Open-Source-Software-Entwicklung und Downloads

TOMOYO

Browse Subversion Repository

/[tomoyo]/trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Annotation of /trunk/1.6.x/ccs-patch/fs/tomoyo_exec.c

Parent Directory Parent Directory | Revision Log Revision Log

Revision 856 - (hide annotations) (download) (as text)
Thu Jan 3 07:16:18 2008 UTC (16 years, 5 months ago) by kumaneko
Original Path: trunk/1.5.x/ccs-patch/fs/tomoyo_exec.c
File MIME type: text/x-csrc
File size: 5614 byte(s) 
Change internal structure.
1 kumaneko 111 /*
2     * fs/tomoyo_exec.c
3     *
4     * Implementation of the Domain-Based Mandatory Access Control.
5     *
6 kumaneko 851 * Copyright (C) 2005-2008 NTT DATA CORPORATION
7 kumaneko 111 *
8 kumaneko 856 * Version: 1.5.3-pre 2008/01/03
9 kumaneko 111 *
10     * This file is applicable to both 2.4.30 and 2.6.11 and later.
11     * See README.ccs for ChangeLog.
12     *
13     */
14     /***** TOMOYO Linux start. *****/
15    
16     #include <linux/ccs_common.h>
17     #include <linux/tomoyo.h>
18     #include <linux/realpath.h>
19    
20     /************************* VARIABLES *************************/
21    
22 kumaneko 652 extern struct mutex domain_acl_lock;
23 kumaneko 111
24     /************************* AUDIT FUNCTIONS *************************/
25    
26 kumaneko 851 static int AuditArgv0Log(const struct path_info *filename, const char *argv0, const bool is_granted, const u8 profile, const u8 mode)
27 kumaneko 111 {
28     char *buf;
29     int len;
30     if (CanSaveAuditLog(is_granted) < 0) return -ENOMEM;
31     len = filename->total_len + strlen(argv0) + 8;
32 kumaneko 815 if ((buf = InitAuditLog(&len, profile, mode)) == NULL) return -ENOMEM;
33 kumaneko 111 snprintf(buf + strlen(buf), len - strlen(buf) - 1, KEYWORD_ALLOW_ARGV0 "%s %s\n", filename->name, argv0);
34     return WriteAuditLog(buf, is_granted);
35     }
36    
37     /************************* ARGV0 MISMATCH HANDLER *************************/
38    
39 kumaneko 621 static int AddArgv0Entry(const char *filename, const char *argv0, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
40 kumaneko 111 {
41     struct acl_info *ptr;
42 kumaneko 708 struct argv0_acl_record *acl;
43 kumaneko 856 struct argv0_acl_record_with_condition *p;
44 kumaneko 111 const struct path_info *saved_filename, *saved_argv0;
45     int error = -ENOMEM;
46     if (!IsCorrectPath(filename, 1, 0, -1, __FUNCTION__) || !IsCorrectPath(argv0, -1, 0, -1, __FUNCTION__) || strchr(argv0, '/')) return -EINVAL;
47     if ((saved_filename = SaveName(filename)) == NULL || (saved_argv0 = SaveName(argv0)) == NULL) return -ENOMEM;
48 kumaneko 652 mutex_lock(&domain_acl_lock);
49 kumaneko 514 if (!is_delete) {
50 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
51 kumaneko 856 switch (ptr->type) {
52     case TYPE_ARGV0_ACL:
53     if (condition) continue;
54     acl = container_of(ptr, struct argv0_acl_record, head);
55     break;
56     case TYPE_ARGV0_ACL_WITH_CONDITION:
57     p = container_of(ptr, struct argv0_acl_record_with_condition, record.head);
58     if (p->condition != condition) continue;
59     acl = &p->record;
60     break;
61     default:
62     continue;
63 kumaneko 111 }
64 kumaneko 856 if (acl->filename != saved_filename || acl->argv0 != saved_argv0) continue;
65     ptr->is_deleted = 0;
66     /* Found. Nothing to do. */
67     error = 0;
68     goto out;
69 kumaneko 111 }
70 kumaneko 708 /* Not found. Append it to the tail. */
71 kumaneko 856 if (condition) {
72     if ((p = alloc_element(sizeof(*p))) == NULL) goto out;
73     acl = &p->record;
74     p->condition = condition;
75     acl->head.type = TYPE_ARGV0_ACL_WITH_CONDITION;
76     } else {
77     if ((acl = alloc_element(sizeof(*acl))) == NULL) goto out;
78     acl->head.type = TYPE_ARGV0_ACL;
79     }
80 kumaneko 708 acl->filename = saved_filename;
81     acl->argv0 = saved_argv0;
82     error = AddDomainACL(domain, &acl->head);
83 kumaneko 111 } else {
84     error = -ENOENT;
85 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
86 kumaneko 856 switch (ptr->type) {
87     case TYPE_ARGV0_ACL:
88     if (condition) continue;
89     acl = container_of(ptr, struct argv0_acl_record, head);
90     break;
91     case TYPE_ARGV0_ACL_WITH_CONDITION:
92     p = container_of(ptr, struct argv0_acl_record_with_condition, record.head);
93     if (p->condition != condition) continue;
94     acl = &p->record;
95     break;
96     default:
97     continue;
98     }
99     if (ptr->is_deleted || acl->filename != saved_filename || acl->argv0 != saved_argv0) continue;
100 kumaneko 111 error = DelDomainACL(ptr);
101     break;
102     }
103     }
104 kumaneko 708 out: ;
105 kumaneko 652 mutex_unlock(&domain_acl_lock);
106 kumaneko 111 return error;
107     }
108    
109     static int CheckArgv0ACL(const struct path_info *filename, const char *argv0_)
110     {
111     const struct domain_info *domain = current->domain_info;
112     int error = -EPERM;
113     struct acl_info *ptr;
114     struct path_info argv0;
115     argv0.name = argv0_;
116     fill_path_info(&argv0);
117 kumaneko 722 list1_for_each_entry(ptr, &domain->acl_info_list, list) {
118 kumaneko 708 struct argv0_acl_record *acl;
119 kumaneko 856 struct argv0_acl_record_with_condition *p;
120     const struct condition_list *cond;
121     switch (ptr->type) {
122     default:
123     continue;
124     case TYPE_ARGV0_ACL:
125     acl = container_of(ptr, struct argv0_acl_record, head);
126     cond = NULL;
127 kumaneko 111 break;
128 kumaneko 856 case TYPE_ARGV0_ACL_WITH_CONDITION:
129     p = container_of(ptr, struct argv0_acl_record_with_condition, record.head);
130     acl = &p->record;
131     cond = p->condition;
132     break;
133 kumaneko 111 }
134 kumaneko 856 if (ptr->is_deleted || !CheckCondition(cond, NULL) ||
135     !PathMatchesToPattern(filename, acl->filename) ||
136     !PathMatchesToPattern(&argv0, acl->argv0)) continue;
137     error = 0;
138     break;
139 kumaneko 111 }
140     return error;
141     }
142    
143     int CheckArgv0Perm(const struct path_info *filename, const char *argv0)
144     {
145     int error = 0;
146 kumaneko 815 struct domain_info * const domain = current->domain_info;
147     const u8 profile = domain->profile;
148 kumaneko 851 const u8 mode = CheckCCSFlags(CCS_TOMOYO_MAC_FOR_ARGV0);
149 kumaneko 856 const bool is_enforce = (mode == 3);
150 kumaneko 142 if (!filename || !argv0 || !*argv0) return 0;
151 kumaneko 111 error = CheckArgv0ACL(filename, argv0);
152 kumaneko 815 AuditArgv0Log(filename, argv0, !error, profile, mode);
153 kumaneko 856 if (!error) return 0;
154     if (TomoyoVerboseMode()) {
155     printk("TOMOYO-%s: Run %s as %s denied for %s\n", GetMSG(is_enforce), filename->name, argv0, GetLastName(domain));
156 kumaneko 111 }
157 kumaneko 856 if (is_enforce) return CheckSupervisor("%s\n" KEYWORD_ALLOW_ARGV0 "%s %s\n", domain->domainname->name, filename->name, argv0);
158     else if (mode == 1 && CheckDomainQuota(domain)) AddArgv0Entry(filename->name, argv0, domain, NULL, 0);
159     return 0;
160 kumaneko 111 }
161    
162 kumaneko 621 int AddArgv0Policy(char *data, struct domain_info *domain, const struct condition_list *condition, const bool is_delete)
163 kumaneko 111 {
164     char *argv0 = strchr(data, ' ');
165     if (!argv0) return -EINVAL;
166     *argv0++ = '\0';
167 kumaneko 514 return AddArgv0Entry(data, argv0, domain, condition, is_delete);
168 kumaneko 111 }
169    
170     /***** TOMOYO Linux end. *****/
Back to OSDN">Back to OSDN
 ViewVC Help
Powered by ViewVC 1.1.26  
Über OSDN
Software suchen
Entwickeln Software
Hilfeseiten