security/tomoyo/number_group.c

   1 /*
   2  * security/tomoyo/number_group.c
   3  *
   4  * Copyright (C) 2005-2009  NTT DATA CORPORATION
   5  */
   6
   7 #include <linux/slab.h>
   8 #include "common.h"
   9
  10 /* The list for "struct tomoyo_number_group". */
  11 LIST_HEAD(tomoyo_number_group_list);
  12
  13 /**
  14  * tomoyo_get_number_group - Allocate memory for "struct tomoyo_number_group".
  15  *
  16  * @group_name: The name of number group.
  17  *
  18  * Returns pointer to "struct tomoyo_number_group" on success,
  19  * NULL otherwise.
  20  */
  21 struct tomoyo_number_group *tomoyo_get_number_group(const char *group_name)
  22 {
  23         struct tomoyo_number_group *entry = NULL;
  24         struct tomoyo_number_group *group = NULL;
  25         const struct tomoyo_path_info *saved_group_name;
  26         int error = -ENOMEM;
  27         if (!tomoyo_is_correct_word(group_name))
  28                 return NULL;
  29         saved_group_name = tomoyo_get_name(group_name);
  30         if (!saved_group_name)
  31                 return NULL;
  32         entry = kzalloc(sizeof(*entry), GFP_NOFS);
  33         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  34                 goto out;
  35         list_for_each_entry_rcu(group, &tomoyo_number_group_list, list) {
  36                 if (saved_group_name != group->group_name)
  37                         continue;
  38                 atomic_inc(&group->users);
  39                 error = 0;
  40                 break;
  41         }
  42         if (error && tomoyo_memory_ok(entry)) {
  43                 INIT_LIST_HEAD(&entry->member_list);
  44                 entry->group_name = saved_group_name;
  45                 saved_group_name = NULL;
  46                 atomic_set(&entry->users, 1);
  47                 list_add_tail_rcu(&entry->list, &tomoyo_number_group_list);
  48                 group = entry;
  49                 entry = NULL;
  50                 error = 0;
  51         }
  52         mutex_unlock(&tomoyo_policy_lock);
  53  out:
  54         tomoyo_put_name(saved_group_name);
  55         kfree(entry);
  56         return !error ? group : NULL;
  57 }
  58
  59 /**
  60  * tomoyo_write_number_group_policy - Write "struct tomoyo_number_group" list.
  61  *
  62  * @data:      String to parse.
  63  * @is_delete: True if it is a delete request.
  64  *
  65  * Returns 0 on success, nagative value otherwise.
  66  */
  67 int tomoyo_write_number_group_policy(char *data, const bool is_delete)
  68 {
  69         struct tomoyo_number_group *group;
  70         struct tomoyo_number_group_member e = { };
  71         struct tomoyo_number_group_member *member;
  72         int error = is_delete ? -ENOENT : -ENOMEM;
  73         char *w[2];
  74         if (!tomoyo_tokenize(data, w, sizeof(w)))
  75                 return -EINVAL;
  76         if (!tomoyo_parse_number_union(w[1], &e.number))
  77                 return -EINVAL;
  78         if (e.number.is_group || e.number.values[0] > e.number.values[1]) {
  79                 tomoyo_put_number_union(&e.number);
  80                 return -EINVAL;
  81         }
  82         group = tomoyo_get_number_group(w[0]);
  83         if (!group)
  84                 return -ENOMEM;
  85         if (mutex_lock_interruptible(&tomoyo_policy_lock))
  86                 goto out;
  87         list_for_each_entry_rcu(member, &group->member_list, head.list) {
  88                 if (memcmp(&member->number, &e.number, sizeof(e.number)))
  89                         continue;
  90                 member->head.is_deleted = is_delete;
  91                 error = 0;
  92                 break;
  93         }
  94         if (!is_delete && error) {
  95                 struct tomoyo_number_group_member *entry =
  96                         tomoyo_commit_ok(&e, sizeof(e));
  97                 if (entry) {
  98                         list_add_tail_rcu(&entry->head.list,
  99                                           &group->member_list);
 100                         error = 0;
 101                 }
 102         }
 103         mutex_unlock(&tomoyo_policy_lock);
 104  out:
 105         tomoyo_put_number_group(group);
 106         return error;
 107 }
 108
 109 /**
 110  * tomoyo_read_number_group_policy - Read "struct tomoyo_number_group" list.
 111  *
 112  * @head: Pointer to "struct tomoyo_io_buffer".
 113  *
 114  * Returns true on success, false otherwise.
 115  *
 116  * Caller holds tomoyo_read_lock().
 117  */
 118 bool tomoyo_read_number_group_policy(struct tomoyo_io_buffer *head)
 119 {
 120         struct list_head *gpos;
 121         struct list_head *mpos;
 122         list_for_each_cookie(gpos, head->read_var1, &tomoyo_number_group_list) {
 123                 struct tomoyo_number_group *group;
 124                 const char *name;
 125                 group = list_entry(gpos, struct tomoyo_number_group, list);
 126                 name = group->group_name->name;
 127                 list_for_each_cookie(mpos, head->read_var2,
 128                                      &group->member_list) {
 129                         int pos;
 130                         const struct tomoyo_number_group_member *member
 131                                 = list_entry(mpos,
 132                                              struct tomoyo_number_group_member,
 133                                              head.list);
 134                         if (member->head.is_deleted)
 135                                 continue;
 136                         pos = head->read_avail;
 137                         if (!tomoyo_io_printf(head, TOMOYO_KEYWORD_NUMBER_GROUP
 138                                               "%s", name) ||
 139                             !tomoyo_print_number_union(head, &member->number) ||
 140                             !tomoyo_io_printf(head, "\n")) {
 141                                 head->read_avail = pos;
 142                                 return false;
 143                         }
 144                 }
 145         }
 146         return true;
 147 }
 148
 149 /**
 150  * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
 151  *
 152  * @min:   Min number.
 153  * @max:   Max number.
 154  * @group: Pointer to "struct tomoyo_number_group".
 155  *
 156  * Returns true if @min and @max partially overlaps @group, false otherwise.
 157  *
 158  * Caller holds tomoyo_read_lock().
 159  */
 160 bool tomoyo_number_matches_group(const unsigned long min,
 161                                  const unsigned long max,
 162                                  const struct tomoyo_number_group *group)
 163 {
 164         struct tomoyo_number_group_member *member;
 165         bool matched = false;
 166         list_for_each_entry_rcu(member, &group->member_list, head.list) {
 167                 if (member->head.is_deleted)
 168                         continue;
 169                 if (min > member->number.values[1] ||
 170                     max < member->number.values[0])
 171                         continue;
 172                 matched = true;
 173                 break;
 174         }
 175         return matched;
 176 }