Open-Source-Software-Entwicklung und Downloads

TOMOYO

Browse Subversion Repository

/[tomoyo]/trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Annotation of /trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Parent Directory Parent Directory | Revision Log Revision Log

Revision 815 - (hide annotations) (download) (as text)
Tue Dec 18 07:13:08 2007 UTC (16 years, 5 months ago) by kumaneko
Original Path: trunk/1.5.x/ccs-patch/fs/tomoyo_exec.c
File MIME type: text/x-csrc
File size: 4654 byte(s) 
Change log format.
1 kumaneko 111 /*
2     * fs/tomoyo_exec.c
3     *
4     * Implementation of the Domain-Based Mandatory Access Control.
5     *
6     * Copyright (C) 2005-2007 NTT DATA CORPORATION
7     *
8 kumaneko 815 * Version: 1.5.3-pre 2007/12/18
9 kumaneko 111 *
10     * This file is applicable to both 2.4.30 and 2.6.11 and later.
11     * See README.ccs for ChangeLog.
12     *
13     */
14     /***** TOMOYO Linux start. *****/
15    
16     #include <linux/ccs_common.h>
17     #include <linux/tomoyo.h>
18     #include <linux/realpath.h>
19    
20     /************************* VARIABLES *************************/
21    
22 kumaneko 652 extern struct mutex domain_acl_lock;
23 kumaneko 111
24     /************************* AUDIT FUNCTIONS *************************/
25    
26 kumaneko 815 static int AuditArgv0Log(const struct path_info *filename, const char *argv0, const bool is_granted, const u8 profile, const unsigned int mode)
27 kumaneko 111 {
28     char *buf;
29     int len;
30     if (CanSaveAuditLog(is_granted) < 0) return -ENOMEM;
31     len = filename->total_len + strlen(argv0) + 8;
32 kumaneko 815 if ((buf = InitAuditLog(&len, profile, mode)) == NULL) return -ENOMEM;
33 kumaneko 111 snprintf(buf + strlen(buf), len - strlen(buf) - 1, KEYWORD_ALLOW_ARGV0 "%s %s\n", filename->name, argv0);
34     return WriteAuditLog(buf, is_granted);
35     }
36    
37     /************************* ARGV0 MISMATCH HANDLER *************************/
38    
39 kumaneko 621 static int AddArgv0Entry(const char *filename, const char *argv0, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
40 kumaneko 111 {
41     struct acl_info *ptr;
42 kumaneko 708 struct argv0_acl_record *acl;
43 kumaneko 111 const struct path_info *saved_filename, *saved_argv0;
44     int error = -ENOMEM;
45     if (!IsCorrectPath(filename, 1, 0, -1, __FUNCTION__) || !IsCorrectPath(argv0, -1, 0, -1, __FUNCTION__) || strchr(argv0, '/')) return -EINVAL;
46     if ((saved_filename = SaveName(filename)) == NULL || (saved_argv0 = SaveName(argv0)) == NULL) return -ENOMEM;
47 kumaneko 652 mutex_lock(&domain_acl_lock);
48 kumaneko 514 if (!is_delete) {
49 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
50 kumaneko 712 acl = container_of(ptr, struct argv0_acl_record, head);
51 kumaneko 111 if (ptr->type == TYPE_ARGV0_ACL && ptr->cond == condition) {
52 kumaneko 708 if (acl->filename == saved_filename && acl->argv0 == saved_argv0) {
53 kumaneko 111 ptr->is_deleted = 0;
54     /* Found. Nothing to do. */
55     error = 0;
56 kumaneko 708 goto out;
57 kumaneko 111 }
58     }
59     }
60 kumaneko 708 /* Not found. Append it to the tail. */
61     if ((acl = alloc_element(sizeof(*acl))) == NULL) goto out;
62     acl->head.type = TYPE_ARGV0_ACL;
63     acl->head.cond = condition;
64     acl->filename = saved_filename;
65     acl->argv0 = saved_argv0;
66     error = AddDomainACL(domain, &acl->head);
67 kumaneko 111 } else {
68     error = -ENOENT;
69 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
70 kumaneko 712 acl = container_of(ptr, struct argv0_acl_record, head);
71 kumaneko 111 if (ptr->type != TYPE_ARGV0_ACL || ptr->is_deleted || ptr->cond != condition) continue;
72 kumaneko 708 if (acl->filename != saved_filename || acl->argv0 != saved_argv0) continue;
73 kumaneko 111 error = DelDomainACL(ptr);
74     break;
75     }
76     }
77 kumaneko 708 out: ;
78 kumaneko 652 mutex_unlock(&domain_acl_lock);
79 kumaneko 111 return error;
80     }
81    
82     static int CheckArgv0ACL(const struct path_info *filename, const char *argv0_)
83     {
84     const struct domain_info *domain = current->domain_info;
85     int error = -EPERM;
86     struct acl_info *ptr;
87     struct path_info argv0;
88     argv0.name = argv0_;
89     fill_path_info(&argv0);
90 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
91 kumaneko 708 struct argv0_acl_record *acl;
92 kumaneko 712 acl = container_of(ptr, struct argv0_acl_record, head);
93 kumaneko 111 if (ptr->type == TYPE_ARGV0_ACL && ptr->is_deleted == 0 && CheckCondition(ptr->cond, NULL) == 0 &&
94 kumaneko 708 PathMatchesToPattern(filename, acl->filename) &&
95     PathMatchesToPattern(&argv0, acl->argv0)) {
96 kumaneko 111 error = 0;
97     break;
98     }
99     }
100     return error;
101     }
102    
103     int CheckArgv0Perm(const struct path_info *filename, const char *argv0)
104     {
105     int error = 0;
106 kumaneko 815 struct domain_info * const domain = current->domain_info;
107     const u8 profile = domain->profile;
108     const unsigned int mode = CheckCCSFlags(CCS_TOMOYO_MAC_FOR_ARGV0);
109 kumaneko 142 if (!filename || !argv0 || !*argv0) return 0;
110 kumaneko 111 error = CheckArgv0ACL(filename, argv0);
111 kumaneko 815 AuditArgv0Log(filename, argv0, !error, profile, mode);
112 kumaneko 111 if (error) {
113 kumaneko 815 const bool is_enforce = (mode == 3);
114 kumaneko 111 if (TomoyoVerboseMode()) {
115     printk("TOMOYO-%s: Run %s as %s denied for %s\n", GetMSG(is_enforce), filename->name, argv0, GetLastName(domain));
116     }
117     if (is_enforce) error = CheckSupervisor("%s\n" KEYWORD_ALLOW_ARGV0 "%s %s\n", domain->domainname->name, filename->name, argv0);
118 kumaneko 815 else if (mode == 1 && CheckDomainQuota(domain)) AddArgv0Entry(filename->name, argv0, domain, NULL, 0);
119 kumaneko 111 if (!is_enforce) error = 0;
120     }
121     return error;
122     }
123    
124 kumaneko 621 int AddArgv0Policy(char *data, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
125 kumaneko 111 {
126     char *argv0 = strchr(data, ' ');
127     if (!argv0) return -EINVAL;
128     *argv0++ = '\0';
129 kumaneko 514 return AddArgv0Entry(data, argv0, domain, condition, is_delete);
130 kumaneko 111 }
131    
132     /***** TOMOYO Linux end. *****/
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
Über OSDN
Software suchen
Entwickeln Software
Hilfeseiten