4 * Implementation of the Domain-Based Mandatory Access Control.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
11 #include <linux/kthread.h>
12 #include <linux/slab.h>
14 /* The list for "struct tomoyo_io_buffer". */
15 static LIST_HEAD(tomoyo_io_buffer_list
);
16 /* Lock for protecting tomoyo_io_buffer_list. */
17 static DEFINE_SPINLOCK(tomoyo_io_buffer_list_lock
);
19 /* Size of an element. */
20 static const u8 tomoyo_element_size
[TOMOYO_MAX_POLICY
] = {
21 [TOMOYO_ID_GROUP
] = sizeof(struct tomoyo_group
),
22 [TOMOYO_ID_PATH_GROUP
] = sizeof(struct tomoyo_path_group
),
23 [TOMOYO_ID_NUMBER_GROUP
] = sizeof(struct tomoyo_number_group
),
24 [TOMOYO_ID_AGGREGATOR
] = sizeof(struct tomoyo_aggregator
),
25 [TOMOYO_ID_TRANSITION_CONTROL
] =
26 sizeof(struct tomoyo_transition_control
),
27 [TOMOYO_ID_MANAGER
] = sizeof(struct tomoyo_manager
),
28 /* [TOMOYO_ID_CONDITION] = "struct tomoyo_condition"->size, */
29 /* [TOMOYO_ID_NAME] = "struct tomoyo_name"->size, */
31 tomoyo_acl_size["struct tomoyo_acl_info"->type], */
32 [TOMOYO_ID_DOMAIN
] = sizeof(struct tomoyo_domain_info
),
35 /* Size of a domain ACL element. */
36 static const u8 tomoyo_acl_size
[] = {
37 [TOMOYO_TYPE_PATH_ACL
] = sizeof(struct tomoyo_path_acl
),
38 [TOMOYO_TYPE_PATH2_ACL
] = sizeof(struct tomoyo_path2_acl
),
39 [TOMOYO_TYPE_PATH_NUMBER_ACL
] = sizeof(struct tomoyo_path_number_acl
),
40 [TOMOYO_TYPE_MKDEV_ACL
] = sizeof(struct tomoyo_mkdev_acl
),
41 [TOMOYO_TYPE_MOUNT_ACL
] = sizeof(struct tomoyo_mount_acl
),
45 * tomoyo_struct_used_by_io_buffer - Check whether the list element is used by /sys/kernel/security/tomoyo/ users or not.
47 * @element: Pointer to "struct list_head".
49 * Returns true if @element is used by /sys/kernel/security/tomoyo/ users,
52 static bool tomoyo_struct_used_by_io_buffer(const struct list_head
*element
)
54 struct tomoyo_io_buffer
*head
;
57 spin_lock(&tomoyo_io_buffer_list_lock
);
58 list_for_each_entry(head
, &tomoyo_io_buffer_list
, list
) {
60 spin_unlock(&tomoyo_io_buffer_list_lock
);
61 if (mutex_lock_interruptible(&head
->io_sem
)) {
65 if (head
->r
.domain
== element
|| head
->r
.group
== element
||
66 head
->r
.acl
== element
|| &head
->w
.domain
->list
== element
)
68 mutex_unlock(&head
->io_sem
);
70 spin_lock(&tomoyo_io_buffer_list_lock
);
75 spin_unlock(&tomoyo_io_buffer_list_lock
);
80 * tomoyo_name_used_by_io_buffer - Check whether the string is used by /sys/kernel/security/tomoyo/ users or not.
82 * @string: String to check.
83 * @size: Memory allocated for @string .
85 * Returns true if @string is used by /sys/kernel/security/tomoyo/ users,
88 static bool tomoyo_name_used_by_io_buffer(const char *string
,
91 struct tomoyo_io_buffer
*head
;
94 spin_lock(&tomoyo_io_buffer_list_lock
);
95 list_for_each_entry(head
, &tomoyo_io_buffer_list
, list
) {
98 spin_unlock(&tomoyo_io_buffer_list_lock
);
99 if (mutex_lock_interruptible(&head
->io_sem
)) {
103 for (i
= 0; i
< TOMOYO_MAX_IO_READ_QUEUE
; i
++) {
104 const char *w
= head
->r
.w
[i
];
105 if (w
< string
|| w
> string
+ size
)
110 mutex_unlock(&head
->io_sem
);
112 spin_lock(&tomoyo_io_buffer_list_lock
);
117 spin_unlock(&tomoyo_io_buffer_list_lock
);
121 /* Structure for garbage collection. */
123 struct list_head list
;
124 enum tomoyo_policy_id type
;
126 struct list_head
*element
;
128 /* List of entries to be deleted. */
129 static LIST_HEAD(tomoyo_gc_list
);
130 /* Length of tomoyo_gc_list. */
131 static int tomoyo_gc_list_len
;
134 * tomoyo_add_to_gc - Add an entry to to be deleted list.
136 * @type: One of values in "enum tomoyo_policy_id".
137 * @element: Pointer to "struct list_head".
139 * Returns true on success, false otherwise.
141 * Caller holds tomoyo_policy_lock mutex.
143 * Adding an entry needs kmalloc(). Thus, if we try to add thousands of
144 * entries at once, it will take too long time. Thus, do not add more than 128
145 * entries per a scan. But to be able to handle worst case where all entries
146 * are in-use, we accept one more entry per a scan.
148 * If we use singly linked list using "struct list_head"->prev (which is
149 * LIST_POISON2), we can avoid kmalloc().
151 static bool tomoyo_add_to_gc(const int type
, struct list_head
*element
)
153 struct tomoyo_gc
*entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
157 if (type
== TOMOYO_ID_ACL
)
158 entry
->size
= tomoyo_acl_size
[
159 container_of(element
,
160 typeof(struct tomoyo_acl_info
),
162 else if (type
== TOMOYO_ID_NAME
)
163 entry
->size
= strlen(container_of(element
,
164 typeof(struct tomoyo_name
),
165 head
.list
)->entry
.name
) + 1;
166 else if (type
== TOMOYO_ID_CONDITION
)
168 container_of(element
, typeof(struct tomoyo_condition
),
171 entry
->size
= tomoyo_element_size
[type
];
172 entry
->element
= element
;
173 list_add(&entry
->list
, &tomoyo_gc_list
);
174 list_del_rcu(element
);
175 return tomoyo_gc_list_len
++ < 128;
179 * tomoyo_element_linked_by_gc - Validate next element of an entry.
181 * @element: Pointer to an element.
182 * @size: Size of @element in byte.
184 * Returns true if @element is linked by other elements in the garbage
185 * collector's queue, false otherwise.
187 static bool tomoyo_element_linked_by_gc(const u8
*element
, const size_t size
)
190 list_for_each_entry(p
, &tomoyo_gc_list
, list
) {
191 const u8
*ptr
= (const u8
*) p
->element
->next
;
192 if (ptr
< element
|| element
+ size
< ptr
)
200 * tomoyo_del_transition_control - Delete members in "struct tomoyo_transition_control".
202 * @element: Pointer to "struct list_head".
206 static void tomoyo_del_transition_control(struct list_head
*element
)
208 struct tomoyo_transition_control
*ptr
=
209 container_of(element
, typeof(*ptr
), head
.list
);
210 tomoyo_put_name(ptr
->domainname
);
211 tomoyo_put_name(ptr
->program
);
215 * tomoyo_del_aggregator - Delete members in "struct tomoyo_aggregator".
217 * @element: Pointer to "struct list_head".
221 static void tomoyo_del_aggregator(struct list_head
*element
)
223 struct tomoyo_aggregator
*ptr
=
224 container_of(element
, typeof(*ptr
), head
.list
);
225 tomoyo_put_name(ptr
->original_name
);
226 tomoyo_put_name(ptr
->aggregated_name
);
230 * tomoyo_del_manager - Delete members in "struct tomoyo_manager".
232 * @element: Pointer to "struct list_head".
236 static void tomoyo_del_manager(struct list_head
*element
)
238 struct tomoyo_manager
*ptr
=
239 container_of(element
, typeof(*ptr
), head
.list
);
240 tomoyo_put_name(ptr
->manager
);
244 * tomoyo_del_acl - Delete members in "struct tomoyo_acl_info".
246 * @element: Pointer to "struct list_head".
250 static void tomoyo_del_acl(struct list_head
*element
)
252 struct tomoyo_acl_info
*acl
=
253 container_of(element
, typeof(*acl
), list
);
254 tomoyo_put_condition(acl
->cond
);
256 case TOMOYO_TYPE_PATH_ACL
:
258 struct tomoyo_path_acl
*entry
259 = container_of(acl
, typeof(*entry
), head
);
260 tomoyo_put_name_union(&entry
->name
);
263 case TOMOYO_TYPE_PATH2_ACL
:
265 struct tomoyo_path2_acl
*entry
266 = container_of(acl
, typeof(*entry
), head
);
267 tomoyo_put_name_union(&entry
->name1
);
268 tomoyo_put_name_union(&entry
->name2
);
271 case TOMOYO_TYPE_PATH_NUMBER_ACL
:
273 struct tomoyo_path_number_acl
*entry
274 = container_of(acl
, typeof(*entry
), head
);
275 tomoyo_put_name_union(&entry
->name
);
276 tomoyo_put_number_union(&entry
->number
);
279 case TOMOYO_TYPE_MKDEV_ACL
:
281 struct tomoyo_mkdev_acl
*entry
282 = container_of(acl
, typeof(*entry
), head
);
283 tomoyo_put_name_union(&entry
->name
);
284 tomoyo_put_number_union(&entry
->mode
);
285 tomoyo_put_number_union(&entry
->major
);
286 tomoyo_put_number_union(&entry
->minor
);
289 case TOMOYO_TYPE_MOUNT_ACL
:
291 struct tomoyo_mount_acl
*entry
292 = container_of(acl
, typeof(*entry
), head
);
293 tomoyo_put_name_union(&entry
->dev_name
);
294 tomoyo_put_name_union(&entry
->dir_name
);
295 tomoyo_put_name_union(&entry
->fs_type
);
296 tomoyo_put_number_union(&entry
->flags
);
303 * tomoyo_del_domain - Delete members in "struct tomoyo_domain_info".
305 * @element: Pointer to "struct list_head".
307 * Returns true if deleted, false otherwise.
309 static bool tomoyo_del_domain(struct list_head
*element
)
311 struct tomoyo_domain_info
*domain
=
312 container_of(element
, typeof(*domain
), list
);
313 struct tomoyo_acl_info
*acl
;
314 struct tomoyo_acl_info
*tmp
;
316 * Since we don't protect whole execve() operation using SRCU,
317 * we need to recheck domain->users at this point.
319 * (1) Reader starts SRCU section upon execve().
320 * (2) Reader traverses tomoyo_domain_list and finds this domain.
321 * (3) Writer marks this domain as deleted.
322 * (4) Garbage collector removes this domain from tomoyo_domain_list
323 * because this domain is marked as deleted and used by nobody.
324 * (5) Reader saves reference to this domain into
325 * "struct linux_binprm"->cred->security .
326 * (6) Reader finishes SRCU section, although execve() operation has
328 * (7) Garbage collector waits for SRCU synchronization.
329 * (8) Garbage collector kfree() this domain because this domain is
331 * (9) Reader finishes execve() operation and restores this domain from
332 * "struct linux_binprm"->cred->security.
334 * By updating domain->users at (5), we can solve this race problem
335 * by rechecking domain->users at (8).
337 if (atomic_read(&domain
->users
))
339 list_for_each_entry_safe(acl
, tmp
, &domain
->acl_info_list
, list
) {
340 tomoyo_del_acl(&acl
->list
);
341 tomoyo_memory_free(acl
);
343 tomoyo_put_name(domain
->domainname
);
348 * tomoyo_del_condition - Delete members in "struct tomoyo_condition".
350 * @element: Pointer to "struct list_head".
354 void tomoyo_del_condition(struct list_head
*element
)
356 struct tomoyo_condition
*cond
= container_of(element
, typeof(*cond
),
358 const u16 condc
= cond
->condc
;
359 const u16 numbers_count
= cond
->numbers_count
;
361 const struct tomoyo_condition_element
*condp
362 = (const struct tomoyo_condition_element
*) (cond
+ 1);
363 struct tomoyo_number_union
*numbers_p
364 = (struct tomoyo_number_union
*) (condp
+ condc
);
365 for (i
= 0; i
< numbers_count
; i
++)
366 tomoyo_put_number_union(numbers_p
++);
370 * tomoyo_del_name - Delete members in "struct tomoyo_name".
372 * @element: Pointer to "struct list_head".
376 static void tomoyo_del_name(struct list_head
*element
)
378 const struct tomoyo_name
*ptr
=
379 container_of(element
, typeof(*ptr
), head
.list
);
383 * tomoyo_del_path_group - Delete members in "struct tomoyo_path_group".
385 * @element: Pointer to "struct list_head".
389 static void tomoyo_del_path_group(struct list_head
*element
)
391 struct tomoyo_path_group
*member
=
392 container_of(element
, typeof(*member
), head
.list
);
393 tomoyo_put_name(member
->member_name
);
397 * tomoyo_del_group - Delete "struct tomoyo_group".
399 * @element: Pointer to "struct list_head".
403 static void tomoyo_del_group(struct list_head
*element
)
405 struct tomoyo_group
*group
=
406 container_of(element
, typeof(*group
), head
.list
);
407 tomoyo_put_name(group
->group_name
);
411 * tomoyo_del_number_group - Delete members in "struct tomoyo_number_group".
413 * @element: Pointer to "struct list_head".
417 static void tomoyo_del_number_group(struct list_head
*element
)
419 struct tomoyo_number_group
*member
=
420 container_of(element
, typeof(*member
), head
.list
);
424 * tomoyo_collect_member - Delete elements with "struct tomoyo_acl_head".
426 * @id: One of values in "enum tomoyo_policy_id".
427 * @member_list: Pointer to "struct list_head".
429 * Returns true if some elements are deleted, false otherwise.
431 static bool tomoyo_collect_member(const enum tomoyo_policy_id id
,
432 struct list_head
*member_list
)
434 struct tomoyo_acl_head
*member
;
435 list_for_each_entry(member
, member_list
, list
) {
436 if (!member
->is_deleted
)
438 if (!tomoyo_add_to_gc(id
, &member
->list
))
445 * tomoyo_collect_acl - Delete elements in "struct tomoyo_domain_info".
447 * @list: Pointer to "struct list_head".
449 * Returns true if some elements are deleted, false otherwise.
451 static bool tomoyo_collect_acl(struct list_head
*list
)
453 struct tomoyo_acl_info
*acl
;
454 list_for_each_entry(acl
, list
, list
) {
455 if (!acl
->is_deleted
)
457 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL
, &acl
->list
))
464 * tomoyo_collect_entry - Scan lists for deleted elements.
468 static void tomoyo_collect_entry(void)
471 enum tomoyo_policy_id id
;
472 struct tomoyo_policy_namespace
*ns
;
474 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
476 idx
= tomoyo_read_lock();
478 struct tomoyo_domain_info
*domain
;
479 list_for_each_entry_rcu(domain
, &tomoyo_domain_list
, list
) {
480 if (!tomoyo_collect_acl(&domain
->acl_info_list
))
482 if (!domain
->is_deleted
|| atomic_read(&domain
->users
))
485 * Nobody is referring this domain. But somebody may
486 * refer this domain after successful execve().
487 * We recheck domain->users after SRCU synchronization.
489 if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN
, &domain
->list
))
493 list_for_each_entry_rcu(ns
, &tomoyo_namespace_list
, namespace_list
) {
494 for (id
= 0; id
< TOMOYO_MAX_POLICY
; id
++)
495 if (!tomoyo_collect_member(id
, &ns
->policy_list
[id
]))
497 for (i
= 0; i
< TOMOYO_MAX_ACL_GROUPS
; i
++)
498 if (!tomoyo_collect_acl(&ns
->acl_group
[i
]))
500 for (i
= 0; i
< TOMOYO_MAX_GROUP
; i
++) {
501 struct list_head
*list
= &ns
->group_list
[i
];
502 struct tomoyo_group
*group
;
505 id
= TOMOYO_ID_PATH_GROUP
;
508 id
= TOMOYO_ID_NUMBER_GROUP
;
511 list_for_each_entry(group
, list
, head
.list
) {
512 if (!tomoyo_collect_member
513 (id
, &group
->member_list
))
515 if (!list_empty(&group
->member_list
) ||
516 atomic_read(&group
->head
.users
))
518 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP
,
524 id
= TOMOYO_ID_CONDITION
;
525 for (i
= 0; i
< TOMOYO_MAX_HASH
+ 1; i
++) {
526 struct list_head
*list
= !i
?
527 &tomoyo_condition_list
: &tomoyo_name_list
[i
- 1];
528 struct tomoyo_shared_acl_head
*ptr
;
529 list_for_each_entry(ptr
, list
, list
) {
530 if (atomic_read(&ptr
->users
))
532 if (!tomoyo_add_to_gc(id
, &ptr
->list
))
538 tomoyo_read_unlock(idx
);
539 mutex_unlock(&tomoyo_policy_lock
);
543 * tomoyo_kfree_entry - Delete entries in tomoyo_gc_list.
545 * Returns true if some entries were kfree()d, false otherwise.
547 static bool tomoyo_kfree_entry(void)
550 struct tomoyo_gc
*tmp
;
553 list_for_each_entry_safe(p
, tmp
, &tomoyo_gc_list
, list
) {
554 struct list_head
*element
= p
->element
;
557 * list_del_rcu() in tomoyo_add_to_gc() guarantees that the
558 * list element became no longer reachable from the list which
559 * the element was originally on (e.g. tomoyo_domain_list).
560 * Also, synchronize_srcu() in tomoyo_gc_thread() guarantees
561 * that the list element became no longer referenced by syscall
564 * However, there are three users which may still be using the
565 * list element. We need to defer until all of these users
566 * forget the list element.
568 * Firstly, defer until "struct tomoyo_io_buffer"->r.{domain,
569 * group,acl} and "struct tomoyo_io_buffer"->w.domain forget
572 if (tomoyo_struct_used_by_io_buffer(element
))
575 * Secondly, defer until all other elements in the
576 * tomoyo_gc_list list forget the list element.
578 if (tomoyo_element_linked_by_gc((const u8
*) element
, p
->size
))
581 case TOMOYO_ID_TRANSITION_CONTROL
:
582 tomoyo_del_transition_control(element
);
584 case TOMOYO_ID_AGGREGATOR
:
585 tomoyo_del_aggregator(element
);
587 case TOMOYO_ID_MANAGER
:
588 tomoyo_del_manager(element
);
590 case TOMOYO_ID_CONDITION
:
591 tomoyo_del_condition(element
);
595 * Thirdly, defer until all "struct tomoyo_io_buffer"
596 * ->r.w[] forget the list element.
598 if (tomoyo_name_used_by_io_buffer(
599 container_of(element
, typeof(struct tomoyo_name
),
600 head
.list
)->entry
.name
, p
->size
))
602 tomoyo_del_name(element
);
605 tomoyo_del_acl(element
);
607 case TOMOYO_ID_DOMAIN
:
608 if (!tomoyo_del_domain(element
))
611 case TOMOYO_ID_PATH_GROUP
:
612 tomoyo_del_path_group(element
);
614 case TOMOYO_ID_GROUP
:
615 tomoyo_del_group(element
);
617 case TOMOYO_ID_NUMBER_GROUP
:
618 tomoyo_del_number_group(element
);
620 case TOMOYO_MAX_POLICY
:
623 tomoyo_memory_free(element
);
626 tomoyo_gc_list_len
--;
633 * tomoyo_gc_thread - Garbage collector thread function.
637 * In case OOM-killer choose this thread for termination, we create this thread
638 * as a short live thread whenever /sys/kernel/security/tomoyo/ interface was
643 static int tomoyo_gc_thread(void *unused
)
645 /* Garbage collector thread is exclusive. */
646 static DEFINE_MUTEX(tomoyo_gc_mutex
);
647 if (!mutex_trylock(&tomoyo_gc_mutex
))
649 daemonize("GC for TOMOYO");
651 tomoyo_collect_entry();
652 if (list_empty(&tomoyo_gc_list
))
654 synchronize_srcu(&tomoyo_ss
);
655 } while (tomoyo_kfree_entry());
657 struct tomoyo_io_buffer
*head
;
658 struct tomoyo_io_buffer
*tmp
;
660 spin_lock(&tomoyo_io_buffer_list_lock
);
661 list_for_each_entry_safe(head
, tmp
, &tomoyo_io_buffer_list
,
665 list_del(&head
->list
);
666 kfree(head
->read_buf
);
667 kfree(head
->write_buf
);
670 spin_unlock(&tomoyo_io_buffer_list_lock
);
672 mutex_unlock(&tomoyo_gc_mutex
);
674 /* This acts as do_exit(0). */
679 * tomoyo_notify_gc - Register/unregister /sys/kernel/security/tomoyo/ users.
681 * @head: Pointer to "struct tomoyo_io_buffer".
682 * @is_register: True if register, false if unregister.
686 void tomoyo_notify_gc(struct tomoyo_io_buffer
*head
, const bool is_register
)
688 bool is_write
= false;
690 spin_lock(&tomoyo_io_buffer_list_lock
);
693 list_add(&head
->list
, &tomoyo_io_buffer_list
);
695 is_write
= head
->write_buf
!= NULL
;
696 if (!--head
->users
) {
697 list_del(&head
->list
);
698 kfree(head
->read_buf
);
699 kfree(head
->write_buf
);
703 spin_unlock(&tomoyo_io_buffer_list_lock
);
705 struct task_struct
*task
= kthread_create(tomoyo_gc_thread
,
709 wake_up_process(task
);