Open-Source-Software-Entwicklung und Downloads

TOMOYO

Browse Subversion Repository

/[tomoyo]/trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Annotation of /trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Parent Directory Parent Directory | Revision Log Revision Log

Revision 290 - (hide annotations) (download) (as text)
Tue Jul 10 11:52:21 2007 UTC (16 years, 10 months ago) by kumaneko
Original Path: trunk/ccs-patch/fs/tomoyo_exec.c
File MIME type: text/x-csrc
File size: 5094 byte(s) 
1.4.2
1 kumaneko 111 /*
2     * fs/tomoyo_exec.c
3     *
4     * Implementation of the Domain-Based Mandatory Access Control.
5     *
6     * Copyright (C) 2005-2007 NTT DATA CORPORATION
7     *
8 kumaneko 290 * Version: 1.4.2 2007/07/13
9 kumaneko 111 *
10     * This file is applicable to both 2.4.30 and 2.6.11 and later.
11     * See README.ccs for ChangeLog.
12     *
13     */
14     /***** TOMOYO Linux start. *****/
15    
16     #include <linux/ccs_common.h>
17     #include <linux/tomoyo.h>
18     #include <linux/realpath.h>
19    
20     /************************* VARIABLES *************************/
21    
22     extern struct semaphore domain_acl_lock;
23    
24     /************************* AUDIT FUNCTIONS *************************/
25    
26     #ifdef CONFIG_TOMOYO_AUDIT
27     static int AuditArgv0Log(const struct path_info *filename, const char *argv0, const int is_granted)
28     {
29     char *buf;
30     int len;
31     if (CanSaveAuditLog(is_granted) < 0) return -ENOMEM;
32     len = filename->total_len + strlen(argv0) + 8;
33     if ((buf = InitAuditLog(&len)) == NULL) return -ENOMEM;
34     snprintf(buf + strlen(buf), len - strlen(buf) - 1, KEYWORD_ALLOW_ARGV0 "%s %s\n", filename->name, argv0);
35     return WriteAuditLog(buf, is_granted);
36     }
37    
38     #else
39     static inline void AuditArgv0Log(const struct path_info *filename, const char *argv0, const int is_granted) {}
40     #endif
41    
42     /************************* ARGV0 MISMATCH HANDLER *************************/
43    
44 kumaneko 120 static int AddArgv0Entry(const char *filename, const char *argv0, struct domain_info *domain, const u8 is_add, const struct condition_list *condition)
45 kumaneko 111 {
46     struct acl_info *ptr;
47     const struct path_info *saved_filename, *saved_argv0;
48     int error = -ENOMEM;
49     if (!IsCorrectPath(filename, 1, 0, -1, __FUNCTION__) || !IsCorrectPath(argv0, -1, 0, -1, __FUNCTION__) || strchr(argv0, '/')) return -EINVAL;
50     if ((saved_filename = SaveName(filename)) == NULL || (saved_argv0 = SaveName(argv0)) == NULL) return -ENOMEM;
51     down(&domain_acl_lock);
52 kumaneko 120 if (is_add) {
53 kumaneko 111 if ((ptr = domain->first_acl_ptr) == NULL) goto first_entry;
54     while (1) {
55 kumaneko 214 struct argv0_acl_record *new_ptr;
56 kumaneko 111 if (ptr->type == TYPE_ARGV0_ACL && ptr->cond == condition) {
57 kumaneko 214 if (((struct argv0_acl_record *) ptr)->filename == saved_filename && ((struct argv0_acl_record *) ptr)->argv0 == saved_argv0) {
58 kumaneko 111 ptr->is_deleted = 0;
59     /* Found. Nothing to do. */
60     error = 0;
61     break;
62     }
63     }
64     if (ptr->next) {
65     ptr = ptr->next;
66     continue;
67     }
68     first_entry: ;
69 kumaneko 120 if (is_add == 1 && TooManyDomainACL(domain)) break;
70 kumaneko 111 /* Not found. Append it to the tail. */
71 kumaneko 214 if ((new_ptr = alloc_element(sizeof(*new_ptr))) == NULL) break;
72 kumaneko 111 new_ptr->head.type = TYPE_ARGV0_ACL;
73     new_ptr->head.cond = condition;
74     new_ptr->filename = saved_filename;
75     new_ptr->argv0 = saved_argv0;
76     error = AddDomainACL(ptr, domain, (struct acl_info *) new_ptr);
77     break;
78     }
79     } else {
80     error = -ENOENT;
81     for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
82     if (ptr->type != TYPE_ARGV0_ACL || ptr->is_deleted || ptr->cond != condition) continue;
83 kumaneko 214 if (((struct argv0_acl_record *) ptr)->filename != saved_filename || ((struct argv0_acl_record *) ptr)->argv0 != saved_argv0) continue;
84 kumaneko 111 error = DelDomainACL(ptr);
85     break;
86     }
87     }
88     up(&domain_acl_lock);
89     return error;
90     }
91    
92     static int CheckArgv0ACL(const struct path_info *filename, const char *argv0_)
93     {
94     const struct domain_info *domain = current->domain_info;
95     int error = -EPERM;
96     struct acl_info *ptr;
97     struct path_info argv0;
98     if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_ARGV0)) return 0;
99     argv0.name = argv0_;
100     fill_path_info(&argv0);
101     for (ptr = domain->first_acl_ptr; ptr; ptr = ptr->next) {
102     if (ptr->type == TYPE_ARGV0_ACL && ptr->is_deleted == 0 && CheckCondition(ptr->cond, NULL) == 0 &&
103 kumaneko 214 PathMatchesToPattern(filename, ((struct argv0_acl_record *) ptr)->filename) &&
104     PathMatchesToPattern(&argv0, ((struct argv0_acl_record *) ptr)->argv0)) {
105 kumaneko 111 error = 0;
106     break;
107     }
108     }
109     return error;
110     }
111    
112     int CheckArgv0Perm(const struct path_info *filename, const char *argv0)
113     {
114     int error = 0;
115     if (!CheckCCSFlags(CCS_TOMOYO_MAC_FOR_ARGV0)) return 0;
116 kumaneko 142 if (!filename || !argv0 || !*argv0) return 0;
117 kumaneko 111 error = CheckArgv0ACL(filename, argv0);
118     AuditArgv0Log(filename, argv0, !error);
119     if (error) {
120     struct domain_info * const domain = current->domain_info;
121     const int is_enforce = CheckCCSEnforce(CCS_TOMOYO_MAC_FOR_ARGV0);
122     if (TomoyoVerboseMode()) {
123     printk("TOMOYO-%s: Run %s as %s denied for %s\n", GetMSG(is_enforce), filename->name, argv0, GetLastName(domain));
124     }
125     if (is_enforce) error = CheckSupervisor("%s\n" KEYWORD_ALLOW_ARGV0 "%s %s\n", domain->domainname->name, filename->name, argv0);
126 kumaneko 120 else if (CheckCCSAccept(CCS_TOMOYO_MAC_FOR_ARGV0)) AddArgv0Entry(filename->name, argv0, domain, 1, NULL);
127 kumaneko 111 if (!is_enforce) error = 0;
128     }
129     return error;
130     }
131 kumaneko 223 EXPORT_SYMBOL(CheckArgv0Perm);
132 kumaneko 111
133     int AddArgv0Policy(char *data, struct domain_info *domain, const int is_delete)
134     {
135     char *argv0 = strchr(data, ' ');
136     char *cp;
137     const struct condition_list *condition = NULL;
138     if (!argv0) return -EINVAL;
139     *argv0++ = '\0';
140     cp = FindConditionPart(argv0);
141     if (cp && (condition = FindOrAssignNewCondition(cp)) == NULL) return -EINVAL;
142 kumaneko 120 return AddArgv0Entry(data, argv0, domain, is_delete ? 0 : -1, condition);
143 kumaneko 111 }
144    
145     /***** TOMOYO Linux end. *****/
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
Über OSDN
Software suchen
Entwickeln Software
Hilfeseiten