TOMOYO: Fix quota and garbage collector.

[linux-beck.git] / security / tomoyo / util.c

diff --git a/security/tomoyo/util.c b/security/tomoyo/util.c
index 7ff54c95e1f25c45440d97395723416a7be1dbb5..4a9b4b2eb755c0129d408b371ebb3f102b862662 100644 (file)
--- a/security/tomoyo/util.c
+++ b/security/tomoyo/util.c
@@ -1,9 +1,7 @@
 /*
  * security/tomoyo/util.c
  *
- * Utility functions for TOMOYO.
- *
- * Copyright (C) 2005-2010  NTT DATA CORPORATION
+ * Copyright (C) 2005-2011  NTT DATA CORPORATION
  */
 
 #include <linux/slab.h>
@@ -44,6 +42,39 @@ const u8 tomoyo_index2category[TOMOYO_MAX_MAC_INDEX] = {
        [TOMOYO_MAC_FILE_MOUNT]      = TOMOYO_MAC_CATEGORY_FILE,
        [TOMOYO_MAC_FILE_UMOUNT]     = TOMOYO_MAC_CATEGORY_FILE,
        [TOMOYO_MAC_FILE_PIVOT_ROOT] = TOMOYO_MAC_CATEGORY_FILE,
+       /* CONFIG::network group */
+       [TOMOYO_MAC_NETWORK_INET_STREAM_BIND]       =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_STREAM_LISTEN]     =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_STREAM_CONNECT]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_BIND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_DGRAM_SEND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_RAW_BIND]          =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_INET_RAW_SEND]          =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_BIND]       =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_LISTEN]     =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_STREAM_CONNECT]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_BIND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_DGRAM_SEND]        =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_BIND]    =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_LISTEN]  =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       [TOMOYO_MAC_NETWORK_UNIX_SEQPACKET_CONNECT] =
+       TOMOYO_MAC_CATEGORY_NETWORK,
+       /* CONFIG::misc group */
+       [TOMOYO_MAC_ENVIRON]         = TOMOYO_MAC_CATEGORY_MISC,
 };
 
 /**
@@ -127,6 +158,31 @@ char *tomoyo_read_token(struct tomoyo_acl_param *param)
        return pos;
 }
 
+/**
+ * tomoyo_get_domainname - Read a domainname from a line.
+ *
+ * @param: Pointer to "struct tomoyo_acl_param".
+ *
+ * Returns a domainname on success, NULL otherwise.
+ */
+const struct tomoyo_path_info *tomoyo_get_domainname
+(struct tomoyo_acl_param *param)
+{
+       char *start = param->data;
+       char *pos = start;
+       while (*pos) {
+               if (*pos++ != ' ' || *pos++ == '/')
+                       continue;
+               pos -= 2;
+               *pos++ = '\0';
+               break;
+       }
+       param->data = pos;
+       if (tomoyo_correct_domain(start))
+               return tomoyo_get_name(start);
+       return NULL;
+}
+
 /**
  * tomoyo_parse_ulong - Parse an "unsigned long" value.
  *
@@ -138,7 +194,7 @@ char *tomoyo_read_token(struct tomoyo_acl_param *param)
  * The @src is updated to point the first character after the value
  * on success.
  */
-static u8 tomoyo_parse_ulong(unsigned long *result, char **str)
+u8 tomoyo_parse_ulong(unsigned long *result, char **str)
 {
        const char *cp = *str;
        char *ep;
@@ -378,7 +434,7 @@ void tomoyo_normalize_line(unsigned char *buffer)
 /**
  * tomoyo_correct_word2 - Validate a string.
  *
- * @string: The string to check. May be non-'\0'-terminated.
+ * @string: The string to check. Maybe non-'\0'-terminated.
  * @len:    Length of @string.
  *
  * Check whether the given string follows the naming rules.
@@ -922,14 +978,17 @@ int tomoyo_get_mode(const struct tomoyo_policy_namespace *ns, const u8 profile,
                    const u8 index)
 {
        u8 mode;
-       const u8 category = TOMOYO_MAC_CATEGORY_FILE;
+       struct tomoyo_profile *p;
+
        if (!tomoyo_policy_loaded)
                return TOMOYO_CONFIG_DISABLED;
-       mode = tomoyo_profile(ns, profile)->config[index];
+       p = tomoyo_profile(ns, profile);
+       mode = p->config[index];
        if (mode == TOMOYO_CONFIG_USE_DEFAULT)
-               mode = tomoyo_profile(ns, profile)->config[category];
+               mode = p->config[tomoyo_index2category[index]
+                                + TOMOYO_MAX_MAC_INDEX];
        if (mode == TOMOYO_CONFIG_USE_DEFAULT)
-               mode = tomoyo_profile(ns, profile)->default_config;
+               mode = p->default_config;
        return mode & 3;
 }
 
@@ -998,6 +1057,17 @@ bool tomoyo_domain_quota_is_ok(struct tomoyo_request_info *r)
                        perm = container_of(ptr, struct tomoyo_mkdev_acl,
                                            head)->perm;
                        break;
+               case TOMOYO_TYPE_INET_ACL:
+                       perm = container_of(ptr, struct tomoyo_inet_acl,
+                                           head)->perm;
+                       break;
+               case TOMOYO_TYPE_UNIX_ACL:
+                       perm = container_of(ptr, struct tomoyo_unix_acl,
+                                           head)->perm;
+                       break;
+               case TOMOYO_TYPE_MANUAL_TASK_ACL:
+                       perm = 0;
+                       break;
                default:
                        perm = 1;
                }