~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/security/tomoyo/group.c

Version: ~ [ linux-5.4-rc3 ] ~ [ linux-5.3.6 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.79 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.149 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.196 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.196 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.19.8 ] ~ [ linux-3.18.140 ] ~ [ linux-3.17.8 ] ~ [ linux-3.16.75 ] ~ [ linux-3.15.10 ] ~ [ linux-3.14.79 ] ~ [ linux-3.13.11 ] ~ [ linux-3.12.74 ] ~ [ linux-3.11.10 ] ~ [ linux-3.10.108 ] ~ [ linux-3.9.11 ] ~ [ linux-3.8.13 ] ~ [ linux-3.7.10 ] ~ [ linux-3.6.11 ] ~ [ linux-3.5.7 ] ~ [ linux-3.4.113 ] ~ [ linux-3.3.8 ] ~ [ linux-3.2.102 ] ~ [ linux-3.1.10 ] ~ [ linux-3.0.101 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * security/tomoyo/group.c
  3  *
  4  * Copyright (C) 2005-2011  NTT DATA CORPORATION
  5  */
  6 
  7 #include <linux/slab.h>
  8 #include <linux/rculist.h>
  9 
 10 #include "common.h"
 11 
 12 /**
 13  * tomoyo_same_path_group - Check for duplicated "struct tomoyo_path_group" entry.
 14  *
 15  * @a: Pointer to "struct tomoyo_acl_head".
 16  * @b: Pointer to "struct tomoyo_acl_head".
 17  *
 18  * Returns true if @a == @b, false otherwise.
 19  */
 20 static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,
 21                                    const struct tomoyo_acl_head *b)
 22 {
 23         return container_of(a, struct tomoyo_path_group, head)->member_name ==
 24                 container_of(b, struct tomoyo_path_group, head)->member_name;
 25 }
 26 
 27 /**
 28  * tomoyo_same_number_group - Check for duplicated "struct tomoyo_number_group" entry.
 29  *
 30  * @a: Pointer to "struct tomoyo_acl_head".
 31  * @b: Pointer to "struct tomoyo_acl_head".
 32  *
 33  * Returns true if @a == @b, false otherwise.
 34  */
 35 static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
 36                                      const struct tomoyo_acl_head *b)
 37 {
 38         return !memcmp(&container_of(a, struct tomoyo_number_group, head)
 39                        ->number,
 40                        &container_of(b, struct tomoyo_number_group, head)
 41                        ->number,
 42                        sizeof(container_of(a, struct tomoyo_number_group, head)
 43                               ->number));
 44 }
 45 
 46 /**
 47  * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
 48  *
 49  * @a: Pointer to "struct tomoyo_acl_head".
 50  * @b: Pointer to "struct tomoyo_acl_head".
 51  *
 52  * Returns true if @a == @b, false otherwise.
 53  */
 54 static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
 55                                       const struct tomoyo_acl_head *b)
 56 {
 57         const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
 58                                                              head);
 59         const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
 60                                                              head);
 61 
 62         return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
 63 }
 64 
 65 /**
 66  * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
 67  *
 68  * @param: Pointer to "struct tomoyo_acl_param".
 69  * @type:  Type of this group.
 70  *
 71  * Returns 0 on success, negative value otherwise.
 72  */
 73 int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
 74 {
 75         struct tomoyo_group *group = tomoyo_get_group(param, type);
 76         int error = -EINVAL;
 77         if (!group)
 78                 return -ENOMEM;
 79         param->list = &group->member_list;
 80         if (type == TOMOYO_PATH_GROUP) {
 81                 struct tomoyo_path_group e = { };
 82                 e.member_name = tomoyo_get_name(tomoyo_read_token(param));
 83                 if (!e.member_name) {
 84                         error = -ENOMEM;
 85                         goto out;
 86                 }
 87                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
 88                                           tomoyo_same_path_group);
 89                 tomoyo_put_name(e.member_name);
 90         } else if (type == TOMOYO_NUMBER_GROUP) {
 91                 struct tomoyo_number_group e = { };
 92                 if (param->data[0] == '@' ||
 93                     !tomoyo_parse_number_union(param, &e.number))
 94                         goto out;
 95                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
 96                                           tomoyo_same_number_group);
 97                 /*
 98                  * tomoyo_put_number_union() is not needed because
 99                  * param->data[0] != '@'.
100                  */
101         } else {
102                 struct tomoyo_address_group e = { };
103 
104                 if (param->data[0] == '@' ||
105                     !tomoyo_parse_ipaddr_union(param, &e.address))
106                         goto out;
107                 error = tomoyo_update_policy(&e.head, sizeof(e), param,
108                                              tomoyo_same_address_group);
109         }
110 out:
111         tomoyo_put_group(group);
112         return error;
113 }
114 
115 /**
116  * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.
117  *
118  * @pathname: The name of pathname.
119  * @group:    Pointer to "struct tomoyo_path_group".
120  *
121  * Returns matched member's pathname if @pathname matches pathnames in @group,
122  * NULL otherwise.
123  *
124  * Caller holds tomoyo_read_lock().
125  */
126 const struct tomoyo_path_info *
127 tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
128                           const struct tomoyo_group *group)
129 {
130         struct tomoyo_path_group *member;
131         list_for_each_entry_rcu(member, &group->member_list, head.list) {
132                 if (member->head.is_deleted)
133                         continue;
134                 if (!tomoyo_path_matches_pattern(pathname, member->member_name))
135                         continue;
136                 return member->member_name;
137         }
138         return NULL;
139 }
140 
141 /**
142  * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
143  *
144  * @min:   Min number.
145  * @max:   Max number.
146  * @group: Pointer to "struct tomoyo_number_group".
147  *
148  * Returns true if @min and @max partially overlaps @group, false otherwise.
149  *
150  * Caller holds tomoyo_read_lock().
151  */
152 bool tomoyo_number_matches_group(const unsigned long min,
153                                  const unsigned long max,
154                                  const struct tomoyo_group *group)
155 {
156         struct tomoyo_number_group *member;
157         bool matched = false;
158         list_for_each_entry_rcu(member, &group->member_list, head.list) {
159                 if (member->head.is_deleted)
160                         continue;
161                 if (min > member->number.values[1] ||
162                     max < member->number.values[0])
163                         continue;
164                 matched = true;
165                 break;
166         }
167         return matched;
168 }
169 
170 /**
171  * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
172  *
173  * @is_ipv6: True if @address is an IPv6 address.
174  * @address: An IPv4 or IPv6 address.
175  * @group:   Pointer to "struct tomoyo_address_group".
176  *
177  * Returns true if @address matches addresses in @group group, false otherwise.
178  *
179  * Caller holds tomoyo_read_lock().
180  */
181 bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
182                                   const struct tomoyo_group *group)
183 {
184         struct tomoyo_address_group *member;
185         bool matched = false;
186         const u8 size = is_ipv6 ? 16 : 4;
187 
188         list_for_each_entry_rcu(member, &group->member_list, head.list) {
189                 if (member->head.is_deleted)
190                         continue;
191                 if (member->address.is_ipv6 != is_ipv6)
192                         continue;
193                 if (memcmp(&member->address.ip[0], address, size) > 0 ||
194                     memcmp(address, &member->address.ip[1], size) > 0)
195                         continue;
196                 matched = true;
197                 break;
198         }
199         return matched;
200 }
201 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp