TOMOYO: Add recursive directory matching operator support.

TOMOYO 1.7.1 has recursive directory matching operator support.
I want to add it to TOMOYO for Linux 2.6.33 .
----------
[PATCH] TOMOYO: Add recursive directory matching operator support.

This patch introduces new operator /\{dir\}/ which matches
'/' + 'One or more repetitions of dir/' (e.g. /dir/ /dir/dir/ /dir/dir/dir/ ).

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: James Morris <jmorris@namei.org>

2 files changed, 121 insertions, 83 deletions

diff --git a/security/tomoyo/common.c b/security/tomoyo/common.c
index 3c8bd8ee0b95..e0d0354008b7 100644
--- a/security/tomoyo/common.c
+++ b/security/tomoyo/common.c
@@ -187,6 +187,8 @@ bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
                             const s8 pattern_type, const s8 end_type,
                             const char *function)
 {
+        const char *const start = filename;
+        bool in_repetition = false;
         bool contains_pattern = false;
         unsigned char c;
         unsigned char d;
@@ -212,9 +214,13 @@ bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
                 if (c == '/')
                         goto out;
         }
-        while ((c = *filename++) != '\0') {
+        while (1) {
+                c = *filename++;
+                if (!c)
+                        break;
                 if (c == '\\') {
-                        switch ((c = *filename++)) {
+                        c = *filename++;
+                        switch (c) {
                         case '\\':  /* "\\" */
                                 continue;
                         case '$':   /* "\$" */
@@ -231,6 +237,22 @@ bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
                                         break; /* Must not contain pattern */
                                 contains_pattern = true;
                                 continue;
+                        case '{':   /* "/\{" */
+                                if (filename - 3 < start ||
+                                    *(filename - 3) != '/')
+                                        break;
+                                if (pattern_type == -1)
+                                        break; /* Must not contain pattern */
+                                contains_pattern = true;
+                                in_repetition = true;
+                                continue;
+                        case '}':   /* "\}/" */
+                                if (*filename != '/')
+                                        break;
+                                if (!in_repetition)
+                                        break;
+                                in_repetition = false;
+                                continue;
                         case '0':   /* "\ooo" */
                         case '1':
                         case '2':
@@ -246,6 +268,8 @@ bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
                                         continue; /* pattern is not \000 */
                         }
                         goto out;
+                } else if (in_repetition && c == '/') {
+                        goto out;
                 } else if (tomoyo_is_invalid(c)) {
                         goto out;
                 }
@@ -254,6 +278,8 @@ bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
                 if (!contains_pattern)
                         goto out;
         }
+        if (in_repetition)
+                goto out;
         return true;
  out:
         printk(KERN_DEBUG "%s: Invalid pathname '%s'\n", function,
@@ -360,33 +386,6 @@ struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname)
 }
 
 /**
- * tomoyo_path_depth - Evaluate the number of '/' in a string.
- *
- * @pathname: The string to evaluate.
- *
- * Returns path depth of the string.
- *
- * I score 2 for each of the '/' in the @pathname
- * and score 1 if the @pathname ends with '/'.
- */
-static int tomoyo_path_depth(const char *pathname)
-{
-        int i = 0;
-
-        if (pathname) {
-                const char *ep = pathname + strlen(pathname);
-                if (pathname < ep--) {
-                        if (*ep != '/')
-                                i++;
-                        while (pathname <= ep)
-                                if (*ep-- == '/')
-                                        i += 2;
-                }
-        }
-        return i;
-}
-
-/**
  * tomoyo_const_part_length - Evaluate the initial length without a pattern in a token.
  *
  * @filename: The string to evaluate.
@@ -444,11 +443,10 @@ void tomoyo_fill_path_info(struct tomoyo_path_info *ptr)
         ptr->is_dir = len && (name[len - 1] == '/');
         ptr->is_patterned = (ptr->const_len < len);
         ptr->hash = full_name_hash(name, len);
-        ptr->depth = tomoyo_path_depth(name);
 }
 
 /**
- * tomoyo_file_matches_to_pattern2 - Pattern matching without '/' character
+ * tomoyo_file_matches_pattern2 - Pattern matching without '/' character
  * and "\-" pattern.
  *
  * @filename:     The start of string to check.
@@ -458,10 +456,10 @@ void tomoyo_fill_path_info(struct tomoyo_path_info *ptr)
  *
  * Returns true if @filename matches @pattern, false otherwise.
  */
-static bool tomoyo_file_matches_to_pattern2(const char *filename,
-                                            const char *filename_end,
-                                            const char *pattern,
-                                            const char *pattern_end)
+static bool tomoyo_file_matches_pattern2(const char *filename,
+                                         const char *filename_end,
+                                         const char *pattern,
+                                         const char *pattern_end)
 {
         while (filename < filename_end && pattern < pattern_end) {
                 char c;
@@ -519,7 +517,7 @@ static bool tomoyo_file_matches_to_pattern2(const char *filename,
                 case '*':
                 case '@':
                         for (i = 0; i <= filename_end - filename; i++) {
-                                if (tomoyo_file_matches_to_pattern2(
+                                if (tomoyo_file_matches_pattern2(
                                                     filename + i, filename_end,
                                                     pattern + 1, pattern_end))
                                         return true;
@@ -550,7 +548,7 @@ static bool tomoyo_file_matches_to_pattern2(const char *filename,
                                         j++;
                         }
                         for (i = 1; i <= j; i++) {
-                                if (tomoyo_file_matches_to_pattern2(
+                                if (tomoyo_file_matches_pattern2(
                                                     filename + i, filename_end,
                                                     pattern + 1, pattern_end))
                                         return true;
@@ -567,7 +565,7 @@ static bool tomoyo_file_matches_to_pattern2(const char *filename,
 }
 
 /**
- * tomoyo_file_matches_to_pattern - Pattern matching without without '/' character.
+ * tomoyo_file_matches_pattern - Pattern matching without without '/' character.
  *
  * @filename:     The start of string to check.
  * @filename_end: The end of string to check.
@@ -576,7 +574,7 @@ static bool tomoyo_file_matches_to_pattern2(const char *filename,
  *
  * Returns true if @filename matches @pattern, false otherwise.
  */