security/tomoyo/gc.c

   1 /*
   2  * security/tomoyo/gc.c
   3  *
   4  * Implementation of the Domain-Based Mandatory Access Control.
   5  *
   6  * Copyright (C) 2005-2010  NTT DATA CORPORATION
   7  *
   8  */
   9
  10 #include "common.h"
  11 #include <linux/kthread.h>
  12 #include <linux/slab.h>
  13
  14 struct tomoyo_gc_entry {
  15         struct list_head list;
  16         int type;
  17         struct list_head *element;
  18 };
  19 static LIST_HEAD(tomoyo_gc_queue);
  20 static DEFINE_MUTEX(tomoyo_gc_mutex);
  21
  22 /* Caller holds tomoyo_policy_lock mutex. */
  23 static bool tomoyo_add_to_gc(const int type, struct list_head *element)
  24 {
  25         struct tomoyo_gc_entry *entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
  26         if (!entry)
  27                 return false;
  28         entry->type = type;
  29         entry->element = element;
  30         list_add(&entry->list, &tomoyo_gc_queue);
  31         list_del_rcu(element);
  32         return true;
  33 }
  34
  35 static void tomoyo_del_allow_read(struct list_head *element)
  36 {
  37         struct tomoyo_globally_readable_file_entry *ptr =
  38                 container_of(element, typeof(*ptr), head.list);
  39         tomoyo_put_name(ptr->filename);
  40 }
  41
  42 static void tomoyo_del_file_pattern(struct list_head *element)
  43 {
  44         struct tomoyo_pattern_entry *ptr =
  45                 container_of(element, typeof(*ptr), head.list);
  46         tomoyo_put_name(ptr->pattern);
  47 }
  48
  49 static void tomoyo_del_no_rewrite(struct list_head *element)
  50 {
  51         struct tomoyo_no_rewrite_entry *ptr =
  52                 container_of(element, typeof(*ptr), head.list);
  53         tomoyo_put_name(ptr->pattern);
  54 }
  55
  56 static void tomoyo_del_domain_initializer(struct list_head *element)
  57 {
  58         struct tomoyo_domain_initializer_entry *ptr =
  59                 container_of(element, typeof(*ptr), head.list);
  60         tomoyo_put_name(ptr->domainname);
  61         tomoyo_put_name(ptr->program);
  62 }
  63
  64 static void tomoyo_del_domain_keeper(struct list_head *element)
  65 {
  66         struct tomoyo_domain_keeper_entry *ptr =
  67                 container_of(element, typeof(*ptr), head.list);
  68         tomoyo_put_name(ptr->domainname);
  69         tomoyo_put_name(ptr->program);
  70 }
  71
  72 static void tomoyo_del_aggregator(struct list_head *element)
  73 {
  74         struct tomoyo_aggregator_entry *ptr =
  75                 container_of(element, typeof(*ptr), head.list);
  76         tomoyo_put_name(ptr->original_name);
  77         tomoyo_put_name(ptr->aggregated_name);
  78 }
  79
  80 static void tomoyo_del_manager(struct list_head *element)
  81 {
  82         struct tomoyo_policy_manager_entry *ptr =
  83                 container_of(element, typeof(*ptr), head.list);
  84         tomoyo_put_name(ptr->manager);
  85 }
  86
  87 static void tomoyo_del_acl(struct list_head *element)
  88 {
  89         struct tomoyo_acl_info *acl =
  90                 container_of(element, typeof(*acl), list);
  91         switch (acl->type) {
  92         case TOMOYO_TYPE_PATH_ACL:
  93                 {
  94                         struct tomoyo_path_acl *entry
  95                                 = container_of(acl, typeof(*entry), head);
  96                         tomoyo_put_name_union(&entry->name);
  97                 }
  98                 break;
  99         case TOMOYO_TYPE_PATH2_ACL:
 100                 {
 101                         struct tomoyo_path2_acl *entry
 102                                 = container_of(acl, typeof(*entry), head);
 103                         tomoyo_put_name_union(&entry->name1);
 104                         tomoyo_put_name_union(&entry->name2);
 105                 }
 106                 break;
 107         case TOMOYO_TYPE_PATH_NUMBER_ACL:
 108                 {
 109                         struct tomoyo_path_number_acl *entry
 110                                 = container_of(acl, typeof(*entry), head);
 111                         tomoyo_put_name_union(&entry->name);
 112                         tomoyo_put_number_union(&entry->number);
 113                 }
 114                 break;
 115         case TOMOYO_TYPE_MKDEV_ACL:
 116                 {
 117                         struct tomoyo_mkdev_acl *entry
 118                                 = container_of(acl, typeof(*entry), head);
 119                         tomoyo_put_name_union(&entry->name);
 120                         tomoyo_put_number_union(&entry->mode);
 121                         tomoyo_put_number_union(&entry->major);
 122                         tomoyo_put_number_union(&entry->minor);
 123                 }
 124                 break;
 125         case TOMOYO_TYPE_MOUNT_ACL:
 126                 {
 127                         struct tomoyo_mount_acl *entry
 128                                 = container_of(acl, typeof(*entry), head);
 129                         tomoyo_put_name_union(&entry->dev_name);
 130                         tomoyo_put_name_union(&entry->dir_name);
 131                         tomoyo_put_name_union(&entry->fs_type);
 132                         tomoyo_put_number_union(&entry->flags);
 133                 }
 134                 break;
 135         }
 136 }
 137
 138 static bool tomoyo_del_domain(struct list_head *element)
 139 {
 140         struct tomoyo_domain_info *domain =
 141                 container_of(element, typeof(*domain), list);
 142         struct tomoyo_acl_info *acl;
 143         struct tomoyo_acl_info *tmp;
 144         /*
 145          * Since we don't protect whole execve() operation using SRCU,
 146          * we need to recheck domain->users at this point.
 147          *
 148          * (1) Reader starts SRCU section upon execve().
 149          * (2) Reader traverses tomoyo_domain_list and finds this domain.
 150          * (3) Writer marks this domain as deleted.
 151          * (4) Garbage collector removes this domain from tomoyo_domain_list
 152          *     because this domain is marked as deleted and used by nobody.
 153          * (5) Reader saves reference to this domain into
 154          *     "struct linux_binprm"->cred->security .
 155          * (6) Reader finishes SRCU section, although execve() operation has
 156          *     not finished yet.
 157          * (7) Garbage collector waits for SRCU synchronization.
 158          * (8) Garbage collector kfree() this domain because this domain is
 159          *     used by nobody.
 160          * (9) Reader finishes execve() operation and restores this domain from
 161          *     "struct linux_binprm"->cred->security.
 162          *
 163          * By updating domain->users at (5), we can solve this race problem
 164          * by rechecking domain->users at (8).
 165          */
 166         if (atomic_read(&domain->users))
 167                 return false;
 168         list_for_each_entry_safe(acl, tmp, &domain->acl_info_list, list) {
 169                 tomoyo_del_acl(&acl->list);
 170                 tomoyo_memory_free(acl);
 171         }
 172         tomoyo_put_name(domain->domainname);
 173         return true;
 174 }
 175
 176
 177 static void tomoyo_del_name(struct list_head *element)
 178 {
 179         const struct tomoyo_name_entry *ptr =
 180                 container_of(element, typeof(*ptr), list);
 181 }
 182
 183 static void tomoyo_del_path_group(struct list_head *element)
 184 {
 185         struct tomoyo_path_group *member =
 186                 container_of(element, typeof(*member), head.list);
 187         tomoyo_put_name(member->member_name);
 188 }
 189
 190 static void tomoyo_del_group(struct list_head *element)
 191 {
 192         struct tomoyo_group *group =
 193                 container_of(element, typeof(*group), list);
 194         tomoyo_put_name(group->group_name);
 195 }
 196
 197 static void tomoyo_del_number_group(struct list_head *element)
 198 {
 199         struct tomoyo_number_group *member =
 200                 container_of(element, typeof(*member), head.list);
 201 }
 202
 203 static bool tomoyo_collect_member(struct list_head *member_list, int id)
 204 {
 205         struct tomoyo_acl_head *member;
 206         list_for_each_entry(member, member_list, list) {
 207                 if (!member->is_deleted)
 208                         continue;
 209                 if (!tomoyo_add_to_gc(id, &member->list))
 210                         return false;
 211         }
 212         return true;
 213 }
 214
 215 static bool tomoyo_collect_acl(struct tomoyo_domain_info *domain)
 216 {
 217         struct tomoyo_acl_info *acl;
 218         list_for_each_entry(acl, &domain->acl_info_list, list) {
 219                 if (!acl->is_deleted)
 220                         continue;
 221                 if (!tomoyo_add_to_gc(TOMOYO_ID_ACL, &acl->list))
 222                         return false;
 223         }
 224         return true;
 225 }
 226
 227 static void tomoyo_collect_entry(void)
 228 {
 229         int i;
 230         if (mutex_lock_interruptible(&tomoyo_policy_lock))
 231                 return;
 232         for (i = 0; i < TOMOYO_MAX_POLICY; i++) {
 233                 if (!tomoyo_collect_member(&tomoyo_policy_list[i], i))
 234                         goto unlock;
 235         }
 236         {
 237                 struct tomoyo_domain_info *domain;
 238                 list_for_each_entry_rcu(domain, &tomoyo_domain_list, list) {
 239                         if (!tomoyo_collect_acl(domain))
 240                                 goto unlock;
 241                         if (!domain->is_deleted || atomic_read(&domain->users))
 242                                 continue;
 243                         /*
 244                          * Nobody is referring this domain. But somebody may
 245                          * refer this domain after successful execve().
 246                          * We recheck domain->users after SRCU synchronization.
 247                          */
 248                         if (!tomoyo_add_to_gc(TOMOYO_ID_DOMAIN, &domain->list))
 249                                 goto unlock;
 250                 }
 251         }
 252         for (i = 0; i < TOMOYO_MAX_HASH; i++) {
 253                 struct tomoyo_name_entry *ptr;
 254                 list_for_each_entry_rcu(ptr, &tomoyo_name_list[i], list) {
 255                         if (atomic_read(&ptr->users))
 256                                 continue;
 257                         if (!tomoyo_add_to_gc(TOMOYO_ID_NAME, &ptr->list))
 258                                 goto unlock;
 259                 }
 260         }
 261         for (i = 0; i < TOMOYO_MAX_GROUP; i++) {
 262                 struct list_head *list = &tomoyo_group_list[i];
 263                 int id;
 264                 struct tomoyo_group *group;
 265                 switch (i) {
 266                 case 0:
 267                         id = TOMOYO_ID_PATH_GROUP;
 268                         break;
 269                 default:
 270                         id = TOMOYO_ID_NUMBER_GROUP;
 271                         break;
 272                 }
 273                 list_for_each_entry(group, list, list) {
 274                         if (!tomoyo_collect_member(&group->member_list, id))
 275                                 goto unlock;
 276                         if (!list_empty(&group->member_list) ||
 277                             atomic_read(&group->users))
 278                                 continue;
 279                         if (!tomoyo_add_to_gc(TOMOYO_ID_GROUP, &group->list))
 280                                 goto unlock;
 281                 }
 282         }
 283  unlock:
 284         mutex_unlock(&tomoyo_policy_lock);
 285 }
 286
 287 static void tomoyo_kfree_entry(void)
 288 {
 289         struct tomoyo_gc_entry *p;
 290         struct tomoyo_gc_entry *tmp;
 291
 292         list_for_each_entry_safe(p, tmp, &tomoyo_gc_queue, list) {
 293                 struct list_head *element = p->element;
 294                 switch (p->type) {
 295                 case TOMOYO_ID_DOMAIN_INITIALIZER:
 296                         tomoyo_del_domain_initializer(element);
 297                         break;
 298                 case TOMOYO_ID_DOMAIN_KEEPER:
 299                         tomoyo_del_domain_keeper(element);
 300                         break;
 301                 case TOMOYO_ID_AGGREGATOR:
 302                         tomoyo_del_aggregator(element);
 303                         break;
 304                 case TOMOYO_ID_GLOBALLY_READABLE:
 305                         tomoyo_del_allow_read(element);
 306                         break;
 307                 case TOMOYO_ID_PATTERN:
 308                         tomoyo_del_file_pattern(element);
 309                         break;
 310                 case TOMOYO_ID_NO_REWRITE:
 311                         tomoyo_del_no_rewrite(element);
 312                         break;
 313                 case TOMOYO_ID_MANAGER:
 314                         tomoyo_del_manager(element);
 315                         break;
 316                 case TOMOYO_ID_NAME:
 317                         tomoyo_del_name(element);
 318                         break;
 319                 case TOMOYO_ID_ACL:
 320                         tomoyo_del_acl(element);
 321                         break;
 322                 case TOMOYO_ID_DOMAIN:
 323                         if (!tomoyo_del_domain(element))
 324                                 continue;
 325                         break;
 326                 case TOMOYO_ID_PATH_GROUP:
 327                         tomoyo_del_path_group(element);
 328                         break;
 329                 case TOMOYO_ID_GROUP:
 330                         tomoyo_del_group(element);
 331                         break;
 332                 case TOMOYO_ID_NUMBER_GROUP:
 333                         tomoyo_del_number_group(element);
 334                         break;
 335                 }
 336                 tomoyo_memory_free(element);
 337                 list_del(&p->list);
 338                 kfree(p);
 339         }
 340 }
 341
 342 static int tomoyo_gc_thread(void *unused)
 343 {
 344         daemonize("GC for TOMOYO");
 345         if (mutex_trylock(&tomoyo_gc_mutex)) {
 346                 int i;
 347                 for (i = 0; i < 10; i++) {
 348                         tomoyo_collect_entry();
 349                         if (list_empty(&tomoyo_gc_queue))
 350                                 break;
 351                         synchronize_srcu(&tomoyo_ss);
 352                         tomoyo_kfree_entry();
 353                 }
 354                 mutex_unlock(&tomoyo_gc_mutex);
 355         }
 356         do_exit(0);
 357 }
 358
 359 void tomoyo_run_gc(void)
 360 {
 361         struct task_struct *task = kthread_create(tomoyo_gc_thread, NULL,
 362                                                   "GC for TOMOYO");
 363         if (!IS_ERR(task))
 364                 wake_up_process(task);
 365 }