]>
Commit | Line | Data |
---|---|---|
1 | /* | |
2 | * security/tomoyo/gc.c | |
3 | * | |
4 | * Implementation of the Domain-Based Mandatory Access Control. | |
5 | * | |
6 | * Copyright (C) 2005-2010 NTT DATA CORPORATION | |
7 | * | |
8 | */ | |
9 | ||
10 | #include "common.h" | |
11 | #include <linux/kthread.h> | |
12 | #include <linux/slab.h> | |
13 | ||
14 | struct tomoyo_gc { | |
15 | struct list_head list; | |
16 | int type; | |
17 | struct list_head *element; | |
18 | }; | |
19 | static LIST_HEAD(tomoyo_gc_queue); | |
20 | static DEFINE_MUTEX(tomoyo_gc_mutex); | |
21 | ||
22 | /* Caller holds tomoyo_policy_lock mutex. */ | |
23 | static bool tomoyo_add_to_gc(const int type, struct list_head *element) | |
24 | { | |
25 | struct tomoyo_gc *entry = kzalloc(sizeof(*entry), GFP_ATOMIC); | |
26 | if (!entry) | |
27 | return false; | |
28 | entry->type = type; | |
29 | entry->element = element; | |
30 | list_add(&entry->list, &tomoyo_gc_queue); | |
31 | list_del_rcu(element); | |
32 | return true; | |
33 | } | |
34 | ||
35 | static void tomoyo_del_allow_read(struct list_head *element) | |
36 | { | |
37 | struct tomoyo_readable_file *ptr = | |
38 | container_of(element, typeof(*ptr), head.list); | |
39 | tomoyo_put_name(ptr->filename); | |
40 | } | |
41 | ||
42 | static void tomoyo_del_file_pattern(struct list_head *element) | |
43 | { | |
44 | struct tomoyo_no_pattern *ptr = | |
45 | container_of(element, typeof(*ptr), head.list); | |
46 | tomoyo_put_name(ptr->pattern); | |
47 | } | |
48 | ||
49 | static void tomoyo_del_no_rewrite(struct list_head *element) | |
50 | { | |
51 | struct tomoyo_no_rewrite *ptr = | |
52 | container_of(element, typeof(*ptr), head.list); | |
53 | tomoyo_put_name(ptr->pattern); | |
54 | } | |
55 | ||
56 | static void tomoyo_del_transition_control(struct list_head *element) | |
57 | { | |
58 | struct tomoyo_transition_control *ptr = | |
59 | container_of(element, typeof(*ptr), head.list); | |
60 | tomoyo_put_name(ptr->domainname); | |
61 | tomoyo_put_name(ptr->program); | |
62 | } | |
63 | ||
64 | static void tomoyo_del_aggregator(struct list_head *element) | |
65 | { | |
66 | struct tomoyo_aggregator *ptr = | |
67 | container_of(element, typeof(*ptr), head.list); | |
68 | tomoyo_put_name(ptr->original_name); | |
69 | tomoyo_put_name(ptr->aggregated_name); | |
70 | } | |
71 | ||
72 | static void tomoyo_del_manager(struct list_head *element) | |
73 | { | |
74 | struct tomoyo_manager *ptr = | |
75 | container_of(element, typeof(*ptr), head.list); | |
76 | tomoyo_put_name(ptr->manager); | |
77 | } | |
78 | ||
79 | static void tomoyo_del_acl(struct list_head *element) | |
80 | { | |
81 | struct tomoyo_acl_info *acl = | |
82 | container_of(element, typeof(*acl), list); | |
83 | switch (acl->type) { | |
84 | case TOMOYO_TYPE_PATH_ACL: | |
85 | { | |
86 | struct tomoyo_path_acl *entry | |
87 | = container_of(acl, typeof(*entry), head); | |
88 | tomoyo_put_name_union(&entry->name); | |
89 | } | |
90 | break; | |
91 | case TOMOYO_TYPE_PATH2_ACL: | |
92 | { | |
93 | struct tomoyo_path2_acl *entry | |
94 | = container_of(acl, typeof(*entry), head); | |
95 | tomoyo_put_name_union(&entry->name1); | |
96 | tomoyo_put_name_union(&entry->name2); | |
97 | } | |
98 | break; | |
99 | case TOMOYO_TYPE_PATH_NUMBER_ACL: | |
100 | { | |
101 | struct tomoyo_path_number_acl *entry | |
102 | = container_of(acl, typeof(*entry), head); | |
103 | tomoyo_put_name_union(&entry->name); | |
104 | tomoyo_put_number_union(&entry->number); | |
105 | } | |
106 | break; | |
107 | case TOMOYO_TYPE_MKDEV_ACL: | |
108 | { | |
109 | struct tomoyo_mkdev_acl *entry | |
110 | = container_of(acl, typeof(*entry), head); | |
111 | tomoyo_put_name_union(&entry->name); | |
112 | tomoyo_put_number_union(&entry->mode); | |
113 | tomoyo_put_number_union(&entry->major); | |
114 | tomoyo_put_number_union(&entry->minor); | |
115 | } | |
116 | break; | |
117 | case TOMOYO_TYPE_MOUNT_ACL: | |
118 | { | |
119 | struct tomoyo_mount_acl *entry | |
120 | = container_of(acl, typeof(*entry), head); | |
121 | tomoyo_put_name_union(&entry->dev_name); | |
122 | tomoyo_put_name_union(&entry->dir_name); | |
123 | tomoyo_put_name_union(&entry->fs_type); | |
124 | tomoyo_put_number_union(&entry->flags); | |
125 | } | |
126 | break; | |
127 | } | |
128 | } | |
129 | ||
130 | static bool tomoyo_del_domain(struct list_head *element) | |
131 | { | |
132 | struct tomoyo_domain_info *domain = | |
133 | container_of(element, typeof(*domain), list); | |
134 | struct tomoyo_acl_info *acl; | |
135 | struct tomoyo_acl_info *tmp; | |
136 | /* | |
137 | * Since we don't protect whole execve() operation using SRCU, | |
138 | * we need to recheck domain->users at this point. | |
139 | * | |
140 | * (1) Reader starts SRCU section upon execve(). | |
141 | * (2) Reader traverses tomoyo_domain_list and finds this domain. | |
142 | * (3) Writer marks this domain as deleted. | |
143 | * (4) Garbage collector removes this domain from tomoyo_domain_list | |
144 | * because this domain is marked as deleted and used by nobody. | |
145 | * (5) Reader saves reference to this domain into | |
146 | * "struct linux_binprm"->cred->security . | |
147 | * (6) Reader finishes SRCU section, although execve() operation has | |
148 | * not finished yet. | |
149 | * (7) Garbage collector waits for SRCU synchronization. | |
150 | * (8) Garbage collector kfree() this domain because this domain is | |
151 | * used by nobody. | |
152 | * (9) Reader finishes execve() operation and restores this domain from | |
153 | * "struct linux_binprm"->cred->security. | |
154 | * | |
155 | * By updating domain->users at (5), we can solve this race problem | |
156 | * by rechecking domain->users at (8). | |
157 | */ | |
158 | if (atomic_read(&domain->users)) | |
159 | return false; | |
160 | list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) { | |
161 | tomoyo_del_acl(&acl->list); | |
162 | tomoyo_memory_free(acl); | |
163 | } | |
164 | tomoyo_put_name(domain->domainname); | |
165 | return true; | |
166 | } | |
167 | ||
168 | ||
169 | static void tomoyo_del_name(struct list_head *element) | |
170 | { | |
171 | const struct tomoyo_name *ptr = | |
172 | container_of(element, typeof(*ptr), list); | |
173 | } | |
174 | ||
175 | static void tomoyo_del_path_group(struct list_head *element) | |
176 | { | |
177 | struct tomoyo_path_group *member = | |
178 | container_of(element, typeof(*member), head.list); | |
179 | tomoyo_put_name(member->member_name); | |
180 | } | |
181 | ||
182 | static void tomoyo_del_group(struct list_head *element) | |
183 | { | |
184 | struct tomoyo_group *group = | |
185 | container_of(element, typeof(*group), list); | |
186 | tomoyo_put_name(group->group_name); | |
187 | } | |
188 | ||
189 | static void tomoyo_del_number_group(struct list_head *element) | |
190 | { | |
191 | struct tomoyo_number_group *member = | |
192 | container_of(element, typeof(*member), head.list); | |
193 | } | |
194 | ||
195 | static bool tomoyo_collect_member(struct list_head *member_list, int id) | |
196 | { | |
197 | struct tomoyo_acl_head *member; | |
198 | list_for_each_entry(member, member_list, list) { | |
199 | if (!member->is_deleted) | |
200 | continue; | |
201 | if (!tomoyo_add_to_gc(id, &member->list)) | |
202 | return false; | |
203 | } | |
204 | return true; | |
205 | } | |
206 | ||
207 | static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain) | |
208 | { | |
209 | struct tomoyo_acl_info *acl; | |
210 | list_for_each_entry(acl, &domain->acl_info_list, list) { | |
211 | if (!acl->is_deleted) | |
212 | continue; | |
213 | if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list)) | |
214 | return false; | |
215 | } | |
216 | return true; | |
217 | } | |
218 | ||
219 | static void tomoyo_collect_entry(void) | |
220 | { | |
221 | int i; | |
222 | if (mutex_lock_interruptible(&tomoyo_policy_lock)) | |
223 | return; | |
224 | for (i = 0; i < TOMOYO_MAX_POLICY; i++) { | |
225 | if (!tomoyo_collect_member(&tomoyo_policy_list[i], i)) | |
226 | goto unlock; | |
227 | } | |
228 | { | |
229 | struct tomoyo_domain_info *domain; | |
230 | list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) { | |
231 | if (!tomoyo_collect_acl(domain)) | |
232 | goto unlock; | |
233 | if (!domain->is_deleted || atomic_read(&domain->users)) | |
234 | continue; | |
235 | /* | |
236 | * Nobody is referring this domain. But somebody may | |
237 | * refer this domain after successful execve(). | |
238 | * We recheck domain->users after SRCU synchronization. | |
239 | */ | |
240 | if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list)) | |
241 | goto unlock; | |
242 | } | |
243 | } | |
244 | for (i = 0; i < TOMOYO_MAX_HASH; i++) { | |
245 | struct tomoyo_name *ptr; | |
246 | list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) { | |
247 | if (atomic_read(&ptr->users)) | |
248 | continue; | |
249 | if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list)) | |
250 | goto unlock; | |
251 | } | |
252 | } | |
253 | for (i = 0; i < TOMOYO_MAX_GROUP; i++) { | |
254 | struct list_head *list = &tomoyo_group_list[i]; | |
255 | int id; | |
256 | struct tomoyo_group *group; | |
257 | switch (i) { | |
258 | case 0: | |
259 | id = TOMOYO_ID_PATH_GROUP; | |
260 | break; | |
261 | default: | |
262 | id = TOMOYO_ID_NUMBER_GROUP; | |
263 | break; | |
264 | } | |
265 | list_for_each_entry(group, list, list) { | |
266 | if (!tomoyo_collect_member(&group->member_list, id)) | |
267 | goto unlock; | |
268 | if (!list_empty(&group->member_list) || | |
269 | atomic_read(&group->users)) | |
270 | continue; | |
271 | if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list)) | |
272 | goto unlock; | |
273 | } | |
274 | } | |
275 | unlock: | |
276 | mutex_unlock(&tomoyo_policy_lock); | |
277 | } | |
278 | ||
279 | static void tomoyo_kfree_entry(void) | |
280 | { | |
281 | struct tomoyo_gc *p; | |
282 | struct tomoyo_gc *tmp; | |
283 | ||
284 | list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) { | |
285 | struct list_head *element = p->element; | |
286 | switch (p->type) { | |
287 | case TOMOYO_ID_TRANSITION_CONTROL: | |
288 | tomoyo_del_transition_control(element); | |
289 | break; | |
290 | case TOMOYO_ID_AGGREGATOR: | |
291 | tomoyo_del_aggregator(element); | |
292 | break; | |
293 | case TOMOYO_ID_GLOBALLY_READABLE: | |
294 | tomoyo_del_allow_read(element); | |
295 | break; | |
296 | case TOMOYO_ID_PATTERN: | |
297 | tomoyo_del_file_pattern(element); | |
298 | break; | |
299 | case TOMOYO_ID_NO_REWRITE: | |
300 | tomoyo_del_no_rewrite(element); | |
301 | break; | |
302 | case TOMOYO_ID_MANAGER: | |
303 | tomoyo_del_manager(element); | |
304 | break; | |
305 | case TOMOYO_ID_NAME: | |
306 | tomoyo_del_name(element); | |
307 | break; | |
308 | case TOMOYO_ID_ACL: | |
309 | tomoyo_del_acl(element); | |
310 | break; | |
311 | case TOMOYO_ID_DOMAIN: | |
312 | if (!tomoyo_del_domain(element)) | |
313 | continue; | |
314 | break; | |
315 | case TOMOYO_ID_PATH_GROUP: | |
316 | tomoyo_del_path_group(element); | |
317 | break; | |
318 | case TOMOYO_ID_GROUP: | |
319 | tomoyo_del_group(element); | |
320 | break; | |
321 | case TOMOYO_ID_NUMBER_GROUP: | |
322 | tomoyo_del_number_group(element); | |
323 | break; | |
324 | } | |
325 | tomoyo_memory_free(element); | |
326 | list_del(&p->list); | |
327 | kfree(p); | |
328 | } | |
329 | } | |
330 | ||
331 | static int tomoyo_gc_thread(void *unused) | |
332 | { | |
333 | daemonize("GC for TOMOYO"); | |
334 | if (mutex_trylock(&tomoyo_gc_mutex)) { | |
335 | int i; | |
336 | for (i = 0; i < 10; i++) { | |
337 | tomoyo_collect_entry(); | |
338 | if (list_empty(&tomoyo_gc_queue)) | |
339 | break; | |
340 | synchronize_srcu(&tomoyo_ss); | |
341 | tomoyo_kfree_entry(); | |
342 | } | |
343 | mutex_unlock(&tomoyo_gc_mutex); | |
344 | } | |
345 | do_exit(0); | |
346 | } | |
347 | ||
348 | void tomoyo_run_gc(void) | |
349 | { | |
350 | struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL, | |
351 | "GC for TOMOYO"); | |
352 | if (!IS_ERR(task)) | |
353 | wake_up_process(task); | |
354 | } |