1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 /* 2 /*
3 * security/tomoyo/group.c 3 * security/tomoyo/group.c
4 * 4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATI 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */ 6 */
7 7
8 #include <linux/slab.h> 8 #include <linux/slab.h>
9 #include <linux/rculist.h> 9 #include <linux/rculist.h>
10 10
11 #include "common.h" 11 #include "common.h"
12 12
13 /** 13 /**
14 * tomoyo_same_path_group - Check for duplicat 14 * tomoyo_same_path_group - Check for duplicated "struct tomoyo_path_group" entry.
15 * 15 *
16 * @a: Pointer to "struct tomoyo_acl_head". 16 * @a: Pointer to "struct tomoyo_acl_head".
17 * @b: Pointer to "struct tomoyo_acl_head". 17 * @b: Pointer to "struct tomoyo_acl_head".
18 * 18 *
19 * Returns true if @a == @b, false otherwise. 19 * Returns true if @a == @b, false otherwise.
20 */ 20 */
21 static bool tomoyo_same_path_group(const struc 21 static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,
22 const struc 22 const struct tomoyo_acl_head *b)
23 { 23 {
24 return container_of(a, struct tomoyo_p 24 return container_of(a, struct tomoyo_path_group, head)->member_name ==
25 container_of(b, struct tomoyo_ 25 container_of(b, struct tomoyo_path_group, head)->member_name;
26 } 26 }
27 27
28 /** 28 /**
29 * tomoyo_same_number_group - Check for duplic 29 * tomoyo_same_number_group - Check for duplicated "struct tomoyo_number_group" entry.
30 * 30 *
31 * @a: Pointer to "struct tomoyo_acl_head". 31 * @a: Pointer to "struct tomoyo_acl_head".
32 * @b: Pointer to "struct tomoyo_acl_head". 32 * @b: Pointer to "struct tomoyo_acl_head".
33 * 33 *
34 * Returns true if @a == @b, false otherwise. 34 * Returns true if @a == @b, false otherwise.
35 */ 35 */
36 static bool tomoyo_same_number_group(const str 36 static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
37 const str 37 const struct tomoyo_acl_head *b)
38 { 38 {
39 return !memcmp(&container_of(a, struct 39 return !memcmp(&container_of(a, struct tomoyo_number_group, head)
40 ->number, 40 ->number,
41 &container_of(b, struct 41 &container_of(b, struct tomoyo_number_group, head)
42 ->number, 42 ->number,
43 sizeof(container_of(a, 43 sizeof(container_of(a, struct tomoyo_number_group, head)
44 ->number)); 44 ->number));
45 } 45 }
46 46
47 /** 47 /**
48 * tomoyo_same_address_group - Check for dupli 48 * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
49 * 49 *
50 * @a: Pointer to "struct tomoyo_acl_head". 50 * @a: Pointer to "struct tomoyo_acl_head".
51 * @b: Pointer to "struct tomoyo_acl_head". 51 * @b: Pointer to "struct tomoyo_acl_head".
52 * 52 *
53 * Returns true if @a == @b, false otherwise. 53 * Returns true if @a == @b, false otherwise.
54 */ 54 */
55 static bool tomoyo_same_address_group(const st 55 static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
56 const st 56 const struct tomoyo_acl_head *b)
57 { 57 {
58 const struct tomoyo_address_group *p1 58 const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
59 59 head);
60 const struct tomoyo_address_group *p2 60 const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
61 61 head);
62 62
63 return tomoyo_same_ipaddr_union(&p1->a 63 return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
64 } 64 }
65 65
66 /** 66 /**
67 * tomoyo_write_group - Write "struct tomoyo_p 67 * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
68 * 68 *
69 * @param: Pointer to "struct tomoyo_acl_param 69 * @param: Pointer to "struct tomoyo_acl_param".
70 * @type: Type of this group. 70 * @type: Type of this group.
71 * 71 *
72 * Returns 0 on success, negative value otherw 72 * Returns 0 on success, negative value otherwise.
73 */ 73 */
74 int tomoyo_write_group(struct tomoyo_acl_param 74 int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
75 { 75 {
76 struct tomoyo_group *group = tomoyo_ge 76 struct tomoyo_group *group = tomoyo_get_group(param, type);
77 int error = -EINVAL; 77 int error = -EINVAL;
78 <<
79 if (!group) 78 if (!group)
80 return -ENOMEM; 79 return -ENOMEM;
81 param->list = &group->member_list; 80 param->list = &group->member_list;
82 if (type == TOMOYO_PATH_GROUP) { 81 if (type == TOMOYO_PATH_GROUP) {
83 struct tomoyo_path_group e = { 82 struct tomoyo_path_group e = { };
84 <<
85 e.member_name = tomoyo_get_nam 83 e.member_name = tomoyo_get_name(tomoyo_read_token(param));
86 if (!e.member_name) { 84 if (!e.member_name) {
87 error = -ENOMEM; 85 error = -ENOMEM;
88 goto out; 86 goto out;
89 } 87 }
90 error = tomoyo_update_policy(& 88 error = tomoyo_update_policy(&e.head, sizeof(e), param,
91 tomo 89 tomoyo_same_path_group);
92 tomoyo_put_name(e.member_name) 90 tomoyo_put_name(e.member_name);
93 } else if (type == TOMOYO_NUMBER_GROUP 91 } else if (type == TOMOYO_NUMBER_GROUP) {
94 struct tomoyo_number_group e = 92 struct tomoyo_number_group e = { };
95 <<
96 if (param->data[0] == '@' || 93 if (param->data[0] == '@' ||
97 !tomoyo_parse_number_union 94 !tomoyo_parse_number_union(param, &e.number))
98 goto out; 95 goto out;
99 error = tomoyo_update_policy(& 96 error = tomoyo_update_policy(&e.head, sizeof(e), param,
100 tomo 97 tomoyo_same_number_group);
101 /* 98 /*
102 * tomoyo_put_number_union() i 99 * tomoyo_put_number_union() is not needed because
103 * param->data[0] != '@'. 100 * param->data[0] != '@'.
104 */ 101 */
105 } else { 102 } else {
106 struct tomoyo_address_group e 103 struct tomoyo_address_group e = { };
107 104
108 if (param->data[0] == '@' || 105 if (param->data[0] == '@' ||
109 !tomoyo_parse_ipaddr_union 106 !tomoyo_parse_ipaddr_union(param, &e.address))
110 goto out; 107 goto out;
111 error = tomoyo_update_policy(& 108 error = tomoyo_update_policy(&e.head, sizeof(e), param,
112 t 109 tomoyo_same_address_group);
113 } 110 }
114 out: 111 out:
115 tomoyo_put_group(group); 112 tomoyo_put_group(group);
116 return error; 113 return error;
117 } 114 }
118 115
119 /** 116 /**
120 * tomoyo_path_matches_group - Check whether t 117 * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.
121 * 118 *
122 * @pathname: The name of pathname. 119 * @pathname: The name of pathname.
123 * @group: Pointer to "struct tomoyo_path_g 120 * @group: Pointer to "struct tomoyo_path_group".
124 * 121 *
125 * Returns matched member's pathname if @pathn 122 * Returns matched member's pathname if @pathname matches pathnames in @group,
126 * NULL otherwise. 123 * NULL otherwise.
127 * 124 *
128 * Caller holds tomoyo_read_lock(). 125 * Caller holds tomoyo_read_lock().
129 */ 126 */
130 const struct tomoyo_path_info * 127 const struct tomoyo_path_info *
131 tomoyo_path_matches_group(const struct tomoyo_ 128 tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
132 const struct tomoyo_ 129 const struct tomoyo_group *group)
133 { 130 {
134 struct tomoyo_path_group *member; 131 struct tomoyo_path_group *member;
135 !! 132 list_for_each_entry_rcu(member, &group->member_list, head.list) {
136 list_for_each_entry_rcu(member, &group <<
137 srcu_read_lock <<
138 if (member->head.is_deleted) 133 if (member->head.is_deleted)
139 continue; 134 continue;
140 if (!tomoyo_path_matches_patte 135 if (!tomoyo_path_matches_pattern(pathname, member->member_name))
141 continue; 136 continue;
142 return member->member_name; 137 return member->member_name;
143 } 138 }
144 return NULL; 139 return NULL;
145 } 140 }
146 141
147 /** 142 /**
148 * tomoyo_number_matches_group - Check whether 143 * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
149 * 144 *
150 * @min: Min number. 145 * @min: Min number.
151 * @max: Max number. 146 * @max: Max number.
152 * @group: Pointer to "struct tomoyo_number_gr 147 * @group: Pointer to "struct tomoyo_number_group".
153 * 148 *
154 * Returns true if @min and @max partially ove 149 * Returns true if @min and @max partially overlaps @group, false otherwise.
155 * 150 *
156 * Caller holds tomoyo_read_lock(). 151 * Caller holds tomoyo_read_lock().
157 */ 152 */
158 bool tomoyo_number_matches_group(const unsigne 153 bool tomoyo_number_matches_group(const unsigned long min,
159 const unsigne 154 const unsigned long max,
160 const struct 155 const struct tomoyo_group *group)
161 { 156 {
162 struct tomoyo_number_group *member; 157 struct tomoyo_number_group *member;
163 bool matched = false; 158 bool matched = false;
164 !! 159 list_for_each_entry_rcu(member, &group->member_list, head.list) {
165 list_for_each_entry_rcu(member, &group <<
166 srcu_read_lock <<
167 if (member->head.is_deleted) 160 if (member->head.is_deleted)
168 continue; 161 continue;
169 if (min > member->number.value 162 if (min > member->number.values[1] ||
170 max < member->number.value 163 max < member->number.values[0])
171 continue; 164 continue;
172 matched = true; 165 matched = true;
173 break; 166 break;
174 } 167 }
175 return matched; 168 return matched;
176 } 169 }
177 170
178 /** 171 /**
179 * tomoyo_address_matches_group - Check whethe 172 * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
180 * 173 *
181 * @is_ipv6: True if @address is an IPv6 addre 174 * @is_ipv6: True if @address is an IPv6 address.
182 * @address: An IPv4 or IPv6 address. 175 * @address: An IPv4 or IPv6 address.
183 * @group: Pointer to "struct tomoyo_address 176 * @group: Pointer to "struct tomoyo_address_group".
184 * 177 *
185 * Returns true if @address matches addresses 178 * Returns true if @address matches addresses in @group group, false otherwise.
186 * 179 *
187 * Caller holds tomoyo_read_lock(). 180 * Caller holds tomoyo_read_lock().
188 */ 181 */
189 bool tomoyo_address_matches_group(const bool i 182 bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
190 const struct 183 const struct tomoyo_group *group)
191 { 184 {
192 struct tomoyo_address_group *member; 185 struct tomoyo_address_group *member;
193 bool matched = false; 186 bool matched = false;
194 const u8 size = is_ipv6 ? 16 : 4; 187 const u8 size = is_ipv6 ? 16 : 4;
195 188
196 list_for_each_entry_rcu(member, &group !! 189 list_for_each_entry_rcu(member, &group->member_list, head.list) {
197 srcu_read_lock <<
198 if (member->head.is_deleted) 190 if (member->head.is_deleted)
199 continue; 191 continue;
200 if (member->address.is_ipv6 != 192 if (member->address.is_ipv6 != is_ipv6)
201 continue; 193 continue;
202 if (memcmp(&member->address.ip 194 if (memcmp(&member->address.ip[0], address, size) > 0 ||
203 memcmp(address, &member->a 195 memcmp(address, &member->address.ip[1], size) > 0)
204 continue; 196 continue;
205 matched = true; 197 matched = true;
206 break; 198 break;
207 } 199 }
208 return matched; 200 return matched;
209 } 201 }
210 202
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.