security/tomoyo/number_group.c

   1 /*
   2  * security/tomoyo/number_group.c
   3  *
   4  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   5  */
   6
   7 #include <linux/slab.h>
   8 #include "common.h"
   9
  10 /* The list for "struct tomoyo_number_group". */
  11 LIST_HEAD(tomoyo_number_group_list);
  12
  13 /**
  14  * tomoyo_get_number_group - Allocate memory for "struct tomoyo_number_group".
  15  *
  16  * @group_name: The name of number group.
  17  *
  18  * Returns pointer to "struct tomoyo_number_group" on success,
  19  * NULL otherwise.
  20  */
  21 struct tomoyo_number_group *tomoyo_get_number_group(const char *group_name)
  22 {
  23         struct tomoyo_number_group *entry = NULL;
  24         struct tomoyo_number_group *group = NULL;
  25         const struct tomoyo_path_info *saved_group_name;
  26         int error = -ENOMEM;
  27         if (!tomoyo_correct_word(group_name))
  28                 return NULL;
  29         saved_group_name = tomoyo_get_name(group_name);
  30         if (!saved_group_name)
  31                 return NULL;
  32         entry = kzalloc(sizeof(*entry), GFP_NOFS);
  33         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  34                 goto out;
  35         list_for_each_entry_rcu(group, &tomoyo_number_group_list, list) {
  36                 if (saved_group_name != group->group_name)
  37                         continue;
  38                 atomic_inc(&group->users);
  39                 error = 0;
  40                 break;
  41         }
  42         if (error && tomoyo_memory_ok(entry)) {
  43                 INIT_LIST_HEAD(&entry->member_list);
  44                 entry->group_name = saved_group_name;
  45                 saved_group_name = NULL;
  46                 atomic_set(&entry->users, 1);
  47                 list_add_tail_rcu(&entry->list, &tomoyo_number_group_list);
  48                 group = entry;
  49                 entry = NULL;
  50                 error = 0;
  51         }
  52         mutex_unlock(&tomoyo_policy_lock);
  53  out:
  54         tomoyo_put_name(saved_group_name);
  55         kfree(entry);
  56         return !error ? group : NULL;
  57 }
  58
  59 static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
  60                                      const struct tomoyo_acl_head *b)
  61 {
  62         return !memcmp(&container_of(a, struct tomoyo_number_group_member,
  63                                      head)->number,
  64                        &container_of(b, struct tomoyo_number_group_member,
  65                                      head)->number,
  66                        sizeof(container_of(a,
  67                                            struct tomoyo_number_group_member,
  68                                            head)->number));
  69 }
  70
  71 /**
  72  * tomoyo_write_number_group_policy - Write "struct tomoyo_number_group" list.
  73  *
  74  * @data:      String to parse.
  75  * @is_delete: True if it is a delete request.
  76  *
  77  * Returns 0 on success, nagative value otherwise.
  78  */
  79 int tomoyo_write_number_group_policy(char *data, const bool is_delete)
  80 {
  81         struct tomoyo_number_group *group;
  82         struct tomoyo_number_group_member e = { };
  83         int error;
  84         char *w[2];
  85         if (!tomoyo_tokenize(data, w, sizeof(w)))
  86                 return -EINVAL;
  87         if (w[1][0] == '@' || !tomoyo_parse_number_union(w[1], &e.number) ||
  88             e.number.values[0] > e.number.values[1])
  89                 return -EINVAL;
  90         group = tomoyo_get_number_group(w[0]);
  91         if (!group)
  92                 return -ENOMEM;
  93         error = tomoyo_update_policy(&e.head, sizeof(e), is_delete,
  94                                      &group->member_list,
  95                                      tomoyo_same_number_group);
  96         tomoyo_put_number_group(group);
  97         return error;
  98 }
  99
 100 /**
 101  * tomoyo_read_number_group_policy - Read "struct tomoyo_number_group" list.
 102  *
 103  * @head: Pointer to "struct tomoyo_io_buffer".
 104  *
 105  * Returns true on success, false otherwise.
 106  *
 107  * Caller holds tomoyo_read_lock().
 108  */
 109 bool tomoyo_read_number_group_policy(struct tomoyo_io_buffer *head)
 110 {
 111         struct list_head *gpos;
 112         struct list_head *mpos;
 113         list_for_each_cookie(gpos, head->read_var1, &tomoyo_number_group_list) {
 114                 struct tomoyo_number_group *group;
 115                 const char *name;
 116                 group = list_entry(gpos, struct tomoyo_number_group, list);
 117                 name = group->group_name->name;
 118                 list_for_each_cookie(mpos, head->read_var2,
 119                                      &group->member_list) {
 120                         int pos;
 121                         const struct tomoyo_number_group_member *member
 122                                 = list_entry(mpos,
 123                                              struct tomoyo_number_group_member,
 124                                              head.list);
 125                         if (member->head.is_deleted)
 126                                 continue;
 127                         pos = head->read_avail;
 128                         if (!tomoyo_io_printf(head, TOMOYO_KEYWORD_NUMBER_GROUP
 129                                               "%s", name) ||
 130                             !tomoyo_print_number_union(head, &member->number) ||
 131                             !tomoyo_io_printf(head, "\n")) {
 132                                 head->read_avail = pos;
 133                                 return false;
 134                         }
 135                 }
 136         }
 137         return true;
 138 }
 139
 140 /**
 141  * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
 142  *
 143  * @min:   Min number.
 144  * @max:   Max number.
 145  * @group: Pointer to "struct tomoyo_number_group".
 146  *
 147  * Returns true if @min and @max partially overlaps @group, false otherwise.
 148  *
 149  * Caller holds tomoyo_read_lock().
 150  */
 151 bool tomoyo_number_matches_group(const unsigned long min,
 152                                  const unsigned long max,
 153                                  const struct tomoyo_number_group *group)
 154 {
 155         struct tomoyo_number_group_member *member;
 156         bool matched = false;
 157         list_for_each_entry_rcu(member, &group->member_list, head.list) {
 158                 if (member->head.is_deleted)
 159                         continue;
 160                 if (min > member->number.values[1] ||
 161                     max < member->number.values[0])
 162                         continue;
 163                 matched = true;
 164                 break;
 165         }
 166         return matched;
 167 }