1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 /* 2 /*
3 * security/tomoyo/group.c 3 * security/tomoyo/group.c
4 * 4 *
5 * Copyright (C) 2005-2011 NTT DATA CORPORATI 5 * Copyright (C) 2005-2011 NTT DATA CORPORATION
6 */ 6 */
7 7
8 #include <linux/slab.h> 8 #include <linux/slab.h>
9 #include <linux/rculist.h> 9 #include <linux/rculist.h>
10 10
11 #include "common.h" 11 #include "common.h"
12 12
13 /** 13 /**
14 * tomoyo_same_path_group - Check for duplicat 14 * tomoyo_same_path_group - Check for duplicated "struct tomoyo_path_group" entry.
15 * 15 *
16 * @a: Pointer to "struct tomoyo_acl_head". 16 * @a: Pointer to "struct tomoyo_acl_head".
17 * @b: Pointer to "struct tomoyo_acl_head". 17 * @b: Pointer to "struct tomoyo_acl_head".
18 * 18 *
19 * Returns true if @a == @b, false otherwise. 19 * Returns true if @a == @b, false otherwise.
20 */ 20 */
21 static bool tomoyo_same_path_group(const struc 21 static bool tomoyo_same_path_group(const struct tomoyo_acl_head *a,
22 const struc 22 const struct tomoyo_acl_head *b)
23 { 23 {
24 return container_of(a, struct tomoyo_p 24 return container_of(a, struct tomoyo_path_group, head)->member_name ==
25 container_of(b, struct tomoyo_ 25 container_of(b, struct tomoyo_path_group, head)->member_name;
26 } 26 }
27 27
28 /** 28 /**
29 * tomoyo_same_number_group - Check for duplic 29 * tomoyo_same_number_group - Check for duplicated "struct tomoyo_number_group" entry.
30 * 30 *
31 * @a: Pointer to "struct tomoyo_acl_head". 31 * @a: Pointer to "struct tomoyo_acl_head".
32 * @b: Pointer to "struct tomoyo_acl_head". 32 * @b: Pointer to "struct tomoyo_acl_head".
33 * 33 *
34 * Returns true if @a == @b, false otherwise. 34 * Returns true if @a == @b, false otherwise.
35 */ 35 */
36 static bool tomoyo_same_number_group(const str 36 static bool tomoyo_same_number_group(const struct tomoyo_acl_head *a,
37 const str 37 const struct tomoyo_acl_head *b)
38 { 38 {
39 return !memcmp(&container_of(a, struct 39 return !memcmp(&container_of(a, struct tomoyo_number_group, head)
40 ->number, 40 ->number,
41 &container_of(b, struct 41 &container_of(b, struct tomoyo_number_group, head)
42 ->number, 42 ->number,
43 sizeof(container_of(a, 43 sizeof(container_of(a, struct tomoyo_number_group, head)
44 ->number)); 44 ->number));
45 } 45 }
46 46
47 /** 47 /**
48 * tomoyo_same_address_group - Check for dupli 48 * tomoyo_same_address_group - Check for duplicated "struct tomoyo_address_group" entry.
49 * 49 *
50 * @a: Pointer to "struct tomoyo_acl_head". 50 * @a: Pointer to "struct tomoyo_acl_head".
51 * @b: Pointer to "struct tomoyo_acl_head". 51 * @b: Pointer to "struct tomoyo_acl_head".
52 * 52 *
53 * Returns true if @a == @b, false otherwise. 53 * Returns true if @a == @b, false otherwise.
54 */ 54 */
55 static bool tomoyo_same_address_group(const st 55 static bool tomoyo_same_address_group(const struct tomoyo_acl_head *a,
56 const st 56 const struct tomoyo_acl_head *b)
57 { 57 {
58 const struct tomoyo_address_group *p1 58 const struct tomoyo_address_group *p1 = container_of(a, typeof(*p1),
59 59 head);
60 const struct tomoyo_address_group *p2 60 const struct tomoyo_address_group *p2 = container_of(b, typeof(*p2),
61 61 head);
62 62
63 return tomoyo_same_ipaddr_union(&p1->a 63 return tomoyo_same_ipaddr_union(&p1->address, &p2->address);
64 } 64 }
65 65
66 /** 66 /**
67 * tomoyo_write_group - Write "struct tomoyo_p 67 * tomoyo_write_group - Write "struct tomoyo_path_group"/"struct tomoyo_number_group"/"struct tomoyo_address_group" list.
68 * 68 *
69 * @param: Pointer to "struct tomoyo_acl_param 69 * @param: Pointer to "struct tomoyo_acl_param".
70 * @type: Type of this group. 70 * @type: Type of this group.
71 * 71 *
72 * Returns 0 on success, negative value otherw 72 * Returns 0 on success, negative value otherwise.
73 */ 73 */
74 int tomoyo_write_group(struct tomoyo_acl_param 74 int tomoyo_write_group(struct tomoyo_acl_param *param, const u8 type)
75 { 75 {
76 struct tomoyo_group *group = tomoyo_ge 76 struct tomoyo_group *group = tomoyo_get_group(param, type);
77 int error = -EINVAL; 77 int error = -EINVAL;
78 78
79 if (!group) 79 if (!group)
80 return -ENOMEM; 80 return -ENOMEM;
81 param->list = &group->member_list; 81 param->list = &group->member_list;
82 if (type == TOMOYO_PATH_GROUP) { 82 if (type == TOMOYO_PATH_GROUP) {
83 struct tomoyo_path_group e = { 83 struct tomoyo_path_group e = { };
84 84
85 e.member_name = tomoyo_get_nam 85 e.member_name = tomoyo_get_name(tomoyo_read_token(param));
86 if (!e.member_name) { 86 if (!e.member_name) {
87 error = -ENOMEM; 87 error = -ENOMEM;
88 goto out; 88 goto out;
89 } 89 }
90 error = tomoyo_update_policy(& 90 error = tomoyo_update_policy(&e.head, sizeof(e), param,
91 tomo 91 tomoyo_same_path_group);
92 tomoyo_put_name(e.member_name) 92 tomoyo_put_name(e.member_name);
93 } else if (type == TOMOYO_NUMBER_GROUP 93 } else if (type == TOMOYO_NUMBER_GROUP) {
94 struct tomoyo_number_group e = 94 struct tomoyo_number_group e = { };
95 95
96 if (param->data[0] == '@' || 96 if (param->data[0] == '@' ||
97 !tomoyo_parse_number_union 97 !tomoyo_parse_number_union(param, &e.number))
98 goto out; 98 goto out;
99 error = tomoyo_update_policy(& 99 error = tomoyo_update_policy(&e.head, sizeof(e), param,
100 tomo 100 tomoyo_same_number_group);
101 /* 101 /*
102 * tomoyo_put_number_union() i 102 * tomoyo_put_number_union() is not needed because
103 * param->data[0] != '@'. 103 * param->data[0] != '@'.
104 */ 104 */
105 } else { 105 } else {
106 struct tomoyo_address_group e 106 struct tomoyo_address_group e = { };
107 107
108 if (param->data[0] == '@' || 108 if (param->data[0] == '@' ||
109 !tomoyo_parse_ipaddr_union 109 !tomoyo_parse_ipaddr_union(param, &e.address))
110 goto out; 110 goto out;
111 error = tomoyo_update_policy(& 111 error = tomoyo_update_policy(&e.head, sizeof(e), param,
112 t 112 tomoyo_same_address_group);
113 } 113 }
114 out: 114 out:
115 tomoyo_put_group(group); 115 tomoyo_put_group(group);
116 return error; 116 return error;
117 } 117 }
118 118
119 /** 119 /**
120 * tomoyo_path_matches_group - Check whether t 120 * tomoyo_path_matches_group - Check whether the given pathname matches members of the given pathname group.
121 * 121 *
122 * @pathname: The name of pathname. 122 * @pathname: The name of pathname.
123 * @group: Pointer to "struct tomoyo_path_g 123 * @group: Pointer to "struct tomoyo_path_group".
124 * 124 *
125 * Returns matched member's pathname if @pathn 125 * Returns matched member's pathname if @pathname matches pathnames in @group,
126 * NULL otherwise. 126 * NULL otherwise.
127 * 127 *
128 * Caller holds tomoyo_read_lock(). 128 * Caller holds tomoyo_read_lock().
129 */ 129 */
130 const struct tomoyo_path_info * 130 const struct tomoyo_path_info *
131 tomoyo_path_matches_group(const struct tomoyo_ 131 tomoyo_path_matches_group(const struct tomoyo_path_info *pathname,
132 const struct tomoyo_ 132 const struct tomoyo_group *group)
133 { 133 {
134 struct tomoyo_path_group *member; 134 struct tomoyo_path_group *member;
135 135
136 list_for_each_entry_rcu(member, &group 136 list_for_each_entry_rcu(member, &group->member_list, head.list,
137 srcu_read_lock 137 srcu_read_lock_held(&tomoyo_ss)) {
138 if (member->head.is_deleted) 138 if (member->head.is_deleted)
139 continue; 139 continue;
140 if (!tomoyo_path_matches_patte 140 if (!tomoyo_path_matches_pattern(pathname, member->member_name))
141 continue; 141 continue;
142 return member->member_name; 142 return member->member_name;
143 } 143 }
144 return NULL; 144 return NULL;
145 } 145 }
146 146
147 /** 147 /**
148 * tomoyo_number_matches_group - Check whether 148 * tomoyo_number_matches_group - Check whether the given number matches members of the given number group.
149 * 149 *
150 * @min: Min number. 150 * @min: Min number.
151 * @max: Max number. 151 * @max: Max number.
152 * @group: Pointer to "struct tomoyo_number_gr 152 * @group: Pointer to "struct tomoyo_number_group".
153 * 153 *
154 * Returns true if @min and @max partially ove 154 * Returns true if @min and @max partially overlaps @group, false otherwise.
155 * 155 *
156 * Caller holds tomoyo_read_lock(). 156 * Caller holds tomoyo_read_lock().
157 */ 157 */
158 bool tomoyo_number_matches_group(const unsigne 158 bool tomoyo_number_matches_group(const unsigned long min,
159 const unsigne 159 const unsigned long max,
160 const struct 160 const struct tomoyo_group *group)
161 { 161 {
162 struct tomoyo_number_group *member; 162 struct tomoyo_number_group *member;
163 bool matched = false; 163 bool matched = false;
164 164
165 list_for_each_entry_rcu(member, &group 165 list_for_each_entry_rcu(member, &group->member_list, head.list,
166 srcu_read_lock 166 srcu_read_lock_held(&tomoyo_ss)) {
167 if (member->head.is_deleted) 167 if (member->head.is_deleted)
168 continue; 168 continue;
169 if (min > member->number.value 169 if (min > member->number.values[1] ||
170 max < member->number.value 170 max < member->number.values[0])
171 continue; 171 continue;
172 matched = true; 172 matched = true;
173 break; 173 break;
174 } 174 }
175 return matched; 175 return matched;
176 } 176 }
177 177
178 /** 178 /**
179 * tomoyo_address_matches_group - Check whethe 179 * tomoyo_address_matches_group - Check whether the given address matches members of the given address group.
180 * 180 *
181 * @is_ipv6: True if @address is an IPv6 addre 181 * @is_ipv6: True if @address is an IPv6 address.
182 * @address: An IPv4 or IPv6 address. 182 * @address: An IPv4 or IPv6 address.
183 * @group: Pointer to "struct tomoyo_address 183 * @group: Pointer to "struct tomoyo_address_group".
184 * 184 *
185 * Returns true if @address matches addresses 185 * Returns true if @address matches addresses in @group group, false otherwise.
186 * 186 *
187 * Caller holds tomoyo_read_lock(). 187 * Caller holds tomoyo_read_lock().
188 */ 188 */
189 bool tomoyo_address_matches_group(const bool i 189 bool tomoyo_address_matches_group(const bool is_ipv6, const __be32 *address,
190 const struct 190 const struct tomoyo_group *group)
191 { 191 {
192 struct tomoyo_address_group *member; 192 struct tomoyo_address_group *member;
193 bool matched = false; 193 bool matched = false;
194 const u8 size = is_ipv6 ? 16 : 4; 194 const u8 size = is_ipv6 ? 16 : 4;
195 195
196 list_for_each_entry_rcu(member, &group 196 list_for_each_entry_rcu(member, &group->member_list, head.list,
197 srcu_read_lock 197 srcu_read_lock_held(&tomoyo_ss)) {
198 if (member->head.is_deleted) 198 if (member->head.is_deleted)
199 continue; 199 continue;
200 if (member->address.is_ipv6 != 200 if (member->address.is_ipv6 != is_ipv6)
201 continue; 201 continue;
202 if (memcmp(&member->address.ip 202 if (memcmp(&member->address.ip[0], address, size) > 0 ||
203 memcmp(address, &member->a 203 memcmp(address, &member->address.ip[1], size) > 0)
204 continue; 204 continue;
205 matched = true; 205 matched = true;
206 break; 206 break;
207 } 207 }
208 return matched; 208 return matched;
209 } 209 }
210 210
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.