security/tomoyo/common.c

   1 /*
   2  * security/tomoyo/common.c
   3  *
   4  * Common functions for TOMOYO.
   5  *
   6  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   7  *
   8  * Version: 2.2.0   2009/04/01
   9  *
  10  */
  11
  12 #include <linux/uaccess.h>
  13 #include <linux/slab.h>
  14 #include <linux/security.h>
  15 #include <linux/hardirq.h>
  16 #include "common.h"
  17
  18 /* Lock for protecting policy. */
  19 DEFINE_MUTEX(tomoyo_policy_lock);
  20
  21 /* Has loading policy done? */
  22 bool tomoyo_policy_loaded;
  23
  24 /* String table for functionality that takes 4 modes. */
  25 static const char *tomoyo_mode_4[4] = {
  26         "disabled", "learning", "permissive", "enforcing"
  27 };
  28 /* String table for functionality that takes 2 modes. */
  29 static const char *tomoyo_mode_2[4] = {
  30         "disabled", "enabled", "enabled", "enabled"
  31 };
  32
  33 /*
  34  * tomoyo_control_array is a static data which contains
  35  *
  36  *  (1) functionality name used by /sys/kernel/security/tomoyo/profile .
  37  *  (2) initial values for "struct tomoyo_profile".
  38  *  (3) max values for "struct tomoyo_profile".
  39  */
  40 static struct {
  41         const char *keyword;
  42         unsigned int current_value;
  43         const unsigned int max_value;
  44 } tomoyo_control_array[TOMOYO_MAX_CONTROL_INDEX] = {
  45         [TOMOYO_MAC_FOR_FILE]     = { "MAC_FOR_FILE",        0,       3 },
  46         [TOMOYO_MAX_ACCEPT_ENTRY] = { "MAX_ACCEPT_ENTRY", 2048, INT_MAX },
  47         [TOMOYO_VERBOSE]          = { "TOMOYO_VERBOSE",      1,       1 },
  48 };
  49
  50 /*
  51  * tomoyo_profile is a structure which is used for holding the mode of access
  52  * controls. TOMOYO has 4 modes: disabled, learning, permissive, enforcing.
  53  * An administrator can define up to 256 profiles.
  54  * The ->profile of "struct tomoyo_domain_info" is used for remembering
  55  * the profile's number (0 - 255) assigned to that domain.
  56  */
  57 static struct tomoyo_profile {
  58         unsigned int value[TOMOYO_MAX_CONTROL_INDEX];
  59         const struct tomoyo_path_info *comment;
  60 } *tomoyo_profile_ptr[TOMOYO_MAX_PROFILES];
  61
  62 /* Permit policy management by non-root user? */
  63 static bool tomoyo_manage_by_non_root;
  64
  65 /* Utility functions. */
  66
  67 /* Open operation for /sys/kernel/security/tomoyo/ interface. */
  68 static int tomoyo_open_control(const u8 type, struct file *file);
  69 /* Close /sys/kernel/security/tomoyo/ interface. */
  70 static int tomoyo_close_control(struct file *file);
  71 /* Read operation for /sys/kernel/security/tomoyo/ interface. */
  72 static int tomoyo_read_control(struct file *file, char __user *buffer,
  73                                const int buffer_len);
  74 /* Write operation for /sys/kernel/security/tomoyo/ interface. */
  75 static int tomoyo_write_control(struct file *file, const char __user *buffer,
  76                                 const int buffer_len);
  77
  78 /**
  79  * tomoyo_parse_name_union - Parse a tomoyo_name_union.
  80  *
  81  * @filename: Name or name group.
  82  * @ptr:      Pointer to "struct tomoyo_name_union".
  83  *
  84  * Returns true on success, false otherwise.
  85  */
  86 bool tomoyo_parse_name_union(const char *filename,
  87                              struct tomoyo_name_union *ptr)
  88 {
  89         if (!tomoyo_is_correct_path(filename, 0, 0, 0))
  90                 return false;
  91         if (filename[0] == '@') {
  92                 ptr->group = tomoyo_get_path_group(filename + 1);
  93                 ptr->is_group = true;
  94                 return ptr->group != NULL;
  95         }
  96         ptr->filename = tomoyo_get_name(filename);
  97         ptr->is_group = false;
  98         return ptr->filename != NULL;
  99 }
 100
 101 /**
 102  * tomoyo_print_name_union - Print a tomoyo_name_union.
 103  *
 104  * @head: Pointer to "struct tomoyo_io_buffer".
 105  * @ptr:  Pointer to "struct tomoyo_name_union".
 106  *
 107  * Returns true on success, false otherwise.
 108  */
 109 static bool tomoyo_print_name_union(struct tomoyo_io_buffer *head,
 110                                  const struct tomoyo_name_union *ptr)
 111 {
 112         int pos = head->read_avail;
 113         if (pos && head->read_buf[pos - 1] == ' ')
 114                 head->read_avail--;
 115         if (ptr->is_group)
 116                 return tomoyo_io_printf(head, " @%s",
 117                                         ptr->group->group_name->name);
 118         return tomoyo_io_printf(head, " %s", ptr->filename->name);
 119 }
 120
 121 /**
 122  * tomoyo_parse_ulong - Parse an "unsigned long" value.
 123  *
 124  * @result: Pointer to "unsigned long".
 125  * @str:    Pointer to string to parse.
 126  *
 127  * Returns value type on success, 0 otherwise.
 128  *
 129  * The @src is updated to point the first character after the value
 130  * on success.
 131  */
 132 u8 tomoyo_parse_ulong(unsigned long *result, char **str)
 133 {
 134         const char *cp = *str;
 135         char *ep;
 136         int base = 10;
 137         if (*cp == '0') {
 138                 char c = *(cp + 1);
 139                 if (c == 'x' || c == 'X') {
 140                         base = 16;
 141                         cp += 2;
 142                 } else if (c >= '0' && c <= '7') {
 143                         base = 8;
 144                         cp++;
 145                 }
 146         }
 147         *result = simple_strtoul(cp, &ep, base);
 148         if (cp == ep)
 149                 return 0;
 150         *str = ep;
 151         switch (base) {
 152         case 16:
 153                 return TOMOYO_VALUE_TYPE_HEXADECIMAL;
 154         case 8:
 155                 return TOMOYO_VALUE_TYPE_OCTAL;
 156         default:
 157                 return TOMOYO_VALUE_TYPE_DECIMAL;
 158         }
 159 }
 160
 161 /**
 162  * tomoyo_print_ulong - Print an "unsigned long" value.
 163  *
 164  * @buffer:     Pointer to buffer.
 165  * @buffer_len: Size of @buffer.
 166  * @value:      An "unsigned long" value.
 167  * @type:       Type of @value.
 168  *
 169  * Returns nothing.
 170  */
 171 void tomoyo_print_ulong(char *buffer, const int buffer_len,
 172                         const unsigned long value, const u8 type)
 173 {
 174         if (type == TOMOYO_VALUE_TYPE_DECIMAL)
 175                 snprintf(buffer, buffer_len, "%lu", value);
 176         else if (type == TOMOYO_VALUE_TYPE_OCTAL)
 177                 snprintf(buffer, buffer_len, "0%lo", value);
 178         else if (type == TOMOYO_VALUE_TYPE_HEXADECIMAL)
 179                 snprintf(buffer, buffer_len, "0x%lX", value);
 180         else
 181                 snprintf(buffer, buffer_len, "type(%u)", type);
 182 }
 183
 184 /**
 185  * tomoyo_print_number_union - Print a tomoyo_number_union.
 186  *
 187  * @head:       Pointer to "struct tomoyo_io_buffer".
 188  * @ptr:        Pointer to "struct tomoyo_number_union".
 189  *
 190  * Returns true on success, false otherwise.
 191  */
 192 bool tomoyo_print_number_union(struct tomoyo_io_buffer *head,
 193                                const struct tomoyo_number_union *ptr)
 194 {
 195         unsigned long min;
 196         unsigned long max;
 197         u8 min_type;
 198         u8 max_type;
 199         if (!tomoyo_io_printf(head, " "))
 200                 return false;
 201         if (ptr->is_group)
 202                 return tomoyo_io_printf(head, "@%s",
 203                                         ptr->group->group_name->name);
 204         min_type = ptr->min_type;
 205         max_type = ptr->max_type;
 206         min = ptr->values[0];
 207         max = ptr->values[1];
 208         switch (min_type) {
 209         case TOMOYO_VALUE_TYPE_HEXADECIMAL:
 210                 if (!tomoyo_io_printf(head, "0x%lX", min))
 211                         return false;
 212                 break;
 213         case TOMOYO_VALUE_TYPE_OCTAL:
 214                 if (!tomoyo_io_printf(head, "0%lo", min))
 215                         return false;
 216                 break;
 217         default:
 218                 if (!tomoyo_io_printf(head, "%lu", min))
 219                         return false;
 220                 break;
 221         }
 222         if (min == max && min_type == max_type)
 223                 return true;
 224         switch (max_type) {
 225         case TOMOYO_VALUE_TYPE_HEXADECIMAL:
 226                 return tomoyo_io_printf(head, "-0x%lX", max);
 227         case TOMOYO_VALUE_TYPE_OCTAL:
 228                 return tomoyo_io_printf(head, "-0%lo", max);
 229         default:
 230                 return tomoyo_io_printf(head, "-%lu", max);
 231         }
 232 }
 233
 234 /**
 235  * tomoyo_parse_number_union - Parse a tomoyo_number_union.
 236  *
 237  * @data: Number or number range or number group.
 238  * @ptr:  Pointer to "struct tomoyo_number_union".
 239  *
 240  * Returns true on success, false otherwise.
 241  */
 242 bool tomoyo_parse_number_union(char *data, struct tomoyo_number_union *num)
 243 {
 244         u8 type;
 245         unsigned long v;
 246         memset(num, 0, sizeof(*num));
 247         if (data[0] == '@') {
 248                 if (!tomoyo_is_correct_path(data, 0, 0, 0))
 249                         return false;
 250                 num->group = tomoyo_get_number_group(data + 1);
 251                 num->is_group = true;
 252                 return num->group != NULL;
 253         }
 254         type = tomoyo_parse_ulong(&v, &data);
 255         if (!type)
 256                 return false;
 257         num->values[0] = v;
 258         num->min_type = type;
 259         if (!*data) {
 260                 num->values[1] = v;
 261                 num->max_type = type;
 262                 return true;
 263         }
 264         if (*data++ != '-')
 265                 return false;
 266         type = tomoyo_parse_ulong(&v, &data);
 267         if (!type || *data)
 268                 return false;
 269         num->values[1] = v;
 270         num->max_type = type;
 271         return true;
 272 }
 273
 274 /**
 275  * tomoyo_is_byte_range - Check whether the string isa \ooo style octal value.
 276  *
 277  * @str: Pointer to the string.
 278  *
 279  * Returns true if @str is a \ooo style octal value, false otherwise.
 280  *
 281  * TOMOYO uses \ooo style representation for 0x01 - 0x20 and 0x7F - 0xFF.
 282  * This function verifies that \ooo is in valid range.
 283  */
 284 static inline bool tomoyo_is_byte_range(const char *str)
 285 {
 286         return *str >= '0' && *str++ <= '3' &&
 287                 *str >= '0' && *str++ <= '7' &&
 288                 *str >= '0' && *str <= '7';
 289 }
 290
 291 /**
 292  * tomoyo_is_alphabet_char - Check whether the character is an alphabet.
 293  *
 294  * @c: The character to check.
 295  *
 296  * Returns true if @c is an alphabet character, false otherwise.
 297  */
 298 static inline bool tomoyo_is_alphabet_char(const char c)
 299 {
 300         return (c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z');
 301 }
 302
 303 /**
 304  * tomoyo_make_byte - Make byte value from three octal characters.
 305  *
 306  * @c1: The first character.
 307  * @c2: The second character.
 308  * @c3: The third character.
 309  *
 310  * Returns byte value.
 311  */
 312 static inline u8 tomoyo_make_byte(const u8 c1, const u8 c2, const u8 c3)
 313 {
 314         return ((c1 - '0') << 6) + ((c2 - '0') << 3) + (c3 - '0');
 315 }
 316
 317 /**
 318  * tomoyo_str_starts - Check whether the given string starts with the given keyword.
 319  *
 320  * @src:  Pointer to pointer to the string.
 321  * @find: Pointer to the keyword.
 322  *
 323  * Returns true if @src starts with @find, false otherwise.
 324  *
 325  * The @src is updated to point the first character after the @find
 326  * if @src starts with @find.
 327  */
 328 static bool tomoyo_str_starts(char **src, const char *find)
 329 {
 330         const int len = strlen(find);
 331         char *tmp = *src;
 332
 333         if (strncmp(tmp, find, len))
 334                 return false;
 335         tmp += len;
 336         *src = tmp;
 337         return true;
 338 }
 339
 340 /**
 341  * tomoyo_normalize_line - Format string.
 342  *
 343  * @buffer: The line to normalize.
 344  *
 345  * Leading and trailing whitespaces are removed.
 346  * Multiple whitespaces are packed into single space.
 347  *
 348  * Returns nothing.
 349  */
 350 static void tomoyo_normalize_line(unsigned char *buffer)
 351 {
 352         unsigned char *sp = buffer;
 353         unsigned char *dp = buffer;
 354         bool first = true;
 355
 356         while (tomoyo_is_invalid(*sp))
 357                 sp++;
 358         while (*sp) {
 359                 if (!first)
 360                         *dp++ = ' ';
 361                 first = false;
 362                 while (tomoyo_is_valid(*sp))
 363                         *dp++ = *sp++;
 364                 while (tomoyo_is_invalid(*sp))
 365                         sp++;
 366         }
 367         *dp = '\0';
 368 }
 369
 370 /**
 371  * tomoyo_tokenize - Tokenize string.
 372  *
 373  * @buffer: The line to tokenize.
 374  * @w:      Pointer to "char *".
 375  * @size:   Sizeof @w .
 376  *
 377  * Returns true on success, false otherwise.
 378  */
 379 bool tomoyo_tokenize(char *buffer, char *w[], size_t size)
 380 {
 381         int count = size / sizeof(char *);
 382         int i;
 383         for (i = 0; i < count; i++)
 384                 w[i] = "";
 385         for (i = 0; i < count; i++) {
 386                 char *cp = strchr(buffer, ' ');
 387                 if (cp)
 388                         *cp = '\0';
 389                 w[i] = buffer;
 390                 if (!cp)
 391                         break;
 392                 buffer = cp + 1;
 393         }
 394         return i < count || !*buffer;
 395 }
 396
 397 /**
 398  * tomoyo_is_correct_path - Validate a pathname.
 399  * @filename:     The pathname to check.
 400  * @start_type:   Should the pathname start with '/'?
 401  *                1 = must / -1 = must not / 0 = don't care
 402  * @pattern_type: Can the pathname contain a wildcard?
 403  *                1 = must / -1 = must not / 0 = don't care
 404  * @end_type:     Should the pathname end with '/'?
 405  *                1 = must / -1 = must not / 0 = don't care
 406  *
 407  * Check whether the given filename follows the naming rules.
 408  * Returns true if @filename follows the naming rules, false otherwise.
 409  */
 410 bool tomoyo_is_correct_path(const char *filename, const s8 start_type,
 411                             const s8 pattern_type, const s8 end_type)
 412 {
 413         const char *const start = filename;
 414         bool in_repetition = false;
 415         bool contains_pattern = false;
 416         unsigned char c;
 417         unsigned char d;
 418         unsigned char e;
 419
 420         if (!filename)
 421                 goto out;
 422         c = *filename;
 423         if (start_type == 1) { /* Must start with '/' */
 424                 if (c != '/')
 425                         goto out;
 426         } else if (start_type == -1) { /* Must not start with '/' */
 427                 if (c == '/')
 428                         goto out;
 429         }
 430         if (c)
 431                 c = *(filename + strlen(filename) - 1);
 432         if (end_type == 1) { /* Must end with '/' */
 433                 if (c != '/')
 434                         goto out;
 435         } else if (end_type == -1) { /* Must not end with '/' */
 436                 if (c == '/')
 437                         goto out;
 438         }
 439         while (1) {
 440                 c = *filename++;
 441                 if (!c)
 442                         break;
 443                 if (c == '\\') {
 444                         c = *filename++;
 445                         switch (c) {
 446                         case '\\':  /* "\\" */
 447                                 continue;
 448                         case '$':   /* "\$" */
 449                         case '+':   /* "\+" */
 450                         case '?':   /* "\?" */
 451                         case '*':   /* "\*" */
 452                         case '@':   /* "\@" */
 453                         case 'x':   /* "\x" */
 454                         case 'X':   /* "\X" */
 455                         case 'a':   /* "\a" */
 456                         case 'A':   /* "\A" */
 457                         case '-':   /* "\-" */
 458                                 if (pattern_type == -1)
 459                                         break; /* Must not contain pattern */
 460                                 contains_pattern = true;
 461                                 continue;
 462                         case '{':   /* "/\{" */
 463                                 if (filename - 3 < start ||
 464                                     *(filename - 3) != '/')
 465                                         break;
 466                                 if (pattern_type == -1)
 467                                         break; /* Must not contain pattern */
 468                                 contains_pattern = true;
 469                                 in_repetition = true;
 470                                 continue;
 471                         case '}':   /* "\}/" */
 472                                 if (*filename != '/')
 473                                         break;
 474                                 if (!in_repetition)
 475                                         break;
 476                                 in_repetition = false;
 477                                 continue;
 478                         case '0':   /* "\ooo" */
 479                         case '1':
 480                         case '2':
 481                         case '3':
 482                                 d = *filename++;
 483                                 if (d < '0' || d > '7')
 484                                         break;
 485                                 e = *filename++;
 486                                 if (e < '0' || e > '7')
 487                                         break;
 488                                 c = tomoyo_make_byte(c, d, e);
 489                                 if (tomoyo_is_invalid(c))
 490                                         continue; /* pattern is not \000 */
 491                         }
 492                         goto out;
 493                 } else if (in_repetition && c == '/') {
 494                         goto out;
 495                 } else if (tomoyo_is_invalid(c)) {
 496                         goto out;
 497                 }
 498         }
 499         if (pattern_type == 1) { /* Must contain pattern */
 500                 if (!contains_pattern)
 501                         goto out;
 502         }
 503         if (in_repetition)
 504                 goto out;
 505         return true;
 506  out:
 507         return false;
 508 }
 509
 510 /**
 511  * tomoyo_is_correct_domain - Check whether the given domainname follows the naming rules.
 512  * @domainname:   The domainname to check.
 513  *
 514  * Returns true if @domainname follows the naming rules, false otherwise.
 515  */
 516 bool tomoyo_is_correct_domain(const unsigned char *domainname)
 517 {
 518         unsigned char c;
 519         unsigned char d;
 520         unsigned char e;
 521
 522         if (!domainname || strncmp(domainname, TOMOYO_ROOT_NAME,
 523                                    TOMOYO_ROOT_NAME_LEN))
 524                 goto out;
 525         domainname += TOMOYO_ROOT_NAME_LEN;
 526         if (!*domainname)
 527                 return true;
 528         do {
 529                 if (*domainname++ != ' ')
 530                         goto out;
 531                 if (*domainname++ != '/')
 532                         goto out;
 533                 while ((c = *domainname) != '\0' && c != ' ') {
 534                         domainname++;
 535                         if (c == '\\') {
 536                                 c = *domainname++;
 537                                 switch ((c)) {
 538                                 case '\\':  /* "\\" */
 539                                         continue;
 540                                 case '0':   /* "\ooo" */
 541                                 case '1':
 542                                 case '2':
 543                                 case '3':
 544                                         d = *domainname++;
 545                                         if (d < '0' || d > '7')
 546                                                 break;
 547                                         e = *domainname++;
 548                                         if (e < '0' || e > '7')
 549                                                 break;
 550                                         c = tomoyo_make_byte(c, d, e);
 551                                         if (tomoyo_is_invalid(c))
 552                                                 /* pattern is not \000 */
 553                                                 continue;
 554                                 }
 555                                 goto out;
 556                         } else if (tomoyo_is_invalid(c)) {
 557                                 goto out;
 558                         }
 559                 }
 560         } while (*domainname);
 561         return true;
 562  out:
 563         return false;
 564 }
 565
 566 /**
 567  * tomoyo_is_domain_def - Check whether the given token can be a domainname.
 568  *
 569  * @buffer: The token to check.
 570  *
 571  * Returns true if @buffer possibly be a domainname, false otherwise.
 572  */
 573 bool tomoyo_is_domain_def(const unsigned char *buffer)
 574 {
 575         return !strncmp(buffer, TOMOYO_ROOT_NAME, TOMOYO_ROOT_NAME_LEN);
 576 }
 577
 578 /**
 579  * tomoyo_find_domain - Find a domain by the given name.
 580  *
 581  * @domainname: The domainname to find.
 582  *
 583  * Returns pointer to "struct tomoyo_domain_info" if found, NULL otherwise.
 584  *
 585  * Caller holds tomoyo_read_lock().
 586  */
 587 struct tomoyo_domain_info *tomoyo_find_domain(const char *domainname)
 588 {
 589         struct tomoyo_domain_info *domain;
 590         struct tomoyo_path_info name;
 591
 592         name.name = domainname;
 593         tomoyo_fill_path_info(&name);
 594         list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 595                 if (!domain->is_deleted &&
 596                     !tomoyo_pathcmp(&name, domain->domainname))
 597                         return domain;
 598         }
 599         return NULL;
 600 }
 601
 602 /**
 603  * tomoyo_const_part_length - Evaluate the initial length without a pattern in a token.
 604  *
 605  * @filename: The string to evaluate.
 606  *
 607  * Returns the initial length without a pattern in @filename.
 608  */
 609 static int tomoyo_const_part_length(const char *filename)
 610 {
 611         char c;
 612         int len = 0;
 613
 614         if (!filename)
 615                 return 0;
 616         while ((c = *filename++) != '\0') {
 617                 if (c != '\\') {
 618                         len++;
 619                         continue;
 620                 }
 621                 c = *filename++;
 622                 switch (c) {
 623                 case '\\':  /* "\\" */
 624                         len += 2;
 625                         continue;
 626                 case '0':   /* "\ooo" */
 627                 case '1':
 628                 case '2':
 629                 case '3':
 630                         c = *filename++;
 631                         if (c < '0' || c > '7')
 632                                 break;
 633                         c = *filename++;
 634                         if (c < '0' || c > '7')
 635                                 break;
 636                         len += 4;
 637                         continue;
 638                 }
 639                 break;
 640         }
 641         return len;
 642 }
 643
 644 /**
 645  * tomoyo_fill_path_info - Fill in "struct tomoyo_path_info" members.
 646  *
 647  * @ptr: Pointer to "struct tomoyo_path_info" to fill in.
 648  *
 649  * The caller sets "struct tomoyo_path_info"->name.
 650  */
 651 void tomoyo_fill_path_info(struct tomoyo_path_info *ptr)
 652 {
 653         const char *name = ptr->name;
 654         const int len = strlen(name);
 655
 656         ptr->const_len = tomoyo_const_part_length(name);
 657         ptr->is_dir = len && (name[len - 1] == '/');
 658         ptr->is_patterned = (ptr->const_len < len);
 659         ptr->hash = full_name_hash(name, len);
 660 }
 661
 662 /**
 663  * tomoyo_file_matches_pattern2 - Pattern matching without '/' character
 664  * and "\-" pattern.
 665  *
 666  * @filename:     The start of string to check.
 667  * @filename_end: The end of string to check.
 668  * @pattern:      The start of pattern to compare.
 669  * @pattern_end:  The end of pattern to compare.
 670  *
 671  * Returns true if @filename matches @pattern, false otherwise.
 672  */
 673 static bool tomoyo_file_matches_pattern2(const char *filename,
 674                                          const char *filename_end,
 675                                          const char *pattern,
 676                                          const char *pattern_end)
 677 {
 678         while (filename < filename_end && pattern < pattern_end) {
 679                 char c;
 680                 if (*pattern != '\\') {
 681                         if (*filename++ != *pattern++)
 682                                 return false;
 683                         continue;
 684                 }
 685                 c = *filename;
 686                 pattern++;
 687                 switch (*pattern) {
 688                         int i;
 689                         int j;
 690                 case '?':
 691                         if (c == '/') {
 692                                 return false;
 693                         } else if (c == '\\') {
 694                                 if (filename[1] == '\\')
 695                                         filename++;
 696                                 else if (tomoyo_is_byte_range(filename + 1))
 697                                         filename += 3;
 698                                 else
 699                                         return false;
 700                         }
 701                         break;
 702                 case '\\':
 703                         if (c != '\\')
 704                                 return false;
 705                         if (*++filename != '\\')
 706                                 return false;
 707                         break;
 708                 case '+':
 709                         if (!isdigit(c))
 710                                 return false;
 711                         break;
 712                 case 'x':
 713                         if (!isxdigit(c))
 714                                 return false;
 715                         break;
 716                 case 'a':
 717                         if (!tomoyo_is_alphabet_char(c))
 718                                 return false;
 719                         break;
 720                 case '0':
 721                 case '1':
 722                 case '2':
 723                 case '3':
 724                         if (c == '\\' && tomoyo_is_byte_range(filename + 1)
 725                             && strncmp(filename + 1, pattern, 3) == 0) {
 726                                 filename += 3;
 727                                 pattern += 2;
 728                                 break;
 729                         }
 730                         return false; /* Not matched. */
 731                 case '*':
 732                 case '@':
 733                         for (i = 0; i <= filename_end - filename; i++) {
 734                                 if (tomoyo_file_matches_pattern2(
 735                                                     filename + i, filename_end,
 736                                                     pattern + 1, pattern_end))
 737                                         return true;
 738                                 c = filename[i];
 739                                 if (c == '.' && *pattern == '@')
 740                                         break;
 741                                 if (c != '\\')
 742                                         continue;
 743                                 if (filename[i + 1] == '\\')
 744                                         i++;
 745                                 else if (tomoyo_is_byte_range(filename + i + 1))
 746                                         i += 3;
 747                                 else
 748                                         break; /* Bad pattern. */
 749                         }
 750                         return false; /* Not matched. */
 751                 default:
 752                         j = 0;
 753                         c = *pattern;
 754                         if (c == '$') {
 755                                 while (isdigit(filename[j]))
 756                                         j++;
 757                         } else if (c == 'X') {
 758                                 while (isxdigit(filename[j]))
 759                                         j++;
 760                         } else if (c == 'A') {
 761                                 while (tomoyo_is_alphabet_char(filename[j]))
 762                                         j++;
 763                         }
 764                         for (i = 1; i <= j; i++) {
 765                                 if (tomoyo_file_matches_pattern2(
 766                                                     filename + i, filename_end,
 767                                                     pattern + 1, pattern_end))
 768                                         return true;
 769                         }
 770                         return false; /* Not matched or bad pattern. */
 771                 }
 772                 filename++;
 773                 pattern++;
 774         }
 775         while (*pattern == '\\' &&
 776                (*(pattern + 1) == '*' || *(pattern + 1) == '@'))
 777                 pattern += 2;
 778         return filename == filename_end && pattern == pattern_end;
 779 }
 780
 781 /**
 782  * tomoyo_file_matches_pattern - Pattern matching without without '/' character.
 783  *
 784  * @filename:     The start of string to check.
 785  * @filename_end: The end of string to check.
 786  * @pattern:      The start of pattern to compare.
 787  * @pattern_end:  The end of pattern to compare.
 788  *
 789  * Returns true if @filename matches @pattern, false otherwise.
 790  */
 791 static bool tomoyo_file_matches_pattern(const char *filename,
 792                                            const char *filename_end,
 793                                            const char *pattern,
 794                                            const char *pattern_end)
 795 {
 796         const char *pattern_start = pattern;
 797         bool first = true;
 798         bool result;
 799
 800         while (pattern < pattern_end - 1) {
 801                 /* Split at "\-" pattern. */
 802                 if (*pattern++ != '\\' || *pattern++ != '-')
 803                         continue;
 804                 result = tomoyo_file_matches_pattern2(filename,
 805                                                       filename_end,
 806                                                       pattern_start,
 807                                                       pattern - 2);
 808                 if (first)
 809                         result = !result;
 810                 if (result)
 811                         return false;
 812                 first = false;
 813                 pattern_start = pattern;
 814         }
 815         result = tomoyo_file_matches_pattern2(filename, filename_end,
 816                                               pattern_start, pattern_end);
 817         return first ? result : !result;
 818 }
 819
 820 /**
 821  * tomoyo_path_matches_pattern2 - Do pathname pattern matching.
 822  *
 823  * @f: The start of string to check.
 824  * @p: The start of pattern to compare.
 825  *
 826  * Returns true if @f matches @p, false otherwise.
 827  */
 828 static bool tomoyo_path_matches_pattern2(const char *f, const char *p)
 829 {
 830         const char *f_delimiter;
 831         const char *p_delimiter;
 832
 833         while (*f && *p) {
 834                 f_delimiter = strchr(f, '/');
 835                 if (!f_delimiter)
 836                         f_delimiter = f + strlen(f);
 837                 p_delimiter = strchr(p, '/');
 838                 if (!p_delimiter)
 839                         p_delimiter = p + strlen(p);
 840                 if (*p == '\\' && *(p + 1) == '{')
 841                         goto recursive;
 842                 if (!tomoyo_file_matches_pattern(f, f_delimiter, p,
 843                                                  p_delimiter))
 844                         return false;
 845                 f = f_delimiter;
 846                 if (*f)
 847                         f++;
 848                 p = p_delimiter;
 849                 if (*p)
 850                         p++;
 851         }
 852         /* Ignore trailing "\*" and "\@" in @pattern. */
 853         while (*p == '\\' &&
 854                (*(p + 1) == '*' || *(p + 1) == '@'))
 855                 p += 2;
 856         return !*f && !*p;
 857  recursive:
 858         /*
 859          * The "\{" pattern is permitted only after '/' character.
 860          * This guarantees that below "*(p - 1)" is safe.
 861          * Also, the "\}" pattern is permitted only before '/' character
 862          * so that "\{" + "\}" pair will not break the "\-" operator.
 863          */
 864         if (*(p - 1) != '/' || p_delimiter <= p + 3 || *p_delimiter != '/' ||
 865             *(p_delimiter - 1) != '}' || *(p_delimiter - 2) != '\\')
 866                 return false; /* Bad pattern. */
 867         do {
 868                 /* Compare current component with pattern. */
 869                 if (!tomoyo_file_matches_pattern(f, f_delimiter, p + 2,
 870                                                  p_delimiter - 2))
 871                         break;
 872                 /* Proceed to next component. */
 873                 f = f_delimiter;
 874                 if (!*f)
 875                         break;
 876                 f++;
 877                 /* Continue comparison. */
 878                 if (tomoyo_path_matches_pattern2(f, p_delimiter + 1))
 879                         return true;
 880                 f_delimiter = strchr(f, '/');
 881         } while (f_delimiter);
 882         return false; /* Not matched. */
 883 }
 884
 885 /**
 886  * tomoyo_path_matches_pattern - Check whether the given filename matches the given pattern.
 887  *
 888  * @filename: The filename to check.
 889  * @pattern:  The pattern to compare.
 890  *
 891  * Returns true if matches, false otherwise.
 892  *
 893  * The following patterns are available.
 894  *   \\     \ itself.
 895  *   \ooo   Octal representation of a byte.
 896  *   \*     Zero or more repetitions of characters other than '/'.
 897  *   \@     Zero or more repetitions of characters other than '/' or '.'.
 898  *   \?     1 byte character other than '/'.
 899  *   \$     One or more repetitions of decimal digits.
 900  *   \+     1 decimal digit.
 901  *   \X     One or more repetitions of hexadecimal digits.
 902  *   \x     1 hexadecimal digit.
 903  *   \A     One or more repetitions of alphabet characters.
 904  *   \a     1 alphabet character.
 905  *
 906  *   \-     Subtraction operator.
 907  *
 908  *   /\{dir\}/   '/' + 'One or more repetitions of dir/' (e.g. /dir/ /dir/dir/
 909  *               /dir/dir/dir/ ).
 910  */
 911 bool tomoyo_path_matches_pattern(const struct tomoyo_path_info *filename,
 912                                  const struct tomoyo_path_info *pattern)
 913 {
 914         const char *f = filename->name;
 915         const char *p = pattern->name;
 916         const int len = pattern->const_len;
 917
 918         /* If @pattern doesn't contain pattern, I can use strcmp(). */
 919         if (!pattern->is_patterned)
 920                 return !tomoyo_pathcmp(filename, pattern);
 921         /* Don't compare directory and non-directory. */
 922         if (filename->is_dir != pattern->is_dir)
 923                 return false;
 924         /* Compare the initial length without patterns. */
 925         if (strncmp(f, p, len))
 926                 return false;
 927         f += len;
 928         p += len;
 929         return tomoyo_path_matches_pattern2(f, p);
 930 }
 931
 932 /**
 933  * tomoyo_io_printf - Transactional printf() to "struct tomoyo_io_buffer" structure.
 934  *
 935  * @head: Pointer to "struct tomoyo_io_buffer".
 936  * @fmt:  The printf()'s format string, followed by parameters.
 937  *
 938  * Returns true if output was written, false otherwise.
 939  *
 940  * The snprintf() will truncate, but tomoyo_io_printf() won't.
 941  */
 942 bool tomoyo_io_printf(struct tomoyo_io_buffer *head, const char *fmt, ...)
 943 {
 944         va_list args;
 945         int len;
 946         int pos = head->read_avail;
 947         int size = head->readbuf_size - pos;
 948
 949         if (size <= 0)
 950                 return false;
 951         va_start(args, fmt);
 952         len = vsnprintf(head->read_buf + pos, size, fmt, args);
 953         va_end(args);
 954         if (pos + len >= head->readbuf_size)
 955                 return false;
 956         head->read_avail += len;
 957         return true;
 958 }
 959
 960 /**
 961  * tomoyo_get_exe - Get tomoyo_realpath() of current process.
 962  *
 963  * Returns the tomoyo_realpath() of current process on success, NULL otherwise.
 964  *
 965  * This function uses kzalloc(), so the caller must call kfree()
 966  * if this function didn't return NULL.
 967  */
 968 static const char *tomoyo_get_exe(void)
 969 {
 970         struct mm_struct *mm = current->mm;
 971         struct vm_area_struct *vma;
 972         const char *cp = NULL;
 973
 974         if (!mm)
 975                 return NULL;
 976         down_read(&mm->mmap_sem);
 977         for (vma = mm->mmap; vma; vma = vma->vm_next) {
 978                 if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file) {
 979                         cp = tomoyo_realpath_from_path(&vma->vm_file->f_path);
 980                         break;
 981                 }
 982         }
 983         up_read(&mm->mmap_sem);
 984         return cp;
 985 }
 986
 987 /**
 988  * tomoyo_check_flags - Check mode for specified functionality.
 989  *
 990  * @domain: Pointer to "struct tomoyo_domain_info".
 991  * @index:  The functionality to check mode.
 992  *
 993  * TOMOYO checks only process context.
 994  * This code disables TOMOYO's enforcement in case the function is called from
 995  * interrupt context.
 996  */
 997 unsigned int tomoyo_check_flags(const struct tomoyo_domain_info *domain,
 998                                 const u8 index)
 999 {
1000         const u8 profile = domain->profile;
1001
1002         if (WARN_ON(in_interrupt()))
1003                 return 0;
1004         return tomoyo_policy_loaded && index < TOMOYO_MAX_CONTROL_INDEX
1005 #if TOMOYO_MAX_PROFILES != 256
1006                 && profile < TOMOYO_MAX_PROFILES
1007 #endif
1008                 && tomoyo_profile_ptr[profile] ?
1009                 tomoyo_profile_ptr[profile]->value[index] : 0;
1010 }
1011
1012 /**
1013  * tomoyo_verbose_mode - Check whether TOMOYO is verbose mode.
1014  *
1015  * @domain: Pointer to "struct tomoyo_domain_info".
1016  *
1017  * Returns true if domain policy violation warning should be printed to
1018  * console.
1019  */
1020 bool tomoyo_verbose_mode(const struct tomoyo_domain_info *domain)
1021 {
1022         return tomoyo_check_flags(domain, TOMOYO_VERBOSE) != 0;
1023 }
1024
1025 /**
1026  * tomoyo_domain_quota_is_ok - Check for domain's quota.
1027  *
1028  * @r: Pointer to "struct tomoyo_request_info".
1029  *
1030  * Returns true if the domain is not exceeded quota, false otherwise.
1031  *
1032  * Caller holds tomoyo_read_lock().
1033  */
1034 bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
1035 {
1036         unsigned int count = 0;
1037         struct tomoyo_domain_info *domain = r->domain;
1038         struct tomoyo_acl_info *ptr;
1039
1040         if (r->mode != TOMOYO_CONFIG_LEARNING)
1041                 return false;
1042         if (!domain)
1043                 return true;
1044         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1045                 switch (ptr->type) {
1046                         u16 perm;
1047                         u8 i;
1048                 case TOMOYO_TYPE_PATH_ACL:
1049                         perm = container_of(ptr, struct tomoyo_path_acl, head)
1050                                 ->perm;
1051                         for (i = 0; i < TOMOYO_MAX_PATH_OPERATION; i++)
1052                                 if (perm & (1 << i))
1053                                         count++;
1054                         if (perm & (1 << TOMOYO_TYPE_READ_WRITE))
1055                                 count -= 2;
1056                         break;
1057                 case TOMOYO_TYPE_PATH2_ACL:
1058                         perm = container_of(ptr, struct tomoyo_path2_acl, head)
1059                                 ->perm;
1060                         for (i = 0; i < TOMOYO_MAX_PATH2_OPERATION; i++)
1061                                 if (perm & (1 << i))
1062                                         count++;
1063                         break;
1064                 case TOMOYO_TYPE_PATH_NUMBER_ACL:
1065                         perm = container_of(ptr, struct tomoyo_path_number_acl,
1066                                             head)->perm;
1067                         for (i = 0; i < TOMOYO_MAX_PATH_NUMBER_OPERATION; i++)
1068                                 if (perm & (1 << i))
1069                                         count++;
1070                         break;
1071                 case TOMOYO_TYPE_PATH_NUMBER3_ACL:
1072                         perm = container_of(ptr, struct tomoyo_path_number3_acl,
1073                                             head)->perm;
1074                         for (i = 0; i < TOMOYO_MAX_PATH_NUMBER3_OPERATION; i++)
1075                                 if (perm & (1 << i))
1076                                         count++;
1077                         break;
1078                 }
1079         }
1080         if (count < tomoyo_check_flags(domain, TOMOYO_MAX_ACCEPT_ENTRY))
1081                 return true;
1082         if (!domain->quota_warned) {
1083                 domain->quota_warned = true;
1084                 printk(KERN_WARNING "TOMOYO-WARNING: "
1085                        "Domain '%s' has so many ACLs to hold. "
1086                        "Stopped learning mode.\n", domain->domainname->name);
1087         }
1088         return false;
1089 }
1090
1091 /**
1092  * tomoyo_find_or_assign_new_profile - Create a new profile.
1093  *
1094  * @profile: Profile number to create.
1095  *
1096  * Returns pointer to "struct tomoyo_profile" on success, NULL otherwise.
1097  */
1098 static struct tomoyo_profile *tomoyo_find_or_assign_new_profile(const unsigned
1099                                                                 int profile)
1100 {
1101         struct tomoyo_profile *ptr = NULL;
1102         int i;
1103
1104         if (profile >= TOMOYO_MAX_PROFILES)
1105                 return NULL;
1106         if (mutex_lock_interruptible(&tomoyo_policy_lock))
1107                 return NULL;
1108         ptr = tomoyo_profile_ptr[profile];
1109         if (ptr)
1110                 goto ok;
1111         ptr = kmalloc(sizeof(*ptr), GFP_NOFS);
1112         if (!tomoyo_memory_ok(ptr)) {
1113                 kfree(ptr);
1114                 ptr = NULL;
1115                 goto ok;
1116         }
1117         for (i = 0; i < TOMOYO_MAX_CONTROL_INDEX; i++)
1118                 ptr->value[i] = tomoyo_control_array[i].current_value;
1119         mb(); /* Avoid out-of-order execution. */
1120         tomoyo_profile_ptr[profile] = ptr;
1121  ok:
1122         mutex_unlock(&tomoyo_policy_lock);
1123         return ptr;
1124 }
1125
1126 /**
1127  * tomoyo_write_profile - Write to profile table.
1128  *
1129  * @head: Pointer to "struct tomoyo_io_buffer".
1130  *
1131  * Returns 0 on success, negative value otherwise.
1132  */
1133 static int tomoyo_write_profile(struct tomoyo_io_buffer *head)
1134 {
1135         char *data = head->write_buf;
1136         unsigned int i;
1137         unsigned int value;
1138         char *cp;
1139         struct tomoyo_profile *profile;
1140         unsigned long num;
1141
1142         cp = strchr(data, '-');
1143         if (cp)
1144                 *cp = '\0';
1145         if (strict_strtoul(data, 10, &num))
1146                 return -EINVAL;
1147         if (cp)
1148                 data = cp + 1;
1149         profile = tomoyo_find_or_assign_new_profile(num);
1150         if (!profile)
1151                 return -EINVAL;
1152         cp = strchr(data, '=');
1153         if (!cp)
1154                 return -EINVAL;
1155         *cp = '\0';
1156         if (!strcmp(data, "COMMENT")) {
1157                 const struct tomoyo_path_info *old_comment = profile->comment;
1158                 profile->comment = tomoyo_get_name(cp + 1);
1159                 tomoyo_put_name(old_comment);
1160                 return 0;
1161         }
1162         for (i = 0; i < TOMOYO_MAX_CONTROL_INDEX; i++) {
1163                 if (strcmp(data, tomoyo_control_array[i].keyword))
1164                         continue;
1165                 if (sscanf(cp + 1, "%u", &value) != 1) {
1166                         int j;
1167                         const char **modes;
1168                         switch (i) {
1169                         case TOMOYO_VERBOSE:
1170                                 modes = tomoyo_mode_2;
1171                                 break;
1172                         default:
1173                                 modes = tomoyo_mode_4;
1174                                 break;
1175                         }
1176                         for (j = 0; j < 4; j++) {
1177                                 if (strcmp(cp + 1, modes[j]))
1178                                         continue;
1179                                 value = j;
1180                                 break;
1181                         }
1182                         if (j == 4)
1183                                 return -EINVAL;
1184                 } else if (value > tomoyo_control_array[i].max_value) {
1185                         value = tomoyo_control_array[i].max_value;
1186                 }
1187                 profile->value[i] = value;
1188                 return 0;
1189         }
1190         return -EINVAL;
1191 }
1192
1193 /**
1194  * tomoyo_read_profile - Read from profile table.
1195  *
1196  * @head: Pointer to "struct tomoyo_io_buffer".
1197  *
1198  * Returns 0.
1199  */
1200 static int tomoyo_read_profile(struct tomoyo_io_buffer *head)
1201 {
1202         static const int total = TOMOYO_MAX_CONTROL_INDEX + 1;
1203         int step;
1204
1205         if (head->read_eof)
1206                 return 0;
1207         for (step = head->read_step; step < TOMOYO_MAX_PROFILES * total;
1208              step++) {
1209                 const u8 index = step / total;
1210                 u8 type = step % total;
1211                 const struct tomoyo_profile *profile
1212                         = tomoyo_profile_ptr[index];
1213                 head->read_step = step;
1214                 if (!profile)
1215                         continue;
1216                 if (!type) { /* Print profile' comment tag. */
1217                         if (!tomoyo_io_printf(head, "%u-COMMENT=%s\n",
1218                                               index, profile->comment ?
1219                                               profile->comment->name : ""))
1220                                 break;
1221                         continue;
1222                 }
1223                 type--;
1224                 if (type < TOMOYO_MAX_CONTROL_INDEX) {
1225                         const unsigned int value = profile->value[type];
1226                         const char **modes = NULL;
1227                         const char *keyword
1228                                 = tomoyo_control_array[type].keyword;
1229                         switch (tomoyo_control_array[type].max_value) {
1230                         case 3:
1231                                 modes = tomoyo_mode_4;
1232                                 break;
1233                         case 1:
1234                                 modes = tomoyo_mode_2;
1235                                 break;
1236                         }
1237                         if (modes) {
1238                                 if (!tomoyo_io_printf(head, "%u-%s=%s\n", index,
1239                                                       keyword, modes[value]))
1240                                         break;
1241                         } else {
1242                                 if (!tomoyo_io_printf(head, "%u-%s=%u\n", index,
1243                                                       keyword, value))
1244                                         break;
1245                         }
1246                 }
1247         }
1248         if (step == TOMOYO_MAX_PROFILES * total)
1249                 head->read_eof = true;
1250         return 0;
1251 }
1252
1253 /*
1254  * tomoyo_policy_manager_list is used for holding list of domainnames or
1255  * programs which are permitted to modify configuration via
1256  * /sys/kernel/security/tomoyo/ interface.
1257  *
1258  * An entry is added by
1259  *
1260  * # echo '<kernel> /sbin/mingetty /bin/login /bin/bash' > \
1261  *                                        /sys/kernel/security/tomoyo/manager
1262  *  (if you want to specify by a domainname)
1263  *
1264  *  or
1265  *
1266  * # echo '/usr/lib/ccs/editpolicy' > /sys/kernel/security/tomoyo/manager
1267  *  (if you want to specify by a program's location)
1268  *
1269  * and is deleted by
1270  *
1271  * # echo 'delete <kernel> /sbin/mingetty /bin/login /bin/bash' > \
1272  *                                        /sys/kernel/security/tomoyo/manager
1273  *
1274  *  or
1275  *
1276  * # echo 'delete /usr/lib/ccs/editpolicy' > \
1277  *                                        /sys/kernel/security/tomoyo/manager
1278  *
1279  * and all entries are retrieved by
1280  *
1281  * # cat /sys/kernel/security/tomoyo/manager
1282  */
1283 LIST_HEAD(tomoyo_policy_manager_list);
1284
1285 /**
1286  * tomoyo_update_manager_entry - Add a manager entry.
1287  *
1288  * @manager:   The path to manager or the domainnamme.
1289  * @is_delete: True if it is a delete request.
1290  *
1291  * Returns 0 on success, negative value otherwise.
1292  *
1293  * Caller holds tomoyo_read_lock().
1294  */
1295 static int tomoyo_update_manager_entry(const char *manager,
1296                                        const bool is_delete)
1297 {
1298         struct tomoyo_policy_manager_entry *ptr;
1299         struct tomoyo_policy_manager_entry e = { };
1300         int error = is_delete ? -ENOENT : -ENOMEM;
1301
1302         if (tomoyo_is_domain_def(manager)) {
1303                 if (!tomoyo_is_correct_domain(manager))
1304                         return -EINVAL;
1305                 e.is_domain = true;
1306         } else {
1307                 if (!tomoyo_is_correct_path(manager, 1, -1, -1))
1308                         return -EINVAL;
1309         }
1310         e.manager = tomoyo_get_name(manager);
1311         if (!e.manager)
1312                 return -ENOMEM;
1313         if (mutex_lock_interruptible(&tomoyo_policy_lock))
1314                 goto out;
1315         list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list, list) {
1316                 if (ptr->manager != e.manager)
1317                         continue;
1318                 ptr->is_deleted = is_delete;
1319                 error = 0;
1320                 break;
1321         }
1322         if (!is_delete && error) {
1323                 struct tomoyo_policy_manager_entry *entry =
1324                         tomoyo_commit_ok(&e, sizeof(e));
1325                 if (entry) {
1326                         list_add_tail_rcu(&entry->list,
1327                                           &tomoyo_policy_manager_list);
1328                         error = 0;
1329                 }
1330         }
1331         mutex_unlock(&tomoyo_policy_lock);
1332  out:
1333         tomoyo_put_name(e.manager);
1334         return error;
1335 }
1336
1337 /**
1338  * tomoyo_write_manager_policy - Write manager policy.
1339  *
1340  * @head: Pointer to "struct tomoyo_io_buffer".
1341  *
1342  * Returns 0 on success, negative value otherwise.
1343  *
1344  * Caller holds tomoyo_read_lock().
1345  */
1346 static int tomoyo_write_manager_policy(struct tomoyo_io_buffer *head)
1347 {
1348         char *data = head->write_buf;
1349         bool is_delete = tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE);
1350
1351         if (!strcmp(data, "manage_by_non_root")) {
1352                 tomoyo_manage_by_non_root = !is_delete;
1353                 return 0;
1354         }
1355         return tomoyo_update_manager_entry(data, is_delete);
1356 }
1357
1358 /**
1359  * tomoyo_read_manager_policy - Read manager policy.
1360  *
1361  * @head: Pointer to "struct tomoyo_io_buffer".
1362  *
1363  * Returns 0.
1364  *
1365  * Caller holds tomoyo_read_lock().
1366  */
1367 static int tomoyo_read_manager_policy(struct tomoyo_io_buffer *head)
1368 {
1369         struct list_head *pos;
1370         bool done = true;
1371
1372         if (head->read_eof)
1373                 return 0;
1374         list_for_each_cookie(pos, head->read_var2,
1375                              &tomoyo_policy_manager_list) {
1376                 struct tomoyo_policy_manager_entry *ptr;
1377                 ptr = list_entry(pos, struct tomoyo_policy_manager_entry,
1378                                  list);
1379                 if (ptr->is_deleted)
1380                         continue;
1381                 done = tomoyo_io_printf(head, "%s\n", ptr->manager->name);
1382                 if (!done)
1383                         break;
1384         }
1385         head->read_eof = done;
1386         return 0;
1387 }
1388
1389 /**
1390  * tomoyo_is_policy_manager - Check whether the current process is a policy manager.
1391  *
1392  * Returns true if the current process is permitted to modify policy
1393  * via /sys/kernel/security/tomoyo/ interface.
1394  *
1395  * Caller holds tomoyo_read_lock().
1396  */
1397 static bool tomoyo_is_policy_manager(void)
1398 {
1399         struct tomoyo_policy_manager_entry *ptr;
1400         const char *exe;
1401         const struct task_struct *task = current;
1402         const struct tomoyo_path_info *domainname = tomoyo_domain()->domainname;
1403         bool found = false;
1404
1405         if (!tomoyo_policy_loaded)
1406                 return true;
1407         if (!tomoyo_manage_by_non_root && (task->cred->uid || task->cred->euid))
1408                 return false;
1409         list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list, list) {
1410                 if (!ptr->is_deleted && ptr->is_domain
1411                     && !tomoyo_pathcmp(domainname, ptr->manager)) {
1412                         found = true;
1413                         break;
1414                 }
1415         }
1416         if (found)
1417                 return true;
1418         exe = tomoyo_get_exe();
1419         if (!exe)
1420                 return false;
1421         list_for_each_entry_rcu(ptr, &tomoyo_policy_manager_list, list) {
1422                 if (!ptr->is_deleted && !ptr->is_domain
1423                     && !strcmp(exe, ptr->manager->name)) {
1424                         found = true;
1425                         break;
1426                 }
1427         }
1428         if (!found) { /* Reduce error messages. */
1429                 static pid_t last_pid;
1430                 const pid_t pid = current->pid;
1431                 if (last_pid != pid) {
1432                         printk(KERN_WARNING "%s ( %s ) is not permitted to "
1433                                "update policies.\n", domainname->name, exe);
1434                         last_pid = pid;
1435                 }
1436         }
1437         kfree(exe);
1438         return found;
1439 }
1440
1441 /**
1442  * tomoyo_is_select_one - Parse select command.
1443  *
1444  * @head: Pointer to "struct tomoyo_io_buffer".
1445  * @data: String to parse.
1446  *
1447  * Returns true on success, false otherwise.
1448  *
1449  * Caller holds tomoyo_read_lock().
1450  */
1451 static bool tomoyo_is_select_one(struct tomoyo_io_buffer *head,
1452                                  const char *data)
1453 {
1454         unsigned int pid;
1455         struct tomoyo_domain_info *domain = NULL;
1456
1457         if (sscanf(data, "pid=%u", &pid) == 1) {
1458                 struct task_struct *p;
1459                 rcu_read_lock();
1460                 read_lock(&tasklist_lock);
1461                 p = find_task_by_vpid(pid);
1462                 if (p)
1463                         domain = tomoyo_real_domain(p);
1464                 read_unlock(&tasklist_lock);
1465                 rcu_read_unlock();
1466         } else if (!strncmp(data, "domain=", 7)) {
1467                 if (tomoyo_is_domain_def(data + 7))
1468                         domain = tomoyo_find_domain(data + 7);
1469         } else
1470                 return false;
1471         head->write_var1 = domain;
1472         /* Accessing read_buf is safe because head->io_sem is held. */
1473         if (!head->read_buf)
1474                 return true; /* Do nothing if open(O_WRONLY). */
1475         head->read_avail = 0;
1476         tomoyo_io_printf(head, "# select %s\n", data);
1477         head->read_single_domain = true;
1478         head->read_eof = !domain;
1479         if (domain) {
1480                 struct tomoyo_domain_info *d;
1481                 head->read_var1 = NULL;
1482                 list_for_each_entry_rcu(d, &tomoyo_domain_list, list) {
1483                         if (d == domain)
1484                                 break;
1485                         head->read_var1 = &d->list;
1486                 }
1487                 head->read_var2 = NULL;
1488                 head->read_bit = 0;
1489                 head->read_step = 0;
1490                 if (domain->is_deleted)
1491                         tomoyo_io_printf(head, "# This is a deleted domain.\n");
1492         }
1493         return true;
1494 }
1495
1496 /**
1497  * tomoyo_delete_domain - Delete a domain.
1498  *
1499  * @domainname: The name of domain.
1500  *
1501  * Returns 0.
1502  *
1503  * Caller holds tomoyo_read_lock().
1504  */
1505 static int tomoyo_delete_domain(char *domainname)
1506 {
1507         struct tomoyo_domain_info *domain;
1508         struct tomoyo_path_info name;
1509
1510         name.name = domainname;
1511         tomoyo_fill_path_info(&name);
1512         if (mutex_lock_interruptible(&tomoyo_policy_lock))
1513                 return 0;
1514         /* Is there an active domain? */
1515         list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
1516                 /* Never delete tomoyo_kernel_domain */
1517                 if (domain == &tomoyo_kernel_domain)
1518                         continue;
1519                 if (domain->is_deleted ||
1520                     tomoyo_pathcmp(domain->domainname, &name))
1521                         continue;
1522                 domain->is_deleted = true;
1523                 break;
1524         }
1525         mutex_unlock(&tomoyo_policy_lock);
1526         return 0;
1527 }
1528
1529 /**
1530  * tomoyo_write_domain_policy - Write domain policy.
1531  *
1532  * @head: Pointer to "struct tomoyo_io_buffer".
1533  *
1534  * Returns 0 on success, negative value otherwise.
1535  *
1536  * Caller holds tomoyo_read_lock().
1537  */
1538 static int tomoyo_write_domain_policy(struct tomoyo_io_buffer *head)
1539 {
1540         char *data = head->write_buf;
1541         struct tomoyo_domain_info *domain = head->write_var1;
1542         bool is_delete = false;
1543         bool is_select = false;
1544         unsigned int profile;
1545
1546         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE))
1547                 is_delete = true;
1548         else if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_SELECT))
1549                 is_select = true;
1550         if (is_select && tomoyo_is_select_one(head, data))
1551                 return 0;
1552         /* Don't allow updating policies by non manager programs. */
1553         if (!tomoyo_is_policy_manager())
1554                 return -EPERM;
1555         if (tomoyo_is_domain_def(data)) {
1556                 domain = NULL;
1557                 if (is_delete)
1558                         tomoyo_delete_domain(data);
1559                 else if (is_select)
1560                         domain = tomoyo_find_domain(data);
1561                 else
1562                         domain = tomoyo_find_or_assign_new_domain(data, 0);
1563                 head->write_var1 = domain;
1564                 return 0;
1565         }
1566         if (!domain)
1567                 return -EINVAL;
1568
1569         if (sscanf(data, TOMOYO_KEYWORD_USE_PROFILE "%u", &profile) == 1
1570             && profile < TOMOYO_MAX_PROFILES) {
1571                 if (tomoyo_profile_ptr[profile] || !tomoyo_policy_loaded)
1572                         domain->profile = (u8) profile;
1573                 return 0;
1574         }
1575         if (!strcmp(data, TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ)) {
1576                 domain->ignore_global_allow_read = !is_delete;
1577                 return 0;
1578         }
1579         return tomoyo_write_file_policy(data, domain, is_delete);
1580 }
1581
1582 /**
1583  * tomoyo_print_path_acl - Print a single path ACL entry.
1584  *
1585  * @head: Pointer to "struct tomoyo_io_buffer".
1586  * @ptr:  Pointer to "struct tomoyo_path_acl".
1587  *
1588  * Returns true on success, false otherwise.
1589  */
1590 static bool tomoyo_print_path_acl(struct tomoyo_io_buffer *head,
1591                                   struct tomoyo_path_acl *ptr)
1592 {
1593         int pos;
1594         u8 bit;
1595         const u16 perm = ptr->perm;
1596
1597         for (bit = head->read_bit; bit < TOMOYO_MAX_PATH_OPERATION; bit++) {
1598                 if (!(perm & (1 << bit)))
1599                         continue;
1600                 /* Print "read/write" instead of "read" and "write". */
1601                 if ((bit == TOMOYO_TYPE_READ || bit == TOMOYO_TYPE_WRITE)
1602                     && (perm & (1 << TOMOYO_TYPE_READ_WRITE)))
1603                         continue;
1604                 pos = head->read_avail;
1605                 if (!tomoyo_io_printf(head, "allow_%s ",
1606                                       tomoyo_path2keyword(bit)) ||
1607                     !tomoyo_print_name_union(head, &ptr->name) ||
1608                     !tomoyo_io_printf(head, "\n"))
1609                         goto out;
1610         }
1611         head->read_bit = 0;
1612         return true;
1613  out:
1614         head->read_bit = bit;
1615         head->read_avail = pos;
1616         return false;
1617 }
1618
1619 /**
1620  * tomoyo_print_path2_acl - Print a double path ACL entry.
1621  *
1622  * @head: Pointer to "struct tomoyo_io_buffer".
1623  * @ptr:  Pointer to "struct tomoyo_path2_acl".
1624  *
1625  * Returns true on success, false otherwise.
1626  */
1627 static bool tomoyo_print_path2_acl(struct tomoyo_io_buffer *head,
1628                                    struct tomoyo_path2_acl *ptr)
1629 {
1630         int pos;
1631         const u8 perm = ptr->perm;
1632         u8 bit;
1633
1634         for (bit = head->read_bit; bit < TOMOYO_MAX_PATH2_OPERATION; bit++) {
1635                 if (!(perm & (1 << bit)))
1636                         continue;
1637                 pos = head->read_avail;
1638                 if (!tomoyo_io_printf(head, "allow_%s ",
1639                                       tomoyo_path22keyword(bit)) ||
1640                     !tomoyo_print_name_union(head, &ptr->name1) ||
1641                     !tomoyo_print_name_union(head, &ptr->name2) ||
1642                     !tomoyo_io_printf(head, "\n"))
1643                         goto out;
1644         }
1645         head->read_bit = 0;
1646         return true;
1647  out:
1648         head->read_bit = bit;
1649         head->read_avail = pos;
1650         return false;
1651 }
1652
1653 /**
1654  * tomoyo_print_path_number_acl - Print a path_number ACL entry.
1655  *
1656  * @head: Pointer to "struct tomoyo_io_buffer".
1657  * @ptr:  Pointer to "struct tomoyo_path_number_acl".
1658  *
1659  * Returns true on success, false otherwise.
1660  */
1661 static bool tomoyo_print_path_number_acl(struct tomoyo_io_buffer *head,
1662                                          struct tomoyo_path_number_acl *ptr)
1663 {
1664         int pos;
1665         u8 bit;
1666         const u8 perm = ptr->perm;
1667         for (bit = head->read_bit; bit < TOMOYO_MAX_PATH_NUMBER_OPERATION;
1668              bit++) {
1669                 if (!(perm & (1 << bit)))
1670                         continue;
1671                 pos = head->read_avail;
1672                 if (!tomoyo_io_printf(head, "allow_%s",
1673                                       tomoyo_path_number2keyword(bit)) ||
1674                     !tomoyo_print_name_union(head, &ptr->name) ||
1675                     !tomoyo_print_number_union(head, &ptr->number) ||
1676                     !tomoyo_io_printf(head, "\n"))
1677                         goto out;
1678         }
1679         head->read_bit = 0;
1680         return true;
1681  out:
1682         head->read_bit = bit;
1683         head->read_avail = pos;
1684         return false;
1685 }
1686
1687 /**
1688  * tomoyo_print_path_number3_acl - Print a path_number3 ACL entry.
1689  *
1690  * @head: Pointer to "struct tomoyo_io_buffer".
1691  * @ptr:  Pointer to "struct tomoyo_path_number3_acl".
1692  *
1693  * Returns true on success, false otherwise.
1694  */
1695 static bool tomoyo_print_path_number3_acl(struct tomoyo_io_buffer *head,
1696                                           struct tomoyo_path_number3_acl *ptr)
1697 {
1698         int pos;
1699         u8 bit;
1700         const u16 perm = ptr->perm;
1701         for (bit = head->read_bit; bit < TOMOYO_MAX_PATH_NUMBER3_OPERATION;
1702              bit++) {
1703                 if (!(perm & (1 << bit)))
1704                         continue;
1705                 pos = head->read_avail;
1706                 if (!tomoyo_io_printf(head, "allow_%s",
1707                                       tomoyo_path_number32keyword(bit)) ||
1708                     !tomoyo_print_name_union(head, &ptr->name) ||
1709                     !tomoyo_print_number_union(head, &ptr->mode) ||
1710                     !tomoyo_print_number_union(head, &ptr->major) ||
1711                     !tomoyo_print_number_union(head, &ptr->minor) ||
1712                     !tomoyo_io_printf(head, "\n"))
1713                         goto out;
1714         }
1715         head->read_bit = 0;
1716         return true;
1717  out:
1718         head->read_bit = bit;
1719         head->read_avail = pos;
1720         return false;
1721 }
1722
1723 /**
1724  * tomoyo_print_entry - Print an ACL entry.
1725  *
1726  * @head: Pointer to "struct tomoyo_io_buffer".
1727  * @ptr:  Pointer to an ACL entry.
1728  *
1729  * Returns true on success, false otherwise.
1730  */
1731 static bool tomoyo_print_entry(struct tomoyo_io_buffer *head,
1732                                struct tomoyo_acl_info *ptr)
1733 {
1734         const u8 acl_type = ptr->type;
1735
1736         if (acl_type == TOMOYO_TYPE_PATH_ACL) {
1737                 struct tomoyo_path_acl *acl
1738                         = container_of(ptr, struct tomoyo_path_acl, head);
1739                 return tomoyo_print_path_acl(head, acl);
1740         }
1741         if (acl_type == TOMOYO_TYPE_PATH2_ACL) {
1742                 struct tomoyo_path2_acl *acl
1743                         = container_of(ptr, struct tomoyo_path2_acl, head);
1744                 return tomoyo_print_path2_acl(head, acl);
1745         }
1746         if (acl_type == TOMOYO_TYPE_PATH_NUMBER_ACL) {
1747                 struct tomoyo_path_number_acl *acl
1748                         = container_of(ptr, struct tomoyo_path_number_acl,
1749                                        head);
1750                 return tomoyo_print_path_number_acl(head, acl);
1751         }
1752         if (acl_type == TOMOYO_TYPE_PATH_NUMBER3_ACL) {
1753                 struct tomoyo_path_number3_acl *acl
1754                         = container_of(ptr, struct tomoyo_path_number3_acl,
1755                                        head);
1756                 return tomoyo_print_path_number3_acl(head, acl);
1757         }
1758         BUG(); /* This must not happen. */
1759         return false;
1760 }
1761
1762 /**
1763  * tomoyo_read_domain_policy - Read domain policy.
1764  *
1765  * @head: Pointer to "struct tomoyo_io_buffer".
1766  *
1767  * Returns 0.
1768  *
1769  * Caller holds tomoyo_read_lock().
1770  */
1771 static int tomoyo_read_domain_policy(struct tomoyo_io_buffer *head)
1772 {
1773         struct list_head *dpos;
1774         struct list_head *apos;
1775         bool done = true;
1776
1777         if (head->read_eof)
1778                 return 0;
1779         if (head->read_step == 0)
1780                 head->read_step = 1;
1781         list_for_each_cookie(dpos, head->read_var1, &tomoyo_domain_list) {
1782                 struct tomoyo_domain_info *domain;
1783                 const char *quota_exceeded = "";
1784                 const char *transition_failed = "";
1785                 const char *ignore_global_allow_read = "";
1786                 domain = list_entry(dpos, struct tomoyo_domain_info, list);
1787                 if (head->read_step != 1)
1788                         goto acl_loop;
1789                 if (domain->is_deleted && !head->read_single_domain)
1790                         continue;
1791                 /* Print domainname and flags. */
1792                 if (domain->quota_warned)
1793                         quota_exceeded = "quota_exceeded\n";
1794                 if (domain->transition_failed)
1795                         transition_failed = "transition_failed\n";
1796                 if (domain->ignore_global_allow_read)
1797                         ignore_global_allow_read
1798                                 = TOMOYO_KEYWORD_IGNORE_GLOBAL_ALLOW_READ "\n";
1799                 done = tomoyo_io_printf(head, "%s\n" TOMOYO_KEYWORD_USE_PROFILE
1800                                         "%u\n%s%s%s\n",
1801                                         domain->domainname->name,
1802                                         domain->profile, quota_exceeded,
1803                                         transition_failed,
1804                                         ignore_global_allow_read);
1805                 if (!done)
1806                         break;
1807                 head->read_step = 2;
1808 acl_loop:
1809                 if (head->read_step == 3)
1810                         goto tail_mark;
1811                 /* Print ACL entries in the domain. */
1812                 list_for_each_cookie(apos, head->read_var2,
1813                                      &domain->acl_info_list) {
1814                         struct tomoyo_acl_info *ptr
1815                                 = list_entry(apos, struct tomoyo_acl_info,
1816                                              list);
1817                         done = tomoyo_print_entry(head, ptr);
1818                         if (!done)
1819                                 break;
1820                 }
1821                 if (!done)
1822                         break;
1823                 head->read_step = 3;
1824 tail_mark:
1825                 done = tomoyo_io_printf(head, "\n");
1826                 if (!done)
1827                         break;
1828                 head->read_step = 1;
1829                 if (head->read_single_domain)
1830                         break;
1831         }
1832         head->read_eof = done;
1833         return 0;
1834 }
1835
1836 /**
1837  * tomoyo_write_domain_profile - Assign profile for specified domain.
1838  *
1839  * @head: Pointer to "struct tomoyo_io_buffer".
1840  *
1841  * Returns 0 on success, -EINVAL otherwise.
1842  *
1843  * This is equivalent to doing
1844  *
1845  *     ( echo "select " $domainname; echo "use_profile " $profile ) |
1846  *     /usr/lib/ccs/loadpolicy -d
1847  *
1848  * Caller holds tomoyo_read_lock().
1849  */
1850 static int tomoyo_write_domain_profile(struct tomoyo_io_buffer *head)
1851 {
1852         char *data = head->write_buf;
1853         char *cp = strchr(data, ' ');
1854         struct tomoyo_domain_info *domain;
1855         unsigned long profile;
1856
1857         if (!cp)
1858                 return -EINVAL;
1859         *cp = '\0';
1860         domain = tomoyo_find_domain(cp + 1);
1861         if (strict_strtoul(data, 10, &profile))
1862                 return -EINVAL;
1863         if (domain && profile < TOMOYO_MAX_PROFILES
1864             && (tomoyo_profile_ptr[profile] || !tomoyo_policy_loaded))
1865                 domain->profile = (u8) profile;
1866         return 0;
1867 }
1868
1869 /**
1870  * tomoyo_read_domain_profile - Read only domainname and profile.
1871  *
1872  * @head: Pointer to "struct tomoyo_io_buffer".
1873  *
1874  * Returns list of profile number and domainname pairs.
1875  *
1876  * This is equivalent to doing
1877  *
1878  *     grep -A 1 '^<kernel>' /sys/kernel/security/tomoyo/domain_policy |
1879  *     awk ' { if ( domainname == "" ) { if ( $1 == "<kernel>" )
1880  *     domainname = $0; } else if ( $1 == "use_profile" ) {
1881  *     print $2 " " domainname; domainname = ""; } } ; '
1882  *
1883  * Caller holds tomoyo_read_lock().
1884  */
1885 static int tomoyo_read_domain_profile(struct tomoyo_io_buffer *head)
1886 {
1887         struct list_head *pos;
1888         bool done = true;
1889
1890         if (head->read_eof)
1891                 return 0;
1892         list_for_each_cookie(pos, head->read_var1, &tomoyo_domain_list) {
1893                 struct tomoyo_domain_info *domain;
1894                 domain = list_entry(pos, struct tomoyo_domain_info, list);
1895                 if (domain->is_deleted)
1896                         continue;
1897                 done = tomoyo_io_printf(head, "%u %s\n", domain->profile,
1898                                         domain->domainname->name);
1899                 if (!done)
1900                         break;
1901         }
1902         head->read_eof = done;
1903         return 0;
1904 }
1905
1906 /**
1907  * tomoyo_write_pid: Specify PID to obtain domainname.
1908  *
1909  * @head: Pointer to "struct tomoyo_io_buffer".
1910  *
1911  * Returns 0.
1912  */
1913 static int tomoyo_write_pid(struct tomoyo_io_buffer *head)
1914 {
1915         unsigned long pid;
1916         /* No error check. */
1917         strict_strtoul(head->write_buf, 10, &pid);
1918         head->read_step = (int) pid;
1919         head->read_eof = false;
1920         return 0;
1921 }
1922
1923 /**
1924  * tomoyo_read_pid - Get domainname of the specified PID.
1925  *
1926  * @head: Pointer to "struct tomoyo_io_buffer".
1927  *
1928  * Returns the domainname which the specified PID is in on success,
1929  * empty string otherwise.
1930  * The PID is specified by tomoyo_write_pid() so that the user can obtain
1931  * using read()/write() interface rather than sysctl() interface.
1932  */
1933 static int tomoyo_read_pid(struct tomoyo_io_buffer *head)
1934 {
1935         if (head->read_avail == 0 && !head->read_eof) {
1936                 const int pid = head->read_step;
1937                 struct task_struct *p;
1938                 struct tomoyo_domain_info *domain = NULL;
1939                 rcu_read_lock();
1940                 read_lock(&tasklist_lock);
1941                 p = find_task_by_vpid(pid);
1942                 if (p)
1943                         domain = tomoyo_real_domain(p);
1944                 read_unlock(&tasklist_lock);
1945                 rcu_read_unlock();
1946                 if (domain)
1947                         tomoyo_io_printf(head, "%d %u %s", pid, domain->profile,
1948                                          domain->domainname->name);
1949                 head->read_eof = true;
1950         }
1951         return 0;
1952 }
1953
1954 /**
1955  * tomoyo_write_exception_policy - Write exception policy.
1956  *
1957  * @head: Pointer to "struct tomoyo_io_buffer".
1958  *
1959  * Returns 0 on success, negative value otherwise.
1960  *
1961  * Caller holds tomoyo_read_lock().
1962  */
1963 static int tomoyo_write_exception_policy(struct tomoyo_io_buffer *head)
1964 {
1965         char *data = head->write_buf;
1966         bool is_delete = tomoyo_str_starts(&data, TOMOYO_KEYWORD_DELETE);
1967
1968         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_KEEP_DOMAIN))
1969                 return tomoyo_write_domain_keeper_policy(data, false,
1970                                                          is_delete);
1971         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NO_KEEP_DOMAIN))
1972                 return tomoyo_write_domain_keeper_policy(data, true, is_delete);
1973         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_INITIALIZE_DOMAIN))
1974                 return tomoyo_write_domain_initializer_policy(data, false,
1975                                                               is_delete);
1976         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NO_INITIALIZE_DOMAIN))
1977                 return tomoyo_write_domain_initializer_policy(data, true,
1978                                                               is_delete);
1979         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALIAS))
1980                 return tomoyo_write_alias_policy(data, is_delete);
1981         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_ALLOW_READ))
1982                 return tomoyo_write_globally_readable_policy(data, is_delete);
1983         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_FILE_PATTERN))
1984                 return tomoyo_write_pattern_policy(data, is_delete);
1985         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_DENY_REWRITE))
1986                 return tomoyo_write_no_rewrite_policy(data, is_delete);
1987         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_PATH_GROUP))
1988                 return tomoyo_write_path_group_policy(data, is_delete);
1989         if (tomoyo_str_starts(&data, TOMOYO_KEYWORD_NUMBER_GROUP))
1990                 return tomoyo_write_number_group_policy(data, is_delete);
1991         return -EINVAL;
1992 }
1993
1994 /**
1995  * tomoyo_read_exception_policy - Read exception policy.
1996  *
1997  * @head: Pointer to "struct tomoyo_io_buffer".
1998  *
1999  * Returns 0 on success, -EINVAL otherwise.
2000  *
2001  * Caller holds tomoyo_read_lock().
2002  */
2003 static int tomoyo_read_exception_policy(struct tomoyo_io_buffer *head)
2004 {
2005         if (!head->read_eof) {
2006                 switch (head->read_step) {
2007                 case 0:
2008                         head->read_var2 = NULL;
2009                         head->read_step = 1;
2010                 case 1:
2011                         if (!tomoyo_read_domain_keeper_policy(head))
2012                                 break;
2013                         head->read_var2 = NULL;
2014                         head->read_step = 2;
2015                 case 2:
2016                         if (!tomoyo_read_globally_readable_policy(head))
2017                                 break;
2018                         head->read_var2 = NULL;
2019                         head->read_step = 3;
2020                 case 3:
2021                         head->read_var2 = NULL;
2022                         head->read_step = 4;
2023                 case 4:
2024                         if (!tomoyo_read_domain_initializer_policy(head))
2025                                 break;
2026                         head->read_var2 = NULL;
2027                         head->read_step = 5;
2028                 case 5:
2029                         if (!tomoyo_read_alias_policy(head))
2030                                 break;
2031                         head->read_var2 = NULL;
2032                         head->read_step = 6;
2033                 case 6:
2034                         head->read_var2 = NULL;
2035                         head->read_step = 7;
2036                 case 7:
2037                         if (!tomoyo_read_file_pattern(head))
2038                                 break;
2039                         head->read_var2 = NULL;
2040                         head->read_step = 8;
2041                 case 8:
2042                         if (!tomoyo_read_no_rewrite_policy(head))
2043                                 break;
2044                         head->read_var2 = NULL;
2045                         head->read_step = 9;
2046                 case 9:
2047                         if (!tomoyo_read_path_group_policy(head))
2048                                 break;
2049                         head->read_var1 = NULL;
2050                         head->read_var2 = NULL;
2051                         head->read_step = 10;
2052                 case 10:
2053                         if (!tomoyo_read_number_group_policy(head))
2054                                 break;
2055                         head->read_var1 = NULL;
2056                         head->read_var2 = NULL;
2057                         head->read_step = 11;
2058                 case 11:
2059                         head->read_eof = true;
2060                         break;
2061                 default:
2062                         return -EINVAL;
2063                 }
2064         }
2065         return 0;
2066 }
2067
2068 /* path to policy loader */
2069 static const char *tomoyo_loader = "/sbin/tomoyo-init";
2070
2071 /**
2072  * tomoyo_policy_loader_exists - Check whether /sbin/tomoyo-init exists.
2073  *
2074  * Returns true if /sbin/tomoyo-init exists, false otherwise.
2075  */
2076 static bool tomoyo_policy_loader_exists(void)
2077 {
2078         /*
2079          * Don't activate MAC if the policy loader doesn't exist.
2080          * If the initrd includes /sbin/init but real-root-dev has not
2081          * mounted on / yet, activating MAC will block the system since
2082          * policies are not loaded yet.
2083          * Thus, let do_execve() call this function everytime.
2084          */
2085         struct path path;
2086
2087         if (kern_path(tomoyo_loader, LOOKUP_FOLLOW, &path)) {
2088                 printk(KERN_INFO "Not activating Mandatory Access Control now "
2089                        "since %s doesn't exist.\n", tomoyo_loader);
2090                 return false;
2091         }
2092         path_put(&path);
2093         return true;
2094 }
2095
2096 /**
2097  * tomoyo_load_policy - Run external policy loader to load policy.
2098  *
2099  * @filename: The program about to start.
2100  *
2101  * This function checks whether @filename is /sbin/init , and if so
2102  * invoke /sbin/tomoyo-init and wait for the termination of /sbin/tomoyo-init
2103  * and then continues invocation of /sbin/init.
2104  * /sbin/tomoyo-init reads policy files in /etc/tomoyo/ directory and
2105  * writes to /sys/kernel/security/tomoyo/ interfaces.
2106  *
2107  * Returns nothing.
2108  */
2109 void tomoyo_load_policy(const char *filename)
2110 {
2111         char *argv[2];
2112         char *envp[3];
2113
2114         if (tomoyo_policy_loaded)
2115                 return;
2116         /*
2117          * Check filename is /sbin/init or /sbin/tomoyo-start.
2118          * /sbin/tomoyo-start is a dummy filename in case where /sbin/init can't
2119          * be passed.
2120          * You can create /sbin/tomoyo-start by
2121          * "ln -s /bin/true /sbin/tomoyo-start".
2122          */
2123         if (strcmp(filename, "/sbin/init") &&
2124             strcmp(filename, "/sbin/tomoyo-start"))
2125                 return;
2126         if (!tomoyo_policy_loader_exists())
2127                 return;
2128
2129         printk(KERN_INFO "Calling %s to load policy. Please wait.\n",
2130                tomoyo_loader);
2131         argv[0] = (char *) tomoyo_loader;
2132         argv[1] = NULL;
2133         envp[0] = "HOME=/";
2134         envp[1] = "PATH=/sbin:/bin:/usr/sbin:/usr/bin";
2135         envp[2] = NULL;
2136         call_usermodehelper(argv[0], argv, envp, 1);
2137
2138         printk(KERN_INFO "TOMOYO: 2.2.0   2009/04/01\n");
2139         printk(KERN_INFO "Mandatory Access Control activated.\n");
2140         tomoyo_policy_loaded = true;
2141         { /* Check all profiles currently assigned to domains are defined. */
2142                 struct tomoyo_domain_info *domain;
2143                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
2144                         const u8 profile = domain->profile;
2145                         if (tomoyo_profile_ptr[profile])
2146                                 continue;
2147                         panic("Profile %u (used by '%s') not defined.\n",
2148                               profile, domain->domainname->name);
2149                 }
2150         }
2151 }
2152
2153 /**
2154  * tomoyo_read_version: Get version.
2155  *
2156  * @head: Pointer to "struct tomoyo_io_buffer".
2157  *
2158  * Returns version information.
2159  */
2160 static int tomoyo_read_version(struct tomoyo_io_buffer *head)
2161 {
2162         if (!head->read_eof) {
2163                 tomoyo_io_printf(head, "2.2.0");
2164                 head->read_eof = true;
2165         }
2166         return 0;
2167 }
2168
2169 /**
2170  * tomoyo_read_self_domain - Get the current process's domainname.
2171  *
2172  * @head: Pointer to "struct tomoyo_io_buffer".
2173  *
2174  * Returns the current process's domainname.
2175  */
2176 static int tomoyo_read_self_domain(struct tomoyo_io_buffer *head)
2177 {
2178         if (!head->read_eof) {
2179                 /*
2180                  * tomoyo_domain()->domainname != NULL
2181                  * because every process belongs to a domain and
2182                  * the domain's name cannot be NULL.
2183                  */
2184                 tomoyo_io_printf(head, "%s", tomoyo_domain()->domainname->name);
2185                 head->read_eof = true;
2186         }
2187         return 0;
2188 }
2189
2190 /**
2191  * tomoyo_open_control - open() for /sys/kernel/security/tomoyo/ interface.
2192  *
2193  * @type: Type of interface.
2194  * @file: Pointer to "struct file".
2195  *
2196  * Associates policy handler and returns 0 on success, -ENOMEM otherwise.
2197  *
2198  * Caller acquires tomoyo_read_lock().
2199  */
2200 static int tomoyo_open_control(const u8 type, struct file *file)
2201 {
2202         struct tomoyo_io_buffer *head = kzalloc(sizeof(*head), GFP_NOFS);
2203
2204         if (!head)
2205                 return -ENOMEM;
2206         mutex_init(&head->io_sem);
2207         switch (type) {
2208         case TOMOYO_DOMAINPOLICY:
2209                 /* /sys/kernel/security/tomoyo/domain_policy */
2210                 head->write = tomoyo_write_domain_policy;
2211                 head->read = tomoyo_read_domain_policy;
2212                 break;
2213         case TOMOYO_EXCEPTIONPOLICY:
2214                 /* /sys/kernel/security/tomoyo/exception_policy */
2215                 head->write = tomoyo_write_exception_policy;
2216                 head->read = tomoyo_read_exception_policy;
2217                 break;
2218         case TOMOYO_SELFDOMAIN:
2219                 /* /sys/kernel/security/tomoyo/self_domain */
2220                 head->read = tomoyo_read_self_domain;
2221                 break;
2222         case TOMOYO_DOMAIN_STATUS:
2223                 /* /sys/kernel/security/tomoyo/.domain_status */
2224                 head->write = tomoyo_write_domain_profile;
2225                 head->read = tomoyo_read_domain_profile;
2226                 break;
2227         case TOMOYO_PROCESS_STATUS:
2228                 /* /sys/kernel/security/tomoyo/.process_status */
2229                 head->write = tomoyo_write_pid;
2230                 head->read = tomoyo_read_pid;
2231                 break;
2232         case TOMOYO_VERSION:
2233                 /* /sys/kernel/security/tomoyo/version */
2234                 head->read = tomoyo_read_version;
2235                 head->readbuf_size = 128;
2236                 break;
2237         case TOMOYO_MEMINFO:
2238                 /* /sys/kernel/security/tomoyo/meminfo */
2239                 head->write = tomoyo_write_memory_quota;
2240                 head->read = tomoyo_read_memory_counter;
2241                 head->readbuf_size = 512;
2242                 break;
2243         case TOMOYO_PROFILE:
2244                 /* /sys/kernel/security/tomoyo/profile */
2245                 head->write = tomoyo_write_profile;
2246                 head->read = tomoyo_read_profile;
2247                 break;
2248         case TOMOYO_MANAGER:
2249                 /* /sys/kernel/security/tomoyo/manager */
2250                 head->write = tomoyo_write_manager_policy;
2251                 head->read = tomoyo_read_manager_policy;
2252                 break;
2253         }
2254         if (!(file->f_mode & FMODE_READ)) {
2255                 /*
2256                  * No need to allocate read_buf since it is not opened
2257                  * for reading.
2258                  */
2259                 head->read = NULL;
2260         } else {
2261                 if (!head->readbuf_size)
2262                         head->readbuf_size = 4096 * 2;
2263                 head->read_buf = kzalloc(head->readbuf_size, GFP_NOFS);
2264                 if (!head->read_buf) {
2265                         kfree(head);
2266                         return -ENOMEM;
2267                 }
2268         }
2269         if (!(file->f_mode & FMODE_WRITE)) {
2270                 /*
2271                  * No need to allocate write_buf since it is not opened
2272                  * for writing.
2273                  */
2274                 head->write = NULL;
2275         } else if (head->write) {
2276                 head->writebuf_size = 4096 * 2;
2277                 head->write_buf = kzalloc(head->writebuf_size, GFP_NOFS);
2278                 if (!head->write_buf) {
2279                         kfree(head->read_buf);
2280                         kfree(head);
2281                         return -ENOMEM;
2282                 }
2283         }
2284         head->reader_idx = tomoyo_read_lock();
2285         file->private_data = head;
2286         /*
2287          * Call the handler now if the file is
2288          * /sys/kernel/security/tomoyo/self_domain
2289          * so that the user can use
2290          * cat < /sys/kernel/security/tomoyo/self_domain"
2291          * to know the current process's domainname.
2292          */
2293         if (type == TOMOYO_SELFDOMAIN)
2294                 tomoyo_read_control(file, NULL, 0);
2295         return 0;
2296 }
2297
2298 /**
2299  * tomoyo_read_control - read() for /sys/kernel/security/tomoyo/ interface.
2300  *
2301  * @file:       Pointer to "struct file".
2302  * @buffer:     Poiner to buffer to write to.
2303  * @buffer_len: Size of @buffer.
2304  *
2305  * Returns bytes read on success, negative value otherwise.
2306  *
2307  * Caller holds tomoyo_read_lock().
2308  */
2309 static int tomoyo_read_control(struct file *file, char __user *buffer,
2310                                const int buffer_len)
2311 {
2312         int len = 0;
2313         struct tomoyo_io_buffer *head = file->private_data;
2314         char *cp;
2315
2316         if (!head->read)
2317                 return -ENOSYS;
2318         if (mutex_lock_interruptible(&head->io_sem))
2319                 return -EINTR;
2320         /* Call the policy handler. */
2321         len = head->read(head);
2322         if (len < 0)
2323                 goto out;
2324         /* Write to buffer. */
2325         len = head->read_avail;
2326         if (len > buffer_len)
2327                 len = buffer_len;
2328         if (!len)
2329                 goto out;
2330         /* head->read_buf changes by some functions. */
2331         cp = head->read_buf;
2332         if (copy_to_user(buffer, cp, len)) {
2333                 len = -EFAULT;
2334                 goto out;
2335         }
2336         head->read_avail -= len;
2337         memmove(cp, cp + len, head->read_avail);
2338  out:
2339         mutex_unlock(&head->io_sem);
2340         return len;
2341 }
2342
2343 /**
2344  * tomoyo_write_control - write() for /sys/kernel/security/tomoyo/ interface.
2345  *
2346  * @file:       Pointer to "struct file".
2347  * @buffer:     Pointer to buffer to read from.
2348  * @buffer_len: Size of @buffer.
2349  *
2350  * Returns @buffer_len on success, negative value otherwise.
2351  *
2352  * Caller holds tomoyo_read_lock().
2353  */
2354 static int tomoyo_write_control(struct file *file, const char __user *buffer,
2355                                 const int buffer_len)
2356 {
2357         struct tomoyo_io_buffer *head = file->private_data;
2358         int error = buffer_len;
2359         int avail_len = buffer_len;
2360         char *cp0 = head->write_buf;
2361
2362         if (!head->write)
2363                 return -ENOSYS;
2364         if (!access_ok(VERIFY_READ, buffer, buffer_len))
2365                 return -EFAULT;
2366         /* Don't allow updating policies by non manager programs. */
2367         if (head->write != tomoyo_write_pid &&
2368             head->write != tomoyo_write_domain_policy &&
2369             !tomoyo_is_policy_manager())
2370                 return -EPERM;
2371         if (mutex_lock_interruptible(&head->io_sem))
2372                 return -EINTR;
2373         /* Read a line and dispatch it to the policy handler. */
2374         while (avail_len > 0) {
2375                 char c;
2376                 if (head->write_avail >= head->writebuf_size - 1) {
2377                         error = -ENOMEM;
2378                         break;
2379                 } else if (get_user(c, buffer)) {
2380                         error = -EFAULT;
2381                         break;
2382                 }
2383                 buffer++;
2384                 avail_len--;
2385                 cp0[head->write_avail++] = c;
2386                 if (c != '\n')
2387                         continue;
2388                 cp0[head->write_avail - 1] = '\0';
2389                 head->write_avail = 0;
2390                 tomoyo_normalize_line(cp0);
2391                 head->write(head);
2392         }
2393         mutex_unlock(&head->io_sem);
2394         return error;
2395 }
2396
2397 /**
2398  * tomoyo_close_control - close() for /sys/kernel/security/tomoyo/ interface.
2399  *
2400  * @file: Pointer to "struct file".
2401  *
2402  * Releases memory and returns 0.
2403  *
2404  * Caller looses tomoyo_read_lock().
2405  */
2406 static int tomoyo_close_control(struct file *file)
2407 {
2408         struct tomoyo_io_buffer *head = file->private_data;
2409         const bool is_write = !!head->write_buf;
2410
2411         tomoyo_read_unlock(head->reader_idx);
2412         /* Release memory used for policy I/O. */
2413         kfree(head->read_buf);
2414         head->read_buf = NULL;
2415         kfree(head->write_buf);
2416         head->write_buf = NULL;
2417         kfree(head);
2418         head = NULL;
2419         file->private_data = NULL;
2420         if (is_write)
2421                 tomoyo_run_gc();
2422         return 0;
2423 }
2424
2425 /**
2426  * tomoyo_open - open() for /sys/kernel/security/tomoyo/ interface.
2427  *
2428  * @inode: Pointer to "struct inode".
2429  * @file:  Pointer to "struct file".
2430  *
2431  * Returns 0 on success, negative value otherwise.
2432  */
2433 static int tomoyo_open(struct inode *inode, struct file *file)
2434 {
2435         const int key = ((u8 *) file->f_path.dentry->d_inode->i_private)
2436                 - ((u8 *) NULL);
2437         return tomoyo_open_control(key, file);
2438 }
2439
2440 /**
2441  * tomoyo_release - close() for /sys/kernel/security/tomoyo/ interface.
2442  *
2443  * @inode: Pointer to "struct inode".
2444  * @file:  Pointer to "struct file".
2445  *
2446  * Returns 0 on success, negative value otherwise.
2447  */
2448 static int tomoyo_release(struct inode *inode, struct file *file)
2449 {
2450         return tomoyo_close_control(file);
2451 }
2452
2453 /**
2454  * tomoyo_read - read() for /sys/kernel/security/tomoyo/ interface.
2455  *
2456  * @file:  Pointer to "struct file".
2457  * @buf:   Pointer to buffer.
2458  * @count: Size of @buf.
2459  * @ppos:  Unused.
2460  *
2461  * Returns bytes read on success, negative value otherwise.
2462  */
2463 static ssize_t tomoyo_read(struct file *file, char __user *buf, size_t count,
2464                            loff_t *ppos)
2465 {
2466         return tomoyo_read_control(file, buf, count);
2467 }
2468
2469 /**
2470  * tomoyo_write - write() for /sys/kernel/security/tomoyo/ interface.
2471  *
2472  * @file:  Pointer to "struct file".
2473  * @buf:   Pointer to buffer.
2474  * @count: Size of @buf.
2475  * @ppos:  Unused.
2476  *
2477  * Returns @count on success, negative value otherwise.
2478  */
2479 static ssize_t tomoyo_write(struct file *file, const char __user *buf,
2480                             size_t count, loff_t *ppos)
2481 {
2482         return tomoyo_write_control(file, buf, count);
2483 }
2484
2485 /*
2486  * tomoyo_operations is a "struct file_operations" which is used for handling
2487  * /sys/kernel/security/tomoyo/ interface.
2488  *
2489  * Some files under /sys/kernel/security/tomoyo/ directory accept open(O_RDWR).
2490  * See tomoyo_io_buffer for internals.
2491  */
2492 static const struct file_operations tomoyo_operations = {
2493         .open    = tomoyo_open,
2494         .release = tomoyo_release,
2495         .read    = tomoyo_read,
2496         .write   = tomoyo_write,
2497 };
2498
2499 /**
2500  * tomoyo_create_entry - Create interface files under /sys/kernel/security/tomoyo/ directory.
2501  *
2502  * @name:   The name of the interface file.
2503  * @mode:   The permission of the interface file.
2504  * @parent: The parent directory.
2505  * @key:    Type of interface.
2506  *
2507  * Returns nothing.
2508  */
2509 static void __init tomoyo_create_entry(const char *name, const mode_t mode,
2510                                        struct dentry *parent, const u8 key)
2511 {
2512         securityfs_create_file(name, mode, parent, ((u8 *) NULL) + key,
2513                                &tomoyo_operations);
2514 }
2515
2516 /**
2517  * tomoyo_initerface_init - Initialize /sys/kernel/security/tomoyo/ interface.
2518  *
2519  * Returns 0.
2520  */
2521 static int __init tomoyo_initerface_init(void)
2522 {
2523         struct dentry *tomoyo_dir;
2524
2525         /* Don't create securityfs entries unless registered. */
2526         if (current_cred()->security != &tomoyo_kernel_domain)
2527                 return 0;
2528
2529         tomoyo_dir = securityfs_create_dir("tomoyo", NULL);
2530         tomoyo_create_entry("domain_policy",    0600, tomoyo_dir,
2531                             TOMOYO_DOMAINPOLICY);
2532         tomoyo_create_entry("exception_policy", 0600, tomoyo_dir,
2533                             TOMOYO_EXCEPTIONPOLICY);
2534         tomoyo_create_entry("self_domain",      0400, tomoyo_dir,
2535                             TOMOYO_SELFDOMAIN);
2536         tomoyo_create_entry(".domain_status",   0600, tomoyo_dir,
2537                             TOMOYO_DOMAIN_STATUS);
2538         tomoyo_create_entry(".process_status",  0600, tomoyo_dir,
2539                             TOMOYO_PROCESS_STATUS);
2540         tomoyo_create_entry("meminfo",          0600, tomoyo_dir,
2541                             TOMOYO_MEMINFO);
2542         tomoyo_create_entry("profile",          0600, tomoyo_dir,
2543                             TOMOYO_PROFILE);
2544         tomoyo_create_entry("manager",          0600, tomoyo_dir,
2545                             TOMOYO_MANAGER);
2546         tomoyo_create_entry("version",          0400, tomoyo_dir,
2547                             TOMOYO_VERSION);
2548         return 0;
2549 }
2550
2551 fs_initcall(tomoyo_initerface_init);