security/tomoyo/file.c

   1 /*
   2  * security/tomoyo/file.c
   3  *
   4  * Pathname restriction functions.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  */
   8
   9 #include "common.h"
  10 #include <linux/slab.h>
  11
  12 /* Keyword array for operations with one pathname. */
  13 static const char *tomoyo_path_keyword[TOMOYO_MAX_PATH_OPERATION] = {
  14         [TOMOYO_TYPE_READ_WRITE] = "read/write",
  15         [TOMOYO_TYPE_EXECUTE]    = "execute",
  16         [TOMOYO_TYPE_READ]       = "read",
  17         [TOMOYO_TYPE_WRITE]      = "write",
  18         [TOMOYO_TYPE_UNLINK]     = "unlink",
  19         [TOMOYO_TYPE_RMDIR]      = "rmdir",
  20         [TOMOYO_TYPE_TRUNCATE]   = "truncate",
  21         [TOMOYO_TYPE_SYMLINK]    = "symlink",
  22         [TOMOYO_TYPE_REWRITE]    = "rewrite",
  23         [TOMOYO_TYPE_CHROOT]     = "chroot",
  24         [TOMOYO_TYPE_UMOUNT]     = "unmount",
  25 };
  26
  27 /* Keyword array for operations with one pathname and three numbers. */
  28 static const char *tomoyo_path_number3_keyword
  29 [TOMOYO_MAX_PATH_NUMBER3_OPERATION] = {
  30         [TOMOYO_TYPE_MKBLOCK]    = "mkblock",
  31         [TOMOYO_TYPE_MKCHAR]     = "mkchar",
  32 };
  33
  34 /* Keyword array for operations with two pathnames. */
  35 static const char *tomoyo_path2_keyword[TOMOYO_MAX_PATH2_OPERATION] = {
  36         [TOMOYO_TYPE_LINK]       = "link",
  37         [TOMOYO_TYPE_RENAME]     = "rename",
  38         [TOMOYO_TYPE_PIVOT_ROOT] = "pivot_root",
  39 };
  40
  41 /* Keyword array for operations with one pathname and one number. */
  42 static const char *tomoyo_path_number_keyword
  43 [TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
  44         [TOMOYO_TYPE_CREATE]     = "create",
  45         [TOMOYO_TYPE_MKDIR]      = "mkdir",
  46         [TOMOYO_TYPE_MKFIFO]     = "mkfifo",
  47         [TOMOYO_TYPE_MKSOCK]     = "mksock",
  48         [TOMOYO_TYPE_IOCTL]      = "ioctl",
  49         [TOMOYO_TYPE_CHMOD]      = "chmod",
  50         [TOMOYO_TYPE_CHOWN]      = "chown",
  51         [TOMOYO_TYPE_CHGRP]      = "chgrp",
  52 };
  53
  54 static const u8 tomoyo_p2mac[TOMOYO_MAX_PATH_OPERATION] = {
  55         [TOMOYO_TYPE_READ_WRITE] = TOMOYO_MAC_FILE_OPEN,
  56         [TOMOYO_TYPE_EXECUTE]    = TOMOYO_MAC_FILE_EXECUTE,
  57         [TOMOYO_TYPE_READ]       = TOMOYO_MAC_FILE_OPEN,
  58         [TOMOYO_TYPE_WRITE]      = TOMOYO_MAC_FILE_OPEN,
  59         [TOMOYO_TYPE_UNLINK]     = TOMOYO_MAC_FILE_UNLINK,
  60         [TOMOYO_TYPE_RMDIR]      = TOMOYO_MAC_FILE_RMDIR,
  61         [TOMOYO_TYPE_TRUNCATE]   = TOMOYO_MAC_FILE_TRUNCATE,
  62         [TOMOYO_TYPE_SYMLINK]    = TOMOYO_MAC_FILE_SYMLINK,
  63         [TOMOYO_TYPE_REWRITE]    = TOMOYO_MAC_FILE_REWRITE,
  64         [TOMOYO_TYPE_CHROOT]     = TOMOYO_MAC_FILE_CHROOT,
  65         [TOMOYO_TYPE_UMOUNT]     = TOMOYO_MAC_FILE_UMOUNT,
  66 };
  67
  68 static const u8 tomoyo_pnnn2mac[TOMOYO_MAX_PATH_NUMBER3_OPERATION] = {
  69         [TOMOYO_TYPE_MKBLOCK] = TOMOYO_MAC_FILE_MKBLOCK,
  70         [TOMOYO_TYPE_MKCHAR]  = TOMOYO_MAC_FILE_MKCHAR,
  71 };
  72
  73 static const u8 tomoyo_pp2mac[TOMOYO_MAX_PATH2_OPERATION] = {
  74         [TOMOYO_TYPE_LINK]       = TOMOYO_MAC_FILE_LINK,
  75         [TOMOYO_TYPE_RENAME]     = TOMOYO_MAC_FILE_RENAME,
  76         [TOMOYO_TYPE_PIVOT_ROOT] = TOMOYO_MAC_FILE_PIVOT_ROOT,
  77 };
  78
  79 static const u8 tomoyo_pn2mac[TOMOYO_MAX_PATH_NUMBER_OPERATION] = {
  80         [TOMOYO_TYPE_CREATE] = TOMOYO_MAC_FILE_CREATE,
  81         [TOMOYO_TYPE_MKDIR]  = TOMOYO_MAC_FILE_MKDIR,
  82         [TOMOYO_TYPE_MKFIFO] = TOMOYO_MAC_FILE_MKFIFO,
  83         [TOMOYO_TYPE_MKSOCK] = TOMOYO_MAC_FILE_MKSOCK,
  84         [TOMOYO_TYPE_IOCTL]  = TOMOYO_MAC_FILE_IOCTL,
  85         [TOMOYO_TYPE_CHMOD]  = TOMOYO_MAC_FILE_CHMOD,
  86         [TOMOYO_TYPE_CHOWN]  = TOMOYO_MAC_FILE_CHOWN,
  87         [TOMOYO_TYPE_CHGRP]  = TOMOYO_MAC_FILE_CHGRP,
  88 };
  89
  90 void tomoyo_put_name_union(struct tomoyo_name_union *ptr)
  91 {
  92         if (!ptr)
  93                 return;
  94         if (ptr->is_group)
  95                 tomoyo_put_path_group(ptr->group);
  96         else
  97                 tomoyo_put_name(ptr->filename);
  98 }
  99
 100 bool tomoyo_compare_name_union(const struct tomoyo_path_info *name,
 101                                const struct tomoyo_name_union *ptr)
 102 {
 103         if (ptr->is_group)
 104                 return tomoyo_path_matches_group(name, ptr->group);
 105         return tomoyo_path_matches_pattern(name, ptr->filename);
 106 }
 107
 108 void tomoyo_put_number_union(struct tomoyo_number_union *ptr)
 109 {
 110         if (ptr && ptr->is_group)
 111                 tomoyo_put_number_group(ptr->group);
 112 }
 113
 114 bool tomoyo_compare_number_union(const unsigned long value,
 115                                  const struct tomoyo_number_union *ptr)
 116 {
 117         if (ptr->is_group)
 118                 return tomoyo_number_matches_group(value, value, ptr->group);
 119         return value >= ptr->values[0] && value <= ptr->values[1];
 120 }
 121
 122 /**
 123  * tomoyo_path2keyword - Get the name of single path operation.
 124  *
 125  * @operation: Type of operation.
 126  *
 127  * Returns the name of single path operation.
 128  */
 129 const char *tomoyo_path2keyword(const u8 operation)
 130 {
 131         return (operation < TOMOYO_MAX_PATH_OPERATION)
 132                 ? tomoyo_path_keyword[operation] : NULL;
 133 }
 134
 135 /**
 136  * tomoyo_path_number32keyword - Get the name of path/number/number/number operations.
 137  *
 138  * @operation: Type of operation.
 139  *
 140  * Returns the name of path/number/number/number operation.
 141  */
 142 const char *tomoyo_path_number32keyword(const u8 operation)
 143 {
 144         return (operation < TOMOYO_MAX_PATH_NUMBER3_OPERATION)
 145                 ? tomoyo_path_number3_keyword[operation] : NULL;
 146 }
 147
 148 /**
 149  * tomoyo_path22keyword - Get the name of double path operation.
 150  *
 151  * @operation: Type of operation.
 152  *
 153  * Returns the name of double path operation.
 154  */
 155 const char *tomoyo_path22keyword(const u8 operation)
 156 {
 157         return (operation < TOMOYO_MAX_PATH2_OPERATION)
 158                 ? tomoyo_path2_keyword[operation] : NULL;
 159 }
 160
 161 /**
 162  * tomoyo_path_number2keyword - Get the name of path/number operations.
 163  *
 164  * @operation: Type of operation.
 165  *
 166  * Returns the name of path/number operation.
 167  */
 168 const char *tomoyo_path_number2keyword(const u8 operation)
 169 {
 170         return (operation < TOMOYO_MAX_PATH_NUMBER_OPERATION)
 171                 ? tomoyo_path_number_keyword[operation] : NULL;
 172 }
 173
 174 static void tomoyo_add_slash(struct tomoyo_path_info *buf)
 175 {
 176         if (buf->is_dir)
 177                 return;
 178         /*
 179          * This is OK because tomoyo_encode() reserves space for appending "/".
 180          */
 181         strcat((char *) buf->name, "/");
 182         tomoyo_fill_path_info(buf);
 183 }
 184
 185 /**
 186  * tomoyo_strendswith - Check whether the token ends with the given token.
 187  *
 188  * @name: The token to check.
 189  * @tail: The token to find.
 190  *
 191  * Returns true if @name ends with @tail, false otherwise.
 192  */
 193 static bool tomoyo_strendswith(const char *name, const char *tail)
 194 {
 195         int len;
 196
 197         if (!name || !tail)
 198                 return false;
 199         len = strlen(name) - strlen(tail);
 200         return len >= 0 && !strcmp(name + len, tail);
 201 }
 202
 203 /**
 204  * tomoyo_get_realpath - Get realpath.
 205  *
 206  * @buf:  Pointer to "struct tomoyo_path_info".
 207  * @path: Pointer to "struct path".
 208  *
 209  * Returns true on success, false otherwise.
 210  */
 211 static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, struct path *path)
 212 {
 213         buf->name = tomoyo_realpath_from_path(path);
 214         if (buf->name) {
 215                 tomoyo_fill_path_info(buf);
 216                 return true;
 217         }
 218         return false;
 219 }
 220
 221 static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
 222                                    const char *filename2,
 223                                    struct tomoyo_domain_info *const domain,
 224                                    const bool is_delete);
 225 static int tomoyo_update_path_acl(const u8 type, const char *filename,
 226                                   struct tomoyo_domain_info *const domain,
 227                                   const bool is_delete);
 228
 229 /*
 230  * tomoyo_globally_readable_list is used for holding list of pathnames which
 231  * are by default allowed to be open()ed for reading by any process.
 232  *
 233  * An entry is added by
 234  *
 235  * # echo 'allow_read /lib/libc-2.5.so' > \
 236  *                               /sys/kernel/security/tomoyo/exception_policy
 237  *
 238  * and is deleted by
 239  *
 240  * # echo 'delete allow_read /lib/libc-2.5.so' > \
 241  *                               /sys/kernel/security/tomoyo/exception_policy
 242  *
 243  * and all entries are retrieved by
 244  *
 245  * # grep ^allow_read /sys/kernel/security/tomoyo/exception_policy
 246  *
 247  * In the example above, any process is allowed to
 248  * open("/lib/libc-2.5.so", O_RDONLY).
 249  * One exception is, if the domain which current process belongs to is marked
 250  * as "ignore_global_allow_read", current process can't do so unless explicitly
 251  * given "allow_read /lib/libc-2.5.so" to the domain which current process
 252  * belongs to.
 253  */
 254 LIST_HEAD(tomoyo_globally_readable_list);
 255
 256 /**
 257  * tomoyo_update_globally_readable_entry - Update "struct tomoyo_globally_readable_file_entry" list.
 258  *
 259  * @filename:  Filename unconditionally permitted to open() for reading.
 260  * @is_delete: True if it is a delete request.
 261  *
 262  * Returns 0 on success, negative value otherwise.
 263  *
 264  * Caller holds tomoyo_read_lock().
 265  */
 266 static int tomoyo_update_globally_readable_entry(const char *filename,
 267                                                  const bool is_delete)
 268 {
 269         struct tomoyo_globally_readable_file_entry *ptr;
 270         struct tomoyo_globally_readable_file_entry e = { };
 271         int error = is_delete ? -ENOENT : -ENOMEM;
 272
 273         if (!tomoyo_is_correct_word(filename))
 274                 return -EINVAL;
 275         e.filename = tomoyo_get_name(filename);
 276         if (!e.filename)
 277                 return -ENOMEM;
 278         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 279                 goto out;
 280         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list,
 281                                 head.list) {
 282                 if (ptr->filename != e.filename)
 283                         continue;
 284                 ptr->head.is_deleted = is_delete;
 285                 error = 0;
 286                 break;
 287         }
 288         if (!is_delete && error) {
 289                 struct tomoyo_globally_readable_file_entry *entry =
 290                         tomoyo_commit_ok(&e, sizeof(e));
 291                 if (entry) {
 292                         list_add_tail_rcu(&entry->head.list,
 293                                           &tomoyo_globally_readable_list);
 294                         error = 0;
 295                 }
 296         }
 297         mutex_unlock(&tomoyo_policy_lock);
 298  out:
 299         tomoyo_put_name(e.filename);
 300         return error;
 301 }
 302
 303 /**
 304  * tomoyo_is_globally_readable_file - Check if the file is unconditionnaly permitted to be open()ed for reading.
 305  *
 306  * @filename: The filename to check.
 307  *
 308  * Returns true if any domain can open @filename for reading, false otherwise.
 309  *
 310  * Caller holds tomoyo_read_lock().
 311  */
 312 static bool tomoyo_is_globally_readable_file(const struct tomoyo_path_info *
 313                                              filename)
 314 {
 315         struct tomoyo_globally_readable_file_entry *ptr;
 316         bool found = false;
 317
 318         list_for_each_entry_rcu(ptr, &tomoyo_globally_readable_list,
 319                                 head.list) {
 320                 if (!ptr->head.is_deleted &&
 321                     tomoyo_path_matches_pattern(filename, ptr->filename)) {
 322                         found = true;
 323                         break;
 324                 }
 325         }
 326         return found;
 327 }
 328
 329 /**
 330  * tomoyo_write_globally_readable_policy - Write "struct tomoyo_globally_readable_file_entry" list.
 331  *
 332  * @data:      String to parse.
 333  * @is_delete: True if it is a delete request.
 334  *
 335  * Returns 0 on success, negative value otherwise.
 336  *
 337  * Caller holds tomoyo_read_lock().
 338  */
 339 int tomoyo_write_globally_readable_policy(char *data, const bool is_delete)
 340 {
 341         return tomoyo_update_globally_readable_entry(data, is_delete);
 342 }
 343
 344 /**
 345  * tomoyo_read_globally_readable_policy - Read "struct tomoyo_globally_readable_file_entry" list.
 346  *
 347  * @head: Pointer to "struct tomoyo_io_buffer".
 348  *
 349  * Returns true on success, false otherwise.
 350  *
 351  * Caller holds tomoyo_read_lock().
 352  */
 353 bool tomoyo_read_globally_readable_policy(struct tomoyo_io_buffer *head)
 354 {
 355         struct list_head *pos;
 356         bool done = true;
 357
 358         list_for_each_cookie(pos, head->read_var2,
 359                              &tomoyo_globally_readable_list) {
 360                 struct tomoyo_globally_readable_file_entry *ptr;
 361                 ptr = list_entry(pos,
 362                                  struct tomoyo_globally_readable_file_entry,
 363                                  head.list);
 364                 if (ptr->head.is_deleted)
 365                         continue;
 366                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_ALLOW_READ "%s\n",
 367                                         ptr->filename->name);
 368                 if (!done)
 369                         break;
 370         }
 371         return done;
 372 }
 373
 374 /* tomoyo_pattern_list is used for holding list of pathnames which are used for
 375  * converting pathnames to pathname patterns during learning mode.
 376  *
 377  * An entry is added by
 378  *
 379  * # echo 'file_pattern /proc/\$/mounts' > \
 380  *                             /sys/kernel/security/tomoyo/exception_policy
 381  *
 382  * and is deleted by
 383  *
 384  * # echo 'delete file_pattern /proc/\$/mounts' > \
 385  *                             /sys/kernel/security/tomoyo/exception_policy
 386  *
 387  * and all entries are retrieved by
 388  *
 389  * # grep ^file_pattern /sys/kernel/security/tomoyo/exception_policy
 390  *
 391  * In the example above, if a process which belongs to a domain which is in
 392  * learning mode requested open("/proc/1/mounts", O_RDONLY),
 393  * "allow_read /proc/\$/mounts" is automatically added to the domain which that
 394  * process belongs to.
 395  *
 396  * It is not a desirable behavior that we have to use /proc/\$/ instead of
 397  * /proc/self/ when current process needs to access only current process's
 398  * information. As of now, LSM version of TOMOYO is using __d_path() for
 399  * calculating pathname. Non LSM version of TOMOYO is using its own function
 400  * which pretends as if /proc/self/ is not a symlink; so that we can forbid
 401  * current process from accessing other process's information.
 402  */
 403 LIST_HEAD(tomoyo_pattern_list);
 404
 405 /**
 406  * tomoyo_update_file_pattern_entry - Update "struct tomoyo_pattern_entry" list.
 407  *
 408  * @pattern:   Pathname pattern.
 409  * @is_delete: True if it is a delete request.
 410  *
 411  * Returns 0 on success, negative value otherwise.
 412  *
 413  * Caller holds tomoyo_read_lock().
 414  */
 415 static int tomoyo_update_file_pattern_entry(const char *pattern,
 416                                             const bool is_delete)
 417 {
 418         struct tomoyo_pattern_entry *ptr;
 419         struct tomoyo_pattern_entry e = { };
 420         int error = is_delete ? -ENOENT : -ENOMEM;
 421
 422         if (!tomoyo_is_correct_word(pattern))
 423                 return -EINVAL;
 424         e.pattern = tomoyo_get_name(pattern);
 425         if (!e.pattern)
 426                 return error;
 427         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 428                 goto out;
 429         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, head.list) {
 430                 if (e.pattern != ptr->pattern)
 431                         continue;
 432                 ptr->head.is_deleted = is_delete;
 433                 error = 0;
 434                 break;
 435         }
 436         if (!is_delete && error) {
 437                 struct tomoyo_pattern_entry *entry =
 438                         tomoyo_commit_ok(&e, sizeof(e));
 439                 if (entry) {
 440                         list_add_tail_rcu(&entry->head.list,
 441                                           &tomoyo_pattern_list);
 442                         error = 0;
 443                 }
 444         }
 445         mutex_unlock(&tomoyo_policy_lock);
 446  out:
 447         tomoyo_put_name(e.pattern);
 448         return error;
 449 }
 450
 451 /**
 452  * tomoyo_file_pattern - Get patterned pathname.
 453  *
 454  * @filename: The filename to find patterned pathname.
 455  *
 456  * Returns pointer to pathname pattern if matched, @filename otherwise.
 457  *
 458  * Caller holds tomoyo_read_lock().
 459  */
 460 const char *tomoyo_file_pattern(const struct tomoyo_path_info *filename)
 461 {
 462         struct tomoyo_pattern_entry *ptr;
 463         const struct tomoyo_path_info *pattern = NULL;
 464
 465         list_for_each_entry_rcu(ptr, &tomoyo_pattern_list, head.list) {
 466                 if (ptr->head.is_deleted)
 467                         continue;
 468                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 469                         continue;
 470                 pattern = ptr->pattern;
 471                 if (tomoyo_strendswith(pattern->name, "/\\*")) {
 472                         /* Do nothing. Try to find the better match. */
 473                 } else {
 474                         /* This would be the better match. Use this. */
 475                         break;
 476                 }
 477         }
 478         if (pattern)
 479                 filename = pattern;
 480         return filename->name;
 481 }
 482
 483 /**
 484  * tomoyo_write_pattern_policy - Write "struct tomoyo_pattern_entry" list.
 485  *
 486  * @data:      String to parse.
 487  * @is_delete: True if it is a delete request.
 488  *
 489  * Returns 0 on success, negative value otherwise.
 490  *
 491  * Caller holds tomoyo_read_lock().
 492  */
 493 int tomoyo_write_pattern_policy(char *data, const bool is_delete)
 494 {
 495         return tomoyo_update_file_pattern_entry(data, is_delete);
 496 }
 497
 498 /**
 499  * tomoyo_read_file_pattern - Read "struct tomoyo_pattern_entry" list.
 500  *
 501  * @head: Pointer to "struct tomoyo_io_buffer".
 502  *
 503  * Returns true on success, false otherwise.
 504  *
 505  * Caller holds tomoyo_read_lock().
 506  */
 507 bool tomoyo_read_file_pattern(struct tomoyo_io_buffer *head)
 508 {
 509         struct list_head *pos;
 510         bool done = true;
 511
 512         list_for_each_cookie(pos, head->read_var2, &tomoyo_pattern_list) {
 513                 struct tomoyo_pattern_entry *ptr;
 514                 ptr = list_entry(pos, struct tomoyo_pattern_entry, head.list);
 515                 if (ptr->head.is_deleted)
 516                         continue;
 517                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_FILE_PATTERN
 518                                         "%s\n", ptr->pattern->name);
 519                 if (!done)
 520                         break;
 521         }
 522         return done;
 523 }
 524
 525 /*
 526  * tomoyo_no_rewrite_list is used for holding list of pathnames which are by
 527  * default forbidden to modify already written content of a file.
 528  *
 529  * An entry is added by
 530  *
 531  * # echo 'deny_rewrite /var/log/messages' > \
 532  *                              /sys/kernel/security/tomoyo/exception_policy
 533  *
 534  * and is deleted by
 535  *
 536  * # echo 'delete deny_rewrite /var/log/messages' > \
 537  *                              /sys/kernel/security/tomoyo/exception_policy
 538  *
 539  * and all entries are retrieved by
 540  *
 541  * # grep ^deny_rewrite /sys/kernel/security/tomoyo/exception_policy
 542  *
 543  * In the example above, if a process requested to rewrite /var/log/messages ,
 544  * the process can't rewrite unless the domain which that process belongs to
 545  * has "allow_rewrite /var/log/messages" entry.
 546  *
 547  * It is not a desirable behavior that we have to add "\040(deleted)" suffix
 548  * when we want to allow rewriting already unlink()ed file. As of now,
 549  * LSM version of TOMOYO is using __d_path() for calculating pathname.
 550  * Non LSM version of TOMOYO is using its own function which doesn't append
 551  * " (deleted)" suffix if the file is already unlink()ed; so that we don't
 552  * need to worry whether the file is already unlink()ed or not.
 553  */
 554 LIST_HEAD(tomoyo_no_rewrite_list);
 555
 556 /**
 557  * tomoyo_update_no_rewrite_entry - Update "struct tomoyo_no_rewrite_entry" list.
 558  *
 559  * @pattern:   Pathname pattern that are not rewritable by default.
 560  * @is_delete: True if it is a delete request.
 561  *
 562  * Returns 0 on success, negative value otherwise.
 563  *
 564  * Caller holds tomoyo_read_lock().
 565  */
 566 static int tomoyo_update_no_rewrite_entry(const char *pattern,
 567                                           const bool is_delete)
 568 {
 569         struct tomoyo_no_rewrite_entry *ptr;
 570         struct tomoyo_no_rewrite_entry e = { };
 571         int error = is_delete ? -ENOENT : -ENOMEM;
 572
 573         if (!tomoyo_is_correct_word(pattern))
 574                 return -EINVAL;
 575         e.pattern = tomoyo_get_name(pattern);
 576         if (!e.pattern)
 577                 return error;
 578         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 579                 goto out;
 580         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, head.list) {
 581                 if (ptr->pattern != e.pattern)
 582                         continue;
 583                 ptr->head.is_deleted = is_delete;
 584                 error = 0;
 585                 break;
 586         }
 587         if (!is_delete && error) {
 588                 struct tomoyo_no_rewrite_entry *entry =
 589                         tomoyo_commit_ok(&e, sizeof(e));
 590                 if (entry) {
 591                         list_add_tail_rcu(&entry->head.list,
 592                                           &tomoyo_no_rewrite_list);
 593                         error = 0;
 594                 }
 595         }
 596         mutex_unlock(&tomoyo_policy_lock);
 597  out:
 598         tomoyo_put_name(e.pattern);
 599         return error;
 600 }
 601
 602 /**
 603  * tomoyo_is_no_rewrite_file - Check if the given pathname is not permitted to be rewrited.
 604  *
 605  * @filename: Filename to check.
 606  *
 607  * Returns true if @filename is specified by "deny_rewrite" directive,
 608  * false otherwise.
 609  *
 610  * Caller holds tomoyo_read_lock().
 611  */
 612 static bool tomoyo_is_no_rewrite_file(const struct tomoyo_path_info *filename)
 613 {
 614         struct tomoyo_no_rewrite_entry *ptr;
 615         bool found = false;
 616
 617         list_for_each_entry_rcu(ptr, &tomoyo_no_rewrite_list, head.list) {
 618                 if (ptr->head.is_deleted)
 619                         continue;
 620                 if (!tomoyo_path_matches_pattern(filename, ptr->pattern))
 621                         continue;
 622                 found = true;
 623                 break;
 624         }
 625         return found;
 626 }
 627
 628 /**
 629  * tomoyo_write_no_rewrite_policy - Write "struct tomoyo_no_rewrite_entry" list.
 630  *
 631  * @data:      String to parse.
 632  * @is_delete: True if it is a delete request.
 633  *
 634  * Returns 0 on success, negative value otherwise.
 635  *
 636  * Caller holds tomoyo_read_lock().
 637  */
 638 int tomoyo_write_no_rewrite_policy(char *data, const bool is_delete)
 639 {
 640         return tomoyo_update_no_rewrite_entry(data, is_delete);
 641 }
 642
 643 /**
 644  * tomoyo_read_no_rewrite_policy - Read "struct tomoyo_no_rewrite_entry" list.
 645  *
 646  * @head: Pointer to "struct tomoyo_io_buffer".
 647  *
 648  * Returns true on success, false otherwise.
 649  *
 650  * Caller holds tomoyo_read_lock().
 651  */
 652 bool tomoyo_read_no_rewrite_policy(struct tomoyo_io_buffer *head)
 653 {
 654         struct list_head *pos;
 655         bool done = true;
 656
 657         list_for_each_cookie(pos, head->read_var2, &tomoyo_no_rewrite_list) {
 658                 struct tomoyo_no_rewrite_entry *ptr;
 659                 ptr = list_entry(pos, struct tomoyo_no_rewrite_entry,
 660                                  head.list);
 661                 if (ptr->head.is_deleted)
 662                         continue;
 663                 done = tomoyo_io_printf(head, TOMOYO_KEYWORD_DENY_REWRITE
 664                                         "%s\n", ptr->pattern->name);
 665                 if (!done)
 666                         break;
 667         }
 668         return done;
 669 }
 670
 671 /**
 672  * tomoyo_path_acl - Check permission for single path operation.
 673  *
 674  * @r:               Pointer to "struct tomoyo_request_info".
 675  * @filename:        Filename to check.
 676  * @perm:            Permission.
 677  *
 678  * Returns 0 on success, -EPERM otherwise.
 679  *
 680  * Caller holds tomoyo_read_lock().
 681  */
 682 static int tomoyo_path_acl(const struct tomoyo_request_info *r,
 683                            const struct tomoyo_path_info *filename,
 684                            const u32 perm)
 685 {
 686         struct tomoyo_domain_info *domain = r->domain;
 687         struct tomoyo_acl_info *ptr;
 688         int error = -EPERM;
 689
 690         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 691                 struct tomoyo_path_acl *acl;
 692                 if (ptr->type != TOMOYO_TYPE_PATH_ACL)
 693                         continue;
 694                 acl = container_of(ptr, struct tomoyo_path_acl, head);
 695                 if (!(acl->perm & perm) ||
 696                     !tomoyo_compare_name_union(filename, &acl->name))
 697                         continue;
 698                 error = 0;
 699                 break;
 700         }
 701         return error;
 702 }
 703
 704 /**
 705  * tomoyo_file_perm - Check permission for opening files.
 706  *
 707  * @r:         Pointer to "struct tomoyo_request_info".
 708  * @filename:  Filename to check.
 709  * @mode:      Mode ("read" or "write" or "read/write" or "execute").
 710  *
 711  * Returns 0 on success, negative value otherwise.
 712  *
 713  * Caller holds tomoyo_read_lock().
 714  */
 715 static int tomoyo_file_perm(struct tomoyo_request_info *r,
 716                             const struct tomoyo_path_info *filename,
 717                             const u8 mode)
 718 {
 719         const char *msg = "<unknown>";
 720         int error = 0;
 721         u32 perm = 0;
 722
 723         if (!filename)
 724                 return 0;
 725
 726         if (mode == 6) {
 727                 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ_WRITE);
 728                 perm = 1 << TOMOYO_TYPE_READ_WRITE;
 729         } else if (mode == 4) {
 730                 msg = tomoyo_path2keyword(TOMOYO_TYPE_READ);
 731                 perm = 1 << TOMOYO_TYPE_READ;
 732         } else if (mode == 2) {
 733                 msg = tomoyo_path2keyword(TOMOYO_TYPE_WRITE);
 734                 perm = 1 << TOMOYO_TYPE_WRITE;
 735         } else if (mode == 1) {
 736                 msg = tomoyo_path2keyword(TOMOYO_TYPE_EXECUTE);
 737                 perm = 1 << TOMOYO_TYPE_EXECUTE;
 738         } else
 739                 BUG();
 740         do {
 741                 error = tomoyo_path_acl(r, filename, perm);
 742                 if (error && mode == 4 && !r->domain->ignore_global_allow_read
 743                     && tomoyo_is_globally_readable_file(filename))
 744                         error = 0;
 745                 if (!error)
 746                         break;
 747                 tomoyo_warn_log(r, "%s %s", msg, filename->name);
 748                 error = tomoyo_supervisor(r, "allow_%s %s\n", msg,
 749                                           tomoyo_file_pattern(filename));
 750                 /*
 751                  * Do not retry for execute request, for alias may have
 752                  * changed.
 753                  */
 754         } while (error == TOMOYO_RETRY_REQUEST && mode != 1);
 755         if (r->mode != TOMOYO_CONFIG_ENFORCING)
 756                 error = 0;
 757         return error;
 758 }
 759
 760 static bool tomoyo_same_path_acl(const struct tomoyo_acl_info *a,
 761                                  const struct tomoyo_acl_info *b)
 762 {
 763         const struct tomoyo_path_acl *p1 = container_of(a, typeof(*p1), head);
 764         const struct tomoyo_path_acl *p2 = container_of(b, typeof(*p2), head);
 765         return tomoyo_is_same_acl_head(&p1->head, &p2->head) &&
 766                 tomoyo_is_same_name_union(&p1->name, &p2->name);
 767 }
 768
 769 static bool tomoyo_merge_path_acl(struct tomoyo_acl_info *a,
 770                                   struct tomoyo_acl_info *b,
 771                                   const bool is_delete)
 772 {
 773         u16 * const a_perm = &container_of(a, struct tomoyo_path_acl, head)
 774                 ->perm;
 775         u16 perm = *a_perm;
 776         const u16 b_perm = container_of(b, struct tomoyo_path_acl, head)->perm;
 777         if (is_delete) {
 778                 perm &= ~b_perm;
 779                 if ((perm & TOMOYO_RW_MASK) != TOMOYO_RW_MASK)
 780                         perm &= ~(1 << TOMOYO_TYPE_READ_WRITE);
 781                 else if (!(perm & (1 << TOMOYO_TYPE_READ_WRITE)))
 782                         perm &= ~TOMOYO_RW_MASK;
 783         } else {
 784                 perm |= b_perm;
 785                 if ((perm & TOMOYO_RW_MASK) == TOMOYO_RW_MASK)
 786                         perm |= (1 << TOMOYO_TYPE_READ_WRITE);
 787                 else if (perm & (1 << TOMOYO_TYPE_READ_WRITE))
 788                         perm |= TOMOYO_RW_MASK;
 789         }
 790         *a_perm = perm;
 791         return !perm;
 792 }
 793
 794 /**
 795  * tomoyo_update_path_acl - Update "struct tomoyo_path_acl" list.
 796  *
 797  * @type:      Type of operation.
 798  * @filename:  Filename.
 799  * @domain:    Pointer to "struct tomoyo_domain_info".
 800  * @is_delete: True if it is a delete request.
 801  *
 802  * Returns 0 on success, negative value otherwise.
 803  *
 804  * Caller holds tomoyo_read_lock().
 805  */
 806 static int tomoyo_update_path_acl(const u8 type, const char *filename,
 807                                   struct tomoyo_domain_info * const domain,
 808                                   const bool is_delete)
 809 {
 810         struct tomoyo_path_acl e = {
 811                 .head.type = TOMOYO_TYPE_PATH_ACL,
 812                 .perm = 1 << type
 813         };
 814         int error;
 815         if (e.perm == (1 << TOMOYO_TYPE_READ_WRITE))
 816                 e.perm |= TOMOYO_RW_MASK;
 817         if (!tomoyo_parse_name_union(filename, &e.name))
 818                 return -EINVAL;
 819         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 820                                      tomoyo_same_path_acl,
 821                                      tomoyo_merge_path_acl);
 822         tomoyo_put_name_union(&e.name);
 823         return error;
 824 }
 825
 826 static bool tomoyo_same_path_number3_acl(const struct tomoyo_acl_info *a,
 827                                          const struct tomoyo_acl_info *b)
 828 {
 829         const struct tomoyo_path_number3_acl *p1 = container_of(a, typeof(*p1),
 830                                                                 head);
 831         const struct tomoyo_path_number3_acl *p2 = container_of(b, typeof(*p2),
 832                                                                 head);
 833         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
 834                 && tomoyo_is_same_name_union(&p1->name, &p2->name)
 835                 && tomoyo_is_same_number_union(&p1->mode, &p2->mode)
 836                 && tomoyo_is_same_number_union(&p1->major, &p2->major)
 837                 && tomoyo_is_same_number_union(&p1->minor, &p2->minor);
 838 }
 839
 840 static bool tomoyo_merge_path_number3_acl(struct tomoyo_acl_info *a,
 841                                           struct tomoyo_acl_info *b,
 842                                           const bool is_delete)
 843 {
 844         u8 *const a_perm = &container_of(a, struct tomoyo_path_number3_acl,
 845                                          head)->perm;
 846         u8 perm = *a_perm;
 847         const u8 b_perm = container_of(b, struct tomoyo_path_number3_acl, head)
 848                 ->perm;
 849         if (is_delete)
 850                 perm &= ~b_perm;
 851         else
 852                 perm |= b_perm;
 853         *a_perm = perm;
 854         return !perm;
 855 }
 856
 857 /**
 858  * tomoyo_update_path_number3_acl - Update "struct tomoyo_path_number3_acl" list.
 859  *
 860  * @type:      Type of operation.
 861  * @filename:  Filename.
 862  * @mode:      Create mode.
 863  * @major:     Device major number.
 864  * @minor:     Device minor number.
 865  * @domain:    Pointer to "struct tomoyo_domain_info".
 866  * @is_delete: True if it is a delete request.
 867  *
 868  * Returns 0 on success, negative value otherwise.
 869  *
 870  * Caller holds tomoyo_read_lock().
 871  */
 872 static int tomoyo_update_path_number3_acl(const u8 type, const char *filename,
 873                                           char *mode, char *major, char *minor,
 874                                           struct tomoyo_domain_info * const
 875                                           domain, const bool is_delete)
 876 {
 877         struct tomoyo_path_number3_acl e = {
 878                 .head.type = TOMOYO_TYPE_PATH_NUMBER3_ACL,
 879                 .perm = 1 << type
 880         };
 881         int error = is_delete ? -ENOENT : -ENOMEM;
 882         if (!tomoyo_parse_name_union(filename, &e.name) ||
 883             !tomoyo_parse_number_union(mode, &e.mode) ||
 884             !tomoyo_parse_number_union(major, &e.major) ||
 885             !tomoyo_parse_number_union(minor, &e.minor))
 886                 goto out;
 887         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 888                                      tomoyo_same_path_number3_acl,
 889                                      tomoyo_merge_path_number3_acl);
 890  out:
 891         tomoyo_put_name_union(&e.name);
 892         tomoyo_put_number_union(&e.mode);
 893         tomoyo_put_number_union(&e.major);
 894         tomoyo_put_number_union(&e.minor);
 895         return error;
 896 }
 897
 898 static bool tomoyo_same_path2_acl(const struct tomoyo_acl_info *a,
 899                                   const struct tomoyo_acl_info *b)
 900 {
 901         const struct tomoyo_path2_acl *p1 = container_of(a, typeof(*p1), head);
 902         const struct tomoyo_path2_acl *p2 = container_of(b, typeof(*p2), head);
 903         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
 904                 && tomoyo_is_same_name_union(&p1->name1, &p2->name1)
 905                 && tomoyo_is_same_name_union(&p1->name2, &p2->name2);
 906 }
 907
 908 static bool tomoyo_merge_path2_acl(struct tomoyo_acl_info *a,
 909                                    struct tomoyo_acl_info *b,
 910                                    const bool is_delete)
 911 {
 912         u8 * const a_perm = &container_of(a, struct tomoyo_path2_acl, head)
 913                 ->perm;
 914         u8 perm = *a_perm;
 915         const u8 b_perm = container_of(b, struct tomoyo_path2_acl, head)->perm;
 916         if (is_delete)
 917                 perm &= ~b_perm;
 918         else
 919                 perm |= b_perm;
 920         *a_perm = perm;
 921         return !perm;
 922 }
 923
 924 /**
 925  * tomoyo_update_path2_acl - Update "struct tomoyo_path2_acl" list.
 926  *
 927  * @type:      Type of operation.
 928  * @filename1: First filename.
 929  * @filename2: Second filename.
 930  * @domain:    Pointer to "struct tomoyo_domain_info".
 931  * @is_delete: True if it is a delete request.
 932  *
 933  * Returns 0 on success, negative value otherwise.
 934  *
 935  * Caller holds tomoyo_read_lock().
 936  */
 937 static int tomoyo_update_path2_acl(const u8 type, const char *filename1,
 938                                    const char *filename2,
 939                                    struct tomoyo_domain_info * const domain,
 940                                    const bool is_delete)
 941 {
 942         struct tomoyo_path2_acl e = {
 943                 .head.type = TOMOYO_TYPE_PATH2_ACL,
 944                 .perm = 1 << type
 945         };
 946         int error = is_delete ? -ENOENT : -ENOMEM;
 947         if (!tomoyo_parse_name_union(filename1, &e.name1) ||
 948             !tomoyo_parse_name_union(filename2, &e.name2))
 949                 goto out;
 950         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
 951                                      tomoyo_same_path2_acl,
 952                                      tomoyo_merge_path2_acl);
 953  out:
 954         tomoyo_put_name_union(&e.name1);
 955         tomoyo_put_name_union(&e.name2);
 956         return error;
 957 }
 958
 959 /**
 960  * tomoyo_path_number3_acl - Check permission for path/number/number/number operation.
 961  *
 962  * @r:        Pointer to "struct tomoyo_request_info".
 963  * @filename: Filename to check.
 964  * @perm:     Permission.
 965  * @mode:     Create mode.
 966  * @major:    Device major number.
 967  * @minor:    Device minor number.
 968  *
 969  * Returns 0 on success, -EPERM otherwise.
 970  *
 971  * Caller holds tomoyo_read_lock().
 972  */
 973 static int tomoyo_path_number3_acl(struct tomoyo_request_info *r,
 974                                    const struct tomoyo_path_info *filename,
 975                                    const u16 perm, const unsigned int mode,
 976                                    const unsigned int major,
 977                                    const unsigned int minor)
 978 {
 979         struct tomoyo_domain_info *domain = r->domain;
 980         struct tomoyo_acl_info *ptr;
 981         int error = -EPERM;
 982         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
 983                 struct tomoyo_path_number3_acl *acl;
 984                 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER3_ACL)
 985                         continue;
 986                 acl = container_of(ptr, struct tomoyo_path_number3_acl, head);
 987                 if (!tomoyo_compare_number_union(mode, &acl->mode))
 988                         continue;
 989                 if (!tomoyo_compare_number_union(major, &acl->major))
 990                         continue;
 991                 if (!tomoyo_compare_number_union(minor, &acl->minor))
 992                         continue;
 993                 if (!(acl->perm & perm))
 994                         continue;
 995                 if (!tomoyo_compare_name_union(filename, &acl->name))
 996                         continue;
 997                 error = 0;
 998                 break;
 999         }
1000         return error;
1001 }
1002
1003 /**
1004  * tomoyo_path2_acl - Check permission for double path operation.
1005  *
1006  * @r:         Pointer to "struct tomoyo_request_info".
1007  * @type:      Type of operation.
1008  * @filename1: First filename to check.
1009  * @filename2: Second filename to check.
1010  *
1011  * Returns 0 on success, -EPERM otherwise.
1012  *
1013  * Caller holds tomoyo_read_lock().
1014  */
1015 static int tomoyo_path2_acl(const struct tomoyo_request_info *r, const u8 type,
1016                             const struct tomoyo_path_info *filename1,
1017                             const struct tomoyo_path_info *filename2)
1018 {
1019         const struct tomoyo_domain_info *domain = r->domain;
1020         struct tomoyo_acl_info *ptr;
1021         const u8 perm = 1 << type;
1022         int error = -EPERM;
1023
1024         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1025                 struct tomoyo_path2_acl *acl;
1026                 if (ptr->type != TOMOYO_TYPE_PATH2_ACL)
1027                         continue;
1028                 acl = container_of(ptr, struct tomoyo_path2_acl, head);
1029                 if (!(acl->perm & perm))
1030                         continue;
1031                 if (!tomoyo_compare_name_union(filename1, &acl->name1))
1032                         continue;
1033                 if (!tomoyo_compare_name_union(filename2, &acl->name2))
1034                         continue;
1035                 error = 0;
1036                 break;
1037         }
1038         return error;
1039 }
1040
1041 /**
1042  * tomoyo_path_permission - Check permission for single path operation.
1043  *
1044  * @r:         Pointer to "struct tomoyo_request_info".
1045  * @operation: Type of operation.
1046  * @filename:  Filename to check.
1047  *
1048  * Returns 0 on success, negative value otherwise.
1049  *
1050  * Caller holds tomoyo_read_lock().
1051  */
1052 static int tomoyo_path_permission(struct tomoyo_request_info *r, u8 operation,
1053                                   const struct tomoyo_path_info *filename)
1054 {
1055         const char *msg;
1056         int error;
1057
1058  next:
1059         r->type = tomoyo_p2mac[operation];
1060         r->mode = tomoyo_get_mode(r->profile, r->type);
1061         if (r->mode == TOMOYO_CONFIG_DISABLED)
1062                 return 0;
1063         do {
1064                 error = tomoyo_path_acl(r, filename, 1 << operation);
1065                 if (!error)
1066                         break;
1067                 msg = tomoyo_path2keyword(operation);
1068                 tomoyo_warn_log(r, "%s %s", msg, filename->name);
1069                 error = tomoyo_supervisor(r, "allow_%s %s\n", msg,
1070                                           tomoyo_file_pattern(filename));
1071         } while (error == TOMOYO_RETRY_REQUEST);
1072         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1073                 error = 0;
1074         /*
1075          * Since "allow_truncate" doesn't imply "allow_rewrite" permission,
1076          * we need to check "allow_rewrite" permission if the filename is
1077          * specified by "deny_rewrite" keyword.
1078          */
1079         if (!error && operation == TOMOYO_TYPE_TRUNCATE &&
1080             tomoyo_is_no_rewrite_file(filename)) {
1081                 operation = TOMOYO_TYPE_REWRITE;
1082                 goto next;
1083         }
1084         return error;
1085 }
1086
1087 /**
1088  * tomoyo_path_number_acl - Check permission for ioctl/chmod/chown/chgrp operation.
1089  *
1090  * @r:        Pointer to "struct tomoyo_request_info".
1091  * @type:     Operation.
1092  * @filename: Filename to check.
1093  * @number:   Number.
1094  *
1095  * Returns 0 on success, -EPERM otherwise.
1096  *
1097  * Caller holds tomoyo_read_lock().
1098  */
1099 static int tomoyo_path_number_acl(struct tomoyo_request_info *r, const u8 type,
1100                                   const struct tomoyo_path_info *filename,
1101                                   const unsigned long number)
1102 {
1103         struct tomoyo_domain_info *domain = r->domain;
1104         struct tomoyo_acl_info *ptr;
1105         const u8 perm = 1 << type;
1106         int error = -EPERM;
1107         list_for_each_entry_rcu(ptr, &domain->acl_info_list, list) {
1108                 struct tomoyo_path_number_acl *acl;
1109                 if (ptr->type != TOMOYO_TYPE_PATH_NUMBER_ACL)
1110                         continue;
1111                 acl = container_of(ptr, struct tomoyo_path_number_acl,
1112                                    head);
1113                 if (!(acl->perm & perm) ||
1114                     !tomoyo_compare_number_union(number, &acl->number) ||
1115                     !tomoyo_compare_name_union(filename, &acl->name))
1116                         continue;
1117                 error = 0;
1118                 break;
1119         }
1120         return error;
1121 }
1122
1123 static bool tomoyo_same_path_number_acl(const struct tomoyo_acl_info *a,
1124                                         const struct tomoyo_acl_info *b)
1125 {
1126         const struct tomoyo_path_number_acl *p1 = container_of(a, typeof(*p1),
1127                                                                head);
1128         const struct tomoyo_path_number_acl *p2 = container_of(b, typeof(*p2),
1129                                                                head);
1130         return tomoyo_is_same_acl_head(&p1->head, &p2->head)
1131                 && tomoyo_is_same_name_union(&p1->name, &p2->name)
1132                 && tomoyo_is_same_number_union(&p1->number, &p2->number);
1133 }
1134
1135 static bool tomoyo_merge_path_number_acl(struct tomoyo_acl_info *a,
1136                                          struct tomoyo_acl_info *b,
1137                                          const bool is_delete)
1138 {
1139         u8 * const a_perm = &container_of(a, struct tomoyo_path_number_acl,
1140                                           head)->perm;
1141         u8 perm = *a_perm;
1142         const u8 b_perm = container_of(b, struct tomoyo_path_number_acl, head)
1143                 ->perm;
1144         if (is_delete)
1145                 perm &= ~b_perm;
1146         else
1147                 perm |= b_perm;
1148         *a_perm = perm;
1149         return !perm;
1150 }
1151
1152 /**
1153  * tomoyo_update_path_number_acl - Update ioctl/chmod/chown/chgrp ACL.
1154  *
1155  * @type:      Type of operation.
1156  * @filename:  Filename.
1157  * @number:    Number.
1158  * @domain:    Pointer to "struct tomoyo_domain_info".
1159  * @is_delete: True if it is a delete request.
1160  *
1161  * Returns 0 on success, negative value otherwise.
1162  */
1163 static int tomoyo_update_path_number_acl(const u8 type, const char *filename,
1164                                          char *number,
1165                                          struct tomoyo_domain_info * const
1166                                          domain,
1167                                          const bool is_delete)
1168 {
1169         struct tomoyo_path_number_acl e = {
1170                 .head.type = TOMOYO_TYPE_PATH_NUMBER_ACL,
1171                 .perm = 1 << type
1172         };
1173         int error = is_delete ? -ENOENT : -ENOMEM;
1174         if (!tomoyo_parse_name_union(filename, &e.name))
1175                 return -EINVAL;
1176         if (!tomoyo_parse_number_union(number, &e.number))
1177                 goto out;
1178         error = tomoyo_update_domain(&e.head, sizeof(e), is_delete, domain,
1179                                      tomoyo_same_path_number_acl,
1180                                      tomoyo_merge_path_number_acl);
1181  out:
1182         tomoyo_put_name_union(&e.name);
1183         tomoyo_put_number_union(&e.number);
1184         return error;
1185 }
1186
1187 /**
1188  * tomoyo_path_number_perm2 - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
1189  *
1190  * @r:        Pointer to "strct tomoyo_request_info".
1191  * @filename: Filename to check.
1192  * @number:   Number.
1193  *
1194  * Returns 0 on success, negative value otherwise.
1195  *
1196  * Caller holds tomoyo_read_lock().
1197  */
1198 static int tomoyo_path_number_perm2(struct tomoyo_request_info *r,
1199                                     const u8 type,
1200                                     const struct tomoyo_path_info *filename,
1201                                     const unsigned long number)
1202 {
1203         char buffer[64];
1204         int error;
1205         u8 radix;
1206         const char *msg;
1207
1208         if (!filename)
1209                 return 0;
1210         switch (type) {
1211         case TOMOYO_TYPE_CREATE:
1212         case TOMOYO_TYPE_MKDIR:
1213         case TOMOYO_TYPE_MKFIFO:
1214         case TOMOYO_TYPE_MKSOCK:
1215         case TOMOYO_TYPE_CHMOD:
1216                 radix = TOMOYO_VALUE_TYPE_OCTAL;
1217                 break;
1218         case TOMOYO_TYPE_IOCTL:
1219                 radix = TOMOYO_VALUE_TYPE_HEXADECIMAL;
1220                 break;
1221         default:
1222                 radix = TOMOYO_VALUE_TYPE_DECIMAL;
1223                 break;
1224         }
1225         tomoyo_print_ulong(buffer, sizeof(buffer), number, radix);
1226         do {
1227                 error = tomoyo_path_number_acl(r, type, filename, number);
1228                 if (!error)
1229                         break;
1230                 msg = tomoyo_path_number2keyword(type);
1231                 tomoyo_warn_log(r, "%s %s %s", msg, filename->name, buffer);
1232                 error = tomoyo_supervisor(r, "allow_%s %s %s\n", msg,
1233                                           tomoyo_file_pattern(filename),
1234                                           buffer);
1235         } while (error == TOMOYO_RETRY_REQUEST);
1236         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1237                 error = 0;
1238         return error;
1239 }
1240
1241 /**
1242  * tomoyo_path_number_perm - Check permission for "create", "mkdir", "mkfifo", "mksock", "ioctl", "chmod", "chown", "chgrp".
1243  *
1244  * @type:   Type of operation.
1245  * @path:   Pointer to "struct path".
1246  * @number: Number.
1247  *
1248  * Returns 0 on success, negative value otherwise.
1249  */
1250 int tomoyo_path_number_perm(const u8 type, struct path *path,
1251                             unsigned long number)
1252 {
1253         struct tomoyo_request_info r;
1254         int error = -ENOMEM;
1255         struct tomoyo_path_info buf;
1256         int idx;
1257
1258         if (tomoyo_init_request_info(&r, NULL, tomoyo_pn2mac[type])
1259             == TOMOYO_CONFIG_DISABLED || !path->mnt || !path->dentry)
1260                 return 0;
1261         idx = tomoyo_read_lock();
1262         if (!tomoyo_get_realpath(&buf, path))
1263                 goto out;
1264         if (type == TOMOYO_TYPE_MKDIR)
1265                 tomoyo_add_slash(&buf);
1266         error = tomoyo_path_number_perm2(&r, type, &buf, number);
1267  out:
1268         kfree(buf.name);
1269         tomoyo_read_unlock(idx);
1270         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1271                 error = 0;
1272         return error;
1273 }
1274
1275 /**
1276  * tomoyo_check_exec_perm - Check permission for "execute".
1277  *
1278  * @r:        Pointer to "struct tomoyo_request_info".
1279  * @filename: Check permission for "execute".
1280  *
1281  * Returns 0 on success, negativevalue otherwise.
1282  *
1283  * Caller holds tomoyo_read_lock().
1284  */
1285 int tomoyo_check_exec_perm(struct tomoyo_request_info *r,
1286                            const struct tomoyo_path_info *filename)
1287 {
1288         if (r->mode == TOMOYO_CONFIG_DISABLED)
1289                 return 0;
1290         return tomoyo_file_perm(r, filename, 1);
1291 }
1292
1293 /**
1294  * tomoyo_check_open_permission - Check permission for "read" and "write".
1295  *
1296  * @domain: Pointer to "struct tomoyo_domain_info".
1297  * @path:   Pointer to "struct path".
1298  * @flag:   Flags for open().
1299  *
1300  * Returns 0 on success, negative value otherwise.
1301  */
1302 int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
1303                                  struct path *path, const int flag)
1304 {
1305         const u8 acc_mode = ACC_MODE(flag);
1306         int error = -ENOMEM;
1307         struct tomoyo_path_info buf;
1308         struct tomoyo_request_info r;
1309         int idx;
1310
1311         if (!path->mnt ||
1312             (path->dentry->d_inode && S_ISDIR(path->dentry->d_inode->i_mode)))
1313                 return 0;
1314         buf.name = NULL;
1315         r.mode = TOMOYO_CONFIG_DISABLED;
1316         idx = tomoyo_read_lock();
1317         if (!tomoyo_get_realpath(&buf, path))
1318                 goto out;
1319         error = 0;
1320         /*
1321          * If the filename is specified by "deny_rewrite" keyword,
1322          * we need to check "allow_rewrite" permission when the filename is not
1323          * opened for append mode or the filename is truncated at open time.
1324          */
1325         if ((acc_mode & MAY_WRITE) && !(flag & O_APPEND)
1326             && tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_REWRITE)
1327             != TOMOYO_CONFIG_DISABLED) {
1328                 if (!tomoyo_get_realpath(&buf, path)) {
1329                         error = -ENOMEM;
1330                         goto out;
1331                 }
1332                 if (tomoyo_is_no_rewrite_file(&buf))
1333                         error = tomoyo_path_permission(&r, TOMOYO_TYPE_REWRITE,
1334                                                        &buf);
1335         }
1336         if (!error && acc_mode &&
1337             tomoyo_init_request_info(&r, domain, TOMOYO_MAC_FILE_OPEN)
1338             != TOMOYO_CONFIG_DISABLED) {
1339                 if (!buf.name && !tomoyo_get_realpath(&buf, path)) {
1340                         error = -ENOMEM;
1341                         goto out;
1342                 }
1343                 error = tomoyo_file_perm(&r, &buf, acc_mode);
1344         }
1345  out:
1346         kfree(buf.name);
1347         tomoyo_read_unlock(idx);
1348         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1349                 error = 0;
1350         return error;
1351 }
1352
1353 /**
1354  * tomoyo_path_perm - Check permission for "unlink", "rmdir", "truncate", "symlink", "rewrite", "chroot" and "unmount".
1355  *
1356  * @operation: Type of operation.
1357  * @path:      Pointer to "struct path".
1358  *
1359  * Returns 0 on success, negative value otherwise.
1360  */
1361 int tomoyo_path_perm(const u8 operation, struct path *path)
1362 {
1363         int error = -ENOMEM;
1364         struct tomoyo_path_info buf;
1365         struct tomoyo_request_info r;
1366         int idx;
1367
1368         if (!path->mnt)
1369                 return 0;
1370         if (tomoyo_init_request_info(&r, NULL, tomoyo_p2mac[operation])
1371             == TOMOYO_CONFIG_DISABLED)
1372                 return 0;
1373         buf.name = NULL;
1374         idx = tomoyo_read_lock();
1375         if (!tomoyo_get_realpath(&buf, path))
1376                 goto out;
1377         switch (operation) {
1378         case TOMOYO_TYPE_REWRITE:
1379                 if (!tomoyo_is_no_rewrite_file(&buf)) {
1380                         error = 0;
1381                         goto out;
1382                 }
1383                 break;
1384         case TOMOYO_TYPE_RMDIR:
1385         case TOMOYO_TYPE_CHROOT:
1386         case TOMOYO_TYPE_UMOUNT:
1387                 tomoyo_add_slash(&buf);
1388                 break;
1389         }
1390         error = tomoyo_path_permission(&r, operation, &buf);
1391  out:
1392         kfree(buf.name);
1393         tomoyo_read_unlock(idx);
1394         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1395                 error = 0;
1396         return error;
1397 }
1398
1399 /**
1400  * tomoyo_path_number3_perm2 - Check permission for path/number/number/number operation.
1401  *
1402  * @r:         Pointer to "struct tomoyo_request_info".
1403  * @operation: Type of operation.
1404  * @filename:  Filename to check.
1405  * @mode:      Create mode.
1406  * @dev:       Device number.
1407  *
1408  * Returns 0 on success, negative value otherwise.
1409  *
1410  * Caller holds tomoyo_read_lock().
1411  */
1412 static int tomoyo_path_number3_perm2(struct tomoyo_request_info *r,
1413                                      const u8 operation,
1414                                      const struct tomoyo_path_info *filename,
1415                                      const unsigned int mode,
1416                                      const unsigned int dev)
1417 {
1418         int error;
1419         const char *msg;
1420         const unsigned int major = MAJOR(dev);
1421         const unsigned int minor = MINOR(dev);
1422
1423         do {
1424                 error = tomoyo_path_number3_acl(r, filename, 1 << operation,
1425                                                 mode, major, minor);
1426                 if (!error)
1427                         break;
1428                 msg = tomoyo_path_number32keyword(operation);
1429                 tomoyo_warn_log(r, "%s %s 0%o %u %u", msg, filename->name,
1430                                 mode, major, minor);
1431                 error = tomoyo_supervisor(r, "allow_%s %s 0%o %u %u\n", msg,
1432                                           tomoyo_file_pattern(filename), mode,
1433                                           major, minor);
1434         } while (error == TOMOYO_RETRY_REQUEST);
1435         if (r->mode != TOMOYO_CONFIG_ENFORCING)
1436                 error = 0;
1437         return error;
1438 }
1439
1440 /**
1441  * tomoyo_path_number3_perm - Check permission for "mkblock" and "mkchar".
1442  *
1443  * @operation: Type of operation. (TOMOYO_TYPE_MKCHAR or TOMOYO_TYPE_MKBLOCK)
1444  * @path:      Pointer to "struct path".
1445  * @mode:      Create mode.
1446  * @dev:       Device number.
1447  *
1448  * Returns 0 on success, negative value otherwise.
1449  */
1450 int tomoyo_path_number3_perm(const u8 operation, struct path *path,
1451                              const unsigned int mode, unsigned int dev)
1452 {
1453         struct tomoyo_request_info r;
1454         int error = -ENOMEM;
1455         struct tomoyo_path_info buf;
1456         int idx;
1457
1458         if (!path->mnt ||
1459             tomoyo_init_request_info(&r, NULL, tomoyo_pnnn2mac[operation])
1460             == TOMOYO_CONFIG_DISABLED)
1461                 return 0;
1462         idx = tomoyo_read_lock();
1463         error = -ENOMEM;
1464         if (tomoyo_get_realpath(&buf, path)) {
1465                 error = tomoyo_path_number3_perm2(&r, operation, &buf, mode,
1466                                                   new_decode_dev(dev));
1467                 kfree(buf.name);
1468         }
1469         tomoyo_read_unlock(idx);
1470         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1471                 error = 0;
1472         return error;
1473 }
1474
1475 /**
1476  * tomoyo_path2_perm - Check permission for "rename", "link" and "pivot_root".
1477  *
1478  * @operation: Type of operation.
1479  * @path1:      Pointer to "struct path".
1480  * @path2:      Pointer to "struct path".
1481  *
1482  * Returns 0 on success, negative value otherwise.
1483  */
1484 int tomoyo_path2_perm(const u8 operation, struct path *path1,
1485                       struct path *path2)
1486 {
1487         int error = -ENOMEM;
1488         const char *msg;
1489         struct tomoyo_path_info buf1;
1490         struct tomoyo_path_info buf2;
1491         struct tomoyo_request_info r;
1492         int idx;
1493
1494         if (!path1->mnt || !path2->mnt ||
1495             tomoyo_init_request_info(&r, NULL, tomoyo_pp2mac[operation])
1496             == TOMOYO_CONFIG_DISABLED)
1497                 return 0;
1498         buf1.name = NULL;
1499         buf2.name = NULL;
1500         idx = tomoyo_read_lock();
1501         if (!tomoyo_get_realpath(&buf1, path1) ||
1502             !tomoyo_get_realpath(&buf2, path2))
1503                 goto out;
1504         switch (operation) {
1505                 struct dentry *dentry;
1506         case TOMOYO_TYPE_RENAME:
1507         case TOMOYO_TYPE_LINK:
1508                 dentry = path1->dentry;
1509                 if (!dentry->d_inode || !S_ISDIR(dentry->d_inode->i_mode))
1510                         break;
1511                 /* fall through */
1512         case TOMOYO_TYPE_PIVOT_ROOT:
1513                 tomoyo_add_slash(&buf1);
1514                 tomoyo_add_slash(&buf2);
1515                 break;
1516         }
1517         do {
1518                 error = tomoyo_path2_acl(&r, operation, &buf1, &buf2);
1519                 if (!error)
1520                         break;
1521                 msg = tomoyo_path22keyword(operation);
1522                 tomoyo_warn_log(&r, "%s %s %s", msg, buf1.name, buf2.name);
1523                 error = tomoyo_supervisor(&r, "allow_%s %s %s\n", msg,
1524                                           tomoyo_file_pattern(&buf1),
1525                                           tomoyo_file_pattern(&buf2));
1526         } while (error == TOMOYO_RETRY_REQUEST);
1527  out:
1528         kfree(buf1.name);
1529         kfree(buf2.name);
1530         tomoyo_read_unlock(idx);
1531         if (r.mode != TOMOYO_CONFIG_ENFORCING)
1532                 error = 0;
1533         return error;
1534 }
1535
1536 /**
1537  * tomoyo_write_file_policy - Update file related list.
1538  *
1539  * @data:      String to parse.
1540  * @domain:    Pointer to "struct tomoyo_domain_info".
1541  * @is_delete: True if it is a delete request.
1542  *
1543  * Returns 0 on success, negative value otherwise.
1544  *
1545  * Caller holds tomoyo_read_lock().
1546  */
1547 int tomoyo_write_file_policy(char *data, struct tomoyo_domain_info *domain,
1548                              const bool is_delete)
1549 {
1550         char *w[5];
1551         u8 type;
1552         if (!tomoyo_tokenize(data, w, sizeof(w)) || !w[1][0])
1553                 return -EINVAL;
1554         if (strncmp(w[0], "allow_", 6))
1555                 goto out;
1556         w[0] += 6;
1557         for (type = 0; type < TOMOYO_MAX_PATH_OPERATION; type++) {
1558                 if (strcmp(w[0], tomoyo_path_keyword[type]))
1559                         continue;
1560                 return tomoyo_update_path_acl(type, w[1], domain, is_delete);
1561         }
1562         if (!w[2][0])
1563                 goto out;
1564         for (type = 0; type < TOMOYO_MAX_PATH2_OPERATION; type++) {
1565                 if (strcmp(w[0], tomoyo_path2_keyword[type]))
1566                         continue;
1567                 return tomoyo_update_path2_acl(type, w[1], w[2], domain,
1568                                                is_delete);
1569         }
1570         for (type = 0; type < TOMOYO_MAX_PATH_NUMBER_OPERATION; type++) {
1571                 if (strcmp(w[0], tomoyo_path_number_keyword[type]))
1572                         continue;
1573                 return tomoyo_update_path_number_acl(type, w[1], w[2], domain,
1574                                                      is_delete);
1575         }
1576         if (!w[3][0] || !w[4][0])
1577                 goto out;
1578         for (type = 0; type < TOMOYO_MAX_PATH_NUMBER3_OPERATION; type++) {
1579                 if (strcmp(w[0], tomoyo_path_number3_keyword[type]))
1580                         continue;
1581                 return tomoyo_update_path_number3_acl(type, w[1], w[2], w[3],
1582                                                       w[4], domain, is_delete);
1583         }
1584  out:
1585         return -EINVAL;
1586 }