aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>2019-01-24 04:37:35 -0500
committerJames Morris <james.morris@microsoft.com>2019-01-24 17:50:27 -0500
commitcdcf6723add57a0ffb37cfde1ca54a00f5715b71 (patch)
treec09429e797b0b3655035632bcbb8c40d44407375
parent8c6cb983cd52d78ab4e4c0191c73a11dcb60b866 (diff)
tomoyo: Coding style fix.
Follow many of recommendations by scripts/checkpatch.pl, and follow "lift switch variables out of switches" by Kees Cook. This patch makes no functional change. Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Signed-off-by: James Morris <james.morris@microsoft.com>
Diffstat
-rw-r--r--security/tomoyo/audit.c31
-rw-r--r--security/tomoyo/common.c138
-rw-r--r--security/tomoyo/common.h13
-rw-r--r--security/tomoyo/condition.c59
-rw-r--r--security/tomoyo/domain.c50
-rw-r--r--security/tomoyo/file.c20
-rw-r--r--security/tomoyo/gc.c19
-rw-r--r--security/tomoyo/group.c5
-rw-r--r--security/tomoyo/load_policy.c8
-rw-r--r--security/tomoyo/memory.c9
-rw-r--r--security/tomoyo/mount.c2
-rw-r--r--security/tomoyo/realpath.c18
-rw-r--r--security/tomoyo/securityfs_if.c4
-rw-r--r--security/tomoyo/tomoyo.c15
-rw-r--r--security/tomoyo/util.c23
15 files changed, 309 insertions, 105 deletions
diff --git a/security/tomoyo/audit.c b/security/tomoyo/audit.c
index 479b03a7a17e..3c96e8402e94 100644
--- a/security/tomoyo/audit.c
+++ b/security/tomoyo/audit.c
@@ -32,6 +32,7 @@ static char *tomoyo_print_bprm(struct linux_binprm *bprm,
32 int argv_count = bprm->argc; 32 int argv_count = bprm->argc;
33 int envp_count = bprm->envc; 33 int envp_count = bprm->envc;
34 bool truncated = false; 34 bool truncated = false;
35
35 if (!buffer) 36 if (!buffer)
36 return NULL; 37 return NULL;
37 len = snprintf(buffer, tomoyo_buffer_len - 1, "argv[]={ "); 38 len = snprintf(buffer, tomoyo_buffer_len - 1, "argv[]={ ");
@@ -49,6 +50,7 @@ static char *tomoyo_print_bprm(struct linux_binprm *bprm,
49 while (offset < PAGE_SIZE) { 50 while (offset < PAGE_SIZE) {
50 const char *kaddr = dump->data; 51 const char *kaddr = dump->data;
51 const unsigned char c = kaddr[offset++]; 52 const unsigned char c = kaddr[offset++];
53
52 if (cp == last_start) 54 if (cp == last_start)
53 *cp++ = '"'; 55 *cp++ = '"';
54 if (cp >= buffer + tomoyo_buffer_len - 32) { 56 if (cp >= buffer + tomoyo_buffer_len - 32) {
@@ -154,19 +156,18 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
154 char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS); 156 char *buffer = kmalloc(tomoyo_buffer_len, GFP_NOFS);
155 int pos; 157 int pos;
156 u8 i; 158 u8 i;
159
157 if (!buffer) 160 if (!buffer)
158 return NULL; 161 return NULL;
159 162
160 tomoyo_convert_time(ktime_get_real_seconds(), &stamp); 163 tomoyo_convert_time(ktime_get_real_seconds(), &stamp);
161 164
162 pos = snprintf(buffer, tomoyo_buffer_len - 1, 165 pos = snprintf(buffer, tomoyo_buffer_len - 1,
163 "#%04u/%02u/%02u %02u:%02u:%02u# profile=%u mode=%s " 166 "#%04u/%02u/%02u %02u:%02u:%02u# profile=%u mode=%s granted=%s (global-pid=%u) task={ pid=%u ppid=%u uid=%u gid=%u euid=%u egid=%u suid=%u sgid=%u fsuid=%u fsgid=%u }",
164 "granted=%s (global-pid=%u) task={ pid=%u ppid=%u " 167 stamp.year, stamp.month, stamp.day, stamp.hour,
165 "uid=%u gid=%u euid=%u egid=%u suid=%u sgid=%u " 168 stamp.min, stamp.sec, r->profile, tomoyo_mode[r->mode],
166 "fsuid=%u fsgid=%u }", stamp.year, stamp.month, 169 tomoyo_yesno(r->granted), gpid, tomoyo_sys_getpid(),
167 stamp.day, stamp.hour, stamp.min, stamp.sec, r->profile, 170 tomoyo_sys_getppid(),
168 tomoyo_mode[r->mode], tomoyo_yesno(r->granted), gpid,
169 tomoyo_sys_getpid(), tomoyo_sys_getppid(),
170 from_kuid(&init_user_ns, current_uid()), 171 from_kuid(&init_user_ns, current_uid()),
171 from_kgid(&init_user_ns, current_gid()), 172 from_kgid(&init_user_ns, current_gid()),
172 from_kuid(&init_user_ns, current_euid()), 173 from_kuid(&init_user_ns, current_euid()),
@@ -185,6 +186,7 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
185 struct tomoyo_mini_stat *stat; 186 struct tomoyo_mini_stat *stat;
186 unsigned int dev; 187 unsigned int dev;
187 umode_t mode; 188 umode_t mode;
189
188 if (!obj->stat_valid[i]) 190 if (!obj->stat_valid[i])
189 continue; 191 continue;
190 stat = &obj->stat[i]; 192 stat = &obj->stat[i];
@@ -193,8 +195,8 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
193 if (i & 1) { 195 if (i & 1) {
194 pos += snprintf(buffer + pos, 196 pos += snprintf(buffer + pos,
195 tomoyo_buffer_len - 1 - pos, 197 tomoyo_buffer_len - 1 - pos,
196 " path%u.parent={ uid=%u gid=%u " 198 " path%u.parent={ uid=%u gid=%u ino=%lu perm=0%o }",
197 "ino=%lu perm=0%o }", (i >> 1) + 1, 199 (i >> 1) + 1,
198 from_kuid(&init_user_ns, stat->uid), 200 from_kuid(&init_user_ns, stat->uid),
199 from_kgid(&init_user_ns, stat->gid), 201 from_kgid(&init_user_ns, stat->gid),
200 (unsigned long)stat->ino, 202 (unsigned long)stat->ino,
@@ -202,8 +204,8 @@ static char *tomoyo_print_header(struct tomoyo_request_info *r)
202 continue; 204 continue;
203 } 205 }
204 pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos, 206 pos += snprintf(buffer + pos, tomoyo_buffer_len - 1 - pos,
205 " path%u={ uid=%u gid=%u ino=%lu major=%u" 207 " path%u={ uid=%u gid=%u ino=%lu major=%u minor=%u perm=0%o type=%s",
206 " minor=%u perm=0%o type=%s", (i >> 1) + 1, 208 (i >> 1) + 1,
207 from_kuid(&init_user_ns, stat->uid), 209 from_kuid(&init_user_ns, stat->uid),
208 from_kgid(&init_user_ns, stat->gid), 210 from_kgid(&init_user_ns, stat->gid),
209 (unsigned long)stat->ino, 211 (unsigned long)stat->ino,
@@ -249,6 +251,7 @@ char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
249 const char *symlink = NULL; 251 const char *symlink = NULL;
250 int pos; 252 int pos;
251 const char *domainname = r->domain->domainname->name; 253 const char *domainname = r->domain->domainname->name;
254
252 header = tomoyo_print_header(r); 255 header = tomoyo_print_header(r);
253 if (!header) 256 if (!header)
254 return NULL; 257 return NULL;
@@ -256,6 +259,7 @@ char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
256 len += strlen(domainname) + strlen(header) + 10; 259 len += strlen(domainname) + strlen(header) + 10;
257 if (r->ee) { 260 if (r->ee) {
258 struct file *file = r->ee->bprm->file; 261 struct file *file = r->ee->bprm->file;
262
259 realpath = tomoyo_realpath_from_path(&file->f_path); 263 realpath = tomoyo_realpath_from_path(&file->f_path);
260 bprm_info = tomoyo_print_bprm(r->ee->bprm, &r->ee->dump); 264 bprm_info = tomoyo_print_bprm(r->ee->bprm, &r->ee->dump);
261 if (!realpath || !bprm_info) 265 if (!realpath || !bprm_info)
@@ -275,6 +279,7 @@ char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
275 pos = snprintf(buf, len, "%s", header); 279 pos = snprintf(buf, len, "%s", header);
276 if (realpath) { 280 if (realpath) {
277 struct linux_binprm *bprm = r->ee->bprm; 281 struct linux_binprm *bprm = r->ee->bprm;
282
278 pos += snprintf(buf + pos, len - pos, 283 pos += snprintf(buf + pos, len - pos,
279 " exec={ realpath=\"%s\" argc=%d envc=%d %s }", 284 " exec={ realpath=\"%s\" argc=%d envc=%d %s }",
280 realpath, bprm->argc, bprm->envc, bprm_info); 285 realpath, bprm->argc, bprm->envc, bprm_info);
@@ -328,6 +333,7 @@ static bool tomoyo_get_audit(const struct tomoyo_policy_namespace *ns,
328 const u8 category = tomoyo_index2category[index] + 333 const u8 category = tomoyo_index2category[index] +
329 TOMOYO_MAX_MAC_INDEX; 334 TOMOYO_MAX_MAC_INDEX;
330 struct tomoyo_profile *p; 335 struct tomoyo_profile *p;
336
331 if (!tomoyo_policy_loaded) 337 if (!tomoyo_policy_loaded)
332 return false; 338 return false;
333 p = tomoyo_profile(ns, profile); 339 p = tomoyo_profile(ns, profile);
@@ -362,6 +368,7 @@ void tomoyo_write_log2(struct tomoyo_request_info *r, int len, const char *fmt,
362 char *buf; 368 char *buf;
363 struct tomoyo_log *entry; 369 struct tomoyo_log *entry;
364 bool quota_exceeded = false; 370 bool quota_exceeded = false;
371
365 if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type, 372 if (!tomoyo_get_audit(r->domain->ns, r->profile, r->type,
366 r->matched_acl, r->granted)) 373 r->matched_acl, r->granted))
367 goto out; 374 goto out;
@@ -413,6 +420,7 @@ void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
413{ 420{
414 va_list args; 421 va_list args;
415 int len; 422 int len;
423
416 va_start(args, fmt); 424 va_start(args, fmt);
417 len = vsnprintf((char *) &len, 1, fmt, args) + 1; 425 len = vsnprintf((char *) &len, 1, fmt, args) + 1;
418 va_end(args); 426 va_end(args);
@@ -431,6 +439,7 @@ void tomoyo_write_log(struct tomoyo_request_info *r, const char *fmt, ...)
431void tomoyo_read_log(struct tomoyo_io_buffer *head) 439void tomoyo_read_log(struct tomoyo_io_buffer *head)
432{ 440{
433 struct tomoyo_log *ptr = NULL; 441 struct tomoyo_log *ptr = NULL;
442
434 if (head->r.w_pos) 443 if (head->r.w_pos)
435 return; 444 return;
436 kfree(head->read_buf); 445 kfree(head->read_buf);
diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 6936def78002..0f8079b65e23 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -197,6 +197,7 @@ static void tomoyo_addprintf(char *buffer, int len, const char *fmt, ...)
197{ 197{
198 va_list args; 198 va_list args;
199 const int pos = strlen(buffer); 199 const int pos = strlen(buffer);
200
200 va_start(args, fmt); 201 va_start(args, fmt);
201 vsnprintf(buffer + pos, len - pos - 1, fmt, args); 202 vsnprintf(buffer + pos, len - pos - 1, fmt, args);
202 va_end(args); 203 va_end(args);
@@ -214,6 +215,7 @@ static bool tomoyo_flush(struct tomoyo_io_buffer *head)
214 while (head->r.w_pos) { 215 while (head->r.w_pos) {
215 const char *w = head->r.w[0]; 216 const char *w = head->r.w[0];
216 size_t len = strlen(w); 217 size_t len = strlen(w);
218
217 if (len) { 219 if (len) {
218 if (len > head->read_user_buf_avail) 220 if (len > head->read_user_buf_avail)
219 len = head->read_user_buf_avail; 221 len = head->read_user_buf_avail;
@@ -279,6 +281,7 @@ static void tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt,
279 size_t len; 281 size_t len;
280 size_t pos = head->r.avail; 282 size_t pos = head->r.avail;
281 int size = head->readbuf_size - pos; 283 int size = head->readbuf_size - pos;
284
282 if (size <= 0) 285 if (size <= 0)
283 return; 286 return;
284 va_start(args, fmt); 287 va_start(args, fmt);
@@ -344,6 +347,7 @@ static bool tomoyo_namespace_enabled;
344void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns) 347void tomoyo_init_policy_namespace(struct tomoyo_policy_namespace *ns)
345{ 348{
346 unsigned int idx; 349 unsigned int idx;
350
347 for (idx = 0; idx < TOMOYO_MAX_ACL_GROUPS; idx++) 351 for (idx = 0; idx < TOMOYO_MAX_ACL_GROUPS; idx++)
348 INIT_LIST_HEAD(&ns->acl_group[idx]); 352 INIT_LIST_HEAD(&ns->acl_group[idx]);
349 for (idx = 0; idx < TOMOYO_MAX_GROUP; idx++) 353 for (idx = 0; idx < TOMOYO_MAX_GROUP; idx++)
@@ -433,6 +437,7 @@ static void tomoyo_print_number_union_nospace
433 u8 min_type = ptr->value_type[0]; 437 u8 min_type = ptr->value_type[0];
434 const u8 max_type = ptr->value_type[1]; 438 const u8 max_type = ptr->value_type[1];
435 char buffer[128]; 439 char buffer[128];
440
436 buffer[0] = '\0'; 441 buffer[0] = '\0';
437 for (i = 0; i < 2; i++) { 442 for (i = 0; i < 2; i++) {
438 switch (min_type) { 443 switch (min_type) {
@@ -487,6 +492,7 @@ static struct tomoyo_profile *tomoyo_assign_profile
487{ 492{
488 struct tomoyo_profile *ptr; 493 struct tomoyo_profile *ptr;
489 struct tomoyo_profile *entry; 494 struct tomoyo_profile *entry;
495
490 if (profile >= TOMOYO_MAX_PROFILES) 496 if (profile >= TOMOYO_MAX_PROFILES)
491 return NULL; 497 return NULL;
492 ptr = ns->profile_ptr[profile]; 498 ptr = ns->profile_ptr[profile];
@@ -530,6 +536,7 @@ struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns,
530{ 536{
531 static struct tomoyo_profile tomoyo_null_profile; 537 static struct tomoyo_profile tomoyo_null_profile;
532 struct tomoyo_profile *ptr = ns->profile_ptr[profile]; 538 struct tomoyo_profile *ptr = ns->profile_ptr[profile];
539
533 if (!ptr) 540 if (!ptr)
534 ptr = &tomoyo_null_profile; 541 ptr = &tomoyo_null_profile;
535 return ptr; 542 return ptr;
@@ -546,6 +553,7 @@ struct tomoyo_profile *tomoyo_profile(const struct tomoyo_policy_namespace *ns,
546static s8 tomoyo_find_yesno(const char *string, const char *find) 553static s8 tomoyo_find_yesno(const char *string, const char *find)
547{ 554{
548 const char *cp = strstr(string, find); 555 const char *cp = strstr(string, find);
556
549 if (cp) { 557 if (cp) {
550 cp += strlen(find); 558 cp += strlen(find);
551 if (!strncmp(cp, "=yes", 4)) 559 if (!strncmp(cp, "=yes", 4))
@@ -569,6 +577,7 @@ static void tomoyo_set_uint(unsigned int *i, const char *string,
569 const char *find) 577 const char *find)
570{ 578{
571 const char *cp = strstr(string, find); 579 const char *cp = strstr(string, find);
580
572 if (cp) 581 if (cp)
573 sscanf(cp + strlen(find), "=%u", i); 582 sscanf(cp + strlen(find), "=%u", i);
574} 583}
@@ -587,6 +596,7 @@ static int tomoyo_set_mode(char *name, const char *value,
587{ 596{
588 u8 i; 597 u8 i;
589 u8 config; 598 u8 config;
599
590 if (!strcmp(name, "CONFIG")) { 600 if (!strcmp(name, "CONFIG")) {
591 i = TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX; 601 i = TOMOYO_MAX_MAC_INDEX + TOMOYO_MAX_MAC_CATEGORY_INDEX;
592 config = profile->default_config; 602 config = profile->default_config;
@@ -595,10 +605,12 @@ static int tomoyo_set_mode(char *name, const char *value,
595 for (i = 0; i < TOMOYO_MAX_MAC_INDEX 605 for (i = 0; i < TOMOYO_MAX_MAC_INDEX
596 + TOMOYO_MAX_MAC_CATEGORY_INDEX; i++) { 606 + TOMOYO_MAX_MAC_CATEGORY_INDEX; i++) {
597 int len = 0; 607 int len = 0;
608
598 if (i < TOMOYO_MAX_MAC_INDEX) { 609 if (i < TOMOYO_MAX_MAC_INDEX) {
599 const u8 c = tomoyo_index2category[i]; 610 const u8 c = tomoyo_index2category[i];
600 const char *category = 611 const char *category =
601 tomoyo_category_keywords[c]; 612 tomoyo_category_keywords[c];
613
602 len = strlen(category); 614 len = strlen(category);
603 if (strncmp(name, category, len) || 615 if (strncmp(name, category, len) ||
604 name[len++] != ':' || name[len++] != ':') 616 name[len++] != ':' || name[len++] != ':')
@@ -618,6 +630,7 @@ static int tomoyo_set_mode(char *name, const char *value,
618 config = TOMOYO_CONFIG_USE_DEFAULT; 630 config = TOMOYO_CONFIG_USE_DEFAULT;
619 } else { 631 } else {
620 u8 mode; 632 u8 mode;
633
621 for (mode = 0; mode < 4; mode++) 634 for (mode = 0; mode < 4; mode++)
622 if (strstr(value, tomoyo_mode[mode])) 635 if (strstr(value, tomoyo_mode[mode]))
623 /* 636 /*
@@ -664,6 +677,7 @@ static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
664 unsigned int i; 677 unsigned int i;
665 char *cp; 678 char *cp;
666 struct tomoyo_profile *profile; 679 struct tomoyo_profile *profile;
680
667 if (sscanf(data, "PROFILE_VERSION=%u", &head->w.ns->profile_version) 681 if (sscanf(data, "PROFILE_VERSION=%u", &head->w.ns->profile_version)
668 == 1) 682 == 1)
669 return 0; 683 return 0;
@@ -683,6 +697,7 @@ static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
683 const struct tomoyo_path_info *new_comment 697 const struct tomoyo_path_info *new_comment
684 = tomoyo_get_name(cp); 698 = tomoyo_get_name(cp);
685 const struct tomoyo_path_info *old_comment; 699 const struct tomoyo_path_info *old_comment;
700
686 if (!new_comment) 701 if (!new_comment)
687 return -ENOMEM; 702 return -ENOMEM;
688 spin_lock(&lock); 703 spin_lock(&lock);
@@ -732,6 +747,7 @@ static void tomoyo_read_profile(struct tomoyo_io_buffer *head)
732 struct tomoyo_policy_namespace *ns = 747 struct tomoyo_policy_namespace *ns =
733 container_of(head->r.ns, typeof(*ns), namespace_list); 748 container_of(head->r.ns, typeof(*ns), namespace_list);
734 const struct tomoyo_profile *profile; 749 const struct tomoyo_profile *profile;
750
735 if (head->r.eof) 751 if (head->r.eof)
736 return; 752 return;
737 next: 753 next:
@@ -760,6 +776,7 @@ static void tomoyo_read_profile(struct tomoyo_io_buffer *head)
760 u8 i; 776 u8 i;
761 const struct tomoyo_path_info *comment = 777 const struct tomoyo_path_info *comment =
762 profile->comment; 778 profile->comment;
779
763 tomoyo_print_namespace(head); 780 tomoyo_print_namespace(head);
764 tomoyo_io_printf(head, "%u-COMMENT=", index); 781 tomoyo_io_printf(head, "%u-COMMENT=", index);
765 tomoyo_set_string(head, comment ? comment->name : ""); 782 tomoyo_set_string(head, comment ? comment->name : "");
@@ -788,6 +805,7 @@ static void tomoyo_read_profile(struct tomoyo_io_buffer *head)
788 + TOMOYO_MAX_MAC_CATEGORY_INDEX; head->r.bit++) { 805 + TOMOYO_MAX_MAC_CATEGORY_INDEX; head->r.bit++) {
789 const u8 i = head->r.bit; 806 const u8 i = head->r.bit;
790 const u8 config = profile->config[i]; 807 const u8 config = profile->config[i];
808
791 if (config == TOMOYO_CONFIG_USE_DEFAULT) 809 if (config == TOMOYO_CONFIG_USE_DEFAULT)
792 continue; 810 continue;
793 tomoyo_print_namespace(head); 811 tomoyo_print_namespace(head);
@@ -847,10 +865,10 @@ static int tomoyo_update_manager_entry(const char *manager,
847 struct tomoyo_acl_param param = { 865 struct tomoyo_acl_param param = {
848 /* .ns = &tomoyo_kernel_namespace, */ 866 /* .ns = &tomoyo_kernel_namespace, */
849 .is_delete = is_delete, 867 .is_delete = is_delete,
850 .list = &tomoyo_kernel_namespace. 868 .list = &tomoyo_kernel_namespace.policy_list[TOMOYO_ID_MANAGER],
851 policy_list[TOMOYO_ID_MANAGER],
852 }; 869 };
853 int error = is_delete ? -ENOENT : -ENOMEM; 870 int error = is_delete ? -ENOENT : -ENOMEM;
871
854 if (!tomoyo_correct_domain(manager) && 872 if (!tomoyo_correct_domain(manager) &&
855 !tomoyo_correct_word(manager)) 873 !tomoyo_correct_word(manager))
856 return -EINVAL; 874 return -EINVAL;
@@ -894,10 +912,10 @@ static void tomoyo_read_manager(struct tomoyo_io_buffer *head)
894{ 912{
895 if (head->r.eof) 913 if (head->r.eof)
896 return; 914 return;
897 list_for_each_cookie(head->r.acl, &tomoyo_kernel_namespace. 915 list_for_each_cookie(head->r.acl, &tomoyo_kernel_namespace.policy_list[TOMOYO_ID_MANAGER]) {
898 policy_list[TOMOYO_ID_MANAGER]) {
899 struct tomoyo_manager *ptr = 916 struct tomoyo_manager *ptr =
900 list_entry(head->r.acl, typeof(*ptr), head.list); 917 list_entry(head->r.acl, typeof(*ptr), head.list);
918
901 if (ptr->head.is_deleted) 919 if (ptr->head.is_deleted)
902 continue; 920 continue;
903 if (!tomoyo_flush(head)) 921 if (!tomoyo_flush(head))
@@ -933,8 +951,7 @@ static bool tomoyo_manager(void)
933 exe = tomoyo_get_exe(); 951 exe = tomoyo_get_exe();
934 if (!exe) 952 if (!exe)
935 return false; 953 return false;
936 list_for_each_entry_rcu(ptr, &tomoyo_kernel_namespace. 954 list_for_each_entry_rcu(ptr, &tomoyo_kernel_namespace.policy_list[TOMOYO_ID_MANAGER], head.list) {
937 policy_list[TOMOYO_ID_MANAGER], head.list) {
938 if (!ptr->head.is_deleted && 955 if (!ptr->head.is_deleted &&
939 (!tomoyo_pathcmp(domainname, ptr->manager) || 956 (!tomoyo_pathcmp(domainname, ptr->manager) ||
940 !strcmp(exe, ptr->manager->name))) { 957 !strcmp(exe, ptr->manager->name))) {
@@ -945,9 +962,10 @@ static bool tomoyo_manager(void)
945 if (!found) { /* Reduce error messages. */ 962 if (!found) { /* Reduce error messages. */
946 static pid_t last_pid; 963 static pid_t last_pid;
947 const pid_t pid = current->pid; 964 const pid_t pid = current->pid;
965
948 if (last_pid != pid) { 966 if (last_pid != pid) {
949 printk(KERN_WARNING "%s ( %s ) is not permitted to " 967 pr_warn("%s ( %s ) is not permitted to update policies.\n",
950 "update policies.\n", domainname->name, exe); 968 domainname->name, exe);
951 last_pid = pid; 969 last_pid = pid;
952 } 970 }
953 } 971 }
@@ -974,12 +992,14 @@ static bool tomoyo_select_domain(struct tomoyo_io_buffer *head,
974 unsigned int pid; 992 unsigned int pid;
975 struct tomoyo_domain_info *domain = NULL; 993 struct tomoyo_domain_info *domain = NULL;
976 bool global_pid = false; 994 bool global_pid = false;
995
977 if (strncmp(data, "select ", 7)) 996 if (strncmp(data, "select ", 7))
978 return false; 997 return false;
979 data += 7; 998 data += 7;
980 if (sscanf(data, "pid=%u", &pid) == 1 || 999 if (sscanf(data, "pid=%u", &pid) == 1 ||
981 (global_pid = true, sscanf(data, "global-pid=%u", &pid) == 1)) { 1000 (global_pid = true, sscanf(data, "global-pid=%u", &pid) == 1)) {
982 struct task_struct *p; 1001 struct task_struct *p;
1002
983 rcu_read_lock(); 1003 rcu_read_lock();
984 if (global_pid) 1004 if (global_pid)
985 p = find_task_by_pid_ns(pid, &init_pid_ns); 1005 p = find_task_by_pid_ns(pid, &init_pid_ns);
@@ -1020,10 +1040,11 @@ static bool tomoyo_select_domain(struct tomoyo_io_buffer *head,
1020 * Returns true if @a == @b, false otherwise. 1040 * Returns true if @a == @b, false otherwise.
1021 */ 1041 */
1022static bool tomoyo_same_task_acl(const struct tomoyo_acl_info *a, 1042static bool tomoyo_same_task_acl(const struct tomoyo_acl_info *a,
1023 const struct tomoyo_acl_info *b) 1043 const struct tomoyo_acl_info *b)
1024{ 1044{
1025 const struct tomoyo_task_acl *p1 = container_of(a, typeof(*p1), head); 1045 const struct tomoyo_task_acl *p1 = container_of(a, typeof(*p1), head);
1026 const struct tomoyo_task_acl *p2 = container_of(b, typeof(*p2), head); 1046 const struct tomoyo_task_acl *p2 = container_of(b, typeof(*p2), head);
1047
1027 return p1->domainname == p2->domainname; 1048 return p1->domainname == p2->domainname;
1028} 1049}
1029 1050
@@ -1039,11 +1060,13 @@ static bool tomoyo_same_task_acl(const struct tomoyo_acl_info *a,
1039static int tomoyo_write_task(struct tomoyo_acl_param *param) 1060static int tomoyo_write_task(struct tomoyo_acl_param *param)
1040{ 1061{
1041 int error = -EINVAL; 1062 int error = -EINVAL;
1063
1042 if (tomoyo_str_starts(&param->data, "manual_domain_transition ")) { 1064 if (tomoyo_str_starts(&param->data, "manual_domain_transition ")) {
1043 struct tomoyo_task_acl e = { 1065 struct tomoyo_task_acl e = {
1044 .head.type = TOMOYO_TYPE_MANUAL_TASK_ACL, 1066 .head.type = TOMOYO_TYPE_MANUAL_TASK_ACL,
1045 .domainname = tomoyo_get_domainname(param), 1067 .domainname = tomoyo_get_domainname(param),
1046 }; 1068 };
1069
1047 if (e.domainname) 1070 if (e.domainname)
1048 error = tomoyo_update_domain(&e.head, sizeof(e), param, 1071 error = tomoyo_update_domain(&e.head, sizeof(e), param,
1049 tomoyo_same_task_acl, 1072 tomoyo_same_task_acl,
@@ -1110,7 +1133,7 @@ static int tomoyo_write_domain2(struct tomoyo_policy_namespace *ns,
1110 }; 1133 };
1111 static const struct { 1134 static const struct {
1112 const char *keyword; 1135 const char *keyword;
1113 int (*write) (struct tomoyo_acl_param *); 1136 int (*write)(struct tomoyo_acl_param *param);
1114 } tomoyo_callback[5] = { 1137 } tomoyo_callback[5] = {
1115 { "file ", tomoyo_write_file }, 1138 { "file ", tomoyo_write_file },
1116 { "network inet ", tomoyo_write_inet_network }, 1139 { "network inet ", tomoyo_write_inet_network },
@@ -1152,8 +1175,10 @@ static int tomoyo_write_domain(struct tomoyo_io_buffer *head)
1152 const bool is_delete = head->w.is_delete; 1175 const bool is_delete = head->w.is_delete;
1153 bool is_select = !is_delete && tomoyo_str_starts(&data, "select "); 1176 bool is_select = !is_delete && tomoyo_str_starts(&data, "select ");
1154 unsigned int profile; 1177 unsigned int profile;
1178
1155 if (*data == '<') { 1179 if (*data == '<') {
1156 int ret = 0; 1180 int ret = 0;
1181
1157 domain = NULL; 1182 domain = NULL;
1158 if (is_delete) 1183 if (is_delete)
1159 ret = tomoyo_delete_domain(data); 1184 ret = tomoyo_delete_domain(data);
@@ -1181,6 +1206,7 @@ static int tomoyo_write_domain(struct tomoyo_io_buffer *head)
1181 } 1206 }
1182 for (profile = 0; profile < TOMOYO_MAX_DOMAIN_INFO_FLAGS; profile++) { 1207 for (profile = 0; profile < TOMOYO_MAX_DOMAIN_INFO_FLAGS; profile++) {
1183 const char *cp = tomoyo_dif[profile]; 1208 const char *cp = tomoyo_dif[profile];
1209
1184 if (strncmp(data, cp, strlen(cp) - 1)) 1210 if (strncmp(data, cp, strlen(cp) - 1))
1185 continue; 1211 continue;
1186 domain->flags[profile] = !is_delete; 1212 domain->flags[profile] = !is_delete;
@@ -1225,9 +1251,11 @@ static bool tomoyo_print_condition(struct tomoyo_io_buffer *head,
1225 const struct tomoyo_envp *envp = 1251 const struct tomoyo_envp *envp =
1226 (typeof(envp)) (argv + cond->argc); 1252 (typeof(envp)) (argv + cond->argc);
1227 u16 skip; 1253 u16 skip;
1254
1228 for (skip = 0; skip < head->r.cond_index; skip++) { 1255 for (skip = 0; skip < head->r.cond_index; skip++) {
1229 const u8 left = condp->left; 1256 const u8 left = condp->left;
1230 const u8 right = condp->right; 1257 const u8 right = condp->right;
1258
1231 condp++; 1259 condp++;
1232 switch (left) { 1260 switch (left) {
1233 case TOMOYO_ARGV_ENTRY: 1261 case TOMOYO_ARGV_ENTRY:
@@ -1253,6 +1281,7 @@ static bool tomoyo_print_condition(struct tomoyo_io_buffer *head,
1253 const u8 match = condp->equals; 1281 const u8 match = condp->equals;
1254 const u8 left = condp->left; 1282 const u8 left = condp->left;
1255 const u8 right = condp->right; 1283 const u8 right = condp->right;
1284
1256 if (!tomoyo_flush(head)) 1285 if (!tomoyo_flush(head))
1257 return false; 1286 return false;
1258 condp++; 1287 condp++;
@@ -1262,8 +1291,7 @@ static bool tomoyo_print_condition(struct tomoyo_io_buffer *head,
1262 case TOMOYO_ARGV_ENTRY: 1291 case TOMOYO_ARGV_ENTRY:
1263 tomoyo_io_printf(head, 1292 tomoyo_io_printf(head,
1264 "exec.argv[%lu]%s=\"", 1293 "exec.argv[%lu]%s=\"",
1265 argv->index, argv-> 1294 argv->index, argv->is_not ? "!" : "");
1266 is_not ? "!" : "");
1267 tomoyo_set_string(head, 1295 tomoyo_set_string(head,
1268 argv->value->name); 1296 argv->value->name);
1269 tomoyo_set_string(head, "\""); 1297 tomoyo_set_string(head, "\"");
@@ -1274,12 +1302,10 @@ static bool tomoyo_print_condition(struct tomoyo_io_buffer *head,
1274 "exec.envp[\""); 1302 "exec.envp[\"");
1275 tomoyo_set_string(head, 1303 tomoyo_set_string(head,
1276 envp->name->name); 1304 envp->name->name);
1277 tomoyo_io_printf(head, "\"]%s=", envp-> 1305 tomoyo_io_printf(head, "\"]%s=", envp->is_not ? "!" : "");
1278 is_not ? "!" : "");
1279 if (envp->value) { 1306 if (envp->value) {
1280 tomoyo_set_string(head, "\""); 1307 tomoyo_set_string(head, "\"");
1281 tomoyo_set_string(head, envp-> 1308 tomoyo_set_string(head, envp->value->name);
1282 value->name);
1283 tomoyo_set_string(head, "\""); 1309 tomoyo_set_string(head, "\"");
1284 } else { 1310 } else {
1285 tomoyo_set_string(head, 1311 tomoyo_set_string(head,
@@ -1375,6 +1401,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1375 struct tomoyo_path_acl *ptr = 1401 struct tomoyo_path_acl *ptr =
1376 container_of(acl, typeof(*ptr), head); 1402 container_of(acl, typeof(*ptr), head);
1377 const u16 perm = ptr->perm; 1403 const u16 perm = ptr->perm;
1404
1378 for (bit = 0; bit < TOMOYO_MAX_PATH_OPERATION; bit++) { 1405 for (bit = 0; bit < TOMOYO_MAX_PATH_OPERATION; bit++) {
1379 if (!(perm & (1 << bit))) 1406 if (!(perm & (1 << bit)))
1380 continue; 1407 continue;
@@ -1395,6 +1422,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1395 } else if (acl_type == TOMOYO_TYPE_MANUAL_TASK_ACL) { 1422 } else if (acl_type == TOMOYO_TYPE_MANUAL_TASK_ACL) {
1396 struct tomoyo_task_acl *ptr = 1423 struct tomoyo_task_acl *ptr =
1397 container_of(acl, typeof(*ptr), head); 1424 container_of(acl, typeof(*ptr), head);
1425
1398 tomoyo_set_group(head, "task "); 1426 tomoyo_set_group(head, "task ");
1399 tomoyo_set_string(head, "manual_domain_transition "); 1427 tomoyo_set_string(head, "manual_domain_transition ");
1400 tomoyo_set_string(head, ptr->domainname->name); 1428 tomoyo_set_string(head, ptr->domainname->name);
@@ -1404,6 +1432,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1404 struct tomoyo_path2_acl *ptr = 1432 struct tomoyo_path2_acl *ptr =
1405 container_of(acl, typeof(*ptr), head); 1433 container_of(acl, typeof(*ptr), head);
1406 const u8 perm = ptr->perm; 1434 const u8 perm = ptr->perm;
1435
1407 for (bit = 0; bit < TOMOYO_MAX_PATH2_OPERATION; bit++) { 1436 for (bit = 0; bit < TOMOYO_MAX_PATH2_OPERATION; bit++) {
1408 if (!(perm & (1 << bit))) 1437 if (!(perm & (1 << bit)))
1409 continue; 1438 continue;
@@ -1424,6 +1453,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1424 struct tomoyo_path_number_acl *ptr = 1453 struct tomoyo_path_number_acl *ptr =
1425 container_of(acl, typeof(*ptr), head); 1454 container_of(acl, typeof(*ptr), head);
1426 const u8 perm = ptr->perm; 1455 const u8 perm = ptr->perm;
1456
1427 for (bit = 0; bit < TOMOYO_MAX_PATH_NUMBER_OPERATION; bit++) { 1457 for (bit = 0; bit < TOMOYO_MAX_PATH_NUMBER_OPERATION; bit++) {
1428 if (!(perm & (1 << bit))) 1458 if (!(perm & (1 << bit)))
1429 continue; 1459 continue;
@@ -1444,6 +1474,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1444 struct tomoyo_mkdev_acl *ptr = 1474 struct tomoyo_mkdev_acl *ptr =
1445 container_of(acl, typeof(*ptr), head); 1475 container_of(acl, typeof(*ptr), head);
1446 const u8 perm = ptr->perm; 1476 const u8 perm = ptr->perm;
1477
1447 for (bit = 0; bit < TOMOYO_MAX_MKDEV_OPERATION; bit++) { 1478 for (bit = 0; bit < TOMOYO_MAX_MKDEV_OPERATION; bit++) {
1448 if (!(perm & (1 << bit))) 1479 if (!(perm & (1 << bit)))
1449 continue; 1480 continue;
@@ -1490,6 +1521,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1490 ->name); 1521 ->name);
1491 } else { 1522 } else {
1492 char buf[128]; 1523 char buf[128];
1524
1493 tomoyo_print_ip(buf, sizeof(buf), &ptr->address); 1525 tomoyo_print_ip(buf, sizeof(buf), &ptr->address);
1494 tomoyo_io_printf(head, "%s", buf); 1526 tomoyo_io_printf(head, "%s", buf);
1495 } 1527 }
@@ -1519,6 +1551,7 @@ static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1519 } else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) { 1551 } else if (acl_type == TOMOYO_TYPE_MOUNT_ACL) {
1520 struct tomoyo_mount_acl *ptr = 1552 struct tomoyo_mount_acl *ptr =
1521 container_of(acl, typeof(*ptr), head); 1553 container_of(acl, typeof(*ptr), head);
1554
1522 tomoyo_set_group(head, "file mount"); 1555 tomoyo_set_group(head, "file mount");
1523 tomoyo_print_name_union(head, &ptr->dev_name); 1556 tomoyo_print_name_union(head, &ptr->dev_name);
1524 tomoyo_print_name_union(head, &ptr->dir_name); 1557 tomoyo_print_name_union(head, &ptr->dir_name);
@@ -1562,6 +1595,7 @@ static bool tomoyo_read_domain2(struct tomoyo_io_buffer *head,
1562 list_for_each_cookie(head->r.acl, list) { 1595 list_for_each_cookie(head->r.acl, list) {
1563 struct tomoyo_acl_info *ptr = 1596 struct tomoyo_acl_info *ptr =
1564 list_entry(head->r.acl, typeof(*ptr), list); 1597 list_entry(head->r.acl, typeof(*ptr), list);
1598
1565 if (!tomoyo_print_entry(head, ptr)) 1599 if (!tomoyo_print_entry(head, ptr))
1566 return false; 1600 return false;
1567 } 1601 }
@@ -1583,8 +1617,9 @@ static void tomoyo_read_domain(struct tomoyo_io_buffer *head)
1583 list_for_each_cookie(head->r.domain, &tomoyo_domain_list) { 1617 list_for_each_cookie(head->r.domain, &tomoyo_domain_list) {
1584 struct tomoyo_domain_info *domain = 1618 struct tomoyo_domain_info *domain =
1585 list_entry(head->r.domain, typeof(*domain), list); 1619 list_entry(head->r.domain, typeof(*domain), list);
1620 u8 i;
1621
1586 switch (head->r.step) { 1622 switch (head->r.step) {
1587 u8 i;
1588 case 0: 1623 case 0:
1589 if (domain->is_deleted && 1624 if (domain->is_deleted &&
1590 !head->r.print_this_domain_only) 1625 !head->r.print_this_domain_only)
@@ -1711,6 +1746,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
1711 .data = head->write_buf, 1746 .data = head->write_buf,
1712 }; 1747 };
1713 u8 i; 1748 u8 i;
1749
1714 if (tomoyo_str_starts(&param.data, "aggregator ")) 1750 if (tomoyo_str_starts(&param.data, "aggregator "))
1715 return tomoyo_write_aggregator(&param); 1751 return tomoyo_write_aggregator(&param);
1716 for (i = 0; i < TOMOYO_MAX_TRANSITION_TYPE; i++) 1752 for (i = 0; i < TOMOYO_MAX_TRANSITION_TYPE; i++)
@@ -1722,6 +1758,7 @@ static int tomoyo_write_exception(struct tomoyo_io_buffer *head)
1722 if (tomoyo_str_starts(&param.data, "acl_group ")) { 1758 if (tomoyo_str_starts(&param.data, "acl_group ")) {
1723 unsigned int group; 1759 unsigned int group;
1724 char *data; 1760 char *data;
1761
1725 group = simple_strtoul(param.data, &data, 10); 1762 group = simple_strtoul(param.data, &data, 10);
1726 if (group < TOMOYO_MAX_ACL_GROUPS && *data++ == ' ') 1763 if (group < TOMOYO_MAX_ACL_GROUPS && *data++ == ' ')
1727 return tomoyo_write_domain2 1764 return tomoyo_write_domain2
@@ -1746,12 +1783,15 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
1746 struct tomoyo_policy_namespace *ns = 1783 struct tomoyo_policy_namespace *ns =
1747 container_of(head->r.ns, typeof(*ns), namespace_list); 1784 container_of(head->r.ns, typeof(*ns), namespace_list);
1748 struct list_head *list = &ns->group_list[idx]; 1785 struct list_head *list = &ns->group_list[idx];
1786
1749 list_for_each_cookie(head->r.group, list) { 1787 list_for_each_cookie(head->r.group, list) {
1750 struct tomoyo_group *group = 1788 struct tomoyo_group *group =
1751 list_entry(head->r.group, typeof(*group), head.list); 1789 list_entry(head->r.group, typeof(*group), head.list);
1790
1752 list_for_each_cookie(head->r.acl, &group->member_list) { 1791 list_for_each_cookie(head->r.acl, &group->member_list) {
1753 struct tomoyo_acl_head *ptr = 1792 struct tomoyo_acl_head *ptr =
1754 list_entry(head->r.acl, typeof(*ptr), list); 1793 list_entry(head->r.acl, typeof(*ptr), list);
1794
1755 if (ptr->is_deleted) 1795 if (ptr->is_deleted)
1756 continue; 1796 continue;
1757 if (!tomoyo_flush(head)) 1797 if (!tomoyo_flush(head))
@@ -1771,10 +1811,10 @@ static bool tomoyo_read_group(struct tomoyo_io_buffer *head, const int idx)
1771 head)->number); 1811 head)->number);
1772 } else if (idx == TOMOYO_ADDRESS_GROUP) { 1812 } else if (idx == TOMOYO_ADDRESS_GROUP) {
1773 char buffer[128]; 1813 char buffer[128];
1774
1775 struct tomoyo_address_group *member = 1814 struct tomoyo_address_group *member =
1776 container_of(ptr, typeof(*member), 1815 container_of(ptr, typeof(*member),
1777 head); 1816 head);
1817
1778 tomoyo_print_ip(buffer, sizeof(buffer), 1818 tomoyo_print_ip(buffer, sizeof(buffer),
1779 &member->address); 1819 &member->address);
1780 tomoyo_io_printf(head, " %s", buffer); 1820 tomoyo_io_printf(head, " %s", buffer);
@@ -1802,6 +1842,7 @@ static bool tomoyo_read_policy(struct tomoyo_io_buffer *head, const int idx)
1802 struct tomoyo_policy_namespace *ns = 1842 struct tomoyo_policy_namespace *ns =
1803 container_of(head->r.ns, typeof(*ns), namespace_list); 1843 container_of(head->r.ns, typeof(*ns), namespace_list);
1804 struct list_head *list = &ns->policy_list[idx]; 1844 struct list_head *list = &ns->policy_list[idx];
1845
1805 list_for_each_cookie(head->r.acl, list) { 1846 list_for_each_cookie(head->r.acl, list) {
1806 struct tomoyo_acl_head *acl = 1847 struct tomoyo_acl_head *acl =
1807 container_of(head->r.acl, typeof(*acl), list); 1848 container_of(head->r.acl, typeof(*acl), list);
@@ -1814,6 +1855,7 @@ static bool tomoyo_read_policy(struct tomoyo_io_buffer *head, const int idx)
1814 { 1855 {
1815 struct tomoyo_transition_control *ptr = 1856 struct tomoyo_transition_control *ptr =
1816 container_of(acl, typeof(*ptr), head); 1857 container_of(acl, typeof(*ptr), head);
1858
1817 tomoyo_print_namespace(head); 1859 tomoyo_print_namespace(head);
1818 tomoyo_set_string(head, tomoyo_transition_type 1860 tomoyo_set_string(head, tomoyo_transition_type
1819 [ptr->type]); 1861 [ptr->type]);
@@ -1829,6 +1871,7 @@ static bool tomoyo_read_policy(struct tomoyo_io_buffer *head, const int idx)
1829 { 1871 {
1830 struct tomoyo_aggregator *ptr = 1872 struct tomoyo_aggregator *ptr =
1831 container_of(acl, typeof(*ptr), head); 1873 container_of(acl, typeof(*ptr), head);
1874
1832 tomoyo_print_namespace(head); 1875 tomoyo_print_namespace(head);
1833 tomoyo_set_string(head, "aggregator "); 1876 tomoyo_set_string(head, "aggregator ");
1834 tomoyo_set_string(head, 1877 tomoyo_set_string(head,
@@ -1858,6 +1901,7 @@ static void tomoyo_read_exception(struct tomoyo_io_buffer *head)
1858{ 1901{
1859 struct tomoyo_policy_namespace *ns = 1902 struct tomoyo_policy_namespace *ns =
1860 container_of(head->r.ns, typeof(*ns), namespace_list); 1903 container_of(head->r.ns, typeof(*ns), namespace_list);
1904
1861 if (head->r.eof) 1905 if (head->r.eof)
1862 return; 1906 return;
1863 while (head->r.step < TOMOYO_MAX_POLICY && 1907 while (head->r.step < TOMOYO_MAX_POLICY &&
@@ -1921,6 +1965,7 @@ static atomic_t tomoyo_query_observers = ATOMIC_INIT(0);
1921static int tomoyo_truncate(char *str) 1965static int tomoyo_truncate(char *str)
1922{ 1966{
1923 char *start = str; 1967 char *start = str;
1968
1924 while (*(unsigned char *) str > (unsigned char) ' ') 1969 while (*(unsigned char *) str > (unsigned char) ' ')
1925 str++; 1970 str++;
1926 *str = '\0'; 1971 *str = '\0';
@@ -1943,6 +1988,7 @@ static void tomoyo_add_entry(struct tomoyo_domain_info *domain, char *header)
1943 char *symlink = NULL; 1988 char *symlink = NULL;
1944 char *cp = strchr(header, '\n'); 1989 char *cp = strchr(header, '\n');
1945 int len; 1990 int len;
1991
1946 if (!cp) 1992 if (!cp)
1947 return; 1993 return;
1948 cp = strchr(cp + 1, '\n'); 1994 cp = strchr(cp + 1, '\n');
@@ -2002,6 +2048,7 @@ int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
2002 static unsigned int tomoyo_serial; 2048 static unsigned int tomoyo_serial;
2003 struct tomoyo_query entry = { }; 2049 struct tomoyo_query entry = { };
2004 bool quota_exceeded = false; 2050 bool quota_exceeded = false;
2051
2005 va_start(args, fmt); 2052 va_start(args, fmt);
2006 len = vsnprintf((char *) &len, 1, fmt, args) + 1; 2053 len = vsnprintf((char *) &len, 1, fmt, args) + 1;
2007 va_end(args); 2054 va_end(args);
@@ -2063,8 +2110,7 @@ int tomoyo_supervisor(struct tomoyo_request_info *r, const char *fmt, ...)
2063 (tomoyo_answer_wait, entry.answer || 2110 (tomoyo_answer_wait, entry.answer ||
2064 !atomic_read(&tomoyo_query_observers), HZ)) 2111 !atomic_read(&tomoyo_query_observers), HZ))
2065 break; 2112 break;
2066 else 2113 entry.timer++;
2067 entry.timer++;
2068 } 2114 }
2069 spin_lock(&tomoyo_query_list_lock); 2115 spin_lock(&tomoyo_query_list_lock);
2070 list_del(&entry.list); 2116 list_del(&entry.list);
@@ -2100,6 +2146,7 @@ static struct tomoyo_domain_info *tomoyo_find_domain_by_qid
2100{ 2146{
2101 struct tomoyo_query *ptr; 2147 struct tomoyo_query *ptr;
2102 struct tomoyo_domain_info *domain = NULL; 2148 struct tomoyo_domain_info *domain = NULL;
2149
2103 spin_lock(&tomoyo_query_list_lock); 2150 spin_lock(&tomoyo_query_list_lock);
2104 list_for_each_entry(ptr, &tomoyo_query_list, list) { 2151 list_for_each_entry(ptr, &tomoyo_query_list, list) {
2105 if (ptr->serial != serial) 2152 if (ptr->serial != serial)
@@ -2142,15 +2189,15 @@ static void tomoyo_read_query(struct tomoyo_io_buffer *head)
2142 unsigned int pos = 0; 2189 unsigned int pos = 0;
2143 size_t len = 0; 2190 size_t len = 0;
2144 char *buf; 2191 char *buf;
2192
2145 if (head->r.w_pos) 2193 if (head->r.w_pos)
2146 return; 2194 return;
2147 if (head->read_buf) { 2195 kfree(head->read_buf);
2148 kfree(head->read_buf); 2196 head->read_buf = NULL;
2149 head->read_buf = NULL;
2150 }
2151 spin_lock(&tomoyo_query_list_lock); 2197 spin_lock(&tomoyo_query_list_lock);
2152 list_for_each(tmp, &tomoyo_query_list) { 2198 list_for_each(tmp, &tomoyo_query_list) {
2153 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list); 2199 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list);
2200
2154 if (pos++ != head->r.query_index) 2201 if (pos++ != head->r.query_index)
2155 continue; 2202 continue;
2156 len = ptr->query_len; 2203 len = ptr->query_len;
@@ -2168,6 +2215,7 @@ static void tomoyo_read_query(struct tomoyo_io_buffer *head)
2168 spin_lock(&tomoyo_query_list_lock); 2215 spin_lock(&tomoyo_query_list_lock);
2169 list_for_each(tmp, &tomoyo_query_list) { 2216 list_for_each(tmp, &tomoyo_query_list) {
2170 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list); 2217 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list);
2218
2171 if (pos++ != head->r.query_index) 2219 if (pos++ != head->r.query_index)
2172 continue; 2220 continue;
2173 /* 2221 /*
@@ -2202,9 +2250,11 @@ static int tomoyo_write_answer(struct tomoyo_io_buffer *head)
2202 struct list_head *tmp; 2250 struct list_head *tmp;
2203 unsigned int serial; 2251 unsigned int serial;
2204 unsigned int answer; 2252 unsigned int answer;
2253
2205 spin_lock(&tomoyo_query_list_lock); 2254 spin_lock(&tomoyo_query_list_lock);
2206 list_for_each(tmp, &tomoyo_query_list) { 2255 list_for_each(tmp, &tomoyo_query_list) {
2207 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list); 2256 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list);
2257
2208 ptr->timer = 0; 2258 ptr->timer = 0;
2209 } 2259 }
2210 spin_unlock(&tomoyo_query_list_lock); 2260 spin_unlock(&tomoyo_query_list_lock);
@@ -2213,6 +2263,7 @@ static int tomoyo_write_answer(struct tomoyo_io_buffer *head)
2213 spin_lock(&tomoyo_query_list_lock); 2263 spin_lock(&tomoyo_query_list_lock);
2214 list_for_each(tmp, &tomoyo_query_list) { 2264 list_for_each(tmp, &tomoyo_query_list) {
2215 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list); 2265 struct tomoyo_query *ptr = list_entry(tmp, typeof(*ptr), list);
2266
2216 if (ptr->serial != serial) 2267 if (ptr->serial != serial)
2217 continue; 2268 continue;
2218 ptr->answer = answer; 2269 ptr->answer = answer;
@@ -2287,6 +2338,7 @@ static void tomoyo_read_stat(struct tomoyo_io_buffer *head)
2287{ 2338{
2288 u8 i; 2339 u8 i;
2289 unsigned int total = 0; 2340 unsigned int total = 0;
2341
2290 if (head->r.eof) 2342 if (head->r.eof)
2291 return; 2343 return;
2292 for (i = 0; i < TOMOYO_MAX_POLICY_STAT; i++) { 2344 for (i = 0; i < TOMOYO_MAX_POLICY_STAT; i++) {
@@ -2295,9 +2347,9 @@ static void tomoyo_read_stat(struct tomoyo_io_buffer *head)
2295 tomoyo_stat_updated[i]); 2347 tomoyo_stat_updated[i]);
2296 if (tomoyo_stat_modified[i]) { 2348 if (tomoyo_stat_modified[i]) {
2297 struct tomoyo_time stamp; 2349 struct tomoyo_time stamp;
2350
2298 tomoyo_convert_time(tomoyo_stat_modified[i], &stamp); 2351 tomoyo_convert_time(tomoyo_stat_modified[i], &stamp);
2299 tomoyo_io_printf(head, " (Last: %04u/%02u/%02u " 2352 tomoyo_io_printf(head, " (Last: %04u/%02u/%02u %02u:%02u:%02u)",
2300 "%02u:%02u:%02u)",
2301 stamp.year, stamp.month, stamp.day, 2353 stamp.year, stamp.month, stamp.day,
2302 stamp.hour, stamp.min, stamp.sec); 2354 stamp.hour, stamp.min, stamp.sec);
2303 } 2355 }
@@ -2305,6 +2357,7 @@ static void tomoyo_read_stat(struct tomoyo_io_buffer *head)
2305 } 2357 }
2306 for (i = 0; i < TOMOYO_MAX_MEMORY_STAT; i++) { 2358 for (i = 0; i < TOMOYO_MAX_MEMORY_STAT; i++) {
2307 unsigned int used = tomoyo_memory_used[i]; 2359 unsigned int used = tomoyo_memory_used[i];
2360
2308 total += used; 2361 total += used;
2309 tomoyo_io_printf(head, "Memory used by %-22s %10u", 2362 tomoyo_io_printf(head, "Memory used by %-22s %10u",
2310 tomoyo_memory_headers[i], used); 2363 tomoyo_memory_headers[i], used);
@@ -2329,6 +2382,7 @@ static int tomoyo_write_stat(struct tomoyo_io_buffer *head)
2329{ 2382{
2330 char *data = head->write_buf; 2383 char *data = head->write_buf;
2331 u8 i; 2384 u8 i;
2385
2332 if (tomoyo_str_starts(&data, "Memory used by ")) 2386 if (tomoyo_str_starts(&data, "Memory used by "))
2333 for (i = 0; i < TOMOYO_MAX_MEMORY_STAT; i++) 2387 for (i = 0; i < TOMOYO_MAX_MEMORY_STAT; i++)
2334 if (tomoyo_str_starts(&data, tomoyo_memory_headers[i])) 2388 if (tomoyo_str_starts(&data, tomoyo_memory_headers[i]))
@@ -2457,6 +2511,7 @@ int tomoyo_open_control(const u8 type, struct file *file)
2457__poll_t tomoyo_poll_control(struct file *file, poll_table *wait) 2511__poll_t tomoyo_poll_control(struct file *file, poll_table *wait)
2458{ 2512{
2459 struct tomoyo_io_buffer *head = file->private_data; 2513 struct tomoyo_io_buffer *head = file->private_data;
2514
2460 if (head->poll) 2515 if (head->poll)
2461 return head->poll(file, wait) | EPOLLOUT | EPOLLWRNORM; 2516 return head->poll(file, wait) | EPOLLOUT | EPOLLWRNORM;
2462 return EPOLLIN | EPOLLRDNORM | EPOLLOUT | EPOLLWRNORM; 2517 return EPOLLIN | EPOLLRDNORM | EPOLLOUT | EPOLLWRNORM;
@@ -2472,6 +2527,7 @@ __poll_t tomoyo_poll_control(struct file *file, poll_table *wait)
2472static inline void tomoyo_set_namespace_cursor(struct tomoyo_io_buffer *head) 2527static inline void tomoyo_set_namespace_cursor(struct tomoyo_io_buffer *head)
2473{ 2528{
2474 struct list_head *ns; 2529 struct list_head *ns;
2530
2475 if (head->type != TOMOYO_EXCEPTIONPOLICY && 2531 if (head->type != TOMOYO_EXCEPTIONPOLICY &&
2476 head->type != TOMOYO_PROFILE) 2532 head->type != TOMOYO_PROFILE)
2477 return; 2533 return;
@@ -2517,7 +2573,7 @@ ssize_t tomoyo_read_control(struct tomoyo_io_buffer *head, char __user *buffer,
2517 int idx; 2573 int idx;
2518 2574
2519 if (!head->read) 2575 if (!head->read)
2520 return -ENOSYS; 2576 return -EINVAL;
2521 if (mutex_lock_interruptible(&head->io_sem)) 2577 if (mutex_lock_interruptible(&head->io_sem))
2522 return -EINTR; 2578 return -EINTR;
2523 head->read_user_buf = buffer; 2579 head->read_user_buf = buffer;
@@ -2557,6 +2613,7 @@ static int tomoyo_parse_policy(struct tomoyo_io_buffer *head, char *line)
2557 head->type == TOMOYO_PROFILE) { 2613 head->type == TOMOYO_PROFILE) {
2558 if (*line == '<') { 2614 if (*line == '<') {
2559 char *cp = strchr(line, ' '); 2615 char *cp = strchr(line, ' ');
2616
2560 if (cp) { 2617 if (cp) {
2561 *cp++ = '\0'; 2618 *cp++ = '\0';
2562 head->w.ns = tomoyo_assign_namespace(line); 2619 head->w.ns = tomoyo_assign_namespace(line);
@@ -2589,8 +2646,9 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
2589 size_t avail_len = buffer_len; 2646 size_t avail_len = buffer_len;
2590 char *cp0 = head->write_buf; 2647 char *cp0 = head->write_buf;
2591 int idx; 2648 int idx;
2649
2592 if (!head->write) 2650 if (!head->write)
2593 return -ENOSYS; 2651 return -EINVAL;
2594 if (!access_ok(buffer, buffer_len)) 2652 if (!access_ok(buffer, buffer_len))
2595 return -EFAULT; 2653 return -EFAULT;
2596 if (mutex_lock_interruptible(&head->io_sem)) 2654 if (mutex_lock_interruptible(&head->io_sem))
@@ -2600,9 +2658,11 @@ ssize_t tomoyo_write_control(struct tomoyo_io_buffer *head,
2600 /* Read a line and dispatch it to the policy handler. */ 2658 /* Read a line and dispatch it to the policy handler. */
2601 while (avail_len > 0) { 2659 while (avail_len > 0) {
2602 char c; 2660 char c;
2661
2603 if (head->w.avail >= head->writebuf_size - 1) { 2662 if (head->w.avail >= head->writebuf_size - 1) {
2604 const int len = head->writebuf_size * 2; 2663 const int len = head->writebuf_size * 2;
2605 char *cp = kzalloc(len, GFP_NOFS); 2664 char *cp = kzalloc(len, GFP_NOFS);
2665
2606 if (!cp) { 2666 if (!cp) {
2607 error = -ENOMEM; 2667 error = -ENOMEM;
2608 break; 2668 break;
@@ -2701,30 +2761,27 @@ void tomoyo_check_profile(void)
2701{ 2761{
2702 struct tomoyo_domain_info *domain; 2762 struct tomoyo_domain_info *domain;
2703 const int idx = tomoyo_read_lock(); 2763 const int idx = tomoyo_read_lock();
2764
2704 tomoyo_policy_loaded = true; 2765 tomoyo_policy_loaded = true;
2705 printk(KERN_INFO "TOMOYO: 2.5.0\n"); 2766 pr_info("TOMOYO: 2.5.0\n");
2706 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) { 2767 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
2707 const u8 profile = domain->profile; 2768 const u8 profile = domain->profile;
2708 const struct tomoyo_policy_namespace *ns = domain->ns; 2769 const struct tomoyo_policy_namespace *ns = domain->ns;
2770
2709 if (ns->profile_version != 20110903) 2771 if (ns->profile_version != 20110903)
2710 printk(KERN_ERR 2772 pr_err("Profile version %u is not supported.\n",
2711 "Profile version %u is not supported.\n",
2712 ns->profile_version); 2773 ns->profile_version);
2713 else if (!ns->profile_ptr[profile]) 2774 else if (!ns->profile_ptr[profile])
2714 printk(KERN_ERR 2775 pr_err("Profile %u (used by '%s') is not defined.\n",
2715 "Profile %u (used by '%s') is not defined.\n",
2716 profile, domain->domainname->name); 2776 profile, domain->domainname->name);
2717 else 2777 else
2718 continue; 2778 continue;
2719 printk(KERN_ERR 2779 pr_err("Userland tools for TOMOYO 2.5 must be installed and policy must be initialized.\n");
2720 "Userland tools for TOMOYO 2.5 must be installed and " 2780 pr_err("Please see http://tomoyo.sourceforge.jp/2.5/ for more information.\n");
2721 "policy must be initialized.\n");
2722 printk(KERN_ERR "Please see http://tomoyo.sourceforge.jp/2.5/ "
2723 "for more information.\n");
2724 panic("STOP!"); 2781 panic("STOP!");
2725 } 2782 }
2726 tomoyo_read_unlock(idx); 2783 tomoyo_read_unlock(idx);
2727 printk(KERN_INFO "Mandatory Access Control activated.\n"); 2784 pr_info("Mandatory Access Control activated.\n");
2728} 2785}
2729 2786
2730/** 2787/**
@@ -2743,9 +2800,11 @@ void __init tomoyo_load_builtin_policy(void)
2743#include "builtin-policy.h" 2800#include "builtin-policy.h"
2744 u8 i; 2801 u8 i;
2745 const int idx = tomoyo_read_lock(); 2802 const int idx = tomoyo_read_lock();
2803
2746 for (i = 0; i < 5; i++) { 2804 for (i = 0; i < 5; i++) {
2747 struct tomoyo_io_buffer head = { }; 2805 struct tomoyo_io_buffer head = { };
2748 char *start = ""; 2806 char *start = "";
2807
2749 switch (i) { 2808 switch (i) {
2750 case 0: 2809 case 0:
2751 start = tomoyo_builtin_profile; 2810 start = tomoyo_builtin_profile;
@@ -2775,6 +2834,7 @@ void __init tomoyo_load_builtin_policy(void)
2775 } 2834 }
2776 while (1) { 2835 while (1) {
2777 char *end = strchr(start, '\n'); 2836 char *end = strchr(start, '\n');
2837
2778 if (!end) 2838 if (!end)
2779 break; 2839 break;
2780 *end = '\0'; 2840 *end = '\0';
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index cfd075c92583..f2c458ab9942 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -10,6 +10,8 @@
10#ifndef _SECURITY_TOMOYO_COMMON_H 10#ifndef _SECURITY_TOMOYO_COMMON_H
11#define _SECURITY_TOMOYO_COMMON_H 11#define _SECURITY_TOMOYO_COMMON_H
12 12
13#define pr_fmt(fmt) fmt
14
13#include <linux/ctype.h> 15#include <linux/ctype.h>
14#include <linux/string.h> 16#include <linux/string.h>
15#include <linux/mm.h> 17#include <linux/mm.h>
@@ -788,9 +790,9 @@ struct tomoyo_acl_param {
788 * interfaces. 790 * interfaces.
789 */ 791 */
790struct tomoyo_io_buffer { 792struct tomoyo_io_buffer {
791 void (*read) (struct tomoyo_io_buffer *); 793 void (*read)(struct tomoyo_io_buffer *head);
792 int (*write) (struct tomoyo_io_buffer *); 794 int (*write)(struct tomoyo_io_buffer *head);
793 __poll_t (*poll) (struct file *file, poll_table *wait); 795 __poll_t (*poll)(struct file *file, poll_table *wait);
794 /* Exclusive lock for this structure. */ 796 /* Exclusive lock for this structure. */
795 struct mutex io_sem; 797 struct mutex io_sem;
796 char __user *read_user_buf; 798 char __user *read_user_buf;
@@ -1042,8 +1044,8 @@ void *tomoyo_commit_ok(void *data, const unsigned int size);
1042void __init tomoyo_load_builtin_policy(void); 1044void __init tomoyo_load_builtin_policy(void);
1043void __init tomoyo_mm_init(void); 1045void __init tomoyo_mm_init(void);
1044void tomoyo_check_acl(struct tomoyo_request_info *r, 1046void tomoyo_check_acl(struct tomoyo_request_info *r,
1045 bool (*check_entry) (struct tomoyo_request_info *, 1047 bool (*check_entry)(struct tomoyo_request_info *,
1046 const struct tomoyo_acl_info *)); 1048 const struct tomoyo_acl_info *));
1047void tomoyo_check_profile(void); 1049void tomoyo_check_profile(void);
1048void tomoyo_convert_time(time64_t time, struct tomoyo_time *stamp); 1050void tomoyo_convert_time(time64_t time, struct tomoyo_time *stamp);
1049void tomoyo_del_condition(struct list_head *element); 1051void tomoyo_del_condition(struct list_head *element);
@@ -1131,6 +1133,7 @@ static inline void tomoyo_read_unlock(int idx)
1131static inline pid_t tomoyo_sys_getppid(void) 1133static inline pid_t tomoyo_sys_getppid(void)
1132{ 1134{
1133 pid_t pid; 1135 pid_t pid;
1136
1134 rcu_read_lock(); 1137 rcu_read_lock();
1135 pid = task_tgid_vnr(rcu_dereference(current->real_parent)); 1138 pid = task_tgid_vnr(rcu_dereference(current->real_parent));
1136 rcu_read_unlock(); 1139 rcu_read_unlock();
diff --git a/security/tomoyo/condition.c b/security/tomoyo/condition.c
index 8d0e1b9c9c57..8f6d57c15df6 100644
--- a/security/tomoyo/condition.c
+++ b/security/tomoyo/condition.c
@@ -28,9 +28,11 @@ static bool tomoyo_argv(const unsigned int index, const char *arg_ptr,
28{ 28{
29 int i; 29 int i;
30 struct tomoyo_path_info arg; 30 struct tomoyo_path_info arg;
31
31 arg.name = arg_ptr; 32 arg.name = arg_ptr;
32 for (i = 0; i < argc; argv++, checked++, i++) { 33 for (i = 0; i < argc; argv++, checked++, i++) {
33 bool result; 34 bool result;
35
34 if (index != argv->index) 36 if (index != argv->index)
35 continue; 37 continue;
36 *checked = 1; 38 *checked = 1;
@@ -62,12 +64,14 @@ static bool tomoyo_envp(const char *env_name, const char *env_value,
62 int i; 64 int i;
63 struct tomoyo_path_info name; 65 struct tomoyo_path_info name;
64 struct tomoyo_path_info value; 66 struct tomoyo_path_info value;
67
65 name.name = env_name; 68 name.name = env_name;
66 tomoyo_fill_path_info(&name); 69 tomoyo_fill_path_info(&name);
67 value.name = env_value; 70 value.name = env_value;
68 tomoyo_fill_path_info(&value); 71 tomoyo_fill_path_info(&value);
69 for (i = 0; i < envc; envp++, checked++, i++) { 72 for (i = 0; i < envc; envp++, checked++, i++) {
70 bool result; 73 bool result;
74
71 if (!tomoyo_path_matches_pattern(&name, envp->name)) 75 if (!tomoyo_path_matches_pattern(&name, envp->name))
72 continue; 76 continue;
73 *checked = 1; 77 *checked = 1;
@@ -113,6 +117,7 @@ static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
113 bool result = true; 117 bool result = true;
114 u8 local_checked[32]; 118 u8 local_checked[32];
115 u8 *checked; 119 u8 *checked;
120
116 if (argc + envc <= sizeof(local_checked)) { 121 if (argc + envc <= sizeof(local_checked)) {
117 checked = local_checked; 122 checked = local_checked;
118 memset(local_checked, 0, sizeof(local_checked)); 123 memset(local_checked, 0, sizeof(local_checked));
@@ -131,6 +136,7 @@ static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
131 /* Read. */ 136 /* Read. */
132 const char *kaddr = dump->data; 137 const char *kaddr = dump->data;
133 const unsigned char c = kaddr[offset++]; 138 const unsigned char c = kaddr[offset++];
139
134 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) { 140 if (c && arg_len < TOMOYO_EXEC_TMPSIZE - 10) {
135 if (c == '\\') { 141 if (c == '\\') {
136 arg_ptr[arg_len++] = '\\'; 142 arg_ptr[arg_len++] = '\\';
@@ -160,6 +166,7 @@ static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
160 argv_count--; 166 argv_count--;
161 } else if (envp_count) { 167 } else if (envp_count) {
162 char *cp = strchr(arg_ptr, '='); 168 char *cp = strchr(arg_ptr, '=');
169
163 if (cp) { 170 if (cp) {
164 *cp = '\0'; 171 *cp = '\0';
165 if (!tomoyo_envp(arg_ptr, cp + 1, 172 if (!tomoyo_envp(arg_ptr, cp + 1,
@@ -182,6 +189,7 @@ static bool tomoyo_scan_bprm(struct tomoyo_execve *ee,
182out: 189out:
183 if (result) { 190 if (result) {
184 int i; 191 int i;
192
185 /* Check not-yet-checked entries. */ 193 /* Check not-yet-checked entries. */
186 for (i = 0; i < argc; i++) { 194 for (i = 0; i < argc; i++) {
187 if (checked[i]) 195 if (checked[i])
@@ -229,6 +237,7 @@ static bool tomoyo_scan_exec_realpath(struct file *file,
229{ 237{
230 bool result; 238 bool result;
231 struct tomoyo_path_info exe; 239 struct tomoyo_path_info exe;
240
232 if (!file) 241 if (!file)
233 return false; 242 return false;
234 exe.name = tomoyo_realpath_from_path(&file->f_path); 243 exe.name = tomoyo_realpath_from_path(&file->f_path);
@@ -250,6 +259,7 @@ static bool tomoyo_scan_exec_realpath(struct file *file,
250static const struct tomoyo_path_info *tomoyo_get_dqword(char *start) 259static const struct tomoyo_path_info *tomoyo_get_dqword(char *start)
251{ 260{
252 char *cp = start + strlen(start) - 1; 261 char *cp = start + strlen(start) - 1;
262
253 if (cp == start || *start++ != '"' || *cp != '"') 263 if (cp == start || *start++ != '"' || *cp != '"')
254 return NULL; 264 return NULL;
255 *cp = '\0'; 265 *cp = '\0';
@@ -270,6 +280,7 @@ static bool tomoyo_parse_name_union_quoted(struct tomoyo_acl_param *param,
270 struct tomoyo_name_union *ptr) 280 struct tomoyo_name_union *ptr)
271{ 281{
272 char *filename = param->data; 282 char *filename = param->data;
283
273 if (*filename == '@') 284 if (*filename == '@')
274 return tomoyo_parse_name_union(param, ptr); 285 return tomoyo_parse_name_union(param, ptr);
275 ptr->filename = tomoyo_get_dqword(filename); 286 ptr->filename = tomoyo_get_dqword(filename);
@@ -310,6 +321,7 @@ static bool tomoyo_parse_envp(char *left, char *right,
310 const struct tomoyo_path_info *name; 321 const struct tomoyo_path_info *name;
311 const struct tomoyo_path_info *value; 322 const struct tomoyo_path_info *value;
312 char *cp = left + strlen(left) - 1; 323 char *cp = left + strlen(left) - 1;
324
313 if (*cp-- != ']' || *cp != '"') 325 if (*cp-- != ']' || *cp != '"')
314 goto out; 326 goto out;
315 *cp = '\0'; 327 *cp = '\0';
@@ -364,6 +376,7 @@ static inline bool tomoyo_same_condition(const struct tomoyo_condition *a,
364static u8 tomoyo_condition_type(const char *word) 376static u8 tomoyo_condition_type(const char *word)
365{ 377{
366 u8 i; 378 u8 i;
379
367 for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) { 380 for (i = 0; i < TOMOYO_MAX_CONDITION_KEYWORD; i++) {
368 if (!strcmp(word, tomoyo_condition_keyword[i])) 381 if (!strcmp(word, tomoyo_condition_keyword[i]))
369 break; 382 break;
@@ -395,6 +408,7 @@ static struct tomoyo_condition *tomoyo_commit_condition
395{ 408{
396 struct tomoyo_condition *ptr; 409 struct tomoyo_condition *ptr;
397 bool found = false; 410 bool found = false;
411
398 if (mutex_lock_interruptible(&tomoyo_policy_lock)) { 412 if (mutex_lock_interruptible(&tomoyo_policy_lock)) {
399 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__); 413 dprintk(KERN_WARNING "%u: %s failed\n", __LINE__, __func__);
400 ptr = NULL; 414 ptr = NULL;
@@ -442,12 +456,14 @@ static char *tomoyo_get_transit_preference(struct tomoyo_acl_param *param,
442{ 456{
443 char * const pos = param->data; 457 char * const pos = param->data;
444 bool flag; 458 bool flag;
459
445 if (*pos == '<') { 460 if (*pos == '<') {
446 e->transit = tomoyo_get_domainname(param); 461 e->transit = tomoyo_get_domainname(param);
447 goto done; 462 goto done;
448 } 463 }
449 { 464 {
450 char *cp = strchr(pos, ' '); 465 char *cp = strchr(pos, ' ');
466
451 if (cp) 467 if (cp)
452 *cp = '\0'; 468 *cp = '\0';
453 flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") || 469 flag = tomoyo_correct_path(pos) || !strcmp(pos, "keep") ||
@@ -489,6 +505,7 @@ struct tomoyo_condition *tomoyo_get_condition(struct tomoyo_acl_param *param)
489 tomoyo_get_transit_preference(param, &e); 505 tomoyo_get_transit_preference(param, &e);
490 char * const end_of_string = start_of_string + strlen(start_of_string); 506 char * const end_of_string = start_of_string + strlen(start_of_string);
491 char *pos; 507 char *pos;
508
492rerun: 509rerun:
493 pos = start_of_string; 510 pos = start_of_string;
494 while (1) { 511 while (1) {
@@ -498,6 +515,7 @@ rerun:
498 char *cp; 515 char *cp;
499 char *right_word; 516 char *right_word;
500 bool is_not; 517 bool is_not;
518
501 if (!*left_word) 519 if (!*left_word)
502 break; 520 break;
503 /* 521 /*
@@ -622,8 +640,8 @@ rerun:
622 } 640 }
623store_value: 641store_value:
624 if (!condp) { 642 if (!condp) {
625 dprintk(KERN_WARNING "%u: dry_run left=%u right=%u " 643 dprintk(KERN_WARNING "%u: dry_run left=%u right=%u match=%u\n",
626 "match=%u\n", __LINE__, left, right, !is_not); 644 __LINE__, left, right, !is_not);
627 continue; 645 continue;
628 } 646 }
629 condp->left = left; 647 condp->left = left;
@@ -660,6 +678,7 @@ store_value:
660 envp = (struct tomoyo_envp *) (argv + e.argc); 678 envp = (struct tomoyo_envp *) (argv + e.argc);
661 { 679 {
662 bool flag = false; 680 bool flag = false;
681
663 for (pos = start_of_string; pos < end_of_string; pos++) { 682 for (pos = start_of_string; pos < end_of_string; pos++) {
664 if (*pos) 683 if (*pos)
665 continue; 684 continue;
@@ -698,6 +717,7 @@ void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
698 717
699 for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) { 718 for (i = 0; i < TOMOYO_MAX_PATH_STAT; i++) {
700 struct inode *inode; 719 struct inode *inode;
720
701 switch (i) { 721 switch (i) {
702 case TOMOYO_PATH1: 722 case TOMOYO_PATH1:
703 dentry = obj->path1.dentry; 723 dentry = obj->path1.dentry;
@@ -718,6 +738,7 @@ void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
718 inode = d_backing_inode(dentry); 738 inode = d_backing_inode(dentry);
719 if (inode) { 739 if (inode) {
720 struct tomoyo_mini_stat *stat = &obj->stat[i]; 740 struct tomoyo_mini_stat *stat = &obj->stat[i];
741
721 stat->uid = inode->i_uid; 742 stat->uid = inode->i_uid;
722 stat->gid = inode->i_gid; 743 stat->gid = inode->i_gid;
723 stat->ino = inode->i_ino; 744 stat->ino = inode->i_ino;
@@ -726,8 +747,7 @@ void tomoyo_get_attributes(struct tomoyo_obj_info *obj)
726 stat->rdev = inode->i_rdev; 747 stat->rdev = inode->i_rdev;
727 obj->stat_valid[i] = true; 748 obj->stat_valid[i] = true;
728 } 749 }
729 if (i & 1) /* i == TOMOYO_PATH1_PARENT || 750 if (i & 1) /* TOMOYO_PATH1_PARENT or TOMOYO_PATH2_PARENT */
730 i == TOMOYO_PATH2_PARENT */
731 dput(dentry); 751 dput(dentry);
732 } 752 }
733} 753}
@@ -758,6 +778,7 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
758 u16 argc; 778 u16 argc;
759 u16 envc; 779 u16 envc;
760 struct linux_binprm *bprm = NULL; 780 struct linux_binprm *bprm = NULL;
781
761 if (!cond) 782 if (!cond)
762 return true; 783 return true;
763 condc = cond->condc; 784 condc = cond->condc;
@@ -780,6 +801,7 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
780 const u8 right = condp->right; 801 const u8 right = condp->right;
781 bool is_bitop[2] = { false, false }; 802 bool is_bitop[2] = { false, false };
782 u8 j; 803 u8 j;
804
783 condp++; 805 condp++;
784 /* Check argv[] and envp[] later. */ 806 /* Check argv[] and envp[] later. */
785 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY) 807 if (left == TOMOYO_ARGV_ENTRY || left == TOMOYO_ENVP_ENTRY)
@@ -787,10 +809,11 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
787 /* Check string expressions. */ 809 /* Check string expressions. */
788 if (right == TOMOYO_NAME_UNION) { 810 if (right == TOMOYO_NAME_UNION) {
789 const struct tomoyo_name_union *ptr = names_p++; 811 const struct tomoyo_name_union *ptr = names_p++;
812 struct tomoyo_path_info *symlink;
813 struct tomoyo_execve *ee;
814 struct file *file;
815
790 switch (left) { 816 switch (left) {
791 struct tomoyo_path_info *symlink;
792 struct tomoyo_execve *ee;
793 struct file *file;
794 case TOMOYO_SYMLINK_TARGET: 817 case TOMOYO_SYMLINK_TARGET:
795 symlink = obj ? obj->symlink_target : NULL; 818 symlink = obj ? obj->symlink_target : NULL;
796 if (!symlink || 819 if (!symlink ||
@@ -812,6 +835,7 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
812 for (j = 0; j < 2; j++) { 835 for (j = 0; j < 2; j++) {
813 const u8 index = j ? right : left; 836 const u8 index = j ? right : left;
814 unsigned long value = 0; 837 unsigned long value = 0;
838
815 switch (index) { 839 switch (index) {
816 case TOMOYO_TASK_UID: 840 case TOMOYO_TASK_UID:
817 value = from_kuid(&init_user_ns, current_uid()); 841 value = from_kuid(&init_user_ns, current_uid());
@@ -874,31 +898,31 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
874 value = S_ISVTX; 898 value = S_ISVTX;
875 break; 899 break;
876 case TOMOYO_MODE_OWNER_READ: 900 case TOMOYO_MODE_OWNER_READ:
877 value = S_IRUSR; 901 value = 0400;
878 break; 902 break;
879 case TOMOYO_MODE_OWNER_WRITE: 903 case TOMOYO_MODE_OWNER_WRITE:
880 value = S_IWUSR; 904 value = 0200;
881 break; 905 break;
882 case TOMOYO_MODE_OWNER_EXECUTE: 906 case TOMOYO_MODE_OWNER_EXECUTE:
883 value = S_IXUSR; 907 value = 0100;
884 break; 908 break;
885 case TOMOYO_MODE_GROUP_READ: 909 case TOMOYO_MODE_GROUP_READ:
886 value = S_IRGRP; 910 value = 0040;
887 break; 911 break;
888 case TOMOYO_MODE_GROUP_WRITE: 912 case TOMOYO_MODE_GROUP_WRITE:
889 value = S_IWGRP; 913 value = 0020;
890 break; 914 break;
891 case TOMOYO_MODE_GROUP_EXECUTE: 915 case TOMOYO_MODE_GROUP_EXECUTE:
892 value = S_IXGRP; 916 value = 0010;
893 break; 917 break;
894 case TOMOYO_MODE_OTHERS_READ: 918 case TOMOYO_MODE_OTHERS_READ:
895 value = S_IROTH; 919 value = 0004;
896 break; 920 break;
897 case TOMOYO_MODE_OTHERS_WRITE: 921 case TOMOYO_MODE_OTHERS_WRITE:
898 value = S_IWOTH; 922 value = 0002;
899 break; 923 break;
900 case TOMOYO_MODE_OTHERS_EXECUTE: 924 case TOMOYO_MODE_OTHERS_EXECUTE:
901 value = S_IXOTH; 925 value = 0001;
902 break; 926 break;
903 case TOMOYO_EXEC_ARGC: 927 case TOMOYO_EXEC_ARGC:
904 if (!bprm) 928 if (!bprm)
@@ -923,6 +947,7 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
923 { 947 {
924 u8 stat_index; 948 u8 stat_index;
925 struct tomoyo_mini_stat *stat; 949 struct tomoyo_mini_stat *stat;
950
926 switch (index) { 951 switch (index) {
927 case TOMOYO_PATH1_UID: 952 case TOMOYO_PATH1_UID:
928 case TOMOYO_PATH1_GID: 953 case TOMOYO_PATH1_GID:
@@ -1036,12 +1061,14 @@ bool tomoyo_condition(struct tomoyo_request_info *r,
1036 if (left == TOMOYO_NUMBER_UNION) { 1061 if (left == TOMOYO_NUMBER_UNION) {
1037 /* Fetch values now. */ 1062 /* Fetch values now. */
1038 const struct tomoyo_number_union *ptr = numbers_p++; 1063 const struct tomoyo_number_union *ptr = numbers_p++;
1064
1039 min_v[0] = ptr->values[0]; 1065 min_v[0] = ptr->values[0];
1040 max_v[0] = ptr->values[1]; 1066 max_v[0] = ptr->values[1];
1041 } 1067 }
1042 if (right == TOMOYO_NUMBER_UNION) { 1068 if (right == TOMOYO_NUMBER_UNION) {
1043 /* Fetch values now. */ 1069 /* Fetch values now. */
1044 const struct tomoyo_number_union *ptr = numbers_p++; 1070 const struct tomoyo_number_union *ptr = numbers_p++;
1071
1045 if (ptr->group) { 1072 if (ptr->group) {
1046 if (tomoyo_number_matches_group(min_v[0], 1073 if (tomoyo_number_matches_group(min_v[0],
1047 max_v[0], 1074 max_v[0],
diff --git a/security/tomoyo/domain.c b/security/tomoyo/domain.c
index 39abf3ae6168..bf832b301412 100644
--- a/security/tomoyo/domain.c
+++ b/security/tomoyo/domain.c
@@ -30,10 +30,10 @@ struct tomoyo_domain_info tomoyo_kernel_domain;
30 */ 30 */
31int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size, 31int tomoyo_update_policy(struct tomoyo_acl_head *new_entry, const int size,
32 struct tomoyo_acl_param *param, 32 struct tomoyo_acl_param *param,
33 bool (*check_duplicate) (const struct tomoyo_acl_head 33 bool (*check_duplicate)(const struct tomoyo_acl_head
34 *, 34 *,
35 const struct tomoyo_acl_head 35 const struct tomoyo_acl_head
36 *)) 36 *))
37{ 37{
38 int error = param->is_delete ? -ENOENT : -ENOMEM; 38 int error = param->is_delete ? -ENOENT : -ENOMEM;
39 struct tomoyo_acl_head *entry; 39 struct tomoyo_acl_head *entry;
@@ -90,13 +90,13 @@ static inline bool tomoyo_same_acl_head(const struct tomoyo_acl_info *a,
90 */ 90 */
91int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size, 91int tomoyo_update_domain(struct tomoyo_acl_info *new_entry, const int size,
92 struct tomoyo_acl_param *param, 92 struct tomoyo_acl_param *param,
93 bool (*check_duplicate) (const struct tomoyo_acl_info 93 bool (*check_duplicate)(const struct tomoyo_acl_info
94 *, 94 *,
95 const struct tomoyo_acl_info 95 const struct tomoyo_acl_info
96 *), 96 *),
97 bool (*merge_duplicate) (struct tomoyo_acl_info *, 97 bool (*merge_duplicate)(struct tomoyo_acl_info *,
98 struct tomoyo_acl_info *, 98 struct tomoyo_acl_info *,
99 const bool)) 99 const bool))
100{ 100{
101 const bool is_delete = param->is_delete; 101 const bool is_delete = param->is_delete;
102 int error = is_delete ? -ENOENT : -ENOMEM; 102 int error = is_delete ? -ENOENT : -ENOMEM;
@@ -157,8 +157,8 @@ out:
157 * Caller holds tomoyo_read_lock(). 157 * Caller holds tomoyo_read_lock().
158 */ 158 */
159void tomoyo_check_acl(struct tomoyo_request_info *r, 159void tomoyo_check_acl(struct tomoyo_request_info *r,
160 bool (*check_entry) (struct tomoyo_request_info *, 160 bool (*check_entry)(struct tomoyo_request_info *,
161 const struct tomoyo_acl_info *)) 161 const struct tomoyo_acl_info *))
162{ 162{
163 const struct tomoyo_domain_info *domain = r->domain; 163 const struct tomoyo_domain_info *domain = r->domain;
164 struct tomoyo_acl_info *ptr; 164 struct tomoyo_acl_info *ptr;
@@ -198,6 +198,7 @@ LIST_HEAD(tomoyo_domain_list);
198static const char *tomoyo_last_word(const char *name) 198static const char *tomoyo_last_word(const char *name)
199{ 199{
200 const char *cp = strrchr(name, ' '); 200 const char *cp = strrchr(name, ' ');
201
201 if (cp) 202 if (cp)
202 return cp + 1; 203 return cp + 1;
203 return name; 204 return name;
@@ -220,6 +221,7 @@ static bool tomoyo_same_transition_control(const struct tomoyo_acl_head *a,
220 const struct tomoyo_transition_control *p2 = container_of(b, 221 const struct tomoyo_transition_control *p2 = container_of(b,
221 typeof(*p2), 222 typeof(*p2),
222 head); 223 head);
224
223 return p1->type == p2->type && p1->is_last_name == p2->is_last_name 225 return p1->type == p2->type && p1->is_last_name == p2->is_last_name
224 && p1->domainname == p2->domainname 226 && p1->domainname == p2->domainname
225 && p1->program == p2->program; 227 && p1->program == p2->program;
@@ -240,6 +242,7 @@ int tomoyo_write_transition_control(struct tomoyo_acl_param *param,
240 int error = param->is_delete ? -ENOENT : -ENOMEM; 242 int error = param->is_delete ? -ENOENT : -ENOMEM;
241 char *program = param->data; 243 char *program = param->data;
242 char *domainname = strstr(program, " from "); 244 char *domainname = strstr(program, " from ");
245
243 if (domainname) { 246 if (domainname) {
244 *domainname = '\0'; 247 *domainname = '\0';
245 domainname += 6; 248 domainname += 6;
@@ -293,6 +296,7 @@ static inline bool tomoyo_scan_transition
293 const enum tomoyo_transition_type type) 296 const enum tomoyo_transition_type type)
294{ 297{
295 const struct tomoyo_transition_control *ptr; 298 const struct tomoyo_transition_control *ptr;
299
296 list_for_each_entry_rcu(ptr, list, head.list) { 300 list_for_each_entry_rcu(ptr, list, head.list) {
297 if (ptr->head.is_deleted || ptr->type != type) 301 if (ptr->head.is_deleted || ptr->type != type)
298 continue; 302 continue;
@@ -338,9 +342,11 @@ static enum tomoyo_transition_type tomoyo_transition_type
338{ 342{
339 const char *last_name = tomoyo_last_word(domainname->name); 343 const char *last_name = tomoyo_last_word(domainname->name);
340 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET; 344 enum tomoyo_transition_type type = TOMOYO_TRANSITION_CONTROL_NO_RESET;
345
341 while (type < TOMOYO_MAX_TRANSITION_TYPE) { 346 while (type < TOMOYO_MAX_TRANSITION_TYPE) {
342 const struct list_head * const list = 347 const struct list_head * const list =
343 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL]; 348 &ns->policy_list[TOMOYO_ID_TRANSITION_CONTROL];
349
344 if (!tomoyo_scan_transition(list, domainname, program, 350 if (!tomoyo_scan_transition(list, domainname, program,
345 last_name, type)) { 351 last_name, type)) {
346 type++; 352 type++;
@@ -375,6 +381,7 @@ static bool tomoyo_same_aggregator(const struct tomoyo_acl_head *a,
375 head); 381 head);
376 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2), 382 const struct tomoyo_aggregator *p2 = container_of(b, typeof(*p2),
377 head); 383 head);
384
378 return p1->original_name == p2->original_name && 385 return p1->original_name == p2->original_name &&
379 p1->aggregated_name == p2->aggregated_name; 386 p1->aggregated_name == p2->aggregated_name;
380} 387}
@@ -394,6 +401,7 @@ int tomoyo_write_aggregator(struct tomoyo_acl_param *param)
394 int error = param->is_delete ? -ENOENT : -ENOMEM; 401 int error = param->is_delete ? -ENOENT : -ENOMEM;
395 const char *original_name = tomoyo_read_token(param); 402 const char *original_name = tomoyo_read_token(param);
396 const char *aggregated_name = tomoyo_read_token(param); 403 const char *aggregated_name = tomoyo_read_token(param);
404
397 if (!tomoyo_correct_word(original_name) || 405 if (!tomoyo_correct_word(original_name) ||
398 !tomoyo_correct_path(aggregated_name)) 406 !tomoyo_correct_path(aggregated_name))
399 return -EINVAL; 407 return -EINVAL;
@@ -426,6 +434,7 @@ static struct tomoyo_policy_namespace *tomoyo_find_namespace
426(const char *name, const unsigned int len) 434(const char *name, const unsigned int len)
427{ 435{
428 struct tomoyo_policy_namespace *ns; 436 struct tomoyo_policy_namespace *ns;
437
429 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) { 438 list_for_each_entry(ns, &tomoyo_namespace_list, namespace_list) {
430 if (strncmp(name, ns->name, len) || 439 if (strncmp(name, ns->name, len) ||
431 (name[len] && name[len] != ' ')) 440 (name[len] && name[len] != ' '))
@@ -451,6 +460,7 @@ struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
451 struct tomoyo_policy_namespace *entry; 460 struct tomoyo_policy_namespace *entry;
452 const char *cp = domainname; 461 const char *cp = domainname;
453 unsigned int len = 0; 462 unsigned int len = 0;
463
454 while (*cp && *cp++ != ' ') 464 while (*cp && *cp++ != ' ')
455 len++; 465 len++;
456 ptr = tomoyo_find_namespace(domainname, len); 466 ptr = tomoyo_find_namespace(domainname, len);
@@ -466,6 +476,7 @@ struct tomoyo_policy_namespace *tomoyo_assign_namespace(const char *domainname)
466 ptr = tomoyo_find_namespace(domainname, len); 476 ptr = tomoyo_find_namespace(domainname, len);
467 if (!ptr && tomoyo_memory_ok(entry)) { 477 if (!ptr && tomoyo_memory_ok(entry)) {
468 char *name = (char *) (entry + 1); 478 char *name = (char *) (entry + 1);
479
469 ptr = entry; 480 ptr = entry;
470 memmove(name, domainname, len); 481 memmove(name, domainname, len);
471 name[len] = '\0'; 482 name[len] = '\0';
@@ -490,6 +501,7 @@ static bool tomoyo_namespace_jump(const char *domainname)
490{ 501{
491 const char *namespace = tomoyo_current_namespace()->name; 502 const char *namespace = tomoyo_current_namespace()->name;
492 const int len = strlen(namespace); 503 const int len = strlen(namespace);
504
493 return strncmp(domainname, namespace, len) || 505 return strncmp(domainname, namespace, len) ||
494 (domainname[len] && domainname[len] != ' '); 506 (domainname[len] && domainname[len] != ' ');
495} 507}
@@ -510,6 +522,7 @@ struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
510 struct tomoyo_domain_info e = { }; 522 struct tomoyo_domain_info e = { };
511 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname); 523 struct tomoyo_domain_info *entry = tomoyo_find_domain(domainname);
512 bool created = false; 524 bool created = false;
525
513 if (entry) { 526 if (entry) {
514 if (transit) { 527 if (transit) {
515 /* 528 /*
@@ -546,6 +559,7 @@ struct tomoyo_domain_info *tomoyo_assign_domain(const char *domainname,
546 */ 559 */
547 if (transit) { 560 if (transit) {
548 const struct tomoyo_domain_info *domain = tomoyo_domain(); 561 const struct tomoyo_domain_info *domain = tomoyo_domain();
562
549 e.profile = domain->profile; 563 e.profile = domain->profile;
550 e.group = domain->group; 564 e.group = domain->group;
551 } 565 }
@@ -569,6 +583,7 @@ out:
569 if (entry && transit) { 583 if (entry && transit) {
570 if (created) { 584 if (created) {
571 struct tomoyo_request_info r; 585 struct tomoyo_request_info r;
586
572 tomoyo_init_request_info(&r, entry, 587 tomoyo_init_request_info(&r, entry,
573 TOMOYO_MAC_FILE_EXECUTE); 588 TOMOYO_MAC_FILE_EXECUTE);
574 r.granted = false; 589 r.granted = false;
@@ -712,6 +727,7 @@ retry:
712 struct tomoyo_aggregator *ptr; 727 struct tomoyo_aggregator *ptr;
713 struct list_head *list = 728 struct list_head *list =
714 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR]; 729 &old_domain->ns->policy_list[TOMOYO_ID_AGGREGATOR];
730
715 /* Check 'aggregator' directive. */ 731 /* Check 'aggregator' directive. */
716 candidate = &exename; 732 candidate = &exename;
717 list_for_each_entry_rcu(ptr, list, head.list) { 733 list_for_each_entry_rcu(ptr, list, head.list) {
@@ -747,6 +763,7 @@ retry:
747 */ 763 */
748 if (ee->transition) { 764 if (ee->transition) {
749 const char *domainname = ee->transition->name; 765 const char *domainname = ee->transition->name;
766
750 reject_on_transition_failure = true; 767 reject_on_transition_failure = true;
751 if (!strcmp(domainname, "keep")) 768 if (!strcmp(domainname, "keep"))
752 goto force_keep_domain; 769 goto force_keep_domain;
@@ -758,6 +775,7 @@ retry:
758 goto force_initialize_domain; 775 goto force_initialize_domain;
759 if (!strcmp(domainname, "parent")) { 776 if (!strcmp(domainname, "parent")) {
760 char *cp; 777 char *cp;
778
761 strncpy(ee->tmp, old_domain->domainname->name, 779 strncpy(ee->tmp, old_domain->domainname->name,
762 TOMOYO_EXEC_TMPSIZE - 1); 780 TOMOYO_EXEC_TMPSIZE - 1);
763 cp = strrchr(ee->tmp, ' '); 781 cp = strrchr(ee->tmp, ' ');
@@ -822,8 +840,7 @@ force_jump_domain:
822 if (domain) 840 if (domain)
823 retval = 0; 841 retval = 0;
824 else if (reject_on_transition_failure) { 842 else if (reject_on_transition_failure) {
825 printk(KERN_WARNING "ERROR: Domain '%s' not ready.\n", 843 pr_warn("ERROR: Domain '%s' not ready.\n", ee->tmp);
826 ee->tmp);
827 retval = -ENOMEM; 844 retval = -ENOMEM;
828 } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING) 845 } else if (ee->r.mode == TOMOYO_CONFIG_ENFORCING)
829 retval = -ENOMEM; 846 retval = -ENOMEM;
@@ -834,8 +851,7 @@ force_jump_domain:
834 ee->r.granted = false; 851 ee->r.granted = false;
835 tomoyo_write_log(&ee->r, "%s", tomoyo_dif 852 tomoyo_write_log(&ee->r, "%s", tomoyo_dif
836 [TOMOYO_DIF_TRANSITION_FAILED]); 853 [TOMOYO_DIF_TRANSITION_FAILED]);
837 printk(KERN_WARNING 854 pr_warn("ERROR: Domain '%s' not defined.\n", ee->tmp);
838 "ERROR: Domain '%s' not defined.\n", ee->tmp);
839 } 855 }
840 } 856 }
841 out: 857 out:
diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
index 2a374b4da8f5..86f7d1b90212 100644
--- a/security/tomoyo/file.c
+++ b/security/tomoyo/file.c
@@ -214,6 +214,7 @@ static int tomoyo_audit_path_number_log(struct tomoyo_request_info *r)
214 const u8 type = r->param.path_number.operation; 214 const u8 type = r->param.path_number.operation;
215 u8 radix; 215 u8 radix;
216 char buffer[64]; 216 char buffer[64];
217
217 switch (type) { 218 switch (type) {
218 case TOMOYO_TYPE_CREATE: 219 case TOMOYO_TYPE_CREATE:
219 case TOMOYO_TYPE_MKDIR: 220 case TOMOYO_TYPE_MKDIR:
@@ -253,6 +254,7 @@ static bool tomoyo_check_path_acl(struct tomoyo_request_info *r,
253{ 254{
254 const struct tomoyo_path_acl *acl = container_of(ptr, typeof(*acl), 255 const struct tomoyo_path_acl *acl = container_of(ptr, typeof(*acl),
255 head); 256 head);
257
256 if (acl->perm & (1 << r->param.path.operation)) { 258 if (acl->perm & (1 << r->param.path.operation)) {
257 r->param.path.matched_path = 259 r->param.path.matched_path =
258 tomoyo_compare_name_union(r->param.path.filename, 260 tomoyo_compare_name_union(r->param.path.filename,
@@ -275,6 +277,7 @@ static bool tomoyo_check_path_number_acl(struct tomoyo_request_info *r,
275{ 277{
276 const struct tomoyo_path_number_acl *acl = 278 const struct tomoyo_path_number_acl *acl =
277 container_of(ptr, typeof(*acl), head); 279 container_of(ptr, typeof(*acl), head);
280
278 return (acl->perm & (1 << r->param.path_number.operation)) && 281 return (acl->perm & (1 << r->param.path_number.operation)) &&
279 tomoyo_compare_number_union(r->param.path_number.number, 282 tomoyo_compare_number_union(r->param.path_number.number,
280 &acl->number) && 283 &acl->number) &&
@@ -295,6 +298,7 @@ static bool tomoyo_check_path2_acl(struct tomoyo_request_info *r,
295{ 298{
296 const struct tomoyo_path2_acl *acl = 299 const struct tomoyo_path2_acl *acl =
297 container_of(ptr, typeof(*acl), head); 300 container_of(ptr, typeof(*acl), head);
301
298 return (acl->perm & (1 << r->param.path2.operation)) && 302 return (acl->perm & (1 << r->param.path2.operation)) &&
299 tomoyo_compare_name_union(r->param.path2.filename1, &acl->name1) 303 tomoyo_compare_name_union(r->param.path2.filename1, &acl->name1)
300 && tomoyo_compare_name_union(r->param.path2.filename2, 304 && tomoyo_compare_name_union(r->param.path2.filename2,
@@ -314,6 +318,7 @@ static bool tomoyo_check_mkdev_acl(struct tomoyo_request_info *r,
314{ 318{
315 const struct tomoyo_mkdev_acl *acl = 319 const struct tomoyo_mkdev_acl *acl =
316 container_of(ptr, typeof(*acl), head); 320 container_of(ptr, typeof(*acl), head);
321
317 return (acl->perm & (1 << r->param.mkdev.operation)) && 322 return (acl->perm & (1 << r->param.mkdev.operation)) &&
318 tomoyo_compare_number_union(r->param.mkdev.mode, 323 tomoyo_compare_number_union(r->param.mkdev.mode,
319 &acl->mode) && 324 &acl->mode) &&
@@ -338,6 +343,7 @@ static bool tomoyo_same_path_acl(const struct tomoyo_acl_info *a,
338{ 343{
339 const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head); 344 const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head);
340 const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head); 345 const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head);
346
341 return tomoyo_same_name_union(&p1->name, &p2->name); 347 return tomoyo_same_name_union(&p1->name, &p2->name);
342} 348}
343 349
@@ -358,6 +364,7 @@ static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a,
358 ->perm; 364 ->perm;
359 u16 perm = *a_perm; 365 u16 perm = *a_perm;
360 const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm; 366 const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm;
367
361 if (is_delete) 368 if (is_delete)
362 perm &= ~b_perm; 369 perm &= ~b_perm;
363 else 370 else
@@ -384,6 +391,7 @@ static int tomoyo_update_path_acl(const u16 perm,
384 .perm = perm 391 .perm = perm
385 }; 392 };
386 int error; 393 int error;
394
387 if (!tomoyo_parse_name_union(param, &e.name)) 395 if (!tomoyo_parse_name_union(param, &e.name))
388 error = -EINVAL; 396 error = -EINVAL;
389 else 397 else
@@ -407,6 +415,7 @@ static bool tomoyo_same_mkdev_acl(const struct tomoyo_acl_info *a,
407{ 415{
408 const struct tomoyo_mkdev_acl *p1 = container_of(a, typeof(*p1), head); 416 const struct tomoyo_mkdev_acl *p1 = container_of(a, typeof(*p1), head);
409 const struct tomoyo_mkdev_acl *p2 = container_of(b, typeof(*p2), head); 417 const struct tomoyo_mkdev_acl *p2 = container_of(b, typeof(*p2), head);
418
410 return tomoyo_same_name_union(&p1->name, &p2->name) && 419 return tomoyo_same_name_union(&p1->name, &p2->name) &&
411 tomoyo_same_number_union(&p1->mode, &p2->mode) && 420 tomoyo_same_number_union(&p1->mode, &p2->mode) &&
412 tomoyo_same_number_union(&p1->major, &p2->major) && 421 tomoyo_same_number_union(&p1->major, &p2->major) &&
@@ -431,6 +440,7 @@ static bool tomoyo_merge_mkdev_acl(struct tomoyo_acl_info *a,
431 u8 perm = *a_perm; 440 u8 perm = *a_perm;
432 const u8 b_perm = container_of(b, struct tomoyo_mkdev_acl, head) 441 const u8 b_perm = container_of(b, struct tomoyo_mkdev_acl, head)
433 ->perm; 442 ->perm;
443
434 if (is_delete) 444 if (is_delete)
435 perm &= ~b_perm; 445 perm &= ~b_perm;
436 else 446 else
@@ -457,6 +467,7 @@ static int tomoyo_update_mkdev_acl(const u8 perm,
457 .perm = perm 467 .perm = perm
458 }; 468 };
459 int error; 469 int error;
470
460 if (!tomoyo_parse_name_union(param, &e.name) || 471 if (!tomoyo_parse_name_union(param, &e.name) ||
461 !tomoyo_parse_number_union(param, &e.mode) || 472 !tomoyo_parse_number_union(param, &e.mode) ||
462 !tomoyo_parse_number_union(param, &e.major) || 473 !tomoyo_parse_number_union(param, &e.major) ||
@@ -486,6 +497,7 @@ static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info *a,
486{ 497{
487 const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head); 498 const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head);
488 const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head); 499 const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head);
500
489 return tomoyo_same_name_union(&p1->name1, &p2->name1) && 501 return tomoyo_same_name_union(&p1->name1, &p2->name1) &&
490 tomoyo_same_name_union(&p1->name2, &p2->name2); 502 tomoyo_same_name_union(&p1->name2, &p2->name2);
491} 503}
@@ -507,6 +519,7 @@ static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a,
507 ->perm; 519 ->perm;
508 u8 perm = *a_perm; 520 u8 perm = *a_perm;
509 const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm; 521 const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm;
522
510 if (is_delete) 523 if (is_delete)
511 perm &= ~b_perm; 524 perm &= ~b_perm;
512 else 525 else
@@ -533,6 +546,7 @@ static int tomoyo_update_path2_acl(const u8 perm,
533 .perm = perm 546 .perm = perm
534 }; 547 };
535 int error; 548 int error;
549
536 if (!tomoyo_parse_name_union(param, &e.name1) || 550 if (!tomoyo_parse_name_union(param, &e.name1) ||
537 !tomoyo_parse_name_union(param, &e.name2)) 551 !tomoyo_parse_name_union(param, &e.name2))
538 error = -EINVAL; 552 error = -EINVAL;
@@ -621,6 +635,7 @@ static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info *a,
621 head); 635 head);
622 const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2), 636 const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2),
623 head); 637 head);
638
624 return tomoyo_same_name_union(&p1->name, &p2->name) && 639 return tomoyo_same_name_union(&p1->name, &p2->name) &&
625 tomoyo_same_number_union(&p1->number, &p2->number); 640 tomoyo_same_number_union(&p1->number, &p2->number);
626} 641}
@@ -643,6 +658,7 @@ static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a,
643 u8 perm = *a_perm; 658 u8 perm = *a_perm;
644 const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head) 659 const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head)
645 ->perm; 660 ->perm;
661
646 if (is_delete) 662 if (is_delete)
647 perm &= ~b_perm; 663 perm &= ~b_perm;
648 else 664 else
@@ -667,6 +683,7 @@ static int tomoyo_update_path_number_acl(const u8 perm,
667 .perm = perm 683 .perm = perm
668 }; 684 };
669 int error; 685 int error;
686
670 if (!tomoyo_parse_name_union(param, &e.name) || 687 if (!tomoyo_parse_name_union(param, &e.name) ||
671 !tomoyo_parse_number_union(param, &e.number)) 688 !tomoyo_parse_number_union(param, &e.number))
672 error = -EINVAL; 689 error = -EINVAL;
@@ -947,6 +964,7 @@ static bool tomoyo_same_mount_acl(const struct tomoyo_acl_info *a,
947{ 964{
948 const struct tomoyo_mount_acl *p1 = container_of(a, typeof(*p1), head); 965 const struct tomoyo_mount_acl *p1 = container_of(a, typeof(*p1), head);
949 const struct tomoyo_mount_acl *p2 = container_of(b, typeof(*p2), head); 966 const struct tomoyo_mount_acl *p2 = container_of(b, typeof(*p2), head);
967
950 return tomoyo_same_name_union(&p1->dev_name, &p2->dev_name) && 968 return tomoyo_same_name_union(&p1->dev_name, &p2->dev_name) &&
951 tomoyo_same_name_union(&p1->dir_name, &p2->dir_name) && 969 tomoyo_same_name_union(&p1->dir_name, &p2->dir_name) &&
952 tomoyo_same_name_union(&p1->fs_type, &p2->fs_type) && 970 tomoyo_same_name_union(&p1->fs_type, &p2->fs_type) &&
@@ -966,6 +984,7 @@ static int tomoyo_update_mount_acl(struct tomoyo_acl_param *param)
966{ 984{
967 struct tomoyo_mount_acl e = { .head.type = TOMOYO_TYPE_MOUNT_ACL }; 985 struct tomoyo_mount_acl e = { .head.type = TOMOYO_TYPE_MOUNT_ACL };
968 int error; 986 int error;
987
969 if (!tomoyo_parse_name_union(param, &e.dev_name) || 988 if (!tomoyo_parse_name_union(param, &e.dev_name) ||
970 !tomoyo_parse_name_union(param, &e.dir_name) || 989 !tomoyo_parse_name_union(param, &e.dir_name) ||
971 !tomoyo_parse_name_union(param, &e.fs_type) || 990 !tomoyo_parse_name_union(param, &e.fs_type) ||
@@ -995,6 +1014,7 @@ int tomoyo_write_file(struct tomoyo_acl_param *param)
995 u16 perm = 0; 1014 u16 perm = 0;
996 u8 type; 1015 u8 type;
997 const char *operation = tomoyo_read_token(param); 1016 const char *operation = tomoyo_read_token(param);
1017
998 for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) 1018 for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++)
999 if (tomoyo_permstr(operation, tomoyo_path_keyword[type])) 1019 if (tomoyo_permstr(operation, tomoyo_path_keyword[type]))
1000 perm |= 1 << type; 1020 perm |= 1 << type;
diff --git a/security/tomoyo/gc.c b/security/tomoyo/gc.c
index e22bea811c57..9537832fca18 100644
--- a/security/tomoyo/gc.c
+++ b/security/tomoyo/gc.c
@@ -77,11 +77,13 @@ static bool tomoyo_name_used_by_io_buffer(const char *string)
77 spin_lock(&tomoyo_io_buffer_list_lock); 77 spin_lock(&tomoyo_io_buffer_list_lock);
78 list_for_each_entry(head, &tomoyo_io_buffer_list, list) { 78 list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
79 int i; 79 int i;
80
80 head->users++; 81 head->users++;
81 spin_unlock(&tomoyo_io_buffer_list_lock); 82 spin_unlock(&tomoyo_io_buffer_list_lock);
82 mutex_lock(&head->io_sem); 83 mutex_lock(&head->io_sem);
83 for (i = 0; i < TOMOYO_MAX_IO_READ_QUEUE; i++) { 84 for (i = 0; i < TOMOYO_MAX_IO_READ_QUEUE; i++) {
84 const char *w = head->r.w[i]; 85 const char *w = head->r.w[i];
86
85 if (w < string || w > string + size) 87 if (w < string || w > string + size)
86 continue; 88 continue;
87 in_use = true; 89 in_use = true;
@@ -108,6 +110,7 @@ static inline void tomoyo_del_transition_control(struct list_head *element)
108{ 110{
109 struct tomoyo_transition_control *ptr = 111 struct tomoyo_transition_control *ptr =
110 container_of(element, typeof(*ptr), head.list); 112 container_of(element, typeof(*ptr), head.list);
113
111 tomoyo_put_name(ptr->domainname); 114 tomoyo_put_name(ptr->domainname);
112 tomoyo_put_name(ptr->program); 115 tomoyo_put_name(ptr->program);
113} 116}
@@ -123,6 +126,7 @@ static inline void tomoyo_del_aggregator(struct list_head *element)
123{ 126{
124 struct tomoyo_aggregator *ptr = 127 struct tomoyo_aggregator *ptr =
125 container_of(element, typeof(*ptr), head.list); 128 container_of(element, typeof(*ptr), head.list);
129
126 tomoyo_put_name(ptr->original_name); 130 tomoyo_put_name(ptr->original_name);
127 tomoyo_put_name(ptr->aggregated_name); 131 tomoyo_put_name(ptr->aggregated_name);
128} 132}
@@ -138,6 +142,7 @@ static inline void tomoyo_del_manager(struct list_head *element)
138{ 142{
139 struct tomoyo_manager *ptr = 143 struct tomoyo_manager *ptr =
140 container_of(element, typeof(*ptr), head.list); 144 container_of(element, typeof(*ptr), head.list);
145
141 tomoyo_put_name(ptr->manager); 146 tomoyo_put_name(ptr->manager);
142} 147}
143 148
@@ -152,6 +157,7 @@ static void tomoyo_del_acl(struct list_head *element)
152{ 157{
153 struct tomoyo_acl_info *acl = 158 struct tomoyo_acl_info *acl =
154 container_of(element, typeof(*acl), list); 159 container_of(element, typeof(*acl), list);
160
155 tomoyo_put_condition(acl->cond); 161 tomoyo_put_condition(acl->cond);
156 switch (acl->type) { 162 switch (acl->type) {
157 case TOMOYO_TYPE_PATH_ACL: 163 case TOMOYO_TYPE_PATH_ACL:
@@ -226,6 +232,7 @@ static void tomoyo_del_acl(struct list_head *element)
226 { 232 {
227 struct tomoyo_task_acl *entry = 233 struct tomoyo_task_acl *entry =
228 container_of(acl, typeof(*entry), head); 234 container_of(acl, typeof(*entry), head);
235
229 tomoyo_put_name(entry->domainname); 236 tomoyo_put_name(entry->domainname);
230 } 237 }
231 break; 238 break;
@@ -247,6 +254,7 @@ static inline void tomoyo_del_domain(struct list_head *element)
247 container_of(element, typeof(*domain), list); 254 container_of(element, typeof(*domain), list);
248 struct tomoyo_acl_info *acl; 255 struct tomoyo_acl_info *acl;
249 struct tomoyo_acl_info *tmp; 256 struct tomoyo_acl_info *tmp;
257
250 /* 258 /*
251 * Since this domain is referenced from neither 259 * Since this domain is referenced from neither
252 * "struct tomoyo_io_buffer" nor "struct cred"->security, we can delete 260 * "struct tomoyo_io_buffer" nor "struct cred"->security, we can delete
@@ -286,6 +294,7 @@ void tomoyo_del_condition(struct list_head *element)
286 = (const struct tomoyo_argv *) (names_p + names_count); 294 = (const struct tomoyo_argv *) (names_p + names_count);
287 const struct tomoyo_envp *envp 295 const struct tomoyo_envp *envp
288 = (const struct tomoyo_envp *) (argv + argc); 296 = (const struct tomoyo_envp *) (argv + argc);
297
289 for (i = 0; i < numbers_count; i++) 298 for (i = 0; i < numbers_count; i++)
290 tomoyo_put_number_union(numbers_p++); 299 tomoyo_put_number_union(numbers_p++);
291 for (i = 0; i < names_count; i++) 300 for (i = 0; i < names_count; i++)
@@ -321,6 +330,7 @@ static inline void tomoyo_del_path_group(struct list_head *element)
321{ 330{
322 struct tomoyo_path_group *member = 331 struct tomoyo_path_group *member =
323 container_of(element, typeof(*member), head.list); 332 container_of(element, typeof(*member), head.list);
333
324 tomoyo_put_name(member->member_name); 334 tomoyo_put_name(member->member_name);
325} 335}
326 336
@@ -335,6 +345,7 @@ static inline void tomoyo_del_group(struct list_head *element)
335{ 345{
336 struct tomoyo_group *group = 346 struct tomoyo_group *group =
337 container_of(element, typeof(*group), head.list); 347 container_of(element, typeof(*group), head.list);
348
338 tomoyo_put_name(group->group_name); 349 tomoyo_put_name(group->group_name);
339} 350}
340 351
@@ -476,6 +487,7 @@ static void tomoyo_collect_member(const enum tomoyo_policy_id id,
476{ 487{
477 struct tomoyo_acl_head *member; 488 struct tomoyo_acl_head *member;
478 struct tomoyo_acl_head *tmp; 489 struct tomoyo_acl_head *tmp;
490
479 list_for_each_entry_safe(member, tmp, member_list, list) { 491 list_for_each_entry_safe(member, tmp, member_list, list) {
480 if (!member->is_deleted) 492 if (!member->is_deleted)
481 continue; 493 continue;
@@ -495,6 +507,7 @@ static void tomoyo_collect_acl(struct list_head *list)
495{ 507{
496 struct tomoyo_acl_info *acl; 508 struct tomoyo_acl_info *acl;
497 struct tomoyo_acl_info *tmp; 509 struct tomoyo_acl_info *tmp;
510
498 list_for_each_entry_safe(acl, tmp, list, list) { 511 list_for_each_entry_safe(acl, tmp, list, list) {
499 if (!acl->is_deleted) 512 if (!acl->is_deleted)
500 continue; 513 continue;
@@ -513,10 +526,12 @@ static void tomoyo_collect_entry(void)
513 int i; 526 int i;
514 enum tomoyo_policy_id id; 527 enum tomoyo_policy_id id;
515 struct tomoyo_policy_namespace *ns; 528 struct tomoyo_policy_namespace *ns;
529
516 mutex_lock(&tomoyo_policy_lock); 530 mutex_lock(&tomoyo_policy_lock);
517 { 531 {
518 struct tomoyo_domain_info *domain; 532 struct tomoyo_domain_info *domain;
519 struct tomoyo_domain_info *tmp; 533 struct tomoyo_domain_info *tmp;
534
520 list_for_each_entry_safe(domain, tmp, &tomoyo_domain_list, 535 list_for_each_entry_safe(domain, tmp, &tomoyo_domain_list,
521 list) { 536 list) {
522 tomoyo_collect_acl(&domain->acl_info_list); 537 tomoyo_collect_acl(&domain->acl_info_list);
@@ -534,6 +549,7 @@ static void tomoyo_collect_entry(void)
534 { 549 {
535 struct tomoyo_shared_acl_head *ptr; 550 struct tomoyo_shared_acl_head *ptr;
536 struct tomoyo_shared_acl_head *tmp; 551 struct tomoyo_shared_acl_head *tmp;
552
537 list_for_each_entry_safe(ptr, tmp, &tomoyo_condition_list, 553 list_for_each_entry_safe(ptr, tmp, &tomoyo_condition_list,
538 list) { 554 list) {
539 if (atomic_read(&ptr->users) > 0) 555 if (atomic_read(&ptr->users) > 0)
@@ -547,6 +563,7 @@ static void tomoyo_collect_entry(void)
547 struct list_head *list = &ns->group_list[i]; 563 struct list_head *list = &ns->group_list[i];
548 struct tomoyo_group *group; 564 struct tomoyo_group *group;
549 struct tomoyo_group *tmp; 565 struct tomoyo_group *tmp;
566
550 switch (i) { 567 switch (i) {
551 case 0: 568 case 0:
552 id = TOMOYO_ID_PATH_GROUP; 569 id = TOMOYO_ID_PATH_GROUP;
@@ -574,6 +591,7 @@ static void tomoyo_collect_entry(void)
574 struct list_head *list = &tomoyo_name_list[i]; 591 struct list_head *list = &tomoyo_name_list[i];
575 struct tomoyo_shared_acl_head *ptr; 592 struct tomoyo_shared_acl_head *ptr;
576 struct tomoyo_shared_acl_head *tmp; 593 struct tomoyo_shared_acl_head *tmp;
594
577 list_for_each_entry_safe(ptr, tmp, list, list) { 595 list_for_each_entry_safe(ptr, tmp, list, list) {
578 if (atomic_read(&ptr->users) > 0) 596 if (atomic_read(&ptr->users) > 0)
579 continue; 597 continue;
@@ -595,6 +613,7 @@ static int tomoyo_gc_thread(void *unused)
595{ 613{
596 /* Garbage collector thread is exclusive. */ 614 /* Garbage collector thread is exclusive. */
597 static DEFINE_MUTEX(tomoyo_gc_mutex); 615 static DEFINE_MUTEX(tomoyo_gc_mutex);
616
598 if (!mutex_trylock(&tomoyo_gc_mutex)) 617 if (!mutex_trylock(&tomoyo_gc_mutex))
599 goto out; 618 goto out;
600 tomoyo_collect_entry(); 619 tomoyo_collect_entry();
diff --git a/security/tomoyo/group.c b/security/tomoyo/group.c
index 21b0cc3a7e1a..a37c7dc66e44 100644
--- a/security/tomoyo/group.c
+++ b/security/tomoyo/group.c
@@ -75,11 +75,13 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
75{ 75{
76 struct tomoyo_group *group = tomoyo_get_group(param, type); 76 struct tomoyo_group *group = tomoyo_get_group(param, type);
77 int error = -EINVAL; 77 int error = -EINVAL;
78
78 if (!group) 79 if (!group)
79 return -ENOMEM; 80 return -ENOMEM;
80 param->list = &group->member_list; 81 param->list = &group->member_list;
81 if (type == TOMOYO_PATH_GROUP) { 82 if (type == TOMOYO_PATH_GROUP) {
82 struct tomoyo_path_group e = { }; 83 struct tomoyo_path_group e = { };
84
83 e.member_name = tomoyo_get_name(tomoyo_read_token(param)); 85 e.member_name = tomoyo_get_name(tomoyo_read_token(param));
84 if (!e.member_name) { 86 if (!e.member_name) {
85 error = -ENOMEM; 87 error = -ENOMEM;
@@ -90,6 +92,7 @@ int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
90 tomoyo_put_name(e.member_name); 92 tomoyo_put_name(e.member_name);
91 } else if (type == TOMOYO_NUMBER_GROUP) { 93 } else if (type == TOMOYO_NUMBER_GROUP) {
92 struct tomoyo_number_group e = { }; 94 struct tomoyo_number_group e = { };
95
93 if (param->data[0] == '@' || 96 if (param->data[0] == '@' ||
94 !tomoyo_parse_number_union(param, &e.number)) 97 !tomoyo_parse_number_union(param, &e.number))
95 goto out; 98 goto out;
@@ -129,6 +132,7 @@ tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
129 const struct tomoyo_group *group) 132 const struct tomoyo_group *group)
130{ 133{
131 struct tomoyo_path_group *member; 134 struct tomoyo_path_group *member;
135
132 list_for_each_entry_rcu(member, &group->member_list, head.list) { 136 list_for_each_entry_rcu(member, &group->member_list, head.list) {
133 if (member->head.is_deleted) 137 if (member->head.is_deleted)
134 continue; 138 continue;
@@ -156,6 +160,7 @@ bool tomoyo_number_matches_group(const unsigned long min,
156{ 160{
157 struct tomoyo_number_group *member; 161 struct tomoyo_number_group *member;
158 bool matched = false; 162 bool matched = false;
163
159 list_for_each_entry_rcu(member, &group->member_list, head.list) { 164 list_for_each_entry_rcu(member, &group->member_list, head.list) {
160 if (member->head.is_deleted) 165 if (member->head.is_deleted)
161 continue; 166 continue;
diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c
index 81b951652051..3445ae6fd479 100644
--- a/security/tomoyo/load_policy.c
+++ b/security/tomoyo/load_policy.c
@@ -37,11 +37,12 @@ __setup("TOMOYO_loader=", tomoyo_loader_setup);
37static bool tomoyo_policy_loader_exists(void) 37static bool tomoyo_policy_loader_exists(void)
38{ 38{
39 struct path path; 39 struct path path;
40
40 if (!tomoyo_loader) 41 if (!tomoyo_loader)
41 tomoyo_loader = CONFIG_SECURITY_TOMOYO_POLICY_LOADER; 42 tomoyo_loader = CONFIG_SECURITY_TOMOYO_POLICY_LOADER;
42 if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) { 43 if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
43 printk(KERN_INFO "Not activating Mandatory Access Control " 44 pr_info("Not activating Mandatory Access Control as %s does not exist.\n",
44 "as %s does not exist.\n", tomoyo_loader); 45 tomoyo_loader);
45 return false; 46 return false;
46 } 47 }
47 path_put(&path); 48 path_put(&path);
@@ -96,8 +97,7 @@ void tomoyo_load_policy(const char *filename)
96 if (!tomoyo_policy_loader_exists()) 97 if (!tomoyo_policy_loader_exists())
97 return; 98 return;
98 done = true; 99 done = true;
99 printk(KERN_INFO "Calling %s to load policy. Please wait.\n", 100 pr_info("Calling %s to load policy. Please wait.\n", tomoyo_loader);
100 tomoyo_loader);
101 argv[0] = (char *) tomoyo_loader; 101 argv[0] = (char *) tomoyo_loader;
102 argv[1] = NULL; 102 argv[1] = NULL;
103 envp[0] = "HOME=/"; 103 envp[0] = "HOME=/";
diff --git a/security/tomoyo/memory.c b/security/tomoyo/memory.c
index 12477e0b0a11..2e7fcfa923c9 100644
--- a/security/tomoyo/memory.c
+++ b/security/tomoyo/memory.c
@@ -19,9 +19,9 @@ void tomoyo_warn_oom(const char *function)
19 /* Reduce error messages. */ 19 /* Reduce error messages. */
20 static pid_t tomoyo_last_pid; 20 static pid_t tomoyo_last_pid;
21 const pid_t pid = current->pid; 21 const pid_t pid = current->pid;
22
22 if (tomoyo_last_pid != pid) { 23 if (tomoyo_last_pid != pid) {
23 printk(KERN_WARNING "ERROR: Out of memory at %s.\n", 24 pr_warn("ERROR: Out of memory at %s.\n", function);
24 function);
25 tomoyo_last_pid = pid; 25 tomoyo_last_pid = pid;
26 } 26 }
27 if (!tomoyo_policy_loaded) 27 if (!tomoyo_policy_loaded)
@@ -48,6 +48,7 @@ bool tomoyo_memory_ok(void *ptr)
48{ 48{
49 if (ptr) { 49 if (ptr) {
50 const size_t s = ksize(ptr); 50 const size_t s = ksize(ptr);
51
51 tomoyo_memory_used[TOMOYO_MEMORY_POLICY] += s; 52 tomoyo_memory_used[TOMOYO_MEMORY_POLICY] += s;
52 if (!tomoyo_memory_quota[TOMOYO_MEMORY_POLICY] || 53 if (!tomoyo_memory_quota[TOMOYO_MEMORY_POLICY] ||
53 tomoyo_memory_used[TOMOYO_MEMORY_POLICY] <= 54 tomoyo_memory_used[TOMOYO_MEMORY_POLICY] <=
@@ -73,6 +74,7 @@ bool tomoyo_memory_ok(void *ptr)
73void *tomoyo_commit_ok(void *data, const unsigned int size) 74void *tomoyo_commit_ok(void *data, const unsigned int size)
74{ 75{
75 void *ptr = kzalloc(size, GFP_NOFS); 76 void *ptr = kzalloc(size, GFP_NOFS);
77
76 if (tomoyo_memory_ok(ptr)) { 78 if (tomoyo_memory_ok(ptr)) {
77 memmove(ptr, data, size); 79 memmove(ptr, data, size);
78 memset(data, 0, size); 80 memset(data, 0, size);
@@ -98,6 +100,7 @@ struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param,
98 struct list_head *list; 100 struct list_head *list;
99 const char *group_name = tomoyo_read_token(param); 101 const char *group_name = tomoyo_read_token(param);
100 bool found = false; 102 bool found = false;
103
101 if (!tomoyo_correct_word(group_name) || idx >= TOMOYO_MAX_GROUP) 104 if (!tomoyo_correct_word(group_name) || idx >= TOMOYO_MAX_GROUP)
102 return NULL; 105 return NULL;
103 e.group_name = tomoyo_get_name(group_name); 106 e.group_name = tomoyo_get_name(group_name);
@@ -116,6 +119,7 @@ struct tomoyo_group *tomoyo_get_group(struct tomoyo_acl_param *param,
116 } 119 }
117 if (!found) { 120 if (!found) {
118 struct tomoyo_group *entry = tomoyo_commit_ok(&e, sizeof(e)); 121 struct tomoyo_group *entry = tomoyo_commit_ok(&e, sizeof(e));
122
119 if (entry) { 123 if (entry) {
120 INIT_LIST_HEAD(&entry->member_list); 124 INIT_LIST_HEAD(&entry->member_list);
121 atomic_set(&entry->head.users, 1); 125 atomic_set(&entry->head.users, 1);
@@ -191,6 +195,7 @@ struct tomoyo_policy_namespace tomoyo_kernel_namespace;
191void __init tomoyo_mm_init(void) 195void __init tomoyo_mm_init(void)
192{ 196{
193 int idx; 197 int idx;
198
194 for (idx = 0; idx < TOMOYO_MAX_HASH; idx++) 199 for (idx = 0; idx < TOMOYO_MAX_HASH; idx++)
195 INIT_LIST_HEAD(&tomoyo_name_list[idx]); 200 INIT_LIST_HEAD(&tomoyo_name_list[idx]);
196 tomoyo_kernel_namespace.name = "<kernel>"; 201 tomoyo_kernel_namespace.name = "<kernel>";
diff --git a/security/tomoyo/mount.c b/security/tomoyo/mount.c
index 7dc7f59b7dde..2755971f50df 100644
--- a/security/tomoyo/mount.c
+++ b/security/tomoyo/mount.c
@@ -49,6 +49,7 @@ static bool tomoyo_check_mount_acl(struct tomoyo_request_info *r,
49{ 49{
50 const struct tomoyo_mount_acl *acl = 50 const struct tomoyo_mount_acl *acl =
51 container_of(ptr, typeof(*acl), head); 51 container_of(ptr, typeof(*acl), head);
52
52 return tomoyo_compare_number_union(r->param.mount.flags, 53 return tomoyo_compare_number_union(r->param.mount.flags,
53 &acl->flags) && 54 &acl->flags) &&
54 tomoyo_compare_name_union(r->param.mount.type, 55 tomoyo_compare_name_union(r->param.mount.type,
@@ -89,6 +90,7 @@ static int tomoyo_mount_acl(struct tomoyo_request_info *r,
89 struct tomoyo_path_info rdir; 90 struct tomoyo_path_info rdir;
90 int need_dev = 0; 91 int need_dev = 0;
91 int error = -ENOMEM; 92 int error = -ENOMEM;
93
92 r->obj = &obj; 94 r->obj = &obj;
93 95
94 /* Get fstype. */ 96 /* Get fstype. */
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index 6ff8c21e4fff..85e6e31dd1e5 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -94,11 +94,13 @@ static char *tomoyo_get_absolute_path(const struct path *path, char * const buff
94 const int buflen) 94 const int buflen)
95{ 95{
96 char *pos = ERR_PTR(-ENOMEM); 96 char *pos = ERR_PTR(-ENOMEM);
97
97 if (buflen >= 256) { 98 if (buflen >= 256) {
98 /* go to whatever namespace root we are under */ 99 /* go to whatever namespace root we are under */
99 pos = d_absolute_path(path, buffer, buflen - 1); 100 pos = d_absolute_path(path, buffer, buflen - 1);
100 if (!IS_ERR(pos) && *pos == '/' && pos[1]) { 101 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
101 struct inode *inode = d_backing_inode(path->dentry); 102 struct inode *inode = d_backing_inode(path->dentry);
103
102 if (inode && S_ISDIR(inode->i_mode)) { 104 if (inode && S_ISDIR(inode->i_mode)) {
103 buffer[buflen - 2] = '/'; 105 buffer[buflen - 2] = '/';
104 buffer[buflen - 1] = '\0'; 106 buffer[buflen - 1] = '\0';
@@ -123,10 +125,12 @@ static char *tomoyo_get_dentry_path(struct dentry *dentry, char * const buffer,
123 const int buflen) 125 const int buflen)
124{ 126{
125 char *pos = ERR_PTR(-ENOMEM); 127 char *pos = ERR_PTR(-ENOMEM);
128
126 if (buflen >= 256) { 129 if (buflen >= 256) {
127 pos = dentry_path_raw(dentry, buffer, buflen - 1); 130 pos = dentry_path_raw(dentry, buffer, buflen - 1);
128 if (!IS_ERR(pos) && *pos == '/' && pos[1]) { 131 if (!IS_ERR(pos) && *pos == '/' && pos[1]) {
129 struct inode *inode = d_backing_inode(dentry); 132 struct inode *inode = d_backing_inode(dentry);
133
130 if (inode && S_ISDIR(inode->i_mode)) { 134 if (inode && S_ISDIR(inode->i_mode)) {
131 buffer[buflen - 2] = '/'; 135 buffer[buflen - 2] = '/';
132 buffer[buflen - 1] = '\0'; 136 buffer[buflen - 1] = '\0';
@@ -150,12 +154,14 @@ static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
150{ 154{
151 struct super_block *sb = dentry->d_sb; 155 struct super_block *sb = dentry->d_sb;
152 char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen); 156 char *pos = tomoyo_get_dentry_path(dentry, buffer, buflen);
157
153 if (IS_ERR(pos)) 158 if (IS_ERR(pos))
154 return pos; 159 return pos;
155 /* Convert from $PID to self if $PID is current thread. */ 160 /* Convert from $PID to self if $PID is current thread. */
156 if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') { 161 if (sb->s_magic == PROC_SUPER_MAGIC && *pos == '/') {
157 char *ep; 162 char *ep;
158 const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10); 163 const pid_t pid = (pid_t) simple_strtoul(pos + 1, &ep, 10);
164
159 if (*ep == '/' && pid && pid == 165 if (*ep == '/' && pid && pid ==
160 task_tgid_nr_ns(current, sb->s_fs_info)) { 166 task_tgid_nr_ns(current, sb->s_fs_info)) {
161 pos = ep - 5; 167 pos = ep - 5;
@@ -170,6 +176,7 @@ static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
170 goto prepend_filesystem_name; 176 goto prepend_filesystem_name;
171 { 177 {
172 struct inode *inode = d_backing_inode(sb->s_root); 178 struct inode *inode = d_backing_inode(sb->s_root);
179
173 /* 180 /*
174 * Use filesystem name if filesystem does not support rename() 181 * Use filesystem name if filesystem does not support rename()
175 * operation. 182 * operation.
@@ -182,6 +189,7 @@ static char *tomoyo_get_local_path(struct dentry *dentry, char * const buffer,
182 char name[64]; 189 char name[64];
183 int name_len; 190 int name_len;
184 const dev_t dev = sb->s_dev; 191 const dev_t dev = sb->s_dev;
192
185 name[sizeof(name) - 1] = '\0'; 193 name[sizeof(name) - 1] = '\0';
186 snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev), 194 snprintf(name, sizeof(name) - 1, "dev(%u,%u):", MAJOR(dev),
187 MINOR(dev)); 195 MINOR(dev));
@@ -197,6 +205,7 @@ prepend_filesystem_name:
197 { 205 {
198 const char *name = sb->s_type->name; 206 const char *name = sb->s_type->name;
199 const int name_len = strlen(name); 207 const int name_len = strlen(name);
208
200 pos -= name_len + 1; 209 pos -= name_len + 1;
201 if (pos < buffer) 210 if (pos < buffer)
202 goto out; 211 goto out;
@@ -223,10 +232,10 @@ static char *tomoyo_get_socket_name(const struct path *path, char * const buffer
223 struct inode *inode = d_backing_inode(path->dentry); 232 struct inode *inode = d_backing_inode(path->dentry);
224 struct socket *sock = inode ? SOCKET_I(inode) : NULL; 233 struct socket *sock = inode ? SOCKET_I(inode) : NULL;
225 struct sock *sk = sock ? sock->sk : NULL; 234 struct sock *sk = sock ? sock->sk : NULL;
235
226 if (sk) { 236 if (sk) {
227 snprintf(buffer, buflen, "socket:[family=%u:type=%u:" 237 snprintf(buffer, buflen, "socket:[family=%u:type=%u:protocol=%u]",
228 "protocol=%u]", sk->sk_family, sk->sk_type, 238 sk->sk_family, sk->sk_type, sk->sk_protocol);
229 sk->sk_protocol);
230 } else { 239 } else {
231 snprintf(buffer, buflen, "socket:[unknown]"); 240 snprintf(buffer, buflen, "socket:[unknown]");
232 } 241 }
@@ -255,12 +264,14 @@ char *tomoyo_realpath_from_path(const struct path *path)
255 unsigned int buf_len = PAGE_SIZE / 2; 264 unsigned int buf_len = PAGE_SIZE / 2;
256 struct dentry *dentry = path->dentry; 265 struct dentry *dentry = path->dentry;
257 struct super_block *sb; 266 struct super_block *sb;
267
258 if (!dentry) 268 if (!dentry)
259 return NULL; 269 return NULL;
260 sb = dentry->d_sb; 270 sb = dentry->d_sb;
261 while (1) { 271 while (1) {
262 char *pos; 272 char *pos;
263 struct inode *inode; 273 struct inode *inode;
274
264 buf_len <<= 1; 275 buf_len <<= 1;
265 kfree(buf); 276 kfree(buf);
266 buf = kmalloc(buf_len, GFP_NOFS); 277 buf = kmalloc(buf_len, GFP_NOFS);
@@ -323,6 +334,7 @@ char *tomoyo_realpath_nofollow(const char *pathname)
323 334
324 if (pathname && kern_path(pathname, 0, &path) == 0) { 335 if (pathname && kern_path(pathname, 0, &path) == 0) {
325 char *buf = tomoyo_realpath_from_path(&path); 336 char *buf = tomoyo_realpath_from_path(&path);
337
326 path_put(&path); 338 path_put(&path);
327 return buf; 339 return buf;
328 } 340 }
diff --git a/security/tomoyo/securityfs_if.c b/security/tomoyo/securityfs_if.c
index 338872fa3d06..546281c5b233 100644
--- a/security/tomoyo/securityfs_if.c
+++ b/security/tomoyo/securityfs_if.c
@@ -21,6 +21,7 @@ static bool tomoyo_check_task_acl(struct tomoyo_request_info *r,
21{ 21{
22 const struct tomoyo_task_acl *acl = container_of(ptr, typeof(*acl), 22 const struct tomoyo_task_acl *acl = container_of(ptr, typeof(*acl),
23 head); 23 head);
24
24 return !tomoyo_pathcmp(r->param.task.domainname, acl->domainname); 25 return !tomoyo_pathcmp(r->param.task.domainname, acl->domainname);
25} 26}
26 27
@@ -42,6 +43,7 @@ static ssize_t tomoyo_write_self(struct file *file, const char __user *buf,
42{ 43{
43 char *data; 44 char *data;
44 int error; 45 int error;
46
45 if (!count || count >= TOMOYO_EXEC_TMPSIZE - 10) 47 if (!count || count >= TOMOYO_EXEC_TMPSIZE - 10)
46 return -ENOMEM; 48 return -ENOMEM;
47 data = memdup_user_nul(buf, count); 49 data = memdup_user_nul(buf, count);
@@ -52,6 +54,7 @@ static ssize_t tomoyo_write_self(struct file *file, const char __user *buf,
52 const int idx = tomoyo_read_lock(); 54 const int idx = tomoyo_read_lock();
53 struct tomoyo_path_info name; 55 struct tomoyo_path_info name;
54 struct tomoyo_request_info r; 56 struct tomoyo_request_info r;
57
55 name.name = data; 58 name.name = data;
56 tomoyo_fill_path_info(&name); 59 tomoyo_fill_path_info(&name);
57 /* Check "task manual_domain_transition" permission. */ 60 /* Check "task manual_domain_transition" permission. */
@@ -100,6 +103,7 @@ static ssize_t tomoyo_read_self(struct file *file, char __user *buf,
100 const char *domain = tomoyo_domain()->domainname->name; 103 const char *domain = tomoyo_domain()->domainname->name;
101 loff_t len = strlen(domain); 104 loff_t len = strlen(domain);
102 loff_t pos = *ppos; 105 loff_t pos = *ppos;
106
103 if (pos >= len || !count) 107 if (pos >= len || !count)
104 return 0; 108 return 0;
105 len -= pos; 109 len -= pos;
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index c2ab6575e68e..716c92ec941a 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -105,6 +105,7 @@ static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
105 if (!s->old_domain_info) { 105 if (!s->old_domain_info) {
106 const int idx = tomoyo_read_lock(); 106 const int idx = tomoyo_read_lock();
107 const int err = tomoyo_find_next_domain(bprm); 107 const int err = tomoyo_find_next_domain(bprm);
108
108 tomoyo_read_unlock(idx); 109 tomoyo_read_unlock(idx);
109 return err; 110 return err;
110 } 111 }
@@ -151,6 +152,7 @@ static int tomoyo_path_truncate(const struct path *path)
151static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry) 152static int tomoyo_path_unlink(const struct path *parent, struct dentry *dentry)
152{ 153{
153 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 154 struct path path = { .mnt = parent->mnt, .dentry = dentry };
155
154 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL); 156 return tomoyo_path_perm(TOMOYO_TYPE_UNLINK, &path, NULL);
155} 157}
156 158
@@ -167,6 +169,7 @@ static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
167 umode_t mode) 169 umode_t mode)
168{ 170{
169 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 171 struct path path = { .mnt = parent->mnt, .dentry = dentry };
172
170 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path, 173 return tomoyo_path_number_perm(TOMOYO_TYPE_MKDIR, &path,
171 mode & S_IALLUGO); 174 mode & S_IALLUGO);
172} 175}
@@ -182,6 +185,7 @@ static int tomoyo_path_mkdir(const struct path *parent, struct dentry *dentry,
182static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry) 185static int tomoyo_path_rmdir(const struct path *parent, struct dentry *dentry)
183{ 186{
184 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 187 struct path path = { .mnt = parent->mnt, .dentry = dentry };
188
185 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL); 189 return tomoyo_path_perm(TOMOYO_TYPE_RMDIR, &path, NULL);
186} 190}
187 191
@@ -198,6 +202,7 @@ static int tomoyo_path_symlink(const struct path *parent, struct dentry *dentry,
198 const char *old_name) 202 const char *old_name)
199{ 203{
200 struct path path = { .mnt = parent->mnt, .dentry = dentry }; 204 struct path path = { .mnt = parent->mnt, .dentry = dentry };
205
201 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name); 206 return tomoyo_path_perm(TOMOYO_TYPE_SYMLINK, &path, old_name);
202} 207}
203 208
@@ -255,6 +260,7 @@ static int tomoyo_path_link(struct dentry *old_dentry, const struct path *new_di
255{ 260{
256 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry }; 261 struct path path1 = { .mnt = new_dir->mnt, .dentry = old_dentry };
257 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry }; 262 struct path path2 = { .mnt = new_dir->mnt, .dentry = new_dentry };
263
258 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2); 264 return tomoyo_path2_perm(TOMOYO_TYPE_LINK, &path1, &path2);
259} 265}
260 266
@@ -275,6 +281,7 @@ static int tomoyo_path_rename(const struct path *old_parent,
275{ 281{
276 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry }; 282 struct path path1 = { .mnt = old_parent->mnt, .dentry = old_dentry };
277 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry }; 283 struct path path2 = { .mnt = new_parent->mnt, .dentry = new_dentry };
284
278 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2); 285 return tomoyo_path2_perm(TOMOYO_TYPE_RENAME, &path1, &path2);
279} 286}
280 287
@@ -306,11 +313,11 @@ static int tomoyo_file_fcntl(struct file *file, unsigned int cmd,
306 */ 313 */
307static int tomoyo_file_open(struct file *f) 314static int tomoyo_file_open(struct file *f)
308{ 315{
309 int flags = f->f_flags;
310 /* Don't check read permission here if called from do_execve(). */ 316 /* Don't check read permission here if called from do_execve(). */
311 if (current->in_execve) 317 if (current->in_execve)
312 return 0; 318 return 0;
313 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path, flags); 319 return tomoyo_check_open_permission(tomoyo_domain(), &f->f_path,
320 f->f_flags);
314} 321}
315 322
316/** 323/**
@@ -354,6 +361,7 @@ static int tomoyo_path_chmod(const struct path *path, umode_t mode)
354static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid) 361static int tomoyo_path_chown(const struct path *path, kuid_t uid, kgid_t gid)
355{ 362{
356 int error = 0; 363 int error = 0;
364
357 if (uid_valid(uid)) 365 if (uid_valid(uid))
358 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path, 366 error = tomoyo_path_number_perm(TOMOYO_TYPE_CHOWN, path,
359 from_kuid(&init_user_ns, uid)); 367 from_kuid(&init_user_ns, uid));
@@ -403,6 +411,7 @@ static int tomoyo_sb_mount(const char *dev_name, const struct path *path,
403static int tomoyo_sb_umount(struct vfsmount *mnt, int flags) 411static int tomoyo_sb_umount(struct vfsmount *mnt, int flags)
404{ 412{
405 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root }; 413 struct path path = { .mnt = mnt, .dentry = mnt->mnt_root };
414
406 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL); 415 return tomoyo_path_perm(TOMOYO_TYPE_UMOUNT, &path, NULL);
407} 416}
408 417
@@ -573,7 +582,7 @@ static int __init tomoyo_init(void)
573 582
574 /* register ourselves with the security framework */ 583 /* register ourselves with the security framework */
575 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); 584 security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo");
576 printk(KERN_INFO "TOMOYO Linux initialized\n"); 585 pr_info("TOMOYO Linux initialized\n");
577 s->domain_info = &tomoyo_kernel_domain; 586 s->domain_info = &tomoyo_kernel_domain;
578 atomic_inc(&tomoyo_kernel_domain.users); 587 atomic_inc(&tomoyo_kernel_domain.users);
579 s->old_domain_info = NULL; 588 s->old_domain_info = NULL;
diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index badffc8271c8..0517cbdd7275 100644
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -91,6 +91,7 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
91void tomoyo_convert_time(time64_t time64, struct tomoyo_time *stamp) 91void tomoyo_convert_time(time64_t time64, struct tomoyo_time *stamp)
92{ 92{
93 struct tm tm; 93 struct tm tm;
94
94 time64_to_tm(time64, 0, &tm); 95 time64_to_tm(time64, 0, &tm);
95 stamp->sec = tm.tm_sec; 96 stamp->sec = tm.tm_sec;
96 stamp->min = tm.tm_min; 97 stamp->min = tm.tm_min;
@@ -113,6 +114,7 @@ void tomoyo_convert_time(time64_t time64, struct tomoyo_time *stamp)
113bool tomoyo_permstr(const char *string, const char *keyword) 114bool tomoyo_permstr(const char *string, const char *keyword)
114{ 115{
115 const char *cp = strstr(string, keyword); 116 const char *cp = strstr(string, keyword);
117
116 if (cp) 118 if (cp)
117 return cp == string || *(cp - 1) == '/'; 119 return cp == string || *(cp - 1) == '/';
118 return false; 120 return false;
@@ -132,6 +134,7 @@ char *tomoyo_read_token(struct tomoyo_acl_param *param)
132{ 134{
133 char *pos = param->data; 135 char *pos = param->data;
134 char *del = strchr(pos, ' '); 136 char *del = strchr(pos, ' ');
137
135 if (del) 138 if (del)
136 *del++ = '\0'; 139 *del++ = '\0';
137 else 140 else
@@ -152,6 +155,7 @@ const struct tomoyo_path_info *tomoyo_get_domainname
152{ 155{
153 char *start = param->data; 156 char *start = param->data;
154 char *pos = start; 157 char *pos = start;
158
155 while (*pos) { 159 while (*pos) {
156 if (*pos++ != ' ' || *pos++ == '/') 160 if (*pos++ != ' ' || *pos++ == '/')
157 continue; 161 continue;
@@ -181,8 +185,10 @@ u8 tomoyo_parse_ulong(unsigned long *result, char **str)
181 const char *cp = *str; 185 const char *cp = *str;
182 char *ep; 186 char *ep;
183 int base = 10; 187 int base = 10;
188
184 if (*cp == '0') { 189 if (*cp == '0') {
185 char c = *(cp + 1); 190 char c = *(cp + 1);
191
186 if (c == 'x' || c == 'X') { 192 if (c == 'x' || c == 'X') {
187 base = 16; 193 base = 16;
188 cp += 2; 194 cp += 2;
@@ -240,6 +246,7 @@ bool tomoyo_parse_name_union(struct tomoyo_acl_param *param,
240 struct tomoyo_name_union *ptr) 246 struct tomoyo_name_union *ptr)
241{ 247{
242 char *filename; 248 char *filename;
249
243 if (param->data[0] == '@') { 250 if (param->data[0] == '@') {
244 param->data++; 251 param->data++;
245 ptr->group = tomoyo_get_group(param, TOMOYO_PATH_GROUP); 252 ptr->group = tomoyo_get_group(param, TOMOYO_PATH_GROUP);
@@ -266,6 +273,7 @@ bool tomoyo_parse_number_union(struct tomoyo_acl_param *param,
266 char *data; 273 char *data;
267 u8 type; 274 u8 type;
268 unsigned long v; 275 unsigned long v;
276
269 memset(ptr, 0, sizeof(*ptr)); 277 memset(ptr, 0, sizeof(*ptr));
270 if (param->data[0] == '@') { 278 if (param->data[0] == '@') {
271 param->data++; 279 param->data++;
@@ -429,6 +437,7 @@ static bool tomoyo_correct_word2(const char *string, size_t len)
429 unsigned char c; 437 unsigned char c;
430 unsigned char d; 438 unsigned char d;
431 unsigned char e; 439 unsigned char e;
440
432 if (!len) 441 if (!len)
433 goto out; 442 goto out;
434 while (len--) { 443 while (len--) {
@@ -533,6 +542,7 @@ bool tomoyo_correct_domain(const unsigned char *domainname)
533 return true; 542 return true;
534 while (1) { 543 while (1) {
535 const unsigned char *cp = strchr(domainname, ' '); 544 const unsigned char *cp = strchr(domainname, ' ');
545
536 if (!cp) 546 if (!cp)
537 break; 547 break;
538 if (*domainname != '/' || 548 if (*domainname != '/' ||
@@ -554,6 +564,7 @@ bool tomoyo_domain_def(const unsigned char *buffer)
554{ 564{
555 const unsigned char *cp; 565 const unsigned char *cp;
556 int len; 566 int len;
567
557 if (*buffer != '<') 568 if (*buffer != '<')
558 return false; 569 return false;
559 cp = strchr(buffer, ' '); 570 cp = strchr(buffer, ' ');
@@ -668,6 +679,9 @@ static bool tomoyo_file_matches_pattern2(const char *filename,
668{ 679{
669 while (filename < filename_end && pattern < pattern_end) { 680 while (filename < filename_end && pattern < pattern_end) {
670 char c; 681 char c;
682 int i;
683 int j;
684
671 if (*pattern != '\\') { 685 if (*pattern != '\\') {
672 if (*filename++ != *pattern++) 686 if (*filename++ != *pattern++)
673 return false; 687 return false;
@@ -676,8 +690,6 @@ static bool tomoyo_file_matches_pattern2(const char *filename,
676 c = *filename; 690 c = *filename;
677 pattern++; 691 pattern++;
678 switch (*pattern) { 692 switch (*pattern) {
679 int i;
680 int j;
681 case '?': 693 case '?':
682 if (c == '/') { 694 if (c == '/') {
683 return false; 695 return false;
@@ -985,6 +997,7 @@ int tomoyo_init_request_info(struct tomoyo_request_info *r,
985 struct tomoyo_domain_info *domain, const u8 index) 997 struct tomoyo_domain_info *domain, const u8 index)
986{ 998{
987 u8 profile; 999 u8 profile;
1000
988 memset(r, 0, sizeof(*r)); 1001 memset(r, 0, sizeof(*r));
989 if (!domain) 1002 if (!domain)
990 domain = tomoyo_domain(); 1003 domain = tomoyo_domain();
@@ -1018,6 +1031,7 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
1018 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) { 1031 list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1019 u16 perm; 1032 u16 perm;
1020 u8 i; 1033 u8 i;
1034
1021 if (ptr->is_deleted) 1035 if (ptr->is_deleted)
1022 continue; 1036 continue;
1023 switch (ptr->type) { 1037 switch (ptr->type) {
@@ -1062,9 +1076,8 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
1062 domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true; 1076 domain->flags[TOMOYO_DIF_QUOTA_WARNED] = true;
1063 /* r->granted = false; */ 1077 /* r->granted = false; */
1064 tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]); 1078 tomoyo_write_log(r, "%s", tomoyo_dif[TOMOYO_DIF_QUOTA_WARNED]);
1065 printk(KERN_WARNING "WARNING: " 1079 pr_warn("WARNING: Domain '%s' has too many ACLs to hold. Stopped learning mode.\n",
1066 "Domain '%s' has too many ACLs to hold. " 1080 domain->domainname->name);
1067 "Stopped learning mode.\n", domain->domainname->name);
1068 } 1081 }
1069 return false; 1082 return false;
1070} 1083}
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-11 11:15:59 -0400