atomic_dec_and_test(&ccs_query_observers))
2797                          wake_up_all(&ccs_answer_wait);                          wake_up_all(&ccs_answer_wait);
2798          } else if (type != CCS_GRANTLOG && type != CCS_REJECTLOG)          } else if (type != CCS_AUDIT && type != CCS_VERSION &&
2799                       type != CCS_MEMINFO && type != CCS_STAT)
2800                  ccs_unlock(head->reader_idx);                  ccs_unlock(head->reader_idx);
2801          /* Release memory used for policy I/O. */          /* Release memory used for policy I/O. */
2802          kfree(head->read_buf);          kfree(head->read_buf);
# Line 2434  int ccs_close_control(struct file *file) Line 2811  int ccs_close_control(struct file *file)
2811          return 0;          return 0;
2812  }  }
2813    
2814    /**
2815     * ccs_policy_io_init - Register hooks for policy I/O.
2816     *
2817     * Returns nothing.
2818     */
2819  void __init ccs_policy_io_init(void)  void __init ccs_policy_io_init(void)
2820  {  {
2821          ccsecurity_ops.check_profile = ccs_check_profile;          ccsecurity_ops.check_profile = ccs_check_profile;
Legend:
Removed from v.4056  
changed lines
  Added in v.4280
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
サイト情報
ソフトウェアを探す
ソフトウェアを作る
コミュニティ
ヘルプ