~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/tomoyo/group.c

Version: ~ [ linux-5.3-rc5 ] ~ [ linux-5.2.9 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.67 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.139 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.189 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.189 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.72 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * security/tomoyo/group.c
  3  *
  4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
  5  */
  6 
  7 #include <linux/slab.h>
  8 #include "common.h"
  9 
 10 /**
 11  * tomoyo_same_path_group - Check for duplicated "struct tomoyo_path_group" entry.
 12  *
 13  * @a: Pointer to "struct tomoyo_acl_head".
 14  * @b: Pointer to "struct tomoyo_acl_head".
 15  *
 16  * Returns true if @a == @b, false otherwise.
 17  */
 18 static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,
 19                                    const struct tomoyo_acl_head *b)
 20 {
 21         return container_of(a, struct tomoyo_path_group, head)->member_name ==
 22                 container_of(b, struct tomoyo_path_group, head)->member_name;
 23 }
 24 
 25 /**
 26  * tomoyo_same_number_group - Check for duplicated "struct tomoyo_number_group" entry.
 27  *
 28  * @a: Pointer to "struct tomoyo_acl_head".
 29  * @b: Pointer to "struct tomoyo_acl_head".
 30  *
 31  * Returns true if @a == @b, false otherwise.
 32  */
 33 static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
 34                                      const struct tomoyo_acl_head *b)
 35 {
 36         return !memcmp(&container_of(a, struct tomoyo_number_group, head)
 37                        ->number,
 38                        &container_of(b, struct tomoyo_number_group, head)
 39                        ->number,
 40                        sizeof(container_of(a, struct tomoyo_number_group, head)
 41                               ->number));
 42 }
 43 
 44 /**
 45  * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
 46  *
 47  * @a: Pointer to "struct tomoyo_acl_head".
 48  * @b: Pointer to "struct tomoyo_acl_head".
 49  *
 50  * Returns true if @a == @b, false otherwise.
 51  */
 52 static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
 53                                       const struct tomoyo_acl_head *b)
 54 {
 55         const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
 56                                                              head);
 57         const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
 58                                                              head);
 59 
 60         return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
 61 }
 62 
 63 /**
 64  * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
 65  *
 66  * @param: Pointer to "struct tomoyo_acl_param".
 67  * @type:  Type of this group.
 68  *
 69  * Returns 0 on success, negative value otherwise.
 70  */
 71 int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
 72 {
 73         struct tomoyo_group *group = tomoyo_get_group(param, type);
 74         int error = -EINVAL;
 75         if (!group)
 76                 return -ENOMEM;
 77         param->list = &group->member_list;
 78         if (type == TOMOYO_PATH_GROUP) {
 79                 struct tomoyo_path_group e = { };
 80                 e.member_name = tomoyo_get_name(tomoyo_read_token(param));
 81                 if (!e.member_name) {
 82                         error = -ENOMEM;
 83                         goto out;
 84                 }
 85                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
 86                                           tomoyo_same_path_group);
 87                 tomoyo_put_name(e.member_name);
 88         } else if (type == TOMOYO_NUMBER_GROUP) {
 89                 struct tomoyo_number_group e = { };
 90                 if (param->data[0] == '@' ||
 91                     !tomoyo_parse_number_union(param, &e.number))
 92                         goto out;
 93                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
 94                                           tomoyo_same_number_group);
 95                 /*
 96                  * tomoyo_put_number_union() is not needed because
 97                  * param->data[0] != '@'.
 98                  */
 99         } else {
100                 struct tomoyo_address_group e = { };
101 
102                 if (param->data[0] == '@' ||
103                     !tomoyo_parse_ipaddr_union(param, &e.address))
104                         goto out;
105                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
106                                              tomoyo_same_address_group);
107         }
108 out:
109         tomoyo_put_group(group);
110         return error;
111 }
112 
113 /**
114  * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.
115  *
116  * @pathname: The name of pathname.
117  * @group:    Pointer to "struct tomoyo_path_group".
118  *
119  * Returns matched member's pathname if @pathname matches pathnames in @group,
120  * NULL otherwise.
121  *
122  * Caller holds tomoyo_read_lock().
123  */
124 const struct tomoyo_path_info *
125 tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
126                           const struct tomoyo_group *group)
127 {
128         struct tomoyo_path_group *member;
129         list_for_each_entry_rcu(member, &group->member_list, head.list) {
130                 if (member->head.is_deleted)
131                         continue;
132                 if (!tomoyo_path_matches_pattern(pathname, member->member_name))
133                         continue;
134                 return member->member_name;
135         }
136         return NULL;
137 }
138 
139 /**
140  * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
141  *
142  * @min:   Min number.
143  * @max:   Max number.
144  * @group: Pointer to "struct tomoyo_number_group".
145  *
146  * Returns true if @min and @max partially overlaps @group, false otherwise.
147  *
148  * Caller holds tomoyo_read_lock().
149  */
150 bool tomoyo_number_matches_group(const unsigned long min,
151                                  const unsigned long max,
152                                  const struct tomoyo_group *group)
153 {
154         struct tomoyo_number_group *member;
155         bool matched = false;
156         list_for_each_entry_rcu(member, &group->member_list, head.list) {
157                 if (member->head.is_deleted)
158                         continue;
159                 if (min > member->number.values[1] ||
160                     max < member->number.values[0])
161                         continue;
162                 matched = true;
163                 break;
164         }
165         return matched;
166 }
167 
168 /**
169  * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
170  *
171  * @is_ipv6: True if @address is an IPv6 address.
172  * @address: An IPv4 or IPv6 address.
173  * @group:   Pointer to "struct tomoyo_address_group".
174  *
175  * Returns true if @address matches addresses in @group group, false otherwise.
176  *
177  * Caller holds tomoyo_read_lock().
178  */
179 bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
180                                   const struct tomoyo_group *group)
181 {
182         struct tomoyo_address_group *member;
183         bool matched = false;
184         const u8 size = is_ipv6 ? 16 : 4;
185 
186         list_for_each_entry_rcu(member, &group->member_list, head.list) {
187                 if (member->head.is_deleted)
188                         continue;
189                 if (member->address.is_ipv6 != is_ipv6)
190                         continue;
191                 if (memcmp(&member->address.ip[0], address, size) > 0 ||
192                     memcmp(address, &member->address.ip[1], size) > 0)
193                         continue;
194                 matched = true;
195                 break;
196         }
197         return matched;
198 }
199 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp