[net-next-2.6.git] / security / tomoyo / gc.c

/*
 * security/tomoyo/gc.c
 *
 * Implementation of the Domain-Based Mandatory Access Control.
 *
 * Copyright (C) 2005-2010  NTT DATA CORPORATION
 *
 */

#include "common.h"
#include <linux/kthread.h>
#include <linux/slab.h>

struct tomoyo_gc_entry {
	struct list_head list;
	int type;
	struct list_head *element;
};
static LIST_HEAD(tomoyo_gc_queue);
static DEFINE_MUTEX(tomoyo_gc_mutex);

/* Caller holds tomoyo_policy_lock mutex. */
static bool tomoyo_add_to_gc(const int type, struct list_head *element)
{
	struct tomoyo_gc_entry *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
	if (!entry)
		return false;
	entry->type = type;
	entry->element = element;
	list_add(&entry->list, &tomoyo_gc_queue);
	list_del_rcu(element);
	return true;
}

static void tomoyo_del_allow_read(struct list_head *element)
{
	struct tomoyo_globally_readable_file_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->filename);
}

static void tomoyo_del_file_pattern(struct list_head *element)
{
	struct tomoyo_pattern_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->pattern);
}

static void tomoyo_del_no_rewrite(struct list_head *element)
{
	struct tomoyo_no_rewrite_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->pattern);
}

static void tomoyo_del_domain_initializer(struct list_head *element)
{
	struct tomoyo_domain_initializer_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->domainname);
	tomoyo_put_name(ptr->program);
}

static void tomoyo_del_domain_keeper(struct list_head *element)
{
	struct tomoyo_domain_keeper_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->domainname);
	tomoyo_put_name(ptr->program);
}

static void tomoyo_del_aggregator(struct list_head *element)
{
	struct tomoyo_aggregator_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->original_name);
	tomoyo_put_name(ptr->aggregated_name);
}

static void tomoyo_del_manager(struct list_head *element)
{
	struct tomoyo_policy_manager_entry *ptr =
		container_of(element, typeof(*ptr), head.list);
	tomoyo_put_name(ptr->manager);
}

static void tomoyo_del_acl(struct list_head *element)
{
	struct tomoyo_acl_info *acl =
		container_of(element, typeof(*acl), list);
	switch (acl->type) {
	case TOMOYO_TYPE_PATH_ACL:
		{
			struct tomoyo_path_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
		}
		break;
	case TOMOYO_TYPE_PATH2_ACL:
		{
			struct tomoyo_path2_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name1);
			tomoyo_put_name_union(&entry->name2);
		}
		break;
	case TOMOYO_TYPE_PATH_NUMBER_ACL:
		{
			struct tomoyo_path_number_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
			tomoyo_put_number_union(&entry->number);
		}
		break;
	case TOMOYO_TYPE_MKDEV_ACL:
		{
			struct tomoyo_mkdev_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->name);
			tomoyo_put_number_union(&entry->mode);
			tomoyo_put_number_union(&entry->major);
			tomoyo_put_number_union(&entry->minor);
		}
		break;
	case TOMOYO_TYPE_MOUNT_ACL:
		{
			struct tomoyo_mount_acl *entry
				= container_of(acl, typeof(*entry), head);
			tomoyo_put_name_union(&entry->dev_name);
			tomoyo_put_name_union(&entry->dir_name);
			tomoyo_put_name_union(&entry->fs_type);
			tomoyo_put_number_union(&entry->flags);
		}
		break;
	}
}

static bool tomoyo_del_domain(struct list_head *element)
{
	struct tomoyo_domain_info *domain =
		container_of(element, typeof(*domain), list);
	struct tomoyo_acl_info *acl;
	struct tomoyo_acl_info *tmp;
	/*
	 * Since we don't protect whole execve() operation using SRCU,
	 * we need to recheck domain->users at this point.
	 *
	 * (1) Reader starts SRCU section upon execve().
	 * (2) Reader traverses tomoyo_domain_list and finds this domain.
	 * (3) Writer marks this domain as deleted.
	 * (4) Garbage collector removes this domain from tomoyo_domain_list
	 *     because this domain is marked as deleted and used by nobody.
	 * (5) Reader saves reference to this domain into
	 *     "struct linux_binprm"->cred->security .
	 * (6) Reader finishes SRCU section, although execve() operation has
	 *     not finished yet.
	 * (7) Garbage collector waits for SRCU synchronization.
	 * (8) Garbage collector kfree() this domain because this domain is
	 *     used by nobody.
	 * (9) Reader finishes execve() operation and restores this domain from
	 *     "struct linux_binprm"->cred->security.
	 *
	 * By updating domain->users at (5), we can solve this race problem
	 * by rechecking domain->users at (8).
	 */
	if (atomic_read(&domain->users))
		return false;
	list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
		tomoyo_del_acl(&acl->list);
		tomoyo_memory_free(acl);
	}
	tomoyo_put_name(domain->domainname);
	return true;
}


static void tomoyo_del_name(struct list_head *element)
{
	const struct tomoyo_name_entry *ptr =
		container_of(element, typeof(*ptr), list);
}

static void tomoyo_del_path_group(struct list_head *element)
{
	struct tomoyo_path_group *member =
		container_of(element, typeof(*member), head.list);
	tomoyo_put_name(member->member_name);
}

static void tomoyo_del_group(struct list_head *element)
{
	struct tomoyo_group *group =
		container_of(element, typeof(*group), list);
	tomoyo_put_name(group->group_name);
}

static void tomoyo_del_number_group(struct list_head *element)
{
	struct tomoyo_number_group *member =
		container_of(element, typeof(*member), head.list);
}

static bool tomoyo_collect_member(struct list_head *member_list, int id)
{
	struct tomoyo_acl_head *member;
	list_for_each_entry(member, member_list, list) {
		if (!member->is_deleted)
			continue;
		if (!tomoyo_add_to_gc(id, &member->list))
			return false;
	}
        return true;
}

static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain)
{
	struct tomoyo_acl_info *acl;
	list_for_each_entry(acl, &domain->acl_info_list, list) {
		if (!acl->is_deleted)
			continue;
		if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
			return false;
	}
	return true;
}

static void tomoyo_collect_entry(void)
{
	int i;
	if (mutex_lock_interruptible(&tomoyo_policy_lock))
		return;
	for (i = 0; i < TOMOYO_MAX_POLICY; i++) {
		if (!tomoyo_collect_member(&tomoyo_policy_list[i], i))
			goto unlock;
	}
	{
		struct tomoyo_domain_info *domain;
		list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
			if (!tomoyo_collect_acl(domain))
				goto unlock;
			if (!domain->is_deleted || atomic_read(&domain->users))
				continue;
			/*
			 * Nobody is referring this domain. But somebody may
			 * refer this domain after successful execve().
			 * We recheck domain->users after SRCU synchronization.
			 */
			if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
				goto unlock;
		}
	}
	for (i = 0; i < TOMOYO_MAX_HASH; i++) {
		struct tomoyo_name_entry *ptr;
		list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) {
			if (atomic_read(&ptr->users))
				continue;
			if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list))
				goto unlock;
		}
	}
	for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
		struct list_head *list = &tomoyo_group_list[i];
		int id;
		struct tomoyo_group *group;
		switch (i) {
		case 0:
			id = TOMOYO_ID_PATH_GROUP;
			break;
		default:
			id = TOMOYO_ID_NUMBER_GROUP;
			break;
		}
		list_for_each_entry(group, list, list) {
			if (!tomoyo_collect_member(&group->member_list, id))
				goto unlock;
			if (!list_empty(&group->member_list) ||
			    atomic_read(&group->users))
				continue;
			if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))
				goto unlock;
		}
	}
 unlock:
	mutex_unlock(&tomoyo_policy_lock);
}

static void tomoyo_kfree_entry(void)
{
	struct tomoyo_gc_entry *p;
	struct tomoyo_gc_entry *tmp;

	list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
		struct list_head *element = p->element;
		switch (p->type) {
		case TOMOYO_ID_DOMAIN_INITIALIZER:
			tomoyo_del_domain_initializer(element);
			break;
		case TOMOYO_ID_DOMAIN_KEEPER:
			tomoyo_del_domain_keeper(element);
			break;
		case TOMOYO_ID_AGGREGATOR:
			tomoyo_del_aggregator(element);
			break;
		case TOMOYO_ID_GLOBALLY_READABLE:
			tomoyo_del_allow_read(element);
			break;
		case TOMOYO_ID_PATTERN:
			tomoyo_del_file_pattern(element);
			break;
		case TOMOYO_ID_NO_REWRITE:
			tomoyo_del_no_rewrite(element);
			break;
		case TOMOYO_ID_MANAGER:
			tomoyo_del_manager(element);
			break;
		case TOMOYO_ID_NAME:
			tomoyo_del_name(element);
			break;
		case TOMOYO_ID_ACL:
			tomoyo_del_acl(element);
			break;
		case TOMOYO_ID_DOMAIN:
			if (!tomoyo_del_domain(element))
				continue;
			break;
		case TOMOYO_ID_PATH_GROUP:
			tomoyo_del_path_group(element);
			break;
		case TOMOYO_ID_GROUP:
			tomoyo_del_group(element);
			break;
		case TOMOYO_ID_NUMBER_GROUP:
			tomoyo_del_number_group(element);
			break;
		}
		tomoyo_memory_free(element);
		list_del(&p->list);
		kfree(p);
	}
}

static int tomoyo_gc_thread(void *unused)
{
	daemonize("GC for TOMOYO");
	if (mutex_trylock(&tomoyo_gc_mutex)) {
		int i;
		for (i = 0; i < 10; i++) {
			tomoyo_collect_entry();
			if (list_empty(&tomoyo_gc_queue))
				break;
			synchronize_srcu(&tomoyo_ss);
			tomoyo_kfree_entry();
		}
		mutex_unlock(&tomoyo_gc_mutex);
	}
	do_exit(0);
}

void tomoyo_run_gc(void)
{
	struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
						  "GC for TOMOYO");
	if (!IS_ERR(task))
		wake_up_process(task);
}
Commit	Line	Data
847b173e TH	1	/*
	2	* security/tomoyo/gc.c
	3	*
	4	* Implementation of the Domain-Based Mandatory Access Control.
	5	*
	6	* Copyright (C) 2005-2010 NTT DATA CORPORATION
	7	*
	8	*/
	9
	10	#include "common.h"
	11	#include <linux/kthread.h>
5a0e3ad6	12	#include <linux/slab.h>
847b173e	13
847b173e TH	14	struct tomoyo_gc_entry {
	15	struct list_head list;
	16	int type;
e79acf0e	17	struct list_head *element;
847b173e TH	18	};
	19	static LIST_HEAD(tomoyo_gc_queue);
	20	static DEFINE_MUTEX(tomoyo_gc_mutex);
	21
	22	/* Caller holds tomoyo_policy_lock mutex. */
e79acf0e	23	static bool tomoyo_add_to_gc(const int type, struct list_head *element)
847b173e TH	24	{
	25	struct tomoyo_gc_entry entry = kzalloc(sizeof(entry), GFP_ATOMIC);
	26	if (!entry)
	27	return false;
	28	entry->type = type;
	29	entry->element = element;
	30	list_add(&entry->list, &tomoyo_gc_queue);
e79acf0e	31	list_del_rcu(element);
847b173e TH	32	return true;
	33	}
	34
e79acf0e	35	static void tomoyo_del_allow_read(struct list_head *element)
847b173e	36	{
e79acf0e TH	37	struct tomoyo_globally_readable_file_entry *ptr =
e79acf0e TH	38	container_of(element, typeof(*ptr), head.list);
847b173e TH	39	tomoyo_put_name(ptr->filename);
	40	}
	41
e79acf0e	42	static void tomoyo_del_file_pattern(struct list_head *element)
847b173e	43	{
e79acf0e TH	44	struct tomoyo_pattern_entry *ptr =
e79acf0e TH	45	container_of(element, typeof(*ptr), head.list);
847b173e TH	46	tomoyo_put_name(ptr->pattern);
	47	}
	48
e79acf0e	49	static void tomoyo_del_no_rewrite(struct list_head *element)
847b173e	50	{
e79acf0e TH	51	struct tomoyo_no_rewrite_entry *ptr =
e79acf0e TH	52	container_of(element, typeof(*ptr), head.list);
847b173e TH	53	tomoyo_put_name(ptr->pattern);
	54	}
	55
e79acf0e	56	static void tomoyo_del_domain_initializer(struct list_head *element)
847b173e	57	{
e79acf0e TH	58	struct tomoyo_domain_initializer_entry *ptr =
e79acf0e TH	59	container_of(element, typeof(*ptr), head.list);
847b173e TH	60	tomoyo_put_name(ptr->domainname);
	61	tomoyo_put_name(ptr->program);
	62	}
	63
e79acf0e	64	static void tomoyo_del_domain_keeper(struct list_head *element)
847b173e	65	{
e79acf0e TH	66	struct tomoyo_domain_keeper_entry *ptr =
e79acf0e TH	67	container_of(element, typeof(*ptr), head.list);
847b173e TH	68	tomoyo_put_name(ptr->domainname);
	69	tomoyo_put_name(ptr->program);
	70	}
	71
e79acf0e	72	static void tomoyo_del_aggregator(struct list_head *element)
1084307c	73	{
e79acf0e TH	74	struct tomoyo_aggregator_entry *ptr =
e79acf0e TH	75	container_of(element, typeof(*ptr), head.list);
1084307c TH	76	tomoyo_put_name(ptr->original_name);
	77	tomoyo_put_name(ptr->aggregated_name);
	78	}
	79
e79acf0e	80	static void tomoyo_del_manager(struct list_head *element)
847b173e	81	{
e79acf0e TH	82	struct tomoyo_policy_manager_entry *ptr =
e79acf0e TH	83	container_of(element, typeof(*ptr), head.list);
847b173e TH	84	tomoyo_put_name(ptr->manager);
	85	}
	86
e79acf0e	87	static void tomoyo_del_acl(struct list_head *element)
847b173e	88	{
e79acf0e TH	89	struct tomoyo_acl_info *acl =
e79acf0e TH	90	container_of(element, typeof(*acl), list);
847b173e	91	switch (acl->type) {
7ef61233	92	case TOMOYO_TYPE_PATH_ACL:
847b173e	93	{
7ef61233	94	struct tomoyo_path_acl *entry
847b173e	95	= container_of(acl, typeof(*entry), head);
7762fbff	96	tomoyo_put_name_union(&entry->name);
847b173e TH	97	}
847b173e TH	98	break;
7ef61233	99	case TOMOYO_TYPE_PATH2_ACL:
847b173e	100	{
7ef61233	101	struct tomoyo_path2_acl *entry
847b173e	102	= container_of(acl, typeof(*entry), head);
7762fbff TH	103	tomoyo_put_name_union(&entry->name1);
7762fbff TH	104	tomoyo_put_name_union(&entry->name2);
847b173e TH	105	}
847b173e TH	106	break;
a1f9bb6a TH	107	case TOMOYO_TYPE_PATH_NUMBER_ACL:
	108	{
	109	struct tomoyo_path_number_acl *entry
	110	= container_of(acl, typeof(*entry), head);
	111	tomoyo_put_name_union(&entry->name);
	112	tomoyo_put_number_union(&entry->number);
	113	}
	114	break;
75093152	115	case TOMOYO_TYPE_MKDEV_ACL:
a1f9bb6a	116	{
75093152	117	struct tomoyo_mkdev_acl *entry
a1f9bb6a TH	118	= container_of(acl, typeof(*entry), head);
	119	tomoyo_put_name_union(&entry->name);
	120	tomoyo_put_number_union(&entry->mode);
	121	tomoyo_put_number_union(&entry->major);
	122	tomoyo_put_number_union(&entry->minor);
	123	}
	124	break;
2106ccd9 TH	125	case TOMOYO_TYPE_MOUNT_ACL:
	126	{
	127	struct tomoyo_mount_acl *entry
	128	= container_of(acl, typeof(*entry), head);
	129	tomoyo_put_name_union(&entry->dev_name);
	130	tomoyo_put_name_union(&entry->dir_name);
	131	tomoyo_put_name_union(&entry->fs_type);
	132	tomoyo_put_number_union(&entry->flags);
	133	}
	134	break;
847b173e TH	135	}
	136	}
	137
e79acf0e	138	static bool tomoyo_del_domain(struct list_head *element)
847b173e	139	{
e79acf0e TH	140	struct tomoyo_domain_info *domain =
e79acf0e TH	141	container_of(element, typeof(*domain), list);
847b173e TH	142	struct tomoyo_acl_info *acl;
	143	struct tomoyo_acl_info *tmp;
	144	/*
	145	* Since we don't protect whole execve() operation using SRCU,
	146	* we need to recheck domain->users at this point.
	147	*
	148	* (1) Reader starts SRCU section upon execve().
	149	* (2) Reader traverses tomoyo_domain_list and finds this domain.
	150	* (3) Writer marks this domain as deleted.
	151	* (4) Garbage collector removes this domain from tomoyo_domain_list
	152	* because this domain is marked as deleted and used by nobody.
	153	* (5) Reader saves reference to this domain into
	154	* "struct linux_binprm"->cred->security .
	155	* (6) Reader finishes SRCU section, although execve() operation has
	156	* not finished yet.
	157	* (7) Garbage collector waits for SRCU synchronization.
	158	* (8) Garbage collector kfree() this domain because this domain is
	159	* used by nobody.
	160	* (9) Reader finishes execve() operation and restores this domain from
	161	* "struct linux_binprm"->cred->security.
	162	*
	163	* By updating domain->users at (5), we can solve this race problem
	164	* by rechecking domain->users at (8).
	165	*/
	166	if (atomic_read(&domain->users))
	167	return false;
	168	list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
e79acf0e	169	tomoyo_del_acl(&acl->list);
847b173e TH	170	tomoyo_memory_free(acl);
	171	}
	172	tomoyo_put_name(domain->domainname);
	173	return true;
	174	}
	175
	176
e79acf0e	177	static void tomoyo_del_name(struct list_head *element)
847b173e	178	{
e79acf0e TH	179	const struct tomoyo_name_entry *ptr =
e79acf0e TH	180	container_of(element, typeof(*ptr), list);
847b173e TH	181	}
847b173e TH	182
a98aa4de	183	static void tomoyo_del_path_group(struct list_head *element)
7762fbff	184	{
a98aa4de	185	struct tomoyo_path_group *member =
e79acf0e	186	container_of(element, typeof(*member), head.list);
7762fbff TH	187	tomoyo_put_name(member->member_name);
	188	}
	189
a98aa4de	190	static void tomoyo_del_group(struct list_head *element)
7762fbff	191	{
a98aa4de	192	struct tomoyo_group *group =
e79acf0e	193	container_of(element, typeof(*group), list);
7762fbff TH	194	tomoyo_put_name(group->group_name);
	195	}
	196
e79acf0e	197	static void tomoyo_del_number_group(struct list_head *element)
4c3e9e2d	198	{
a98aa4de TH	199	struct tomoyo_number_group *member =
a98aa4de TH	200	container_of(element, typeof(*member), head.list);
4c3e9e2d TH	201	}
4c3e9e2d TH	202
d2f8b234 TH	203	static bool tomoyo_collect_member(struct list_head *member_list, int id)
	204	{
	205	struct tomoyo_acl_head *member;
	206	list_for_each_entry(member, member_list, list) {
	207	if (!member->is_deleted)
	208	continue;
	209	if (!tomoyo_add_to_gc(id, &member->list))
	210	return false;
d2f8b234 TH	211	}
	212	return true;
	213	}
	214
	215	static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain)
	216	{
	217	struct tomoyo_acl_info *acl;
	218	list_for_each_entry(acl, &domain->acl_info_list, list) {
	219	if (!acl->is_deleted)
	220	continue;
	221	if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
	222	return false;
d2f8b234 TH	223	}
	224	return true;
	225	}
	226
847b173e TH	227	static void tomoyo_collect_entry(void)
847b173e TH	228	{
d2f8b234	229	int i;
29282381 TH	230	if (mutex_lock_interruptible(&tomoyo_policy_lock))
29282381 TH	231	return;
d2f8b234	232	for (i = 0; i < TOMOYO_MAX_POLICY; i++) {
a230f9e7 TH	233	if (!tomoyo_collect_member(&tomoyo_policy_list[i], i))
a230f9e7 TH	234	goto unlock;
847b173e TH	235	}
	236	{
	237	struct tomoyo_domain_info *domain;
	238	list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
d2f8b234 TH	239	if (!tomoyo_collect_acl(domain))
d2f8b234 TH	240	goto unlock;
847b173e TH	241	if (!domain->is_deleted \|\| atomic_read(&domain->users))
	242	continue;
	243	/*
	244	* Nobody is referring this domain. But somebody may
	245	* refer this domain after successful execve().
	246	* We recheck domain->users after SRCU synchronization.
	247	*/
e79acf0e	248	if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
d2f8b234	249	goto unlock;
847b173e TH	250	}
847b173e TH	251	}
d2f8b234 TH	252	for (i = 0; i < TOMOYO_MAX_HASH; i++) {
	253	struct tomoyo_name_entry *ptr;
	254	list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) {
	255	if (atomic_read(&ptr->users))
	256	continue;
e79acf0e	257	if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list))
d2f8b234	258	goto unlock;
847b173e TH	259	}
847b173e TH	260	}
7c2ea22e TH	261	for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
	262	struct list_head *list = &tomoyo_group_list[i];
	263	int id;
a98aa4de	264	struct tomoyo_group *group;
7c2ea22e TH	265	switch (i) {
	266	case 0:
	267	id = TOMOYO_ID_PATH_GROUP;
	268	break;
	269	default:
	270	id = TOMOYO_ID_NUMBER_GROUP;
	271	break;
7762fbff	272	}
7c2ea22e TH	273	list_for_each_entry(group, list, list) {
	274	if (!tomoyo_collect_member(&group->member_list, id))
	275	goto unlock;
4c3e9e2d TH	276	if (!list_empty(&group->member_list) \|\|
	277	atomic_read(&group->users))
	278	continue;
7c2ea22e	279	if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))
d2f8b234	280	goto unlock;
4c3e9e2d TH	281	}
4c3e9e2d TH	282	}
d2f8b234	283	unlock:
29282381	284	mutex_unlock(&tomoyo_policy_lock);
847b173e TH	285	}
	286
	287	static void tomoyo_kfree_entry(void)
	288	{
	289	struct tomoyo_gc_entry *p;
	290	struct tomoyo_gc_entry *tmp;
	291
	292	list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
e79acf0e	293	struct list_head *element = p->element;
847b173e TH	294	switch (p->type) {
847b173e TH	295	case TOMOYO_ID_DOMAIN_INITIALIZER:
e79acf0e	296	tomoyo_del_domain_initializer(element);
847b173e TH	297	break;
847b173e TH	298	case TOMOYO_ID_DOMAIN_KEEPER:
e79acf0e	299	tomoyo_del_domain_keeper(element);
847b173e	300	break;
1084307c	301	case TOMOYO_ID_AGGREGATOR:
e79acf0e	302	tomoyo_del_aggregator(element);
1084307c	303	break;
847b173e	304	case TOMOYO_ID_GLOBALLY_READABLE:
e79acf0e	305	tomoyo_del_allow_read(element);
847b173e TH	306	break;
847b173e TH	307	case TOMOYO_ID_PATTERN:
e79acf0e	308	tomoyo_del_file_pattern(element);
847b173e TH	309	break;
847b173e TH	310	case TOMOYO_ID_NO_REWRITE:
e79acf0e	311	tomoyo_del_no_rewrite(element);
847b173e TH	312	break;
847b173e TH	313	case TOMOYO_ID_MANAGER:
e79acf0e	314	tomoyo_del_manager(element);
847b173e TH	315	break;
847b173e TH	316	case TOMOYO_ID_NAME:
e79acf0e	317	tomoyo_del_name(element);
847b173e TH	318	break;
847b173e TH	319	case TOMOYO_ID_ACL:
e79acf0e	320	tomoyo_del_acl(element);
847b173e TH	321	break;
847b173e TH	322	case TOMOYO_ID_DOMAIN:
e79acf0e	323	if (!tomoyo_del_domain(element))
847b173e TH	324	continue;
847b173e TH	325	break;
7762fbff	326	case TOMOYO_ID_PATH_GROUP:
e79acf0e	327	tomoyo_del_path_group(element);
7762fbff	328	break;
a98aa4de TH	329	case TOMOYO_ID_GROUP:
a98aa4de TH	330	tomoyo_del_group(element);
4c3e9e2d TH	331	break;
4c3e9e2d TH	332	case TOMOYO_ID_NUMBER_GROUP:
e79acf0e	333	tomoyo_del_number_group(element);
847b173e TH	334	break;
847b173e TH	335	}
e79acf0e	336	tomoyo_memory_free(element);
847b173e TH	337	list_del(&p->list);
	338	kfree(p);
	339	}
	340	}
	341
	342	static int tomoyo_gc_thread(void *unused)
	343	{
	344	daemonize("GC for TOMOYO");
	345	if (mutex_trylock(&tomoyo_gc_mutex)) {
	346	int i;
	347	for (i = 0; i < 10; i++) {
	348	tomoyo_collect_entry();
	349	if (list_empty(&tomoyo_gc_queue))
	350	break;
	351	synchronize_srcu(&tomoyo_ss);
	352	tomoyo_kfree_entry();
	353	}
	354	mutex_unlock(&tomoyo_gc_mutex);
	355	}
	356	do_exit(0);
	357	}
	358
	359	void tomoyo_run_gc(void)
	360	{
	361	struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
	362	"GC for TOMOYO");
	363	if (!IS_ERR(task))
	364	wake_up_process(task);
	365	}