security/tomoyo/number_group.c

   1 /*
   2  * security/tomoyo/number_group.c
   3  *
   4  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   5  */
   6
   7 #include <linux/slab.h>
   8 #include "common.h"
   9
  10 /* The list for "struct tomoyo_number_group". */
  11 LIST_HEAD(tomoyo_number_group_list);
  12
  13 /**
  14  * tomoyo_get_number_group - Allocate memory for "struct tomoyo_number_group".
  15  *
  16  * @group_name: The name of number group.
  17  *
  18  * Returns pointer to "struct tomoyo_number_group" on success,
  19  * NULL otherwise.
  20  */
  21 struct tomoyo_number_group *tomoyo_get_number_group(const char *group_name)
  22 {
  23         struct tomoyo_number_group *entry = NULL;
  24         struct tomoyo_number_group *group = NULL;
  25         const struct tomoyo_path_info *saved_group_name;
  26         int error = -ENOMEM;
  27         if (!tomoyo_is_correct_path(group_name, 0, 0, 0) ||
  28             !group_name[0])
  29                 return NULL;
  30         saved_group_name = tomoyo_get_name(group_name);
  31         if (!saved_group_name)
  32                 return NULL;
  33         entry = kzalloc(sizeof(*entry), GFP_NOFS);
  34         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  35                 goto out;
  36         list_for_each_entry_rcu(group, &tomoyo_number_group_list, list) {
  37                 if (saved_group_name != group->group_name)
  38                         continue;
  39                 atomic_inc(&group->users);
  40                 error = 0;
  41                 break;
  42         }
  43         if (error && tomoyo_memory_ok(entry)) {
  44                 INIT_LIST_HEAD(&entry->member_list);
  45                 entry->group_name = saved_group_name;
  46                 saved_group_name = NULL;
  47                 atomic_set(&entry->users, 1);
  48                 list_add_tail_rcu(&entry->list, &tomoyo_number_group_list);
  49                 group = entry;
  50                 entry = NULL;
  51                 error = 0;
  52         }
  53         mutex_unlock(&tomoyo_policy_lock);
  54  out:
  55         tomoyo_put_name(saved_group_name);
  56         kfree(entry);
  57         return !error ? group : NULL;
  58 }
  59
  60 /**
  61  * tomoyo_write_number_group_policy - Write "struct tomoyo_number_group" list.
  62  *
  63  * @data:      String to parse.
  64  * @is_delete: True if it is a delete request.
  65  *
  66  * Returns 0 on success, nagative value otherwise.
  67  */
  68 int tomoyo_write_number_group_policy(char *data, const bool is_delete)
  69 {
  70         struct tomoyo_number_group *group;
  71         struct tomoyo_number_group_member e = { };
  72         struct tomoyo_number_group_member *member;
  73         int error = is_delete ? -ENOENT : -ENOMEM;
  74         char *w[2];
  75         if (!tomoyo_tokenize(data, w, sizeof(w)))
  76                 return -EINVAL;
  77         if (!tomoyo_parse_number_union(w[1], &e.number))
  78                 return -EINVAL;
  79         if (e.number.is_group || e.number.values[0] > e.number.values[1]) {
  80                 tomoyo_put_number_union(&e.number);
  81                 return -EINVAL;
  82         }
  83         group = tomoyo_get_number_group(w[0]);
  84         if (!group)
  85                 return -ENOMEM;
  86         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  87                 goto out;
  88         list_for_each_entry_rcu(member, &group->member_list, list) {
  89                 if (memcmp(&member->number, &e.number, sizeof(e.number)))
  90                         continue;
  91                 member->is_deleted = is_delete;
  92                 error = 0;
  93                 break;
  94         }
  95         if (!is_delete && error) {
  96                 struct tomoyo_number_group_member *entry =
  97                         tomoyo_commit_ok(&e, sizeof(e));
  98                 if (entry) {
  99                         list_add_tail_rcu(&entry->list, &group->member_list);
 100                         error = 0;
 101                 }
 102         }
 103         mutex_unlock(&tomoyo_policy_lock);
 104  out:
 105         tomoyo_put_number_group(group);
 106         return error;
 107 }
 108
 109 /**
 110  * tomoyo_read_number_group_policy - Read "struct tomoyo_number_group" list.
 111  *
 112  * @head: Pointer to "struct tomoyo_io_buffer".
 113  *
 114  * Returns true on success, false otherwise.
 115  *
 116  * Caller holds tomoyo_read_lock().
 117  */
 118 bool tomoyo_read_number_group_policy(struct tomoyo_io_buffer *head)
 119 {
 120         struct list_head *gpos;
 121         struct list_head *mpos;
 122         list_for_each_cookie(gpos, head->read_var1, &tomoyo_number_group_list) {
 123                 struct tomoyo_number_group *group;
 124                 const char *name;
 125                 group = list_entry(gpos, struct tomoyo_number_group, list);
 126                 name = group->group_name->name;
 127                 list_for_each_cookie(mpos, head->read_var2,
 128                                      &group->member_list) {
 129                         int pos;
 130                         const struct tomoyo_number_group_member *member
 131                                 = list_entry(mpos,
 132                                              struct tomoyo_number_group_member,
 133                                              list);
 134                         if (member->is_deleted)
 135                                 continue;
 136                         pos = head->read_avail;
 137                         if (!tomoyo_io_printf(head, TOMOYO_KEYWORD_NUMBER_GROUP
 138                                               "%s", name) ||
 139                             !tomoyo_print_number_union(head, &member->number) ||
 140                             !tomoyo_io_printf(head, "\n")) {
 141                                 head->read_avail = pos;
 142                                 return false;
 143                         }
 144                 }
 145         }
 146         return true;
 147 }
 148
 149 /**
 150  * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
 151  *
 152  * @min:   Min number.
 153  * @max:   Max number.
 154  * @group: Pointer to "struct tomoyo_number_group".
 155  *
 156  * Returns true if @min and @max partially overlaps @group, false otherwise.
 157  *
 158  * Caller holds tomoyo_read_lock().
 159  */
 160 bool tomoyo_number_matches_group(const unsigned long min,
 161                                  const unsigned long max,
 162                                  const struct tomoyo_number_group *group)
 163 {
 164         struct tomoyo_number_group_member *member;
 165         bool matched = false;
 166         list_for_each_entry_rcu(member, &group->member_list, list) {
 167                 if (member->is_deleted)
 168                         continue;
 169                 if (min > member->number.values[1] ||
 170                     max < member->number.values[0])
 171                         continue;
 172                 matched = true;
 173                 break;
 174         }
 175         return matched;
 176 }