4 * Implementation of the Domain-Based Mandatory Access Control.
6 * Copyright (C) 2005-2010 NTT DATA CORPORATION
11 #include <linux/kthread.h>
12 #include <linux/slab.h>
15 struct list_head list
;
17 struct list_head
*element
;
19 static LIST_HEAD(tomoyo_gc_queue
);
20 static DEFINE_MUTEX(tomoyo_gc_mutex
);
22 /* Caller holds tomoyo_policy_lock mutex. */
23 static bool tomoyo_add_to_gc(const int type
, struct list_head
*element
)
25 struct tomoyo_gc
*entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
29 entry
->element
= element
;
30 list_add(&entry
->list
, &tomoyo_gc_queue
);
31 list_del_rcu(element
);
35 static void tomoyo_del_transition_control(struct list_head
*element
)
37 struct tomoyo_transition_control
*ptr
=
38 container_of(element
, typeof(*ptr
), head
.list
);
39 tomoyo_put_name(ptr
->domainname
);
40 tomoyo_put_name(ptr
->program
);
43 static void tomoyo_del_aggregator(struct list_head
*element
)
45 struct tomoyo_aggregator
*ptr
=
46 container_of(element
, typeof(*ptr
), head
.list
);
47 tomoyo_put_name(ptr
->original_name
);
48 tomoyo_put_name(ptr
->aggregated_name
);
51 static void tomoyo_del_manager(struct list_head
*element
)
53 struct tomoyo_manager
*ptr
=
54 container_of(element
, typeof(*ptr
), head
.list
);
55 tomoyo_put_name(ptr
->manager
);
58 static void tomoyo_del_acl(struct list_head
*element
)
60 struct tomoyo_acl_info
*acl
=
61 container_of(element
, typeof(*acl
), list
);
63 case TOMOYO_TYPE_PATH_ACL
:
65 struct tomoyo_path_acl
*entry
66 = container_of(acl
, typeof(*entry
), head
);
67 tomoyo_put_name_union(&entry
->name
);
70 case TOMOYO_TYPE_PATH2_ACL
:
72 struct tomoyo_path2_acl
*entry
73 = container_of(acl
, typeof(*entry
), head
);
74 tomoyo_put_name_union(&entry
->name1
);
75 tomoyo_put_name_union(&entry
->name2
);
78 case TOMOYO_TYPE_PATH_NUMBER_ACL
:
80 struct tomoyo_path_number_acl
*entry
81 = container_of(acl
, typeof(*entry
), head
);
82 tomoyo_put_name_union(&entry
->name
);
83 tomoyo_put_number_union(&entry
->number
);
86 case TOMOYO_TYPE_MKDEV_ACL
:
88 struct tomoyo_mkdev_acl
*entry
89 = container_of(acl
, typeof(*entry
), head
);
90 tomoyo_put_name_union(&entry
->name
);
91 tomoyo_put_number_union(&entry
->mode
);
92 tomoyo_put_number_union(&entry
->major
);
93 tomoyo_put_number_union(&entry
->minor
);
96 case TOMOYO_TYPE_MOUNT_ACL
:
98 struct tomoyo_mount_acl
*entry
99 = container_of(acl
, typeof(*entry
), head
);
100 tomoyo_put_name_union(&entry
->dev_name
);
101 tomoyo_put_name_union(&entry
->dir_name
);
102 tomoyo_put_name_union(&entry
->fs_type
);
103 tomoyo_put_number_union(&entry
->flags
);
109 static bool tomoyo_del_domain(struct list_head
*element
)
111 struct tomoyo_domain_info
*domain
=
112 container_of(element
, typeof(*domain
), list
);
113 struct tomoyo_acl_info
*acl
;
114 struct tomoyo_acl_info
*tmp
;
116 * Since we don't protect whole execve() operation using SRCU,
117 * we need to recheck domain->users at this point.
119 * (1) Reader starts SRCU section upon execve().
120 * (2) Reader traverses tomoyo_domain_list and finds this domain.
121 * (3) Writer marks this domain as deleted.
122 * (4) Garbage collector removes this domain from tomoyo_domain_list
123 * because this domain is marked as deleted and used by nobody.
124 * (5) Reader saves reference to this domain into
125 * "struct linux_binprm"->cred->security .
126 * (6) Reader finishes SRCU section, although execve() operation has
128 * (7) Garbage collector waits for SRCU synchronization.
129 * (8) Garbage collector kfree() this domain because this domain is
131 * (9) Reader finishes execve() operation and restores this domain from
132 * "struct linux_binprm"->cred->security.
134 * By updating domain->users at (5), we can solve this race problem
135 * by rechecking domain->users at (8).
137 if (atomic_read(&domain
->users
))
139 list_for_each_entry_safe(acl
, tmp
, &domain
->acl_info_list
, list
) {
140 tomoyo_del_acl(&acl
->list
);
141 tomoyo_memory_free(acl
);
143 tomoyo_put_name(domain
->domainname
);
148 static void tomoyo_del_name(struct list_head
*element
)
150 const struct tomoyo_name
*ptr
=
151 container_of(element
, typeof(*ptr
), list
);
154 static void tomoyo_del_path_group(struct list_head
*element
)
156 struct tomoyo_path_group
*member
=
157 container_of(element
, typeof(*member
), head
.list
);
158 tomoyo_put_name(member
->member_name
);
161 static void tomoyo_del_group(struct list_head
*element
)
163 struct tomoyo_group
*group
=
164 container_of(element
, typeof(*group
), list
);
165 tomoyo_put_name(group
->group_name
);
168 static void tomoyo_del_number_group(struct list_head
*element
)
170 struct tomoyo_number_group
*member
=
171 container_of(element
, typeof(*member
), head
.list
);
174 static bool tomoyo_collect_member(struct list_head
*member_list
, int id
)
176 struct tomoyo_acl_head
*member
;
177 list_for_each_entry(member
, member_list
, list
) {
178 if (!member
->is_deleted
)
180 if (!tomoyo_add_to_gc(id
, &member
->list
))
186 static bool tomoyo_collect_acl(struct tomoyo_domain_info
*domain
)
188 struct tomoyo_acl_info
*acl
;
189 list_for_each_entry(acl
, &domain
->acl_info_list
, list
) {
190 if (!acl
->is_deleted
)
192 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL
, &acl
->list
))
198 static void tomoyo_collect_entry(void)
201 if (mutex_lock_interruptible(&tomoyo_policy_lock
))
203 for (i
= 0; i
< TOMOYO_MAX_POLICY
; i
++) {
204 if (!tomoyo_collect_member(&tomoyo_policy_list
[i
], i
))
208 struct tomoyo_domain_info
*domain
;
209 list_for_each_entry_rcu(domain
, &tomoyo_domain_list
, list
) {
210 if (!tomoyo_collect_acl(domain
))
212 if (!domain
->is_deleted
|| atomic_read(&domain
->users
))
215 * Nobody is referring this domain. But somebody may
216 * refer this domain after successful execve().
217 * We recheck domain->users after SRCU synchronization.
219 if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN
, &domain
->list
))
223 for (i
= 0; i
< TOMOYO_MAX_HASH
; i
++) {
224 struct tomoyo_name
*ptr
;
225 list_for_each_entry_rcu(ptr
, &tomoyo_name_list
[i
], list
) {
226 if (atomic_read(&ptr
->users
))
228 if (!tomoyo_add_to_gc(TOMOYO_ID_NAME
, &ptr
->list
))
232 for (i
= 0; i
< TOMOYO_MAX_GROUP
; i
++) {
233 struct list_head
*list
= &tomoyo_group_list
[i
];
235 struct tomoyo_group
*group
;
238 id
= TOMOYO_ID_PATH_GROUP
;
241 id
= TOMOYO_ID_NUMBER_GROUP
;
244 list_for_each_entry(group
, list
, list
) {
245 if (!tomoyo_collect_member(&group
->member_list
, id
))
247 if (!list_empty(&group
->member_list
) ||
248 atomic_read(&group
->users
))
250 if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP
, &group
->list
))
255 mutex_unlock(&tomoyo_policy_lock
);
258 static void tomoyo_kfree_entry(void)
261 struct tomoyo_gc
*tmp
;
263 list_for_each_entry_safe(p
, tmp
, &tomoyo_gc_queue
, list
) {
264 struct list_head
*element
= p
->element
;
266 case TOMOYO_ID_TRANSITION_CONTROL
:
267 tomoyo_del_transition_control(element
);
269 case TOMOYO_ID_AGGREGATOR
:
270 tomoyo_del_aggregator(element
);
272 case TOMOYO_ID_MANAGER
:
273 tomoyo_del_manager(element
);
276 tomoyo_del_name(element
);
279 tomoyo_del_acl(element
);
281 case TOMOYO_ID_DOMAIN
:
282 if (!tomoyo_del_domain(element
))
285 case TOMOYO_ID_PATH_GROUP
:
286 tomoyo_del_path_group(element
);
288 case TOMOYO_ID_GROUP
:
289 tomoyo_del_group(element
);
291 case TOMOYO_ID_NUMBER_GROUP
:
292 tomoyo_del_number_group(element
);
295 tomoyo_memory_free(element
);
301 static int tomoyo_gc_thread(void *unused
)
303 daemonize("GC for TOMOYO");
304 if (mutex_trylock(&tomoyo_gc_mutex
)) {
306 for (i
= 0; i
< 10; i
++) {
307 tomoyo_collect_entry();
308 if (list_empty(&tomoyo_gc_queue
))
310 synchronize_srcu(&tomoyo_ss
);
311 tomoyo_kfree_entry();
313 mutex_unlock(&tomoyo_gc_mutex
);
318 void tomoyo_run_gc(void)
320 struct task_struct
*task
= kthread_create(tomoyo_gc_thread
, NULL
,
323 wake_up_process(task
);