security/tomoyo/gc.c

   1 /*
   2  * security/tomoyo/gc.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  *
   8  */
   9
  10 #include "common.h"
  11 #include <linux/kthread.h>
  12 #include <linux/slab.h>
  13
  14 /* The list for "struct tomoyo_io_buffer". */
  15 static LIST_HEAD(tomoyo_io_buffer_list);
  16 /* Lock for protecting tomoyo_io_buffer_list. */
  17 static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock);
  18
  19 /* Size of an element. */
  20 static const u8 tomoyo_element_size[TOMOYO_MAX_POLICY] = {
  21         [TOMOYO_ID_GROUP] = sizeof(struct tomoyo_group),
  22         [TOMOYO_ID_PATH_GROUP] = sizeof(struct tomoyo_path_group),
  23         [TOMOYO_ID_NUMBER_GROUP] = sizeof(struct tomoyo_number_group),
  24         [TOMOYO_ID_AGGREGATOR] = sizeof(struct tomoyo_aggregator),
  25         [TOMOYO_ID_TRANSITION_CONTROL] =
  26         sizeof(struct tomoyo_transition_control),
  27         [TOMOYO_ID_MANAGER] = sizeof(struct tomoyo_manager),
  28         /* [TOMOYO_ID_CONDITION] = "struct tomoyo_condition"->size, */
  29         /* [TOMOYO_ID_NAME] = "struct tomoyo_name"->size, */
  30         /* [TOMOYO_ID_ACL] =
  31            tomoyo_acl_size["struct tomoyo_acl_info"->type], */
  32         [TOMOYO_ID_DOMAIN] = sizeof(struct tomoyo_domain_info),
  33 };
  34
  35 /* Size of a domain ACL element. */
  36 static const u8 tomoyo_acl_size[] = {
  37         [TOMOYO_TYPE_PATH_ACL] = sizeof(struct tomoyo_path_acl),
  38         [TOMOYO_TYPE_PATH2_ACL] = sizeof(struct tomoyo_path2_acl),
  39         [TOMOYO_TYPE_PATH_NUMBER_ACL] = sizeof(struct tomoyo_path_number_acl),
  40         [TOMOYO_TYPE_MKDEV_ACL] = sizeof(struct tomoyo_mkdev_acl),
  41         [TOMOYO_TYPE_MOUNT_ACL] = sizeof(struct tomoyo_mount_acl),
  42 };
  43
  44 /**
  45  * tomoyo_struct_used_by_io_buffer - Check whether the list element is used by /sys/kernel/security/tomoyo/ users or not.
  46  *
  47  * @element: Pointer to "struct list_head".
  48  *
  49  * Returns true if @element is used by /sys/kernel/security/tomoyo/ users,
  50  * false otherwise.
  51  */
  52 static bool tomoyo_struct_used_by_io_buffer(const struct list_head *element)
  53 {
  54         struct tomoyo_io_buffer *head;
  55         bool in_use = false;
  56
  57         spin_lock(&tomoyo_io_buffer_list_lock);
  58         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  59                 head->users++;
  60                 spin_unlock(&tomoyo_io_buffer_list_lock);
  61                 if (mutex_lock_interruptible(&head->io_sem)) {
  62                         in_use = true;
  63                         goto out;
  64                 }
  65                 if (head->r.domain == element || head->r.group == element ||
  66                     head->r.acl == element || &head->w.domain->list == element)
  67                         in_use = true;
  68                 mutex_unlock(&head->io_sem);
  69 out:
  70                 spin_lock(&tomoyo_io_buffer_list_lock);
  71                 head->users--;
  72                 if (in_use)
  73                         break;
  74         }
  75         spin_unlock(&tomoyo_io_buffer_list_lock);
  76         return in_use;
  77 }
  78
  79 /**
  80  * tomoyo_name_used_by_io_buffer - Check whether the string is used by /sys/kernel/security/tomoyo/ users or not.
  81  *
  82  * @string: String to check.
  83  * @size:   Memory allocated for @string .
  84  *
  85  * Returns true if @string is used by /sys/kernel/security/tomoyo/ users,
  86  * false otherwise.
  87  */
  88 static bool tomoyo_name_used_by_io_buffer(const char *string,
  89                                           const size_t size)
  90 {
  91         struct tomoyo_io_buffer *head;
  92         bool in_use = false;
  93
  94         spin_lock(&tomoyo_io_buffer_list_lock);
  95         list_for_each_entry(head, &tomoyo_io_buffer_list, list) {
  96                 int i;
  97                 head->users++;
  98                 spin_unlock(&tomoyo_io_buffer_list_lock);
  99                 if (mutex_lock_interruptible(&head->io_sem)) {
 100                         in_use = true;
 101                         goto out;
 102                 }
 103                 for (i = 0; i < TOMOYO_MAX_IO_READ_QUEUE; i++) {
 104                         const char *w = head->r.w[i];
 105                         if (w < string || w > string + size)
 106                                 continue;
 107                         in_use = true;
 108                         break;
 109                 }
 110                 mutex_unlock(&head->io_sem);
 111 out:
 112                 spin_lock(&tomoyo_io_buffer_list_lock);
 113                 head->users--;
 114                 if (in_use)
 115                         break;
 116         }
 117         spin_unlock(&tomoyo_io_buffer_list_lock);
 118         return in_use;
 119 }
 120
 121 /* Structure for garbage collection. */
 122 struct tomoyo_gc {
 123         struct list_head list;
 124         enum tomoyo_policy_id type;
 125         size_t size;
 126         struct list_head *element;
 127 };
 128 /* List of entries to be deleted. */
 129 static LIST_HEAD(tomoyo_gc_list);
 130 /* Length of tomoyo_gc_list. */
 131 static int tomoyo_gc_list_len;
 132
 133 /**
 134  * tomoyo_add_to_gc - Add an entry to to be deleted list.
 135  *
 136  * @type:    One of values in "enum tomoyo_policy_id".
 137  * @element: Pointer to "struct list_head".
 138  *
 139  * Returns true on success, false otherwise.
 140  *
 141  * Caller holds tomoyo_policy_lock mutex.
 142  *
 143  * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
 144  * entries at once, it will take too long time. Thus, do not add more than 128
 145  * entries per a scan. But to be able to handle worst case where all entries
 146  * are in-use, we accept one more entry per a scan.
 147  *
 148  * If we use singly linked list using "struct list_head"->prev (which is
 149  * LIST_POISON2), we can avoid kmalloc().
 150  */
 151 static bool tomoyo_add_to_gc(const int type, struct list_head *element)
 152 {
 153         struct tomoyo_gc *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
 154         if (!entry)
 155                 return false;
 156         entry->type = type;
 157         if (type == TOMOYO_ID_ACL)
 158                 entry->size = tomoyo_acl_size[
 159                               container_of(element,
 160                                            typeof(struct tomoyo_acl_info),
 161                                            list)->type];
 162         else if (type == TOMOYO_ID_NAME)
 163                 entry->size = strlen(container_of(element,
 164                                                   typeof(struct tomoyo_name),
 165                                                   head.list)->entry.name) + 1;
 166         else if (type == TOMOYO_ID_CONDITION)
 167                 entry->size =
 168                         container_of(element, typeof(struct tomoyo_condition),
 169                                      head.list)->size;
 170         else
 171                 entry->size = tomoyo_element_size[type];
 172         entry->element = element;
 173         list_add(&entry->list, &tomoyo_gc_list);
 174         list_del_rcu(element);
 175         return tomoyo_gc_list_len++ < 128;
 176 }
 177
 178 /**
 179  * tomoyo_element_linked_by_gc - Validate next element of an entry.
 180  *
 181  * @element: Pointer to an element.
 182  * @size:    Size of @element in byte.
 183  *
 184  * Returns true if @element is linked by other elements in the garbage
 185  * collector's queue, false otherwise.
 186  */
 187 static bool tomoyo_element_linked_by_gc(const u8 *element, const size_t size)
 188 {
 189         struct tomoyo_gc *p;
 190         list_for_each_entry(p, &tomoyo_gc_list, list) {
 191                 const u8 *ptr = (const u8 *) p->element->next;
 192                 if (ptr < element || element + size < ptr)
 193                         continue;
 194                 return true;
 195         }
 196         return false;
 197 }
 198
 199 /**
 200  * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
 201  *
 202  * @element: Pointer to "struct list_head".
 203  *
 204  * Returns nothing.
 205  */
 206 static void tomoyo_del_transition_control(struct list_head *element)
 207 {
 208         struct tomoyo_transition_control *ptr =
 209                 container_of(element, typeof(*ptr), head.list);
 210         tomoyo_put_name(ptr->domainname);
 211         tomoyo_put_name(ptr->program);
 212 }
 213
 214 /**
 215  * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
 216  *
 217  * @element: Pointer to "struct list_head".
 218  *
 219  * Returns nothing.
 220  */
 221 static void tomoyo_del_aggregator(struct list_head *element)
 222 {
 223         struct tomoyo_aggregator *ptr =
 224                 container_of(element, typeof(*ptr), head.list);
 225         tomoyo_put_name(ptr->original_name);
 226         tomoyo_put_name(ptr->aggregated_name);
 227 }
 228
 229 /**
 230  * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
 231  *
 232  * @element: Pointer to "struct list_head".
 233  *
 234  * Returns nothing.
 235  */
 236 static void tomoyo_del_manager(struct list_head *element)
 237 {
 238         struct tomoyo_manager *ptr =
 239                 container_of(element, typeof(*ptr), head.list);
 240         tomoyo_put_name(ptr->manager);
 241 }
 242
 243 /**
 244  * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
 245  *
 246  * @element: Pointer to "struct list_head".
 247  *
 248  * Returns nothing.
 249  */
 250 static void tomoyo_del_acl(struct list_head *element)
 251 {
 252         struct tomoyo_acl_info *acl =
 253                 container_of(element, typeof(*acl), list);
 254         tomoyo_put_condition(acl->cond);
 255         switch (acl->type) {
 256         case TOMOYO_TYPE_PATH_ACL:
 257                 {
 258                         struct tomoyo_path_acl *entry
 259                                 = container_of(acl, typeof(*entry), head);
 260                         tomoyo_put_name_union(&entry->name);
 261                 }
 262                 break;
 263         case TOMOYO_TYPE_PATH2_ACL:
 264                 {
 265                         struct tomoyo_path2_acl *entry
 266                                 = container_of(acl, typeof(*entry), head);
 267                         tomoyo_put_name_union(&entry->name1);
 268                         tomoyo_put_name_union(&entry->name2);
 269                 }
 270                 break;
 271         case TOMOYO_TYPE_PATH_NUMBER_ACL:
 272                 {
 273                         struct tomoyo_path_number_acl *entry
 274                                 = container_of(acl, typeof(*entry), head);
 275                         tomoyo_put_name_union(&entry->name);
 276                         tomoyo_put_number_union(&entry->number);
 277                 }
 278                 break;
 279         case TOMOYO_TYPE_MKDEV_ACL:
 280                 {
 281                         struct tomoyo_mkdev_acl *entry
 282                                 = container_of(acl, typeof(*entry), head);
 283                         tomoyo_put_name_union(&entry->name);
 284                         tomoyo_put_number_union(&entry->mode);
 285                         tomoyo_put_number_union(&entry->major);
 286                         tomoyo_put_number_union(&entry->minor);
 287                 }
 288                 break;
 289         case TOMOYO_TYPE_MOUNT_ACL:
 290                 {
 291                         struct tomoyo_mount_acl *entry
 292                                 = container_of(acl, typeof(*entry), head);
 293                         tomoyo_put_name_union(&entry->dev_name);
 294                         tomoyo_put_name_union(&entry->dir_name);
 295                         tomoyo_put_name_union(&entry->fs_type);
 296                         tomoyo_put_number_union(&entry->flags);
 297                 }
 298                 break;
 299         }
 300 }
 301
 302 /**
 303  * tomoyo_del_domain - Delete members in "struct tomoyo_domain_info".
 304  *
 305  * @element: Pointer to "struct list_head".
 306  *
 307  * Returns true if deleted, false otherwise.
 308  */
 309 static bool tomoyo_del_domain(struct list_head *element)
 310 {
 311         struct tomoyo_domain_info *domain =
 312                 container_of(element, typeof(*domain), list);
 313         struct tomoyo_acl_info *acl;
 314         struct tomoyo_acl_info *tmp;
 315         /*
 316          * Since we don't protect whole execve() operation using SRCU,
 317          * we need to recheck domain->users at this point.
 318          *
 319          * (1) Reader starts SRCU section upon execve().
 320          * (2) Reader traverses tomoyo_domain_list and finds this domain.
 321          * (3) Writer marks this domain as deleted.
 322          * (4) Garbage collector removes this domain from tomoyo_domain_list
 323          *     because this domain is marked as deleted and used by nobody.
 324          * (5) Reader saves reference to this domain into
 325          *     "struct linux_binprm"->cred->security .
 326          * (6) Reader finishes SRCU section, although execve() operation has
 327          *     not finished yet.
 328          * (7) Garbage collector waits for SRCU synchronization.
 329          * (8) Garbage collector kfree() this domain because this domain is
 330          *     used by nobody.
 331          * (9) Reader finishes execve() operation and restores this domain from
 332          *     "struct linux_binprm"->cred->security.
 333          *
 334          * By updating domain->users at (5), we can solve this race problem
 335          * by rechecking domain->users at (8).
 336          */
 337         if (atomic_read(&domain->users))
 338                 return false;
 339         list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
 340                 tomoyo_del_acl(&acl->list);
 341                 tomoyo_memory_free(acl);
 342         }
 343         tomoyo_put_name(domain->domainname);
 344         return true;
 345 }
 346
 347 /**
 348  * tomoyo_del_condition - Delete members in "struct tomoyo_condition".
 349  *
 350  * @element: Pointer to "struct list_head".
 351  *
 352  * Returns nothing.
 353  */
 354 void tomoyo_del_condition(struct list_head *element)
 355 {
 356         struct tomoyo_condition *cond = container_of(element, typeof(*cond),
 357                                                      head.list);
 358         const u16 condc = cond->condc;
 359         const u16 numbers_count = cond->numbers_count;
 360         const u16 names_count = cond->names_count;
 361         const u16 argc = cond->argc;
 362         const u16 envc = cond->envc;
 363         unsigned int i;
 364         const struct tomoyo_condition_element *condp
 365                 = (const struct tomoyo_condition_element *) (cond + 1);
 366         struct tomoyo_number_union *numbers_p
 367                 = (struct tomoyo_number_union *) (condp + condc);
 368         struct tomoyo_name_union *names_p
 369                 = (struct tomoyo_name_union *) (numbers_p + numbers_count);
 370         const struct tomoyo_argv *argv
 371                 = (const struct tomoyo_argv *) (names_p + names_count);
 372         const struct tomoyo_envp *envp
 373                 = (const struct tomoyo_envp *) (argv + argc);
 374         for (i = 0; i < numbers_count; i++)
 375                 tomoyo_put_number_union(numbers_p++);
 376         for (i = 0; i < names_count; i++)
 377                 tomoyo_put_name_union(names_p++);
 378         for (i = 0; i < argc; argv++, i++)
 379                 tomoyo_put_name(argv->value);
 380         for (i = 0; i < envc; envp++, i++) {
 381                 tomoyo_put_name(envp->name);
 382                 tomoyo_put_name(envp->value);
 383         }
 384 }
 385
 386 /**
 387  * tomoyo_del_name - Delete members in "struct tomoyo_name".
 388  *
 389  * @element: Pointer to "struct list_head".
 390  *
 391  * Returns nothing.
 392  */
 393 static void tomoyo_del_name(struct list_head *element)
 394 {
 395         const struct tomoyo_name *ptr =
 396                 container_of(element, typeof(*ptr), head.list);
 397 }
 398
 399 /**
 400  * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
 401  *
 402  * @element: Pointer to "struct list_head".
 403  *
 404  * Returns nothing.
 405  */
 406 static void tomoyo_del_path_group(struct list_head *element)
 407 {
 408         struct tomoyo_path_group *member =
 409                 container_of(element, typeof(*member), head.list);
 410         tomoyo_put_name(member->member_name);
 411 }
 412
 413 /**
 414  * tomoyo_del_group - Delete "struct tomoyo_group".
 415  *
 416  * @element: Pointer to "struct list_head".
 417  *
 418  * Returns nothing.
 419  */
 420 static void tomoyo_del_group(struct list_head *element)
 421 {
 422         struct tomoyo_group *group =
 423                 container_of(element, typeof(*group), head.list);
 424         tomoyo_put_name(group->group_name);
 425 }
 426
 427 /**
 428  * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
 429  *
 430  * @element: Pointer to "struct list_head".
 431  *
 432  * Returns nothing.
 433  */
 434 static void tomoyo_del_number_group(struct list_head *element)
 435 {
 436         struct tomoyo_number_group *member =
 437                 container_of(element, typeof(*member), head.list);
 438 }
 439
 440 /**
 441  * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
 442  *
 443  * @id:          One of values in "enum tomoyo_policy_id".
 444  * @member_list: Pointer to "struct list_head".
 445  *
 446  * Returns true if some elements are deleted, false otherwise.
 447  */
 448 static bool tomoyo_collect_member(const enum tomoyo_policy_id id,
 449                                   struct list_head *member_list)
 450 {
 451         struct tomoyo_acl_head *member;
 452         list_for_each_entry(member, member_list, list) {
 453                 if (!member->is_deleted)
 454                         continue;
 455                 if (!tomoyo_add_to_gc(id, &member->list))
 456                         return false;
 457         }
 458         return true;
 459 }
 460
 461 /**
 462  * tomoyo_collect_acl - Delete elements in "struct tomoyo_domain_info".
 463  *
 464  * @list: Pointer to "struct list_head".
 465  *
 466  * Returns true if some elements are deleted, false otherwise.
 467  */
 468 static bool tomoyo_collect_acl(struct list_head *list)
 469 {
 470         struct tomoyo_acl_info *acl;
 471         list_for_each_entry(acl, list, list) {
 472                 if (!acl->is_deleted)
 473                         continue;
 474                 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
 475                         return false;
 476         }
 477         return true;
 478 }
 479
 480 /**
 481  * tomoyo_collect_entry - Scan lists for deleted elements.
 482  *
 483  * Returns nothing.
 484  */
 485 static void tomoyo_collect_entry(void)
 486 {
 487         int i;
 488         enum tomoyo_policy_id id;
 489         struct tomoyo_policy_namespace *ns;
 490         int idx;
 491         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 492                 return;
 493         idx = tomoyo_read_lock();
 494         {
 495                 struct tomoyo_domain_info *domain;
 496                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 497                         if (!tomoyo_collect_acl(&domain->acl_info_list))
 498                                 goto unlock;
 499                         if (!domain->is_deleted || atomic_read(&domain->users))
 500                                 continue;
 501                         /*
 502                          * Nobody is referring this domain. But somebody may
 503                          * refer this domain after successful execve().
 504                          * We recheck domain->users after SRCU synchronization.
 505                          */
 506                         if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
 507                                 goto unlock;
 508                 }
 509         }
 510         list_for_each_entry_rcu(ns, &tomoyo_namespace_list, namespace_list) {
 511                 for (id = 0; id < TOMOYO_MAX_POLICY; id++)
 512                         if (!tomoyo_collect_member(id, &ns->policy_list[id]))
 513                                 goto unlock;
 514                 for (i = 0; i < TOMOYO_MAX_ACL_GROUPS; i++)
 515                         if (!tomoyo_collect_acl(&ns->acl_group[i]))
 516                                 goto unlock;
 517                 for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
 518                         struct list_head *list = &ns->group_list[i];
 519                         struct tomoyo_group *group;
 520                         switch (i) {
 521                         case 0:
 522                                 id = TOMOYO_ID_PATH_GROUP;
 523                                 break;
 524                         default:
 525                                 id = TOMOYO_ID_NUMBER_GROUP;
 526                                 break;
 527                         }
 528                         list_for_each_entry(group, list, head.list) {
 529                                 if (!tomoyo_collect_member
 530                                     (id, &group->member_list))
 531                                         goto unlock;
 532                                 if (!list_empty(&group->member_list) ||
 533                                     atomic_read(&group->head.users))
 534                                         continue;
 535                                 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP,
 536                                                       &group->head.list))
 537                                         goto unlock;
 538                         }
 539                 }
 540         }
 541         id = TOMOYO_ID_CONDITION;
 542         for (i = 0; i < TOMOYO_MAX_HASH + 1; i++) {
 543                 struct list_head *list = !i ?
 544                         &tomoyo_condition_list : &tomoyo_name_list[i - 1];
 545                 struct tomoyo_shared_acl_head *ptr;
 546                 list_for_each_entry(ptr, list, list) {
 547                         if (atomic_read(&ptr->users))
 548                                 continue;
 549                         if (!tomoyo_add_to_gc(id, &ptr->list))
 550                                 goto unlock;
 551                 }
 552                 id = TOMOYO_ID_NAME;
 553         }
 554 unlock:
 555         tomoyo_read_unlock(idx);
 556         mutex_unlock(&tomoyo_policy_lock);
 557 }
 558
 559 /**
 560  * tomoyo_kfree_entry - Delete entries in tomoyo_gc_list.
 561  *
 562  * Returns true if some entries were kfree()d, false otherwise.
 563  */
 564 static bool tomoyo_kfree_entry(void)
 565 {
 566         struct tomoyo_gc *p;
 567         struct tomoyo_gc *tmp;
 568         bool result = false;
 569
 570         list_for_each_entry_safe(p, tmp, &tomoyo_gc_list, list) {
 571                 struct list_head *element = p->element;
 572
 573                 /*
 574                  * list_del_rcu() in tomoyo_add_to_gc() guarantees that the
 575                  * list element became no longer reachable from the list which
 576                  * the element was originally on (e.g. tomoyo_domain_list).
 577                  * Also, synchronize_srcu() in tomoyo_gc_thread() guarantees
 578                  * that the list element became no longer referenced by syscall
 579                  * users.
 580                  *
 581                  * However, there are three users which may still be using the
 582                  * list element. We need to defer until all of these users
 583                  * forget the list element.
 584                  *
 585                  * Firstly, defer until "struct tomoyo_io_buffer"->r.{domain,
 586                  * group,acl} and "struct tomoyo_io_buffer"->w.domain forget
 587                  * the list element.
 588                  */
 589                 if (tomoyo_struct_used_by_io_buffer(element))
 590                         continue;
 591                 /*
 592                  * Secondly, defer until all other elements in the
 593                  * tomoyo_gc_list list forget the list element.
 594                  */
 595                 if (tomoyo_element_linked_by_gc((const u8 *) element, p->size))
 596                         continue;
 597                 switch (p->type) {
 598                 case TOMOYO_ID_TRANSITION_CONTROL:
 599                         tomoyo_del_transition_control(element);
 600                         break;
 601                 case TOMOYO_ID_AGGREGATOR:
 602                         tomoyo_del_aggregator(element);
 603                         break;
 604                 case TOMOYO_ID_MANAGER:
 605                         tomoyo_del_manager(element);
 606                         break;
 607                 case TOMOYO_ID_CONDITION:
 608                         tomoyo_del_condition(element);
 609                         break;
 610                 case TOMOYO_ID_NAME:
 611                         /*
 612                          * Thirdly, defer until all "struct tomoyo_io_buffer"
 613                          * ->r.w[] forget the list element.
 614                          */
 615                         if (tomoyo_name_used_by_io_buffer(
 616                             container_of(element, typeof(struct tomoyo_name),
 617                                          head.list)->entry.name, p->size))
 618                                 continue;
 619                         tomoyo_del_name(element);
 620                         break;
 621                 case TOMOYO_ID_ACL:
 622                         tomoyo_del_acl(element);
 623                         break;
 624                 case TOMOYO_ID_DOMAIN:
 625                         if (!tomoyo_del_domain(element))
 626                                 continue;
 627                         break;
 628                 case TOMOYO_ID_PATH_GROUP:
 629                         tomoyo_del_path_group(element);
 630                         break;
 631                 case TOMOYO_ID_GROUP:
 632                         tomoyo_del_group(element);
 633                         break;
 634                 case TOMOYO_ID_NUMBER_GROUP:
 635                         tomoyo_del_number_group(element);
 636                         break;
 637                 case TOMOYO_MAX_POLICY:
 638                         break;
 639                 }
 640                 tomoyo_memory_free(element);
 641                 list_del(&p->list);
 642                 kfree(p);
 643                 tomoyo_gc_list_len--;
 644                 result = true;
 645         }
 646         return result;
 647 }
 648
 649 /**
 650  * tomoyo_gc_thread - Garbage collector thread function.
 651  *
 652  * @unused: Unused.
 653  *
 654  * In case OOM-killer choose this thread for termination, we create this thread
 655  * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
 656  * close()d.
 657  *
 658  * Returns 0.
 659  */
 660 static int tomoyo_gc_thread(void *unused)
 661 {
 662         /* Garbage collector thread is exclusive. */
 663         static DEFINE_MUTEX(tomoyo_gc_mutex);
 664         if (!mutex_trylock(&tomoyo_gc_mutex))
 665                 goto out;
 666         daemonize("GC for TOMOYO");
 667         do {
 668                 tomoyo_collect_entry();
 669                 if (list_empty(&tomoyo_gc_list))
 670                         break;
 671                 synchronize_srcu(&tomoyo_ss);
 672         } while (tomoyo_kfree_entry());
 673         {
 674                 struct tomoyo_io_buffer *head;
 675                 struct tomoyo_io_buffer *tmp;
 676
 677                 spin_lock(&tomoyo_io_buffer_list_lock);
 678                 list_for_each_entry_safe(head, tmp, &tomoyo_io_buffer_list,
 679                                          list) {
 680                         if (head->users)
 681                                 continue;
 682                         list_del(&head->list);
 683                         kfree(head->read_buf);
 684                         kfree(head->write_buf);
 685                         kfree(head);
 686                 }
 687                 spin_unlock(&tomoyo_io_buffer_list_lock);
 688         }
 689         mutex_unlock(&tomoyo_gc_mutex);
 690 out:
 691         /* This acts as do_exit(0). */
 692         return 0;
 693 }
 694
 695 /**
 696  * tomoyo_notify_gc - Register/unregister /sys/kernel/security/tomoyo/ users.
 697  *
 698  * @head:        Pointer to "struct tomoyo_io_buffer".
 699  * @is_register: True if register, false if unregister.
 700  *
 701  * Returns nothing.
 702  */
 703 void tomoyo_notify_gc(struct tomoyo_io_buffer *head, const bool is_register)
 704 {
 705         bool is_write = false;
 706
 707         spin_lock(&tomoyo_io_buffer_list_lock);
 708         if (is_register) {
 709                 head->users = 1;
 710                 list_add(&head->list, &tomoyo_io_buffer_list);
 711         } else {
 712                 is_write = head->write_buf != NULL;
 713                 if (!--head->users) {
 714                         list_del(&head->list);
 715                         kfree(head->read_buf);
 716                         kfree(head->write_buf);
 717                         kfree(head);
 718                 }
 719         }
 720         spin_unlock(&tomoyo_io_buffer_list_lock);
 721         if (is_write) {
 722                 struct task_struct *task = kthread_create(tomoyo_gc_thread,
 723                                                           NULL,
 724                                                           "GC for TOMOYO");
 725                 if (!IS_ERR(task))
 726                         wake_up_process(task);
 727         }
 728 }